Is di-binary.softonic.com a scam?

Our automated security review flags di-binary.softonic.com as dangerous. Multiple threat indicators were detected — treat the site as a scam until proven otherwise.

Is di-binary.softonic.com safe to use?

No — di-binary.softonic.com scored 25/100 on our trust scale. We detected active threat indicators, so we recommend avoiding the site entirely.

Does di-binary.softonic.com have a valid SSL certificate?

Yes. di-binary.softonic.com presents a valid TLSv1.3 certificate issued by Let's Encrypt · R13, expiring in 35 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.

How old is the di-binary.softonic.com domain?

di-binary.softonic.com is 26.4 years old, registered on 1/28/2000 through Network Solutions, LLC. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.

Has di-binary.softonic.com been flagged by antivirus engines?

No. All 92 antivirus engines in our malware network report di-binary.softonic.com as clean.

Is di-binary.softonic.com on any phishing or malware blacklists?

No. di-binary.softonic.com is not currently listed on the major browser blocklist feeds that modern browsers use.

Where is di-binary.softonic.com hosted?

di-binary.softonic.com resolves to an IP operated by Fastly, Inc. in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.

How often is the di-binary.softonic.com report updated?

This is a permanent record of the scan run on June 25, 2026. The verdict and evidence above reflect that scan and do not change on their own. If circumstances around di-binary.softonic.com have changed, MalwareTips staff can run a fresh scan, which re-runs every check from scratch and publishes an updated report.

Security Review

Is di-binary.softonic.com legit or a scam?

Our verdict:Dangerous· 25/100

SafeSuspiciousDangerous

This Softonic download link serves a malicious executable flagged for registry manipulation and unauthorized screenshot capabilities.

Top reasons

Sandbox analysis confirmed malicious activity including registry autorun modification.The file contains YARA-detected functionality for taking unauthorized screenshots.The installer is flagged for 'evasion' techniques to hide from security software.

di-binary.softonic.comScanned 1h ago

Post Facebook

Trust score

DANGEROUS

Heuristics 90·MT 15

Category tags

malware#malware90% MT confidence

Positive signals (5)

Antivirus clear Not on major blacklists Domain is 26 years old Encrypted connection Clean server reputation

These checks passed — but they don't clear the site. A clean antivirus result, valid SSL, and a calm server only mean it isn't hosting malware; they say nothing about whether the business is real. This verdict is based on the site's conduct and content, not a malware detection.

View density

Analysis Summary

Threat Intelligence

0/92

All engines report clean

Domain Age

26 years old

Registered Jan 28, 2000

MT Intelligence

Dangerous

High likelihood · 90% confidence

DANGEROUS

Critical risk detected

This Softonic download link serves a malicious executable flagged for registry manipulation and unauthorized screenshot capabilities. Multiple independent checks — antivirus engines, browser safety blocklists, and threat databases — flagged this site. Don't enter personal information, deposit money, or download files.

Website Preview

LIVE RENDER

di-binary.softonic.com

1Screenshot incomplete — site may be slow to render

Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →

Visual Screenshot Analysis

We capture a fresh screenshot of the live page and ask a vision model to look for scam visual patterns — fake trust badges, countdown timers, overlay pop-ups, and visual clones of legitimate brands.

/ 100

High visual risk

Visual red flags detected in the screenshot

We could not capture a fully-rendered screenshot of this page; visual analysis is inconclusive.

Visual risk50/100

What our vision model saw

1 signal

Screenshot incomplete — site may be slow to render

MT Intelligence

Advanced threat intelligence

MT Security Analyst

High scam likelihoodengineMT · Guardiantrust15/100

MT AgentLive web researchVisual inspection

Confidence

Our analysis identifies this specific file as a high-risk installer. While the domain has existed for over 26 years, our intelligence stack detected malicious behavior in recent sandbox executions of the 'DeskRest_n.exe' file. The program attempts to gain persistence by changing autorun registry values and contains functionality for capturing screenshots without user consent. Furthermore, the installer is known to drop or overwrite other executables on the system. These patterns are consistent with malware or highly invasive unwanted software.

