home

bluekellii65.paasaa.net

Bit Spark Pvt Ltd

Domain Information

The domain bluekellii65.paasaa.net registered by Bit Spark Pvt Ltd was initially registered in July of 2013 through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Amsterdam, Noord-Holland within Netherlands which resides on the RIPE Network Coordination Centre network.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Noord-Holland, Netherlands (NL)

Create date:
Thursday, July 11, 2013

Expires date:
Saturday, July 11, 2015

Updated date:
Sunday, June 22, 2014

ASN:
AS5580 HIBERNIA TripartZ B.V.,NL

Root domain:
paasaa.net

Whois:
1 paasaa.net record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.CORLEONGROUP.r, PUP.InstallMonster.CORLEONG (M)
100.00%

VIPRE Antivirus
Threat.4845009
50.00%

avast!
Win32:InstallMonstr-DY [PUP]
50.00%

NANO AntiVirus
Trojan.Win32.InstallMonster.dbipfy
50.00%

Avira AntiVirus
APPL/InstallMonster.Gen
50.00%

Sophos
Install Monster
50.00%

G Data
Win32.Application.Installmonstr
50.00%

Vba32 AntiVirus
BScope.Downware.InstallMonstr
50.00%

Rising Antivirus
PE:Trojan.Agentb!6.211
50.00%

Panda Antivirus
PUP/InstallMonstr
50.00%

McAfee
Trojan.Artemis!E45C33D560A6
50.00%

herdProtect (fuzzy)
a variant of 3455363e437b598bce2c006073b8f63f03a45b55
50.00%

The domain bluekellii65.paasaa.net has been seen to resolve to the following IP address.

5.149.255.167
August 17, 2014

File downloads found at URLs served by bluekellii65.paasaa.net.

1 / 68      (Adware)
http://bluekellii65.paasaa.net/get_file/?sid=23&url=http://stream.get-tune.net/listen/64745779/21925901/1312797493/.../Tnn_-_Toli_Toli_(get-tune.net).mp3&name=Tnn_-_Toli_Toli_(get-tune.net).mp3&type=mp3&size=6862922  (tnn_-_toli_toli_(get-tune.net).exe)

12 / 68    (Adware)
http://bluekellii65.paasaa.net/.../?p=eyJzaWQiOiIxOTg3IiwidXJsIjoiaHR0cDpcL1wvdHVyYm9iaXQubmV0XC9kb3dubG9hZFwvcmVkaXJlY3RcL2RkZThmYWM5MzQ5ODg4ODcwZjVmMTEwZjZkNDhhODI1XC9wOGM1Z2V2cnZycmFcLyIsIm5hbWUiOiJRdWFsY29tbV9BdGhlcm9zX0JsdWV0b290aF9TdWl0ZV84LjAuMC4yMjhfd2luN193aW44LnJhciIsInR5cGUiOiIiLCJzaXplIjoiMTkzMzUxNzc4Iiwic3ViX2lkIjoiMTA3In0,  (Qualcomm_Atheros_Bluetooth_Suite_8.0.0.228_win7_win8.exe)

URL:
http://bluekellii65.paasaa.net/

Web server:
nginx/1.4.2 (PHP/5.4.17)

crazycat.ro

edu.mx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.