Evil network: 199.195.196.176/29 / Roman Alyabiev

199.195.196.176/29 is a small bunch of IPs hosting browser hijacker sites, belonging to Hosting Services, Inc. in Utah and suballocated to a customer.

Several domains are flagged by Google as leading to PUAs or malware [1] [2] [3] [4] [5] [6], and almost all those domains also have anonymous registrations.

However, the domain goforfiles.com does not have anonymous registration, and those details are:

Registry Registrant ID:
Registrant Name: Roman Alyabiev
Registrant Organization: Righway Technologies, Inc.
Registrant Street: 1740 H Dell Range Blvd #281
Registrant City: Cheyenne
Registrant State/Province:
Registrant Postal Code: 82009
Registrant Country: US
Registrant Phone: +1.3074590153
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: contact@goforfiles.com
Registry Admin ID: 

There is no such company as "Righway Technologies, Inc" but the name Roman Alyabiev matches the records for the IP block:

network:Network-Name:Dedicated Server
network:IP-Network:199.195.196.176/29
network:IP-Network-Block:199.195.196.176 - 199.195.196.183
network:Org-Name:Alyabiev, Roman
network:Street-Address:pr. Molodeznoi 7 kv. 101
network:City:Kemerovo
network:State:
network:Postal-Code:650044
network:Country-Code:RU

A full list of sites currently or recently hosted in this block can be found here. The domains in use for browser hijacking are:

bestfiledownload.biz
dailyfiledownload.biz
down4load.biz
down-loader.biz
esurf.biz
fansfile.biz
filedatabase.biz
gofor-files.biz
go-for-files.biz
interarchive.biz
loadarchive.biz
lucky-tab.biz
retailfile.biz
sprintload.biz
usedfile.biz
worldfiledownload.biz
yourfiledownloader.biz
archievedownload.com
down4loader.com
downweb-loader.com
express-downloader.com
express-files.com
failsmail.com
filearchieve.com
foryourwebs.com
goforfiles.com
go-for-files.com
houmpage.com
realdown4load.com
safesurfs.com
simple-files.com
smile-file.com
smile-files.com
webdown-loader.com
yfdownloader.com
yorfiled.com
yourfdownloader.com
yourfiledl.com
yourfiledownloader.com
yourfile-downloader.com
yourwebing.com
archievedownload.net
down4loading.net
down4loadist.net
foryourweb.net
goforfiles.net
gofor-files.net
lucky-tab.net
thefailsmail.net
yfdownloader.net
yourfaild.net
yourfdownloader.net
yourfiledownloader.net
yourfile-downloader.net
your-home-page.net
yourwebing.net
goforfiles.org
lucky-browse.org
yourfiledownloader.org

Blocking 199.195.196.176/29 or monitoring traffic to it might detect infected hosts, that appear to have a bunch of per-per-install crapware and other stuff installed.