Full dossier

Analysis complete

Page Content

The URL points directly to a binary executable file hosted on a subdomain used for software distribution. There is no visible web interface for this specific link, as it is a direct download path for an installer package.

Infrastructure

The file is hosted on a legitimate subdomain of a major software portal. However, the hosting IP has a history of abuse reports, and the specific file path is associated with a Delphi-based installer that uses evasion techniques to bypass standard security checks.

Domain History

The parent domain was registered over 26 years ago and is operated by a registered business in Spain. Despite this longevity, the platform has a documented history of bundling third-party software, toolbars, and potentially unwanted programs (PUPs) with its downloads.

Web Reputation

Independent security researchers and sandbox environments have recently issued malicious verdicts for this specific file. Reports on community forums like Reddit frequently warn users that downloads from this provider may contain bundled threats or privacy-invasive components.

Risk Factors

Sandbox analysis confirmed malicious activity including registry autorun modification.
The file contains YARA-detected functionality for taking unauthorized screenshots.
The installer is flagged for 'evasion' techniques to hide from security software.
The executable drops or overwrites other files on the host system.
Long-standing reputation for distributing bundled adware and unwanted programs.

Positive Signals

The domain has been registered for over 26 years.
The operator is a legally registered business in Spain.
The site uses a valid SSL certificate from a recognized issuer.

AI Recommendation

Do not open or execute this file. If you have already run it, perform a full system scan with updated antivirus software and check your startup programs for unauthorized entries.

Next-gen fraud intelligence

Evidence-backedCross-checked

Web Research Findings

Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for di-binary.softonic.com, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.

Domain age

26 yrs

Registered Jan 2000

Business registration

Active · Spain

Site traces back to an actively registered business.

Clone check

Not a clone

No well-known site's layout or branding detected here.

Typosquat check

No look-alike match

The domain doesn't resemble any well-known brand's spelling.

Web mentions

3 scam reports · 5 complaints

Key findings

7 headline facts from open-web research

di-binary.softonic.com is a legitimate subdomain used by Softonic to host direct binary downloads (e.g., *.exe files) for programs listed on en.softonic.com.
In November 2025, the file DeskRest_n.exe hosted at https://di-binary.softonic.com/deskrest/DeskRest_n.exe received a "Malicious activity" verdict on ANY.RUN sandbox.
The analyzed sample (MD5: 520FB9987D563AF8403DC0E43DF9BBBD) is an Inno Setup installer compiled with Borland Delphi; behaviors flagged as malicious include changing autorun registry values, dropping/overwriting executables, screenshot funct
Softonic has a long-standing reputation for bundling adware, PUPs (e.g., PUP.Optional.Softonic detected by Malwarebytes), and unwanted toolbars with downloads, leading to widespread user complaints and Reddit warnings since at least 2014.
No dedicated scam reports for the exact subdomain were found, but the parent domain softonic.com is frequently criticized for distributing modified or bundled software that can include malware or privacy-invasive components.
Domain registered approximately 26 years ago (9645 days); consistent with Softonic's established business as a major software discovery platform.
VirusTotal has a page for the domain, but no specific aggregated detection score was detailed in results.

Scam reports (3)

Direct quotes from public scam databases, forums, and news.

ANY.RUNopen
"Verdict: Malicious activity | URL: https://di-binary.softonic.com/deskrest/DeskRest_n.exe | Tags: evasion delphi inno installer"
ANY.RUNopen
"Malicious * Changes the autorun value in the registry | Checks for external IP | Executable content was dropped or overwritten | There is functionality for taking screenshot (YARA)"
Redditopen
"PSA: The website softonic.com is insecure, and downloads from that site will likely contain malware."

Business registration

Status: active · Spain

Softonic International S.L. is a long-established (over 25 years) Spanish software download portal operator; domain age of 9645 days (~26 years) aligns with company history.

Research summary

Narrative write-up from our AI analyst, grounded on the facts above

Our research found multiple reports of malicious activity associated with this specific download. Sandbox analysis platforms have documented the file's ability to modify system startup and capture screenshots. Additionally, long-term user feedback on Reddit indicates that the parent site is frequently used to distribute bundled software that users consider insecure or harmful.

