- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- Domain
- event.mackeeper.com
- TLD
- com
- Root domain
- mackeeper.com
- Subdomain
- event
- Resolved geo
- United States
- Resolved IP
- 54.192.55.39
- Country
- United States
- DGA risk
- low
- DGA score
- 17.0
- Domain age days
- 6180.0
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Relationship context
11 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections5%
Relationship context11 visible
Intelligence freshnessRecent
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
5shown
40%
high
isoimage
641024 bytes
communicates
Filename
downloaddm
Family
genieo
Type
adware
File type
isoimage
MIME
application/octet-stream
42%
high
isoimage
641024 bytes
communicates
Filename
downloaddm
Family
genieo
Type
adware
File type
isoimage
MIME
application/octet-stream
40%
medium
isoimage
641024 bytes
communicates
Filename
downloaddm
Family
genieo
Type
adware
File type
isoimage
MIME
application/octet-stream
40%
high
isoimage
641024 bytes
communicates
Filename
downloaddm
Family
genieo
Type
adware
File type
isoimage
MIME
application/octet-stream
42%
high
isoimage
641024 bytes
communicates
Filename
downloaddm
Family
genieo
Type
adware
File type
isoimage
MIME
application/octet-stream
Related domains
Domains associated with this indicator.
1shown
5%
low
.com
contains
Root
mackeeper.com
TLD
com
First seen
2023-09-30T00:24:09Z
Last seen
2026-11-03T00:01:32Z
Related URLs
URLs associated with this indicator.
5shown
0%
contains
TLD
com
HTTP status
200
Content length
62
Content SHA256
9d764a52b8c87182c84c36e32f9bef5c0f9421a5695cff6e9e746f4c0396b6b4
First seen
2025-06-26T00:57:04Z
0%
contains
TLD
com
HTTP status
200
Content length
62
Content SHA256
e11712b547d547fb2b8702060531fba33e7684d2d7edcd11d9e6bfc2a97d0401
First seen
2015-12-31T11:44:49Z
0%
contains
TLD
com
HTTP status
200
Content length
62
Content SHA256
3a38e01b88e757ce1f41ffb02c68fcca9e1c37ce288aafa1c5b2bc9dec73f547
First seen
2015-12-31T11:44:49Z
0%
contains
TLD
com
First seen
2015-12-31T11:44:49Z
Last seen
2024-01-18T10:14:16Z
0%
contains
TLD
com
HTTP status
200
Content SHA256
422f942c9f9b320145b88c677dd40358ba3d09dc3d2c80fca0133ed30669b0fc
First seen
2016-09-06T23:07:07Z
Last seen
2025-11-28T20:26:38Z
Analysis details
Severity: low
Freshness: Recent · Last seen 8 days ago.
- Detection rate
- 5%
- detection
- 5 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- Domain
- event.mackeeper.com
- TLD
- com
- Root domain
- mackeeper.com
- Subdomain
- event
- Resolved geo
- United States
- Resolved IP
- 54.192.55.39
- Country
- United States
- DGA risk
- low
- DGA score
- 17.0
- Domain age days
- 6180.0
- Registrar
- NameCheap, Inc.
- Created
- 2009-12-09T14:27:14Z
- Expiry
- 2026-12-09T14:27:14Z
- First seen
- 2023-10-01T05:38:03Z
- Last seen
- 2026-11-02T22:32:30Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Relationship context
11 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
12 timestamped observations are arranged from 2009-12-09 to 2025-06-26. These are observation or metadata times, not execution order.
Infrastructure geography
1 infrastructure/location point(s) are visible on the map. 1 point(s) are country-level approximate.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
3 relationship group(s) provide pivot and infrastructure context.
Last seen 8 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Domain profile
summarySelected domain intelligence summary.
- Root domain
- mackeeper.com
- Subdomain
- event
- Resolved IP
- 54.192.55.39
- Resolved geo
- United States
- Country
- United States
- DGA risk
- low
- DGA score
- 17.0
- Domain age days
- 6180.0
- Registrar
- NameCheap, Inc.
- Created
- 2009-12-09T14:27:14Z
- Expiry
- 2026-12-09T14:27:14Z
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
DNS intelligence5
0 IPs0 domains
- 4 passive DNS records
- 1 DNS records
- 0 unique IPs
- 0 related domains
View details · 1 shown
- Type
- A
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- mackeeper.com
- Issuer
- Amazon RSA 2048 M01