home

clickeu.tractionize.com

Domain Information

Server location:
Texas, United States (US)

ASN:
AS36351 SOFTLAYER - SoftLayer Technologies Inc.,US

Root domain:
tractionize.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.OUTBROWSE.F
100.00%

Dr.Web
Adware.Downware.2081
100.00%

ESET NOD32
Win32/OutBrowse.AH potentially unwanted application
100.00%

VIPRE Antivirus
Threat.4784459
100.00%

Kaspersky
not-a-virus:AdWare.Win32.OutBrowse
100.00%

nProtect
Trojan-Clicker/W32.OutBrowse.636344
100.00%

McAfee
Adware-OutBrowse
100.00%

Malwarebytes
PUP.Optional.OutBrowse
100.00%

K7 AntiVirus
Unwanted-Program
100.00%

NANO AntiVirus
Riskware.Nsis.Downware.dehadt
100.00%

F-Prot
W32/Outbrowse.B2.gen
100.00%

Trend Micro House Call
Suspici.D75A4FB1
100.00%

Agnitum Outpost
PUA.OutBrowse
100.00%

Sophos
OutBrowse Revenyou
100.00%

Avira AntiVirus
APPL/OutBrowse.lwasp
100.00%

The domain clickeu.tractionize.com has been seen to resolve to the following 8 IP addresses.

37.58.71.200
37.58.71.200-static.reverse.softlayer.com
December 23, 2014

37.58.93.177
37.58.93.177-static.reverse.softlayer.com
December 23, 2014

37.58.93.176
37.58.93.176-static.reverse.softlayer.com
December 23, 2014

37.58.93.171
37.58.93.171-static.reverse.softlayer.com
December 23, 2014

37.58.93.170
37.58.93.170-static.reverse.softlayer.com
December 23, 2014

37.58.93.169
37.58.93.169-static.reverse.softlayer.com
December 23, 2014

37.58.93.168
37.58.93.168-static.reverse.softlayer.com
December 23, 2014

37.58.71.205
37.58.71.205-static.reverse.softlayer.com
December 23, 2014

File downloads found at URLs served by clickeu.tractionize.com.

18 / 68    (Adware)
http://clickeu.tractionize.com/st?cipid=1694000&ttype=1&crid=2260798&dast=Ym89MSZzbGlkPTAmc3ViaWQ9MTAwNSZzbz0xJmNpY21wPTI5MjQyOCZwdWJpZD0xMDE3JmNpcGlkPTE2OTQwMDAmY2lzaWQ9NkVDRUFDNzVBQzI0OTcxMTA1MTgxMTU2NiZjaXJpZD02RUNFQUM3NUFDMjQ5NzIxMjgxMTUxMjMmY2l1aWQ9LTE0MzQzNTMwMTgzODU4NjY1MDImY3JpZD0yMjYwNzk4JmV4Y2lkPTIyJm1tdD0tMSZjbnRyeT0yMjY=&cmcv=${CMCV}&tgtf=http://get.file2desktop.com/.../Get?p=8723&d=12098&l=11517&n=1&productname=GoogleChrome&d1=103&d2=3266226&clickid=UAT_ams1COmi6cKXuJXQHhACGKuCj4efsfiKTCINODcuMTE0LjI4LjIyMCgBMPjOrZ8F  (setup.exe)

The following 9 files have been seen to comunicate with clickeu.tractionize.com in live environments.

TCP » 37.58.71.200:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 37.58.71.200:80
client.exe (ClientWrapper)

TCP » 37.58.71.205:80
sysTPLService.exe (sysTPLService by Tlapia)

TCP » 37.58.71.205:80
h2safer-surfgy175.exe

TCP » 37.58.93.168:80
h2safer-surfgy175.exe

TCP » 37.58.93.168:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 37.58.93.169:80
sysTPLService.exe (sysTPLService by Tlapia)

TCP » 37.58.93.170:80
sysTPLService.exe (sysTPLService by Tlapia)

TCP » 37.58.93.170:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 37.58.93.170:80
FreeYouTubeToMP3Converter.exe (Free Studio by DVDVideoSoft)

TCP » 37.58.93.171:80
viewpasswordfix158.exe

TCP » 37.58.93.171:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 37.58.93.176:80
h2safer-surfgy175.exe

TCP » 37.58.93.177:80
viewpasswordfix158.exe

TCP » 37.58.93.177:80
wajaminternetenhancerapp.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.