Antivirus Engines

Clean pass · verified

Clean across 92 engines

We cross-check every URL against our antivirus network of 92 malware and blacklist engines. None of them flagged this URL in the last scan.

0Malicious0Suspicious60Harmless92Engines

Clean

Kaspersky

Clean

Bitdefender

Clean

Microsoft

Not in pass

ESET-NOD32

Not in pass

Avira

Not in pass

Sophos

Clean

Fortinet

Clean

Google Safebrowsing

Clean

Emsisoft

Clean

No engine detections. The URL passed every antivirus and blacklist engine we queried in this scan. Stay vigilant — AV coverage is only one signal among many.

Security Scans

Blacklist Check

Not flagged on major threat lists

Checked against the major public blocklists used by browsers and security tools — no hits.

Domain & Encryption

Domain History

Age26 years old

RegistrarNetwork Solutions, LLC

RegisteredJan 28, 2000

ExpiresJan 28, 2031

Owner privacyVisible

Encryption Certificate

StatusValid

ProtocolTLSv1.3

IssuerLet's Encrypt · R13

ExpiresJul 31, 2026 (35d)

Self-signedNo

Hosting & Technology

HostingFastly, Inc.

Server locationUS

Server Reputation

Abuse Intelligence

Confidence score0%

Reports on file8

ISPFastly, Inc.

Usage typeContent Delivery Network

Avoid this site

Our automated review flagged enough risk that you should treat this site as unverified.

Do not interact with di-binary.softonic.com
Do not enter credentials, deposit money, download files, or install browser extensions from this site.
Verify the business through independent channels
Check the company's social profiles, registry records, and search for recent news or reviews that are not hosted on the site itself.
Never use irreversible payment methods
Crypto, gift cards, wire transfers, and cash apps offer zero buyer protection. Use a credit card or PayPal if you must pay.
Share your experience
If you have additional context, drop a comment below or post on the MalwareTips forum.
Open

Reputation Sources

How this domain rates across independent threat-intelligence and blocklist providers.

Google Safe Browsing

Not listedCheck ↗

VirusTotal

Not listedCheck ↗

AbuseIPDB

Not listedCheck ↗

Also verify:Spamhaus ↗DNSBL / SURBL ↗PhishTank ↗

Safety FAQ

Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.

Our automated security review flags di-binary.softonic.com as dangerous. Multiple threat indicators were detected — treat the site as a scam until proven otherwise.
No — di-binary.softonic.com scored 25/100 on our trust scale. We detected active threat indicators, so we recommend avoiding the site entirely.
Yes. di-binary.softonic.com presents a valid TLSv1.3 certificate issued by Let's Encrypt · R13, expiring in 35 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
di-binary.softonic.com is 26.4 years old, registered on 1/28/2000 through Network Solutions, LLC. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.
No. All 92 antivirus engines in our malware network report di-binary.softonic.com as clean.
No. di-binary.softonic.com is not currently listed on the major browser blocklist feeds that modern browsers use.
di-binary.softonic.com resolves to an IP operated by Fastly, Inc. in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
This is a permanent record of the scan run on June 25, 2026. The verdict and evidence above reflect that scan and do not change on their own. If circumstances around di-binary.softonic.com have changed, MalwareTips staff can run a fresh scan, which re-runs every check from scratch and publishes an updated report.

Final Verdict

Trust / 100

Final Verdict·di-binary.softonic.com

DANGEROUS

This URL hosts a malicious installer that exhibits spyware-like behavior, including taking screenshots and modifying system startup settings. While the parent domain is a long-standing software portal, this specific file has been flagged for harmful activity. Do not download or run this file.

Do not open or execute this file. If you have already run it, perform a full system scan with updated antivirus software and check your startup programs for unauthorized entries.

AV engines

MT passes

Net signals

Scan another URL

Security review completemalwaretips.com/url-scan

Recently scanned

Other Dangerous reports

site-flixquarvex.click

Community review

User reviews & comments(0)

Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.

Loading…

Loading comments…

This report is generated automatically by combining threat intelligence, domain signals, and an AI security analyst. It is informational, not legal advice. Always use your own judgement before sharing personal information or money online.