home

newclickforsale.info

steve magner

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.
Registrar:
GoDaddy.com, LLC

Server location:
Arizona, United States (US)

ASN:
AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC

Whois:
1 newclickforsale.info record

Scanner detections:
Malware distribution  (75% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
75.00%

Dr.Web
Trojan.Crossrider.28215
25.00%

avast!
Win32:MultiPlug-CI [PUP]
25.00%

The domain newclickforsale.info has been seen to resolve to the following IP address.

50.63.202.6
ip-50-63-202-6.ip.secureserver.net
May 17, 2016

File downloads found at URLs served by newclickforsale.info.

1 / 68      (Malware)
http://newclickforsale.info/v2647/lp/?q=bNPuplWUGiADLVNPRJzherVGj5m/8DW/kkm8ZJ22p2Kr2a5G7v92zVydvFXguZ b2ssmWkE8hemzUiSFqmVHcD/eolAfeg/SkFJhakT1JhC9ukFogwzTlFF1QlsF8GxnTdbWQPoW4/nyuSnbvqLM1NqA9qNyFCCHRKf EbGtyvWLQTMLiyxL6 dYqXAPVB/ i byXDMp80mPVCnekkN/.../ZnOCLJIZjlM1hPOC2gkmIl6E7mQ2iC&external_id=1408148732472700411  (hunter_hayes_invisible_.mp3.exe)

1 / 68      (Malware)
http://newclickforsale.info/v970/lp/?q=uHLnk/touCwWdG xztkeb/J3H3ttsTKd4N4NwRAZirBxz90BYq07QfpHgIGQrRAZ2yeP6gjr72zwlo19T9wYNAngP5qFekrEM9MnirBwFUuvYj3febgiKeMn55qGHJOAHn/EN3tttVjvPD19EgGQrNS02l35H0 /mv7Sjy4OT7S0lo19hnc4fhHI9kdVgICseWPB52hfK9iq8t7aDiHztZxb/j27jRJGbHRYl4/ygKmNx/WqlCb6BpNIXlbq2 bfcwNIYgYklNCEK6QL 9QyIPMPx/OJU1SLTomZyW6CcwZxkB4qoN/men/dQw7bKkyaCnwt2 aVIjfj1GsWI5Zx4Z9GWkEwS0DnQnCF 9/m0Eq6pnTS8oqT7qk6Ta5iU1DnkIf04PGnHCjPgKb5G9SZG8HzoNx3jgJAqVIFnOk4Ncn8nOiS/jtXFBdzVN5VW209botSWLNLXtfdIQCnnyeHk QWTxEZo87KwFzH7vSaThfYtFGUCVmk3HmVdi6scNp1OXEN70AwEdZ 2HobR6iNgk12LJPaSQO 9vDXyEx/FKRyy1gdtBAIRGPUuERcHxc0E21O1yxvQ7eg8EQWT2pCVITK 2saVkmgAO6cFt8Xg2vMeWJCTwHNhX3duHog78YXcjb2AVEMuVEUHSBxmXQ8hG/LPKjqlYR9UWsx9fWF7byTVXQBdakoPwYknuAZhROArI7UYCwWUyO69awXVXQBdt6Xu0 /nuAZpnWGqZIcrOutpC73vvyUSCVoX8 /wOSaogGPcz5RSrAZBtkoCj35LTR9Eo1DBm2cW723uawY/gmh5VFOSZI2hG/.../O6ko19hrok4K8yJ7GOaj35KBHIOj3febgi2Rzh3477NzU8yrjG P93AupBNYwSgUokCUL5P5qF81BwBnb2dakpQ2JdR7S030jryMln3duvAdutiZm04HWGv  (--------------- ---------...---------(-.exe)

2 / 68      (inconclusive)
http://newclickforsale.info/v3742/lp/?q=89oexS243YMXYSUMOQwHugEOAAEjDaaSXfLFKp9klkNrWPRD oFzyiaC9wo CJbfnEZQCubaN1cfnKU2INXR3fNACXcqhKdPdhP6RPTtfsiv/2zmqmIb/t1seGOBVfudZ0UiJ8WIQJa86TiQ1FfoNSN4HgW61RHIStKTEl1mkJlKrpkgJVUCNXhcVjVewTWPt0y5/.../XaQwu WFzHrLBC3GacSI1oxX3z&external_id=1408374222468558279  (activator windows 7 windows loader v2.2.2 by daz.exe)

1 / 68      (Malware)
http://newclickforsale.info/v3530/lp/?q=f3FigMWZzsv40cdefAZ9MuyrEQhCjZYz37QHRyzsWLHpuycA5wR0d8W/43cqOoj3ktKIx7TT/OTp7sFzIgzzlXGy/ve MSac4t04FsNdvuSnm7MdVmrrdct9FBhTR37a/.../4s&external_id=1407849481324674123  (download.exe)

The following 8 files have been seen to comunicate with newclickforsale.info in live environments.

TCP » 50.63.202.6:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.63.202.6:80
42fe.tmp.exe

TCP » 50.63.202.6:80
online-guardian-v2.0.9.exe

TCP » 50.63.202.6:25
w.exe

TCP » 50.63.202.6:587
www.exe

TCP » 50.63.202.6:25
www.exe

TCP » 50.63.202.6:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 50.63.202.6:80
produpd.exe (produpd.exe by Vested Development, Inc)

TCP » 50.63.202.6:80
tempsetup.exe (Axlio by Microsoft)

URL:
http://newclickforsale.info/

Title:
“newclickforsale.info”

Web server:
Microsoft-IIS/7.5 (ASP.NET) (Version: 4.0.30319)

3av.it

787networks.com

deejayportal.com

forensicinnovations.com

genieo.com

kadmy.com

metromile.com

rsigroup.net

seuntjie.com

world-telephone.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.