home

clic.hexaweb.net

WHOISGUARD, INC.  (Proxy Registrant)

Domain Information

The domain clic.hexaweb.net is registered by proxy through ENOM, INC. and was originally registered in April of 2011. Currently this domain has been known to host various forms of malware. The hosted servers are located in Roubaix, Nord-Pas-De-Calais within France which resides on the RIPE Network Coordination Centre network.
Registrar:
ENOM, INC.

Server location:
Nord-Pas-De-Calais, France (FR)

Create date:
Saturday, April 2, 2011

Expires date:
Thursday, April 2, 2020

Updated date:
Thursday, October 17, 2013

ASN:
AS16276 OVH OVH SAS,FR

Root domain:
hexaweb.net

Whois:
1 hexaweb.net record

Scanner detections:
Malware distribution  (88% detected)

Scan engine
Details
Detections

Kaspersky
Trojan-Downloader.Win32.Genome, Trojan-Dropper.MSIL.Agent, HEUR:Trojan-Downloader.Win32.Generic, not-a-virus:Downloader.NSIS.Agent
83.33%

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h, TrojanDropper.MSIL.Agent, Signed-Downware.Morstar.AppsInstallerSL
70.83%

McAfee
RDN/Generic Dropper!rk, RDN/Generic Downloader.x!iy, RDN/Generic Downloader.x!il, RDN/Generic Dropper!rm, Artemis!C1E086DDC311, Artemis!B9B3160B8BE0
58.33%

Trend Micro House Call
TROJ_GEN.F47V0923, TROJ_GEN.R0CBH06I913, TROJ_GEN.R0CBH06DU14, TROJ_SPNR.3AJE13, TROJ_GEN.F47V0615, TROJ_GEN.R0CBOH0IQ13, TROJ_GEN.R047H01H713
50.00%

VIPRE Antivirus
Trojan.Win32.Generic, Trojan-Downloader.NSIS.Agent.nom, DownloadMR, Threat.4150696
50.00%

Baidu Antivirus
Trojan-Dropper.MSIL.Agent, Trojan.Win32.Downloader, Trojan.MSIL.Dropper, Trojan-Downloader.Win32.Generic, Trojan.Win32.Genome
41.67%

avast!
Win32:Rootkit-gen [Rtk], Win32:Dropper-gen [Drp], Win32:Solimba-C [PUP], Win32:Malware-gen
37.50%

Dr.Web
Trojan.DownLoader9.22070, Adware.Downware.1125, Trojan.DownLoader9.62979, Trojan.DownLoader10.50355, Trojan.DownLoader9.11848, Trojan.DownLoader10.10504
33.33%

Sophos
Mal/Generic-S, DownloadMR, Solimba Installer
29.17%

Reason Heuristics
(M), PUP.AppsInstallerSL.Q, PUP.Solimba.AppsInstaller.Installer (M), PUP.Solimba.AppsInst.Bundler (M)
25.00%

Panda Antivirus
Trj/CI.A, Trj/Chgt.A, Suspicious file
25.00%

ESET NOD32
Win32/Downloader.Agent.NAN, MSIL/Solimba, Win32/Downloader.Agent.NAN potentially unsafe
25.00%

Fortinet FortiGate
W32/Agent.ALOT!tr, W32/Agent.ALRS!tr, Adware/Solimba, W32/Genome.EYUW!tr.dldr
20.83%

K7 AntiVirus
Trojan-Downloader , Riskware , Unwanted-Program
20.83%

Bkav FE
W32.Clod0a7.Trojan, W32.Clod20c.Trojan, W32.HfsAdware, W32.Clodb61.Trojan
16.67%

The domain clic.hexaweb.net has been seen to resolve to the following 3 IP addresses.

94.23.21.229
ns366973.ip-94-23-21.eu
March 30, 2016

178.33.228.198
ns338802.ip-178-33-228.eu
February 23, 2016

79.143.179.169
ip-169-179-143-79.static.contabo.net
January 10, 2014

File downloads found at URLs served by clic.hexaweb.net.

1 / 68      (Adware)
http://clic.hexaweb.net/clic.php?id_c=42bdefcec149c2c2c0e3272247c89483&id_a=30e3ef6f998  (flv_media_player.exe)

4 / 68      (Malware)
http://clic.hexaweb.net/clic.php?id_c=0578dbe2dbeb5dd66c04acda5418ea20&id_a=30e3ef6f998  (flv-media-player.exe)

8 / 68      (Malware)
http://clic.hexaweb.net/clic.php?id_c=13df3e2a1e735c14aeb385cd1ba88d02&id_a=30e3ef6f998  (flv-media-player.exe)

12 / 68    (Malware)
http://clic.hexaweb.net/clic.php?id_c=e13422effa3177c8b719aeff5314a5d3&id_a=30e3ef6f998  (flv-media-player.exe)

18 / 68    (Malware)
http://clic.hexaweb.net/clic.php?id_c=9e1852e7d8a921dbf8d8c3f08d069bee&id_a=30e3ef6f998  (flv_mplayer_hd.exe)

3 / 68      (Malware)
http://clic.hexaweb.net/clic.php?id_c=f9b41abb38442533174da5b3335a1b16&id_a=30e3ef6f998  (flv-media-player.exe)

9 / 68      (Malware)
http://clic.hexaweb.net/.../FLV-Media-Player.exe  (1b5d69b9a7f0f95535d1c4efda36159c)

4 / 68      (Malware)
http://clic.hexaweb.net/clic.php?id_c=eb062815c8c99542ed28dcbd2d9cb259&id_a=30e3ef6f998&nat=1  (flash-player.exe)

9 / 68      (Malware)
http://clic.hexaweb.net/clic.php?id_c=65718c802a3a0d800a06cd0855c13d9b&id_a=30e3ef6f998  (flv-media-player.exe)

29 / 68    (Adware)
http://clic.hexaweb.net/clic.php?id_c=ffde96eaeeb2e87489a36a43f75065ae&id_a=30e3ef6f998  (flv_media_player.exe)

15 / 68    (Malware)
http://clic.hexaweb.net/clic.php?id_c=2e89cb5698442a68cf10b2886b58b262&id_a=30e3ef6f998  (flv-media-player.exe)

9 / 68      (Adware)
http://clic.hexaweb.net/clic.php?id_c=88e5bbd8b751cd04fa73f94f5657ec43&id_a=30e3ef6f998  (flv_media_player.exe)

URL:
http://clic.hexaweb.net/

Web server:
Apache (PHP/5.5.33)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.