This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrant:
Elbaz Kapulsky
Registrar:
Dynadot, LLC (R259-LRMS)
Server location:
Oregon, United States (US)
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Scanner detections:
Detections (88% detected)
Scan engine
Details
Detections
avast!
Win32:MultiPlug-LT [PUP], Win32:MultiPlug-JU [PUP], Win32:Agent-AUVV [Trj], Win32:Agent-AYLT [PUP]
77.27%
Dr.Web
Trojan.Crossrider.36840, Trojan.Crossrider1.22966
72.73%
ESET NOD32
Win32/AdWare.MultiPlug.CT application
72.73%
AVG
Generic_r, Adware Generic_r.VD
68.18%
McAfee
MultiPlug-FRO, Program.MultiPlug-FRO
63.64%
Norman
Gen:Variant.Adware.Kazy.481287, Gen:Variant.Adware.MPlug.16
63.64%
Kaspersky
not-a-virus:AdWare.Win32.MultiPlug, not-a-virus:HEUR:AdWare.Win32.MultiPlug
59.09%
Emsisoft Anti-Malware
Gen:Variant.Adware.MPlug.16, Gen:Variant.Adware.Kazy.481287
50.00%
VIPRE Antivirus
Threat.4786450, Threat.5085665, Threat.5180739
40.91%
Sophos
MultiPlug, PUA 'MultiPlug' (of type Adware)
36.36%
Reason Heuristics
PUP.AlexeyKurilenko.I, PUP.WebPick, PUP.WebPick.AlexeyKurilenko (M), PUP.Bundler (M), PUP.WebPick.AlexeyKu (M)
36.36%
F-Secure
Gen:Variant.Adware.MPlug.16, Gen:Variant.Adware.Kazy
36.36%
Microsoft Security Essentials
Threat.Undefined
36.36%
Lavasoft Ad-Aware
Gen:Variant.Adware.MPlug.16, Gen:Variant.Adware.Kazy.481287
22.73%
MicroWorld eScan
Gen:Variant.Adware.MPlug.16, Gen:Variant.Adware.Kazy.481287
18.18%
The domain bestorms.info has been seen to resolve to the following 4 IP addresses.
ec2-52-24-161-49.us-west-2.compute.amazonaws.com
July 16, 2015
ec2-54-69-104-255.us-west-2.compute.amazonaws.com
May 4, 2015
File downloads found at URLs served by bestorms.info.
The following 3 files have been seen to comunicate with bestorms.info in live environments.
URL:
http://bestorms.info/
Network:
Amazon Web Services (AWS), running an EC2 instance
SSL certificate subject:
CN=sni22794.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated
SSL certificate issuer:
CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Web server:
ngx_openresty (PHP/5.4.37)