The domain mydl.hexaweb.net is registered by proxy through ENOM, INC. and was originally registered in April of 2011. Currently this domain has been known to host various forms of malware. The hosted servers are located in Roubaix, Nord-Pas-De-Calais within France which resides on the RIPE Network Coordination Centre network.
Registrant:
WHOISGUARD, INC.
Server location:
Nord-Pas-De-Calais, France (FR)
Create date:
Saturday, April 2, 2011
Expires date:
Thursday, April 2, 2020
Updated date:
Thursday, October 17, 2013
ASN:
AS16276 OVH OVH SAS,FR
Scanner detections:
Malware distribution (85% detected)
Scan engine
Details
Detections
VIPRE Antivirus
Trojan.Win32.Generic.pak!cobra, Threat.4657539
61.54%
Vba32 AntiVirus
TrojanDropper.Dapato, suspected of Trojan.Downloader.gen.h
61.54%
McAfee
Artemis!A942B3D27808, Artemis!C97614C14996, RDN/Downloader.a!tx, Artemis!D2CF23C94B75, RDN/Generic.bfr!hw, Artemis!FF8DA545FD18
53.85%
Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Solimba.Bechiro (M)
46.15%
Trend Micro House Call
TROJ_GEN.R0CBH07FT14, Suspicious_GEN.F47V0616, TROJ_GEN.R047C0EL714, TROJ_GEN.R047C0EJT14, TROJ_GEN.R0C1H05A215
46.15%
Baidu Antivirus
Trojan.Win32.Dapato, Hacktool.Win32.Downloader, Trojan.Win32.Badur, Hacktool.Win32.Agent
46.15%
Qihoo 360 Security
Win32/Trojan.Dropper.a9d, HEUR/QVM42.0.Malware.Gen, HEUR/Malware.QVM20.Gen
46.15%
K7 AntiVirus
Riskware , Trojan-Downloader
38.46%
Kaspersky
Trojan-Dropper.Win32.Dapato, UDS:DangerousObject.Multi.Generic, Trojan.Win32.Badur
38.46%
Sophos
Mal/Generic-S, Generic PUA EL, Generic PUA KL
38.46%
Malwarebytes
Trojan.Downloader.Agent
38.46%
avast!
Win32:Dropper-gen [Drp], Win32:Malware-gen
30.77%
Agnitum Outpost
Trojan.Agent
23.08%
Quick Heal
TrojanDropper.Dapato.r5
23.08%
NANO AntiVirus
Trojan.Win32.Blocker.dbnfux
23.08%
The domain mydl.hexaweb.net has been seen to resolve to the following 3 IP addresses.
ns366973.ip-94-23-21.eu
April 6, 2016
ns338802.ip-178-33-228.eu
May 5, 2015
ip-169-179-143-79.static.contabo.net
May 31, 2014
File downloads found at URLs served by mydl.hexaweb.net.
URL:
http://mydl.hexaweb.net/
Web server:
Apache (PHP/5.5.33)