home

ad.betterdeals00.betterdeals.co

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain ad.betterdeals00.betterdeals.co is registered by proxy through GODADDY.COM, INC. and was originally registered in July of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Chicago, Illinois within the United States which resides on the GigeNET network.
Registrar:
GODADDY.COM, INC.

Server location:
Illinois, United States (US)

Create date:
Wednesday, July 3, 2013

Expires date:
Saturday, July 2, 2016

Updated date:
Sunday, August 16, 2015

Root domain:
betterdeals.co

Whois:
2 betterdeals.co records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.FiorentinoMedia.W, PUP.Optional.Installer.T, Win32.Generic
100.00%

Qihoo 360 Security
Malware.QVM05.Gen
50.00%

Dr.Web
infected with BackDoor.Infector.133
50.00%

The domain ad.betterdeals00.betterdeals.co has been seen to resolve to the following 8 IP addresses.

52.1.51.167
ec2-52-1-51-167.compute-1.amazonaws.com
August 22, 2016

54.173.202.137
ec2-54-173-202-137.compute-1.amazonaws.com
August 22, 2016

54.152.60.180
ec2-54-152-60-180.compute-1.amazonaws.com
August 22, 2016

69.39.236.56
ip-69.39.236.56.hosted.by.gigenet.com
June 7, 2016

172.99.89.194
January 28, 2016

54.214.236.232
ec2-54-214-236-232.us-west-2.compute.amazonaws.com
August 19, 2014

50.112.249.78
ec2-50-112-249-78.us-west-2.compute.amazonaws.com
August 19, 2014

50.112.107.113
ec2-50-112-107-113.us-west-2.compute.amazonaws.com
August 19, 2014

File downloads found at URLs served by ad.betterdeals00.betterdeals.co.

1 / 68      (PUP)
http://ad.betterdeals00.betterdeals.co/countAdReport.aspx?url=http://jeffshop.info/li-pchb&ver=2.0.3.0&browser=CHROME 36&domain=a2lja2Fzcy50bw==&partnerId=betterdeals&subId=2222-5515&asd=//ad.betterdeals00.betterdeals.co&uid=PYFy7mIkzLL5732332Qf&iQS=request_id=53dee470ba9c94.49910890&adId=13626207&keywordId=73413993&keyword=pchealthboos&cpv=MC4wMw==&advertiser=15&d={"countryCode":"US","adTimesUTC":["2014-08-03T21:44:34.000000Z"],"adLastSeenUTC":"2014-08-03T21:44:34.000000Z","lastServerAdReturnedUTC":"2014-08-04T01:40:00.000000Z"}  (pchealthboost-setup.exe)

1 / 68      (PUP)
http://ad.betterdeals00.betterdeals.co/countAdReport.aspx?url=http://makingprofits.pw/online/camp/17viralnity.php?token=ww.activeris.co&adId=14773396&keywordId=70716575&ver=2.0.3.0&browser=CHROME 35&domain=bXkuZW1haWxidXp6ZXIuY29t&partnerId=betterdeals&subId=1800-1008&asd=//ad.betterdeals00.betterdeals.co&r=53c17454954d42.79165316  (fastagain-installer-s2.exe)

1 / 68      (PUP)
http://ad.betterdeals00.betterdeals.co/countAdReport.aspx?url=http://makingprofits.pw/online/camp/17viralnity.php?token=w.activeris.co&adId=14773396&keywordId=70716573&ver=2.0.3.0&browser=CHROME 35&domain=d3d3LmFjdGl2ZXJpcy5jb20=&partnerId=betterdeals&subId=1030-8002&d=null&asd=//ad.betterdeals00.betterdeals.co  (fastagain-installer-s2.exe)

