- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- Domain
- geekuninstaller.com
- TLD
- com
- Root domain
- geekuninstaller.com
- Resolved geo
- Fremont, California, United States
- Resolved IP
- 173.230.144.164
- Country
- United States
- DGA risk
- low
- DGA score
- 19.0
- Domain age days
- 5339.0
- Registrar
- ['NAMECHEAP INC', 'NameCheap, Inc.']
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
14 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context14 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
5shown
4%
low
peexe
6265344 bytes
communicates
Filename
4d7a52d2_geek uninstaller (v1.2.1.29).exe.bin
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
6265344
Compile time
2014-04-07T12:14:22Z
88%
high
peexe
2187776 bytes
communicates
Filename
75faf3e0_geek.exe.bin
Family
neshta
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
4%
low
peexe
2553341 bytes
communicates
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
2553341
Compile time
2017-05-23T00:14:02Z
SHA1
1a6cf3848b19a3fe7218c0e6d20856677f65a780
4%
high
peexe
6914496 bytes
communicates
Filename
0DC01CB981DF53983B02BF5D5D5063C9759D828AA2ED6B1B919EFD1DFEFC2EBD.exe
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
6914496
0%
peexe
6965784 bytes
communicates
Filename
1c3f45e5_eed5f382cf12523b89518f340dcd66bbf782c5f4c9dde81879169f6d70ed95e5.bin
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
6965784
Compile time
2016-12-01T09:27:04Z
Related domains
Domains associated with this indicator.
4shown
.com
contains
Root
geekuninstaller.com
TLD
com
Subdomain
mail
First seen
2021-01-25T11:07:27Z
Last seen
2026-05-12T13:16:35Z
0%
.com
contains
Root
geekuninstaller.com
TLD
com
Subdomain
dev
First seen
2022-10-07T17:07:14Z
Last seen
2022-10-07T17:07:14Z
0%
.com
contains
Root
geekuninstaller.com
TLD
com
Subdomain
www
First seen
2023-03-12T07:28:08Z
Last seen
2026-11-04T13:54:25Z
0%
.com
contains
Root
geekuninstaller.com
TLD
com
First seen
2023-03-12T07:28:08Z
Last seen
2026-11-13T19:10:07Z
Related URLs
URLs associated with this indicator.
5shown
0%
contains
TLD
com
HTTP status
200
Content SHA256
6a7c9635b88161771e23454dfe613af5e197ed2a3ff22d10fd8b730fcd5d8d1b
First seen
2017-01-25T17:32:26Z
Last seen
2026-10-27T19:31:43Z
0%
contains
TLD
com
HTTP status
200
Content length
184451
Content SHA256
786137e19529c6bcab21865d7dc9958fd716be911bdaa5c2b9bd9512d859d3d1
First seen
2025-12-10T22:00:10Z
0%
contains
TLD
com
HTTP status
200
Content length
130793
Content SHA256
6af690466e4ab1863bf6764a8f2270e62faf14f0716913beb0404918f18483db
First seen
2025-12-10T22:00:10Z
0%
contains
TLD
com
HTTP status
200
Content length
15653
Content SHA256
02dee8c23d01e3b62c685afd173c57bc18346f40b28417d0643e6e9f696e7b1b
First seen
2025-12-12T11:31:05Z
0%
contains
TLD
com
HTTP status
200
Content length
165742
Content SHA256
7bfcab6db99d5cfbf1705ca0536ddc78585432cc5fa41bbd7ad0f009033b2979
First seen
2024-04-19T05:50:55Z
Analysis details
Freshness: Fresh · Last seen today.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- Domain
- geekuninstaller.com
- TLD
- com
- Root domain
- geekuninstaller.com
- Resolved geo
- Fremont, California, United States
- Resolved IP
- 173.230.144.164
- Country
- United States
- DGA risk
- low
- DGA score
- 19.0
- Domain age days
- 5339.0
- Registrar
- ['NAMECHEAP INC', 'NameCheap, Inc.']
- Created
- 2012-04-02T08:42:46Z
- Expiry
- 2028-04-02T08:42:46Z
- First seen
- 2023-03-12T07:28:08Z
- Last seen
- 2026-11-13T19:10:07Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
14 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
15 timestamped observations are arranged from 1992-06-19 to 2025-12-12. These are observation or metadata times, not execution order.
Infrastructure geography
1 infrastructure/location point(s) are visible on the map. 1 point(s) are country-level approximate.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
3 relationship group(s) provide pivot and infrastructure context.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Domain profile
summarySelected domain intelligence summary.
- Root domain
- geekuninstaller.com
- Resolved IP
- 173.230.144.164
- Resolved geo
- Fremont, California, United States
- Country
- United States
- DGA risk
- low
- DGA score
- 19.0
- Domain age days
- 5339.0
- Registrar
- ['NAMECHEAP INC', 'NameCheap, Inc.']
- Created
- 2012-04-02T08:42:46Z
- Expiry
- 2028-04-02T08:42:46Z
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
DNS intelligence5+
0 IPs0 domains
- 5+ passive DNS records
- 1 DNS records
- 0 unique IPs
- 0 related domains
View details · 4 shown
- Type
- A
- Type
- AAAA
- Type
- MX
- Type
- NS
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- geekuninstaller.com
- Issuer
- YR2