home

yes-download.org

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain yes-download.org is registered by proxy through PDR Ltd. d/b/a PublicDomainRegistry.com. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com

Server location:
Virginia, United States (US)

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 yes-download.org records

Scanner detections:
Detections  (85% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.Bundler.Installer.Meta (M), PUP.InstallCore (M), PUP.InstallCore.RES (M), PUP.InstallCore.RE48 (M), PUP.NewMedia.NMH.Bundler (M)
100.00%

herdProtect (fuzzy)
a variant of c04cf085eba34f7ec6d6ef5dd0ce8db23e42c191
9.09%

The domain yes-download.org has been seen to resolve to the following 3 IP addresses.

54.88.203.136
ec2-54-88-203-136.compute-1.amazonaws.com
May 26, 2016

54.84.209.207
ec2-54-84-209-207.compute-1.amazonaws.com
April 12, 2016

54.88.93.196
ec2-54-88-93-196.compute-1.amazonaws.com
August 17, 2015

File downloads found at URLs served by yes-download.org.

1 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcRNTgRNi==&osos=VdluDrW3cw==&gclid=CJOCioXy-MQCFdgagQods0IADg&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fOTi4NZgRAZcyvm5EIKiWXzC4NZLdAjA3AT7R&pd=IKFz2r5B rDpcEN0UmNJ i==&campaignId=9jn0AjCRAjM4AZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcRNTMFNM==&osos=VdluDrW3cw==&gclid=CInVtYHhgMUCFUcdgQodcaMASg&dr=cHaWck1q7XDPvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAzLwOTMRNjAyvm5EIKiWXzA1AZARNzgwNz7R&pd=2XNlUKxJ2dFB d5CUmNJ i==&campaignId=9jn0AjCzOTM4AZMq  (javaruntimeenvironmentsetup.exe)

1 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcROT7ROi==&osos=VdluDrW3cw==&gclid=CjwKEAjw9bKpBRD-geiF8OHz4EcSJACO4O7T2O3MYhpBYW3qWAlRNo1HNPzfIbHYZxafXzwSmvLJTxoCzbfw_wcB&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8dNTMwNZC4OZAm7K2pDZ1fNjAzAZg0NZc4OZn=&pd=DrW3 mRJ7KitcdVlUmNJ i==&campaignId=9jn0AjCwAzC4AZMq  (minecraftsetup.exe)

1 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcyATgRAi==&osos=VdluDrW3cw==&gclid=CIbbr-r63MQCFfRr7AodZgMACQ&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8dNTMwNZC4OZAm7K2pDZ1fNjC0ATC0NZc4OZn=&pd=DrW3 mRJ7KitcdVlUmNJ i==&campaignId=9jn0AjgRNTCdAZMq  (minecraftsetup.exe)

1 / 68      (Adware)
http://yes-download.org/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&gclid=CMHAsb2VgcUCFcXm7AodSAgAbg&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAZC3AZL3ATgyvm5EIKiWXzM1NTL0OZAdNjny&pd=7KN0IXDlUKluc3xP rRzUEVzUmNJ i==&campaignId=9jn0AjC0AZLyAZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcRNTn0Ni==&osos=VdluDrW3cw==&gclid=CL2Nq9mI_sQCFTCWtAodNyQAqg&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKDyvmNjhLDSvmNBDz1mcQDjhTnmDZ0wvmNpDZ1fOTa0OTgzATcyvm5EIKiWXzCyNZ7RATC1NZCR&pd=eKVzUKluc3xP rwu7dWt&campaignId=9jn0AjCyOTcyAZMq  (openofficesetup.exe)

1 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcROTayAM==&osos=VdluDrW3cw==&gclid=CN26_K3b-MQCFRcWjgodUS8Akw&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNziRAz74Nzgyvm5EIKiWXzcdNjiyAZazOZcR&pd=DEvlcdgtc3xy dFEUmWyDw==&campaignId=9jn0AjCRATAdAZMq  (windowsmoviemakersetup.exe)

1 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcRNzA4Ni==&osos=VdluDrW3cw==&gclid=CLjS6t-14sQCFSLmwgodRlIATA&dr=cHaWck13IKF6IXMm2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWxlam7dREhKVuvmAWASDChTMm7dlChV8dAja3NTAwOZam7K2pDZ1fNjayNTA3OZL1Njn=&pd=IKFz2r5B k1Q rlzcyFj d0=&campaignId=9jn0AjgzNZgdAZMq  (winzipsetup.exe)

1 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcyATgRAi==&osos=VdluDrW3cw==&gclid=CI7QypGE_MQCFUk8gQod3ZgAGA&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8dNTMwNZC4OZAm7K2pDZ1fNjAzAZg0NZc4OZn=&pd=DrW3 mRJ7KitcdVlUmNJ i==&campaignId=9jn0AjCyAjcwAZMq  (minecraftsetup.exe)

0 / 68
http://yes-download.org/?dl=1&pi=AzAdNZLzAZAyOi==&osos=VdluDrW3cw==&gclid=CKTJ-9-fhcUCFWMF7AodHzQAjg&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAZnFAZL3ATgyvm5EIKiWXzM3NjL0OZAdNjny&pd=7KN0IXDlUKluc3xP rRzUEVzUmNJ i==&campaignId=9jn0AjC1NZA4AZMq  (firefox setup 27.0.exe)

1 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcRNTMFNM==&osos=VdluDrW3cw==&gclid=CLOCmOaJ-8QCFdg8gQodoIoAGw&dr=cHaWck1q7XDPvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAzCdOZMRNjAyvm5EIKiWXzAFAZMzNZgwNz7R&pd=2XNlUKxJ2dFB d5CUmNJ i==&campaignId=9jn0AjCROTidAZMq  (javaruntimeenvironmentsetup.exe)

0 / 68
http://yes-download.org/?dl=1&pi=Ajg4NzcyATnzNg==&osos=VdluDrW3cw==&gclid=CNm-3svb-8QCFWRp7Aod7wMAOA&dr=cHaWck1q7XDPvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAzLwOTMRNjAyvm5EIKiWXzAzOTnFNjgwNz7R&pd=2XNlUKxJ2dFB d5CUmNJ i==&campaignId=9jn0AjCyAT7yAZMq  (jre-7u60-windows-i586.exe)

2 / 68      (PUP)
http://yes-download.org/?dl=1&pi=Ajg4NzcRAjc4NM==&osos=VdluDrW3cw==&gclid=CK6twarrzcQCFdgQgQodYFIArw&dr=cHaWck147m1jvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAz74AT71NTAyvm5EIKiWXzA4NTC0ATLFNj7R&pd=IKFz2r5B rPPcHsFUmWyDw==&campaignId=9jn0AjcdNZnyAZMq  (xbmcsetup.exe)

URL:
http://yes-download.org/

Title:
“File-Opener”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.