3 / 68      (PUP)
http://ad.betterdeals00.betterdeals.co/countAdReport.aspx?url=http://jeffshop.info/li-pchb&ver=2.0.3.0&browser=CHROME 33&domain=d3d3LmtiYi5jb20=&partnerId=betterdeals&subId=9800-1002&asd=//ad.betterdeals00.betterdeals.co&uid=IkDpCTGiOVqHI-zZM9YG&iQS=request_id=53f13e699d3ef3.72496289&adId=13626207&keywordId=71798676&keyword=pchealthboost.&cpv=MC4wMzI=&advertiser=15  (pchealthboost-setup.exe)

3 / 68      (PUP)
http://ad.betterdeals00.betterdeals.co/countAdReport.aspx?url=http://jeffshop.info/li-pchb&ver=2.0.3.0&browser=CHROME 36&domain=d3d3LmhlcmRwcm90ZWN0LmNvbQ==&partnerId=betterdeals&subId=9020-5720&asd=//ad.betterdeals00.betterdeals.co&uid=mnXSgCfQznTQmGMoTNQC&iQS=request_id=53f28b92be6aa6.38596848&adId=13626207&keywordId=79721237&keyword=pchealthboost&cpv=MC4wMw==&advertiser=15  (pchealthboost-setup.exe)

The following 363 files have been seen to comunicate with ad.betterdeals00.betterdeals.co in live environments.

TCP » 69.39.236.56:80
globalupdate.exe (globalUpdate Update by globalUpdate)

TCP » 69.39.236.56:8888
popdeals.exe (Today)

TCP » 69.39.236.56:80
9fe7cfbf-5cc9-4391-a512-8a764fd807c3-1-7.exe (CinemaPlus-3.2cV20.05 by Cinema PlusV20.05)

TCP » 69.39.236.56:80
9fe7cfbf-5cc9-4391-a512-8a764fd807c3-5.exe (CinemaPlus-3.2cV20.05 by Cinema PlusV20.05)

TCP » 69.39.236.56:80
1573.exe (SavePass 1.1 by OB)

TCP » 69.39.236.56:80
9fe7cfbf-5cc9-4391-a512-8a764fd807c3-3.exe (CinemaPlus-3.2cV20.05 by Cinema PlusV20.05)

TCP » 69.39.236.56:80
6054.exe (SavePass 1.1 by OB)

TCP » 69.39.236.56:80
5dfde4f5-80af-4a98-8da4-e95b948f183d-10.exe (Ge-Force by Webar)

TCP » 69.39.236.56:80
a4bc936c-5e01-43ed-9315-bef9a4ae2675-10.exe (SavePass 1.1 by OB)

TCP » 69.39.236.56:80
pricehorse.exe (by Pay By Ads)

TCP » 69.39.236.56:80
tbhcn.exe (tcbhn by Blabbers Communications)

TCP » 69.39.236.56:80
d488e0ef-38ce-4f88-bb4a-7a53ee6d0463-1-7.exe (CinemaPlus-4.5vV22.05 by Cinema PlusV22.05)

TCP » 69.39.236.56:80
dailybee.exe

TCP » 69.39.236.56:80
024a6571-2a4e-4467-b299-604f4b85d0bf-7.exe (CinemaPlus-4.5vV23.05 by Cinema PlusV23.05)

TCP » 69.39.236.56:80
avast.exe

TCP » 69.39.236.56:80
shopwit.exe (by Pay By Ads)

TCP » 69.39.236.56:80
72adc4fb-6293-4a4b-a6cc-4fa0a475afe3-1-7.exe (CinemaPlus-3.2cV21.05 by Cinema PlusV21.05)

TCP » 69.39.236.56:80
f77056a6-54df-48d7-b91d-842cbb1c6277-1-7.exe (Cinem Plus 2.4cV25.05 by Cinema Plus ProV25.05)

TCP » 69.39.236.56:80
avast.exe

TCP » 69.39.236.56:80
aab72157-141a-4b3a-9bef-b0a5112fd240-1-7.exe (CinemaPlus-3.2cV21.05 by Cinema PlusV21.05)

 
Latest 20 of 372 files

URL:
http://ad.betterdeals00.betterdeals.co/

Title:
“betterdeals.co”

Web server:
Apache

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.