home

a.developean.in

N/A

Domain Information

The domain a.developean.in registered by N/A was initially registered in July of 2014 through Webiq Domains Solutions Pvt. Ltd. (R131-AFIN). Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
Webiq Domains Solutions Pvt. Ltd. (R131-AFIN)

Server location:
Oregon, United States (US)

Create date:
Wednesday, July 16, 2014

Expires date:
Thursday, July 16, 2015

Updated date:
Monday, September 22, 2014

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
developean.in

Whois:
1 developean.in record

Google Safe Browsing:
unwanted

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

F-Secure
Gen:Variant.Adware.MPlug
20.00%

avast!
Win32:MultiPlug-ZC [PUP]
20.00%

McAfee
Program.MultiPlug-FWG
20.00%

Dr.Web
Trojan.DownLoader13.5963
20.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.MPlug.38
20.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.MPlug.38
20.00%

AVG
Adware Generic6.AKZM
20.00%

Avira AntiVirus
TR/Crypt.XPACK.Gen
20.00%

Norman
Gen:Variant.Adware.MPlug.38
20.00%

MicroWorld eScan
Gen:Variant.Adware.MPlug.38
20.00%

nProtect
Trojan-Dropper/W32.Agent.385024.CZ
20.00%

Malwarebytes
PUP.Optional.MultiPlug
20.00%

Zillya! Antivirus
Adware.MultiPlugGen.Win32.1
20.00%

K7 AntiVirus
Unwanted-Program
20.00%

The domain a.developean.in has been seen to resolve to the following 5 IP addresses.

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 16, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 16, 2015

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 16, 2015

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
June 19, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.developean.in.

1 / 68      (Malware)
http://a.developean.in/hp/?q=ibk79xWNJbwj/34567SDBUnLX/xqclj6qnM8buC1tCC yp3AMpGM2d9i3Gdq0XP/fctTzCZM9VMWnWt1Hfhb7BU9pIkPA4PCxtmyApHLpUnEyKxFeKf6C00l//muynWHYY37z15vgdZsh6Kx0YLdjJPGvCX0wsJM4WwGz QvdI6Q4Eg CTFlSAWt/0tKHEbCZicAwz3IQl4t3sW0TWs9GCjo 9SM2ZnVwIQC9L6mc3/FHBW6WRMfTHRcs72AJjULM9Rnelvp7e8ry8Mag/o zDbAAuKk4kpd7TNuWDZmlAURW7YBGyQIfGZoKJjYAlIIZapnJhkJU9Qr2syDQ hB/Vnyz5KWY5vpBo dL/IZOuXFOLHb6eiK ZebnCBomJLo0LrMh/kmwDkYw8QIW6NvC8Q9oyswVmxpCu XPiYqPuFCy/HLnBDvZNJnbCqI7VV7dGLjwxyA1FpAt1E7spvo96wa7vj 32IuPsCbRfucvpILOyNmUQsyZvgiHnjvBN7TJm8J2pQv5H5JfcyY6m0D1VhHGkDh1Yx8J smAgZ18eHI5rRFt6HYnbGIe4 XYtLlAwlIG/.../e1x 3zhdb8GMvy1LOAIZBaH0OpehnXbfPJS8zmIZLrkSexeTp8xTRdTegJF&external_id=1430166003765419578&uuid=ubbe8MmGTO0zzxR52Q54QZBl6AhJ8cFgj4VTuh1xhfR36ZBukEmWyucJbFjq5N2b5bglWwBFh1s8fpZQfMQOJFyEWBIgCXV3JWfEoa3sOIHq5sCZMVoXriErqNlhn9zUcyKKzQkeuxjzyRsTVl2e2PAFgePMXAWHNsEDegF3dGx1MRrhB2WXT  (flvplayer4free.exe)

1 / 68      (Malware)
http://a.developean.in/v24387?self_redirect=0&product_name=piano guys beethovens 5 secrets&filesize=&product_title=piano guys beethovens 5 secrets&installer_file_name=piano guys beethovens 5 secrets&product_file_name=piano guys beethovens 5 secrets.mp3&product_download_url=http://.../fil.php?s=srv0007&id=687474703a2f2f7777772e6d7033706f69736b2e6e65742f646c2f3934323233312d7069616e6f2d677579732d62656574686f76656e732d352d736563726574732d287777772e6d7033706f69736b2e6e6574292e6d70332f53495a4535323731303039&t=Piano Guys Beethovens 5 Secrets.mp3&tm=true&dl=1  (piano guys beethovens 5 secrets.exe)

1 / 68      (Malware)
http://a.developean.in/v24377?self_redirect=0&product_name=Garry's Mod Full Version&filesize=798kB&filesizeBytes=798461&product_title=phpnuke.org - Garry's Mod Full Version&installer_file_name=garry-s-mod-full-version&product_file_name=4000&product_download_url=http://store.steampowered.com/app/4000&icon=http://media.phpnuke.org/000/981/.../e53_6cd_100_70-garry-s-mod.jpg  (garry-s-mod-full-version.exe)

