home

6904.getfl.net

N.A.

Domain Information

The domain 6904.getfl.net registered by N.A. was initially registered in May of 2014 through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Hollywood, Florida within the United States which resides on the Prolexic Technologies, Inc. network.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Florida, United States (US)

Create date:
Monday, May 26, 2014

Expires date:
Thursday, May 26, 2016

Updated date:
Tuesday, August 11, 2015

ASN:
AS32787 PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK - Prolexic Technologies, Inc.,US

Root domain:
getfl.net

Whois:
1 getfl.net record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Amonetize.TEHSNABSTROY.Bundler (M), PUP.MediaStroy.Installer (M)
100.00%

The domain 6904.getfl.net has been seen to resolve to the following IP address.

72.52.4.120
unknown.prolexic.com
February 29, 2016

File downloads found at URLs served by 6904.getfl.net.

1 / 68      (Adware)
http://6904.getfl.net/?id=t00d&nor=1&sub=boxmp3&name=SongsMp3  (songsmp3_18cyl.exe)

1 / 68      (Adware)
http://6904.getfl.net/?id=t00d&nor=1&sub=boxmp3&name=SongsMp3  (songsmp3_971vi.exe)

The following 74 files have been seen to comunicate with 6904.getfl.net in live environments.

TCP » 72.52.4.120:80
kb799693963.exe

TCP » 72.52.4.120:80
whAgent.exe (webHancer Customer Companion by webHancer)

TCP » 72.52.4.120:80
monhost.exe (monhost.exe by Vested Development, Inc)

TCP » 72.52.4.120:80
online-guardian-v2.0.9.exe

TCP » 72.52.4.120:80
winalert.exe

TCP » 72.52.4.120:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 72.52.4.120:80
guacuilanmog.exe

TCP » 72.52.4.120:80
cssrs.exe

TCP » 72.52.4.120:80
Alternative Flash Player Auto-Updater.exe (Flash Player Auto-Updater by Wecode.biz)

TCP » 72.52.4.120:80
adobe online.com

TCP » 72.52.4.120:80
hbpzabffmyx.exe

TCP » 72.52.4.120:80
onlineguardian-v2.exe

TCP » 72.52.4.120:80
apptrailers.exe

TCP » 72.52.4.120:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 72.52.4.120:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 72.52.4.120:80
updates.exe

TCP » 72.52.4.120:80
mirc.exe (mIRC by mIRC Co)

TCP » 72.52.4.120:80
csrss.exe

TCP » 72.52.4.120:80
photo.exe

TCP » 72.52.4.120:80
adobe online.com

 
Latest 20 of 81 files

URL:
http://6904.getfl.net/

Title:
“getfl.net -&nbspThis website is for sale! -&nbspgetfl Resources and Information.”

Description:
“This website is for sale! getfl.net is your first and best source for information about getfl. Here you will also find topics relating to issues of general interest. We hope you find what you are looking for!”

Web server:
Apache/2.2.22 (Debian)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.