» lp.zpdownload.info
Overview
Analysis
IPs Addresses (7)
Downloads (1)
Network (92)
Related Domains (24)

lp.zpdownload.info

Electronco Ltd

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.

Registrant:

Electronco Ltd

Registrar:

GoDaddy.com, LLC

Server location:

Arizona, United States (US)

ASN:

AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC

Root domain:

zpdownload.info

Whois:

3 zpdownload.info records

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

Adware.WebPick.Installer.I, Adware.QuickSet.Installer (M), Adware.WebPick.Installer (M), Adware (M)

100.00%

McAfee

PUP-FDX!B50872A2FFF2, PUP-FDX!BC73ABE5957E, PUP-FDX!1096899A0083, PUP-FHQ!E48F669A7F3D, PUP-FDX!B29A603FE4A0, PUP-FFQ!304C1765A86C

21.62%

Malwarebytes

PUP.Optional.Installrex, PUP.Optional.InstalleRex

21.62%

K7 AntiVirus

Unwanted-Program , Trojan

21.62%

Agnitum Outpost

PUA.Downloader, Adware.Generic

21.62%

avast!

Win32:InstalleRex-Z [PUP], Win32:InstalleRex-AI [PUP], Win32:InstalleRex-AH [PUP]

21.62%

Kaspersky

Trojan.Win32.AntiFW, not-a-virus:HEUR:Downloader.Win32.AdLoad, not-a-virus:Downloader.Win32.AdLoad

21.62%

NANO AntiVirus

Riskware.Win32.Downware.ctkpjj, Riskware.Win32.Downware.crfmiu, Riskware.Win32.Downware.crfmjd, Riskware.Win32.Downware.crdwip

21.62%

Comodo Security

Application.Win32.InstalleRex.KG

21.62%

Dr.Web

Adware.Downware.1442, Adware.Downware.1541, Adware.Downware.1719

21.62%

VIPRE Antivirus

Installerex/WebPick, Trojan.Win32.Generic, Threat.4753027

21.62%

Avira AntiVirus

TR/Rogue.9595794, APPL/InstallRex.L, ADWARE/InstallRex.Gen, Adware/Agent.310504.1, Adware/InstallRex.O, Adware/InstallRex.bza

21.62%

Sophos

InstallRex

21.62%

AhnLab V3 Security

PUP/Win32.TSULoader

21.62%

G Data

Win32.Application.InstalleRex, Trojan.Generic.10213271

21.62%

The domain lp.zpdownload.info has been seen to resolve to the following 7 IP addresses.

50.63.202.40

ip-50-63-202-40.ip.secureserver.net

June 23, 2016

104.27.164.43

February 23, 2016

104.27.165.43

February 23, 2016

108.162.194.183

(CloudFlare)

August 12, 2014

108.162.195.183

(CloudFlare)

August 12, 2014

108.162.197.41

(CloudFlare)

January 17, 2014

108.162.196.41

(CloudFlare)

January 17, 2014

File downloads found at URLs served by lp.zpdownload.info.

1 / 68 (Adware)

http://lp.zpdownload.info/.../Download.exe (c4b7e589181e5111346d3c12f4486890)

The following 92 files have been seen to comunicate with lp.zpdownload.info in live environments.

TCP » 50.63.202.40:80

googleupdate.exe13d7b73 (globalUpdate Update by globalUpdate)

TCP » 50.63.202.40:80

2c79909a-0790-4040-a366-a60e83b2a157-10.exe (MediaPlayersvideos 1.1 by Enter)

TCP » 50.63.202.40:80

mediaplayersvideos 1.1-codedownloader.exe (MediaPlayersvideos 1.1 by Enter)

TCP » 50.63.202.40:80

ge-force-codedownloader.exe (Ge-Force by iWebar)

TCP » 50.63.202.40:80

bd235320-55b3-4b4c-b65d-42e16109800c-4.exe (SavePass 1.1 by OB)

TCP » 50.63.202.40:80

{blocked}.exe (SavePass 1.1 by OB)

TCP » 50.63.202.40:80

mediaplayersvideos 1.1-codedownloader.exe (MediaPlayersvideos 1.1 by Enter)

TCP » 50.63.202.40:80

ge-force-codedownloader.exe (Ge-Force by iWebar)

TCP » 50.63.202.40:80

3a2eaa25-d3de-4ad1-a29f-9e0869efb2ec-4.exe (I - Cinema by DiscountFrenzy)

TCP » 50.63.202.40:80

fdf73203-60b1-4316-b80c-c1e80e7d73f1-4.exe (PalMall by BND)

TCP » 50.63.202.40:80

sxywu.exe (HQ-Video-Pro-2.1V26.11 by HQ-VideoV26.11)

TCP » 50.63.202.40:80

3a2eaa25-d3de-4ad1-a29f-9e0869efb2ec-11.exe (I - Cinema by DiscountFrenzy)

TCP » 50.63.202.40:80

online-guardian-v2.0.9.exe

TCP » 50.63.202.40:80

alql.exe (TotalPlusHD-3.1V25.11 by HDPlus-3.1TotalV25.11)

TCP » 50.63.202.40:80

39b0c27e-e513-4376-9d09-539622bc7eab-5.exe (Radio Canyon)

TCP » 50.63.202.40:80

i - cinema-codedownloader.exe (I - Cinema by DiscountFrenzy)

TCP » 50.63.202.40:80

UCBrowser.exe (by UCWeb)

TCP » 50.63.202.40:80

video mediaplayer-nova.exe (video MediaPlayer by enter)

TCP » 50.63.202.40:80

888a91b6-e393-40f2-87bf-50b7ae0f2354-11.exe (HQ Pro Video 1.6V27.11 by HQ VideoV27.11)

TCP » 50.63.202.40:80

39b0c27e-e513-4376-9d09-539622bc7eab-11.exe (Radio Canyon)

Latest 20 of 94 files

Related Domains

download-recovery.com

freevideosoftwaredownload.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.