home

prepareupdate.clickonupdate.download

Domain Information

Server location:
Ile-De-France, France (FR)

ASN:
AS12876 AS12876 ONLINE S.A.S., FR

Root domain:
clickonupdate.download

Scanner detections:
Detections  (71% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.OOOKodIn.Installer (M), PUP.DigitalZ.Installer (M)
71.43%

ESET NOD32
MSIL/TrojanDownloader.Adload.BA trojan, MSIL/TrojanDownloader.Adload.AZ trojan
28.57%

The domain prepareupdate.clickonupdate.download has been seen to resolve to the following IP address.

163.172.197.123
163-172-197-123.rev.poneytelecom.eu
May 27, 2016

File downloads found at URLs served by prepareupdate.clickonupdate.download.

1 / 68      (PUP)
http://prepareupdate.clickonupdate.download/dl.php?asdk=ww0ZyS3LXwXbcfAyYDv7Oa6aYcM6SogE5Pl-haYHK6c.&cid=[CLICK_ID]&sub=[3]&conversion_id=14629667733960&app_id=4&lp_id=1618&v=tribat&stub_id=305&v_id=vvjgJpSgnTaPnloSRNgNFEDSdSpH1iba8aBymJeo7AY.&lpp=*-*-*  (flash_player_setup.exe)

1 / 68      (PUP)
http://prepareupdate.clickonupdate.download/dl.php?asdk=49vJSJARXt4sZRPAxwzgT-_PZCWXDaXSgBtJNjNyL_U.&sub=425606&cid=5155176647&conversion_id=14630031230922&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=m_XljjFQ8g2Af0kV0sPuq0q0ZhaYw9C5IfQre80wnJ4.&lpp=w*-*-*  (flash_player_setup.exe)

1 / 68      (PUP)
http://prepareupdate.clickonupdate.download/dl.php?jasfh=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=us5cftt0oyxf81qa9aqb&subid=2279&conversion_id=14627244424848&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=rC6fGzvI6z5Txjt-O6tTnDB--_g-lCDfmNOx7AxMFkA.&lpp=*-*-*  (flash_player_setup.exe)

1 / 68      (PUP)
http://prepareupdate.clickonupdate.download/dl.php?cfgyh=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=eu17qe8xa3d4lu9ancfi&subid=2279&conversion_id=14625372158758&app_id=4&lp_id=1590&v=tribat&stub_id=305&v_id=OhF0kQWbvfGhwku4SBefDXatgRqPP01IwuQXFbSKpOc.&lpp=w10*-*-*  (flash_player_setup.exe)

1 / 68      (PUP)
http://prepareupdate.clickonupdate.download/dl.php?jasfh=9Iew1aL_t8TO8-yJ2i4KbqnNa5I5mEDs_XUGlH-hKWY.&cid=TJ_5Rkg-1gS6hEIa_NZnHKdaEgAdBUo7LSFHDwuXd2wzm1GGfk9AePEPvNwchadF8wvT6wmM67mxsWviWgBXcAAaRvAqoECszsNKUyKVTnYlqcR0fY4Q&qs1=&conversion_id=14627391100636&app_id=100&lp_id=1514&v=tribat&stub_id=305&v_id=JH5IhGooEI8cI1In8OOg-JYaXoewR82E3iKU3o0uh0w.&lpp=*-*-*  (flash_player_setup.exe)

1 / 68      (inconclusive)
http://prepareupdate.clickonupdate.download/dl.php?gcyrt=S_jTzbaCeqY-7A67ZDBHFSrO_sjyRBx58EOys_NsZ9I.&cid=NVekXEoIB7UUH4m0MXB3YDzDIA0qXqyXJ4gyqorxRnOmyO2sXQqaOdTLjUwyafLhalwF4hM2yJ0EqUL3ZhBXC0SABOFIn7hJy2rY9CccVMPQOa-Uvn&qs1=&conversion_id=14624738603993&app_id=4&lp_id=1513&v=tribat&stub_id=305&v_id=wU06Eo3vaR8FXcjUQt8OEyhDcvhVeUOyKMsFGyCzsdg.&lpp=*-*-*  (flash_player_setup.exe)

1 / 68      (inconclusive)
http://prepareupdate.clickonupdate.download/dl.php?gcyrt=S_jTzbaCeqY-7A67ZDBHFSrO_sjyRBx58EOys_NsZ9I.&cid=QDPzdW-df8Cja_NVKF1r-MGGpamZ8znfTMjGB21sEV51OHuyJgNXTMI2uLIlrAf7wmD6Z8T3syHrVl6TcJfqLnN9SjnKVPoWLu999Wpr7MCcbr4a2ksFn&qs1=&conversion_id=14624853582325&app_id=4&lp_id=1509&v=tribat&stub_id=305&v_id=HXZz1Frv4ZQScvd5f_j6E557mUP3gzlksyA59HLDUfs.&lpp=*-*-*  (flash_player_setup.exe)

1 / 68      (PUP)
http://prepareupdate.clickonupdate.download/dl.php?gcyrt=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=eu4cl3c0bkn8fbe2cd8a&subid=2279&conversion_id=14624618915104&app_id=129&lp_id=1590&v=icoin&stub_id=293&v_id=_Eojgmdu-6a6ztxemv9GhBaOGUORp05GEUZlDxnZ0qQ.&lpp=w10*-*-*  (adobe_flashplayer.exe)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.