home

a.gurucustomsafe.net

Robert Fedusku

Domain Information

The domain a.gurucustomsafe.net registered by Robert Fedusku was initially registered in May of 2015 through ONLINENIC, INC.. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
ONLINENIC, INC.

Server location:
Oregon, United States (US)

Create date:
Monday, May 11, 2015

Expires date:
Wednesday, May 11, 2016

Updated date:
Tuesday, May 12, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
gurucustomsafe.net

Whois:
1 gurucustomsafe.net record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

The domain a.gurucustomsafe.net has been seen to resolve to the following 4 IP addresses.

141.8.226.19
May 28, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 16, 2015

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 16, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 16, 2015

File downloads found at URLs served by a.gurucustomsafe.net.

1 / 68      (Malware)
http://a.gurucustomsafe.net/hp/?q=t/FigVDJqmcTTVNPRJz0IC40Jgfym/ZsukLo5wDn1mzNCegEwe3S z2XsFEIkEMbkwDLW7aNosbfdflU1B/3p9CY TGO82 ygWlESX57XT2f10jY2 kdq/HlHGvvdv25JI1qSczvAbcen/8B2I1yIko0mAU2Nl8wVNgwr/.../gTdPxC0xa7jwCvaPkm  (downloadfile.exe)

1 / 68      (Malware)
http://a.gurucustomsafe.net/hp/?q=FxYGAS39IquHIcdefAZ9tsKPycd3H WP9nLJWMiGf3uc foRvAeROBrFv0u174JaLaglNM9mno/6 02Ss4wNBjg2lxtPLQ7VdQnH46RnwHJXzGfxFf4 D1vt2jZLC30QhYO4hyJcX3HIdTzBKyaRnhgzPMTFZYzj54BmPjou4SE36dYzxa yAepBce2Nr6ZIyqhiMPjTPNtOJVFOD/.../dFcgxfCZSXSb7PerijHpETrNdHc9cwqQ7nEgkE9vrDqb17I  (simpleuniplayer.exe)

1 / 68      (Malware)
http://a.gurucustomsafe.net/hp/?q=npjAtLidsUlqu23456YBtiSfHa9oAjhd7pVjSVb4KGaIcwjDcJWejo3MmGueHfcU4ulPrjr4GHPNdA5GDMer/Jc80rWIvR3YiWlWLy bSVCqV98qdoK2EFqkWMneCiERa2IUvI9JgPkCLimB6DWVBISE6EyEv1KE5rHIn9V10nW6xj9wMyrvAbtKS5byaK2UnwsFqvH9MGqjtbi3EBTlVNPvaHcs9AphEFbN6qfsczTWF1iCMgDWd0iDdpyB6RJlbqgXuqdw6IUomnxvzb9dfWVS g7 KvyELa4nVeCD6o5gf3vBQJxiWkgLNnMtCq3t7VaTw42EpJFG9lcZLRGKG CSW5AQEfuwl9htSv29ITEHwUypbKuio/Q/3kwzxbPqN6xCCLDuzGOL Wt/rGqCUCCrg65Pw3CsKorCuUp8EiNIBokdj5r3EeS2QemR04MfPUruReFg2j5hlRP2KbhwTPHINRZyUBw8UcoStkAXPJFgcIEQyCR1oFqiXxhczKVnnzDp5EKLsu42 rI2XT/PX0bZzHMD 3Q/.../oOARO8NVJAZo5BosyqaspGy6iXw3S6atPpI1dELW57qK3hESnkgGRH4lqg4QAzt0dl5HCvZdvynoqcBGdkTI3Xr47OII0PU8tftb7DMiIOYlNEcScNOf5shK2GYKqy0hdIJLra51Rth7JEf 5glt1hqNZzlq fzCRhO2XZVokcl YG4XyUDffMFuqOHdeCDVRWKUGhu6MuULrv1tH9Is L  (download.exe)

The following 2 files have been seen to comunicate with a.gurucustomsafe.net in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

URL:
http://a.gurucustomsafe.net/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.