home

afs.ezdownloadpro.info

Rafael Leviev  (via a Proxy Registrant)

Domain Information

The domain afs.ezdownloadpro.info is registered by proxy through Active Registrar, Inc. (R469-LRMS). Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter. The domain is associated with the publisher Rafael Leviev who is located in Shfela, Israel.
Registrar:
Active Registrar, Inc. (R469-LRMS)

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
ezdownloadpro.info

Whois:
1 ezdownloadpro.info record

Google Safe Browsing:
unwanted

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

The domain afs.ezdownloadpro.info has been seen to resolve to the following 5 IP addresses.

185.53.177.6
July 17, 2016

185.53.177.10
June 4, 2016

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 23, 2015

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 23, 2015

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 23, 2015

File downloads found at URLs served by afs.ezdownloadpro.info.

1 / 68      (Malware)
http://afs.ezdownloadpro.info/hp/?q=GcdSMXni1ukzCDWYSULNlpTyTYcAaOnxmMDRE8/Kky2kbWptKDhw9C08vuRx3Qx acJ16VZZCJsydm6sH0lxUa0EL1z flBo0zePqYGtGbkoSUGGsTnNK5dGsOgKtySvj6 rXJn84r74dqu64b070RZb99Yq1AAC/G2ekZJdDjMtBp/psMOQwipGT6hoNuBVWYnxx/f/DqdBd9WEGUxqiDFVndqKlgRgiZqM5v776RqfBSqiQXzYVLNjtStBb5H4ZPTzDtnFoiEYTPJclz1xk2cKvl3eSfaYgI3ixA/VNsEPcU XNlIfvfyyfaoy7136wwjbC/yBEx/WPY7T/5h6X3P9V2S/QXKxPm0juEACArH4vsMQLY24oj QTOR9 3sxgPD8nf/LrhsydmBikO4mDmxcFtoNMQ14jn1RettMbuSNAXrG0IHtfgYYS9qXQSYcu HKBJOMALv7BM5bo43gPwQP BgdcKtNrPHAVF7iiMZB8Is2mgaTkHL4wbS0WPrKkyawaMoWUyFMm QYu6 OtqJ6MU6u77/HNlwkpM0750pmnJy3C3zTx/y2vpQh3D5R/B4zYw6o3DA2JYbIv5ePdi9i3ZQOVTSuvtOJFu7ST60Ggcw6i31cU6W2/Jy6gIWllSzjDiL9uwEBW8tSwXnLZk/3AQ8ULlHRKdb6IH/3fU4tsOtUpsUElSrZRYBh66Ua84LhWkmb7dAegtoByn sGaa49MvH/NW/mg1YsLoOYSX K8/Klz1x7F7YWa2cm QYw0E/SK2wNgjhQYjRNliJddr750qil92 JUT8c/ycmCZAhWd9/BAGfzF1Qi51y0FSiOBqVuOAVnQfW/PhSmQLzlIYPFQYCTG6YC/MSXepX8/GhP4gdknVwNFn32rae/XxWtuefE3eMHabv/.../HprH  (karaoke il pi grande spettacolo dopo il big beg.mp3.exe)

1 / 68      (Malware)
http://afs.ezdownloadpro.info/hp/?q=ZxdSMS3BGNWxwjlhab7xHdgtMlit4zlpGCE4 s nOwUXx815pj1xpTrMDfrAInbXunn /.../rmbiC52OFXpopQDnzqVH&external_id=1424697351934916189&uuid=rp6z5AOFkkLUiJYug4G8dtq0YDkgWLkquUkICA3Vzf5KVd1Wd3D1E376dtDj1TksevpwNSXOfqqTLTxm6mxNjUP8nFmAFzihtiNVDHEUXcbKkUppTYcAWtuXIx9IkBFZtdqpzfLE2lkyE8kw4rQmJUnCI9XJfuT2ZvouSDWQxTrOxLhGF3M9C4rg350stNUS00XpOUZ6h6vGBvlMKcWVYe1flnLpehgeGC6n29dbmln5K6eogZotfTClbMkc8OtaONA4WbzC5vD8aFVOXNvPXQTUHzDbc58pQsqvgMr1aHoilIbPmfgNqo1MUgzlpnvBdU4jvC2zMX9kaTzStcryIvJUOk82HBpwwXPBYMqW01Vtg7CQcXmChj4l4M1UhQBEckyjAJvzBrfsnMfKXtvj5lnVek4p2jA6pLWNjL8UvXQJFxQjmbhp0DOwEdR4Ecp0iOOuzJqKUAlnFLtb3kl7FW1W3XMmZfXbcsBeFyMaqLZD7HsVguvvJYNa5RbzrwNurB61P  (whatsapp.exe)

1 / 68      (Malware)
http://afs.ezdownloadpro.info/hp/?q=IW7P2vzldrQC/XZTVNGrVPy3bWLvC8 4YUD2aGWkvfI5/1pxUsitTzWlWVLPkwcZy7QqDZWbTuQ1Qvdysij0bSsHme0JdRnsCS/vSMogDclWdAOZF2Af04Hfmm 4PnHZJRH3sYvDVAZsgv0WsXPjHD4BxAsFUPN61TJZ THUci9dBMdlaSwlnT oySad5obf2LdfnMYBqcP5mC9UEswFSl5iQqBX5VtSlZFCfPr40jYytNsZ D5iSaBUowzihbk4PpoBEu2SWOH4ikQ553K rbf3F6BonkRcyOLnLY48m9GIBZUd9UGrM3aO4HFXB54p2Ikc5Xa8CnOQenSsx0f90dLbdCVpd3ZgboJcjLzMCi8sWxCv5LesEjzoZhVxdeefd42sjRAsxMNZqN wK7sQ7CgA5sNVbQnTPv62otBeosFJzuq4gKZtJI0WWUkR0V dSguqOe24O2rPeNmRRasaafS9NzmDjUM4CntZQ4CHaYxRiQqSyxIlnx4siw/FbHL3ajHG4ElseA 6elYUCk7ot6qTx3pqkqXqva86SKrr7pucHLPnuqzRuR/.../IkHSdcT6l0l dJ05F4sVZy864ywFSCmQqk91Y8cJgzRo8ZxUYbm3ndLUnO6WL5&external_id=1424697704431306054&uuid=JIhAM4tXXv2VQo7eVgwNwVAHFmTOsuRApNTA4qPPFFxcgNqCRhtzAXeIDWbesGjTyMeoAYFuE6X2hjRa1HiEuRYS4KfNpQc2JhSwK6uMJoe65rMTs7tIJqvou6sU3ghVQO68wMcaMsnXwmcMNXg0oE4NIflsKNJ8YZZdI1ODFIsVve2GMuKIWSMFwI9YPOjhIwVxNQ2WTyBcbGYwQvamHYKz4hRx7Pjob33pAdvOVpZYlhfZhTHvRkqZuwlf43ECtJCZzuhwlPtkm2XkhEI6fuovze7Er  (anti-keylogger.exe)

The following 2 files have been seen to comunicate with afs.ezdownloadpro.info in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

URL:
http://afs.ezdownloadpro.info/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.