1 / 68      (Malware)
http://a.developean.in/hp/?q=W3BQcm2AUi9PAztvqo1LYWrZoYAQjhZu2qE7x9cgv5ImFIMCfiJKAzVUJOuGJfj0NEzoCGZYotRZ0n uVwAoHv8HOLSTxvhPO 0BIZ19R2iPtUnAdZ I1t2scUFsajW2cYnyKp1KAA5KOF53Wi6gPlKxC3HEs0Atd7UjtuYz4BxYDdnlnHPcFfmUvsGQJGtzy8UvMQAZrXGHUGz7uKFPJ aX5MP5Y6AYFTtLe7LCgbn4/EjXqscdxO9Ajal 4dgsN2H52UcPTkx5MgJSE8APsrKcH Uyd5BMU7qr50gf1Dg1VCSgxN/Kw /Kfa1AFBgHxxEjtQ0HN/K7mA3L6v4xUiHwhcD2ZUGIz34leYnzvWc0nOgy5wgxazTL9kMnqYxL/8Oo9yUvYfaMZzSaBZa372zOpZG9PMtwFm4apXGA5iCm7GoOuc0UIiNHGR62yKbh93utT61RptdvrttS8pTaT6ojM9WFtDL2RiB8dzn80dhpeTLg9RxZs9GwFFy4Nv6GZI5cWs230RWDVIaI44DaR6jb2Uhvt jsxgevGpohxWnsbf1JszCssDuOavgARoIBgKsCkEclhnXgwyeqdBo/RPodrPLvw1XEM2Bkl5dhlJRuGM8xlzcuGXEkkalW/F5QMBT1q5Css9K184vtb4HRVbw9sFfMtPZlhQZ/pSvoS/Hv12w 6NrL3nfO9EjFSVF2mje9QnZfpqt6JdoBWVKYqlozfxgqpxrhSehoDRauWwH9Xcuv112twyS0qV7fOpXIuoCWnGQgIlogLlsftZJMBgOhXvuA7YhsFlpGjj SAGf99mdmJQLM7mARjQtsqYxww985wRTuCfZ vpq0lbhzvlCbpSsabvo74iwmHU8G5FWb7rNv7owSyXsHoYfsohZz6ny9hiENv5TGLNZ6/w7dxsN31k/.../zNUcjCoNOq1VM Bfjw828xlzc  (iron man 2 pc game _ download full version pc games for free.exe)

25 / 68    (PUP)
http://a.developean.in/hp/?q=wu6N1xXVdIsPDABCDWPQI7NY8bjv7sfZj3QOaPg7/6kSGu8yaIMWQrLlHEr60I2xa47L7aabrT4MiwEOhEpGMBKHUbria Fa5Q1H HEOYJNvTgoTzgYT2riqTo0eLcfxBppJoaah uQQFqOfejWlXHGOHVpyYuIYvudPm6oIaQ0 PcywMPcNda0xUAZXfJojdLEzK3evtRRejG //pCDBl3Z2LrpB9YNckiaSfcxMer625/CIGB81evhXCh66x7SMBHJ51bbejCKf2HKIP9q4TcfAQEOGMlwulDlSWvNZ6TqVT69H6DA8npLkHJF tOtIf D6gn8gTGPs9w2ZvK9VEm0sTpukJxbD PP9YJAAfhUxecU6rve1xq FPiiETW3JE9acLtrKsHsVQlBUt073nYxl6LVHV/5x0sZK4MY12zPql0AeUFxzcBnVbmSRwu6wDiyeKYfnbwGap9iyjB02C2GeXg YUCmuK4KMFEP3dmbBTvoDx23ADbfINH17b4yRNiVwlNmUAdhAnBwDqBYBQaODiJxpX4WeOUXjjV5cgLFv7 2TK3xtAs0JAAci1JpjVmfvjGj9QA5m4RKcbLnCm/v9eISorK15mjv7s512dmhy8H1DGCbPzURzY0XA9ckIfMBXOH8 PNpDIV3KDkGOPe29idRBioz2EeNMKrvRLCzz4UvA5NmUEIfXA0ZTT48K63rGG0uz40FM9RCTrk3MIeQoZEVWUIjvcSxTskqhgKxfgxeUjn8kKLefr egZEPBCU1Fb2difX2/.../d4lnTbA9cGYdzWjmDrhjjjmzlHIiirmjuUs4VXJCm2TVwUhZzALe2Sv6qU11VuN5aK3dlBdG7&external_id=1430159909433477577&uuid=XB969oaThAelexi4q6hVdQ0846K0Wda  (imo free video calls and chat for pc.exe)

The following 5 files have been seen to comunicate with a.developean.in in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.69.228.231:80
download.exe

URL:
http://a.developean.in/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.