home

web3.secretsite.com

Stanley Pace

Domain Information

The domain web3.secretsite.com registered by Stanley Pace was initially registered in June of 2014 through FABULOUS.COM PTY LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Hollywood, Florida within the United States which resides on the Prolexic Technologies, Inc. network.
Registrar:
FABULOUS.COM PTY LTD.

Server location:
Florida, United States (US)

Create date:
Thursday, June 12, 2014

Expires date:
Sunday, June 12, 2016

Updated date:
Friday, August 22, 2014

ASN:
AS32787 PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK - Prolexic Technologies, Inc.,US

Root domain:
secretsite.com

Whois:
1 secretsite.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.TINYINSTALLER.F, PUP.PremiumInstaller.Q, PUP.Adknowledge.PremiumInstaller (M), PUP.Adknowledge.OptimumI.Bundler (M)
100.00%

avast!
IBryte-BY [PUP], Win32:IBryte-BY [PUP], Installer-K [PUP]
100.00%

Dr.Web
Adware.Downware.1576, Adware.Downware.1554, Trojan.Packed.25254, Adware.Downware.1377, Adware.Downware.1479
100.00%

Avira AntiVirus
Adware/iBryte.djc, Adware/iBryte.Z.1
100.00%

AhnLab V3 Security
PUP/Win32.IBryte, Adware/Win32.IBryte
100.00%

Vba32 AntiVirus
SScope.Malware-Cryptor.iBryte, BScope.Malware-Cryptor.iBryte
100.00%

Rising Antivirus
PE:Trojan.Injector!1.9C6C, PE:Malware.iBryte!6.45
100.00%

AVG
Adware Skodna.Generic.APB, Adware Generic5
100.00%

nProtect
Trojan-Clicker/W32.iBryte.1791272, Trojan-Clicker/W32.iBryte.1064088
100.00%

Qihoo 360 Security
Malware.QVM10.Gen
100.00%

IKARUS anti.virus
PUA.TinyInstaller, PUP.PremiumInstaller
100.00%

Malwarebytes
PUP.Optional.OptimumInstaller.A, PUP.Optional.IBryte.A
83.33%

Agnitum Outpost
Trojan.Buzus
83.33%

Kaspersky
not-a-virus:AdWare.Win32.iBryte
83.33%

NANO AntiVirus
Riskware.Win32.IBryte.cspzhi, Trojan.Win32.Downware.cssqfh
83.33%

The domain web3.secretsite.com has been seen to resolve to the following IP address.

72.52.4.119
unknown.prolexic.com
September 7, 2014

File downloads found at URLs served by web3.secretsite.com.

1 / 68      (Adware)
http://web3.secretsite.com/.../base.php?c=3&key=489a25c90d4933038615d10b4537ccf4&aff=73232-20376-171869-4600&cam=Download2&kw=download  (flash_player_pro.exe)

1 / 68      (Adware)
http://web3.secretsite.com/.../base.php?c=3&key=489a25c90d4933038615d10b4537ccf4&aff=73232-27681-107443-1544&cam=Download2&kw=download  (flash_player_pro.exe)

25 / 68    (Adware)
http://web3.secretsite.com/.../base.php?c=3&key=489a25c90d4933038615d10b4537ccf4&aff=71603-1827873_0&cam=Download2&kw=window  (flash_player_pro.exe)

29 / 68    (Adware)
http://web3.secretsite.com/securedownload.php?subid=gofree_fpp52yt4f8c_3_582716  (setup.exe)

29 / 68    (Adware)
http://web3.secretsite.com/securedownload.php?subid=gofree_fpp52yt4f8c_3_582716  (setup.exe)

68 / 68    (Adware)
http://web3.secretsite.com/securedownload.php?subid=gofree_fpp52yt4f8c_3_582694  (setup.exe)

The following 28 files have been seen to comunicate with web3.secretsite.com in live environments.

TCP » 72.52.4.119:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 72.52.4.119:80
TBNotifier.exe (Ask TBNotifier by APN)

TCP » 72.52.4.119:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 72.52.4.119:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 72.52.4.119:80
online-guardian-v2.0.9.exe

TCP » 72.52.4.119:80
updat.exe

TCP » 72.52.4.119:80
uran.exe (Uran by uCoz Media and Chromium Authors)

TCP » 72.52.4.119:80
autorun.exe (SoftFullDownload.blogspot.com)

TCP » 72.52.4.119:80
hbpzabffmyx.exe

TCP » 72.52.4.119:80
cpx.exe (Google Embedded Application)

TCP » 72.52.4.119:80
jingling.exe

TCP » 72.52.4.119:80
xkyuizxr.exe

TCP » 72.52.4.119:25
wrk.exe

TCP » 72.52.4.119:25
www.exe

TCP » 72.52.4.119:80
pbiiuvda.exe

TCP » 72.52.4.119:80
swlynnf.exe

TCP » 72.52.4.119:80
websiterecommendation_2_2.crx

TCP » 72.52.4.119:80
fanaticoonline.crx

TCP » 72.52.4.119:25
tiddiszagtor.exe (Faster Aids Manager by XIGMATEK)

TCP » 72.52.4.119:326
tgvbgq.exe

 
Latest 20 of 33 files

URL:
http://web3.secretsite.com/

Title:
“secretsite.com -&nbspThis website is for sale! -&nbspsecretsite Resources and Information.”

Description:
“This”

Web server:
Apache/2.2.22 (Debian)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.