home

www.baixarmusicasonline.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain www.baixarmusicasonline.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in April of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Austin, Texas within the United States which resides on the YHC Corporation network.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Texas, United States (US)

Create date:
Wednesday, April 24, 2013

Expires date:
Sunday, April 24, 2016

Updated date:
Monday, March 23, 2015

ASN:
AS40034 CONFLUENCE-NETWORK-INC - Confluence Networks Inc,VG

Root domain:
baixarmusicasonline.com

Whois:
1 baixarmusicasonline.com record

Scanner detections:
Detections  (80% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Somoto.q, PUP.Somoto.p, PUP.Grupo8Ideias
80.00%

Kaspersky
not-a-virus:AdWare.Win32.Agent, not-a-virus:Downloader.Win32.AdLoad
80.00%

Sophos
Somoto BetterInstaller, Generic PUA AD
80.00%

AVG
Generic, Downloader
80.00%

Baidu Antivirus
Adware.Win32.Agent, Adware.Win32.Somoto
80.00%

Dr.Web
Trojan.Packed.28357
60.00%

avast!
Somoto-R [PUP], Win32:Somoto-R [PUP]
60.00%

SUPERAntiSpyware
PUP.Somoto/Variant
60.00%

Clam AntiVirus
Win.Adware.Somoto
60.00%

NANO AntiVirus
Riskware.Win32.Downware.digcac
60.00%

Avira AntiVirus
APPL/Somoto.Gen2
60.00%

AhnLab V3 Security
Win-PUP/Somoto
60.00%

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen
60.00%

Trend Micro House Call
TROJ_GEN.R0C1H07K914, Suspicious_GEN.F47V0117
40.00%

Microsoft Security Essentials
Worm:Win32/NeksMiner.A
20.00%

The domain www.baixarmusicasonline.com has been seen to resolve to the following 4 IP addresses.

141.8.225.124
June 27, 2016

209.99.40.222
209-99-40-222.fwd.datafoundry.com
May 18, 2016

104.28.7.40
February 27, 2016

104.28.6.40
February 27, 2016

File downloads found at URLs served by www.baixarmusicasonline.com.

12 / 68    (Adware)
http://www.baixarmusicasonline.com/.../whitney-houston-i-look-to-you_downloader-I4n919q5B.exe  (thebigstorefrenchdvdrip2014_downloader-nduxaqqiu.exe)

13 / 68    (PUP)
http://www.baixarmusicasonline.com/.../como-hacer-una-maquina-de-dulces-gumball-machine_downloader-Qa8So9uPj.exe  (00000000)

2 / 68      (false positives)
http://www.baixarmusicasonline.com/.../vanilda-bordieri-a-pesca-play_downloader-Q9xBfPEOm.exe  (wrar420.exe)

12 / 68    (Adware)
http://www.baixarmusicasonline.com/.../musica-popular-portuguesa_downloader-I4gdVH6S4.exe  (thebigstorefrenchdvdrip2014_downloader-nduxaqqiu.exe)

13 / 68    (Adware)
http://www.baixarmusicasonline.com/.../aula-33:-arranjo-de-flores-de-tecido-para-cabelos-e_downloader-I79CHIGsy.exe  (filedownloadedsuccessfully_downloader-nfe9xgiaj.exe)

14 / 68    (Adware)
http://www.baixarmusicasonline.com/.../jade-macrae-you-make-me-weak-2004_downloader-IauLZJjXp.exe  (filedownloadedsuccessfully_downloader-n9ozn5uze.exe)

The following 47 files have been seen to comunicate with www.baixarmusicasonline.com in live environments.

TCP » 209.99.40.222:80
UCBrowser.exe (by UCWeb)

TCP » 209.99.40.222:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.222:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 209.99.40.222:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.222:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 209.99.40.222:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.222:80
hkcmd.exe (Intel Common User Interface by Intel)

TCP » 209.99.40.222:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 209.99.40.222:80
jingling.exe

TCP » 209.99.40.222:80
online-guardian-v2.0.9.exe

TCP » 209.99.40.222:80
msn.exe

TCP » 209.99.40.222:80
apptrailers.exe

TCP » 209.99.40.222:80
y03fd24.tmp

TCP » 209.99.40.222:80
lliseconc8.exe

TCP » 209.99.40.222:80
megacubo.exe (Megacubo by www.megacubo.net)

TCP » 209.99.40.222:80
messengertime.exe

TCP » 209.99.40.222:80
ContentSinder.exe (ContentSinder by ContentSinder Company)

TCP » 209.99.40.222:80
jingling.exe

TCP » 209.99.40.222:80
jingling.exe

TCP » 209.99.40.222:80
browser.exe (speed browser by Smart Applications)

 
Latest 20 of 53 files

URL:
http://www.baixarmusicasonline.com/

Title:
“Baixar Músicas Grátis - Baixar Musicas Online”

Web server:
cloudflare-nginx (PHP/5.5.28)

Facebook:
Likes:  19
Shares:  41
Comments:  1

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.