home

cfs.ezdownloadpro.info

Rafael Leviev  (via a Proxy Registrant)

Domain Information

The domain cfs.ezdownloadpro.info is registered by proxy through Active Registrar, Inc. (R469-LRMS). Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter. The domain is associated with the publisher Rafael Leviev who is located in Shfela, Israel.
Registrar:
Active Registrar, Inc. (R469-LRMS)

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
ezdownloadpro.info

Whois:
1 ezdownloadpro.info record

Google Safe Browsing:
unwanted

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

The domain cfs.ezdownloadpro.info has been seen to resolve to the following 4 IP addresses.

185.53.177.6
July 3, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
August 16, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
August 16, 2015

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
August 16, 2015

File downloads found at URLs served by cfs.ezdownloadpro.info.

1 / 68      (Malware)
http://cfs.ezdownloadpro.info/hp/?q=FybWS3ifMUuV ABCDWPRLajtZ2DJCv9gC cN8zVvVer8Uj 1yAzhH177u59Z3Lb4Uhv5J6cAJvgqo58JWSQmkmaB Musp ySV7PnZ3xsZsA3sZT/wraQZJ3ptTFTCXkQrPHTaAZinyYAVfRCSf5v7NRFV4As2daSQ4S7zh1L99/mbUz9V9SIiD7riutSU4OPeNXHAU Tzhoj6gvZluc4s9Jk1kufrZzOM2wGpBD73OU 5DqwD QHZTrGULHveT6PaQu1/RN9DjqPSGQ5wJzRgCO7MQbR9TDtFOkSgv6TRnLS3wzYmCyAb8wZnvWioO04b6MRM6n6qMDZyMPAnHOmegLeZ5krJgL5VIUYzr EzDZX5UXBkHUpGVLVkpRH9EoY9G2n3fG1TpuuKdkMM9b2CvcMSVdou9Xj jFXIjXmAJRaYAmxXyWpWfMkH5b0WayKmhHT2uaTKwYjA4Vp3lYj6euOemx/57lCfSWs5yWMePNiIo8sHk/GVSoBa47udU7kdBEcapvouPlJENum/0vyCtTXm9wdPGjDN/CpzHCbQ3AAmkrmScBd/Dl2S8qeLcsl3TEclMixHa3Eaq/.../hCTkb&external_id=1424714158381233017&uuid=Ocu4cDf8e59gJf8hgevJOpVpVqMnaWyxfnhorLN3OnCWYstIqcwWJvtv6cGSB1yCghN5betcEcKLvzhRo01lXd2ymED9dq5K7C4xqa2bPuma0mUQbnZEIgsmopqQ6PxiVHPACpZIj4Kr7QxQofGGq3Gvq060GCtPklo9UqD2ohTieMvG0juglpOHicChYgMh4JHgbCBDTPyYh2mKnqbe7MWbB67V4w3ch19hFHlAo24hMVh9sFd8VF2p1qBOuXtoRR85SBqogBQvg4b6KP9GfE9Ur  (cda to mp3 converter.exe)

1 / 68      (Malware)
http://cfs.ezdownloadpro.info/hp/?q=mB6N1HeW HvyqdefABTXGnJvq1CQ nZAbopHP1q2RGw2L1dMCtlOUnbZwAPMzc0Gf4juXOjJ0OiqeHnIDg/JRmdlbBJpDKO6X4ge/NTgL7b5rpipWd/dNzIDjiGNw3/H7UDvmlNxTffuAXpfTafi OYFaaP7cEMKq1YRoOn8/4dl tWgKRRgw0BrqivdBoQzD0UZvKOQAZn8T1D jXo/ogJ30R85MSR7U3LnoNB0TeHXqCcKxUq2sZom6aowa1axTi7HxHs/ewHkN BRJwxpVr82ca5zgVqZepR9ESEukGPzqTPL uZ35Gx6SiI7CW8A/QJwAmntEEC9DT3U623gZtlX9vUY6woj4i4BvmIYtRymqVE0M8bZJsqFmAfGuhCE6T8UxNQN22bu0XEfmgosLICTxXoDOpV5sGoFqF6Wm QOx1ZoX3x616U4XPAv3v7YUF6n7AwExkTuy7YuHim4JOfIiQtHpu/4QnAZJijHJxsAzeq64T/l4zUqMY 1niny8V8I4ftKxOic46/iKtFHbX6iDmTxZCprOSEnLo1K4eaOu7X1s/.../xHQ5fHSonfeAEPQIgMTwW2jvRlpjAUTQoU YuGuJ&external_id=1424727408226852845&uuid=OnVTWcTmiOSEYzJg8G4GoXgavyDn6UJnmXGlb7lm0vEz3m3XgRR4o92gi7OgWJNIQe1CkzdMGg1VevRBa5VOnS70s1vNZPpTyZpzn3GDo82Ip7MNWZvznWJCnG9fOEVI9nCnWcvbEIWbNceR4O1PBsYN1wad8eAm7PwpNsy3WvBYVzBX2sUt5xYT7rNep2zHCechveg51BhWLr0U0SputYDxUQLxQTWYVdR9OLTirlll0ok3PdTOC5oWS7XBpiNOCGfZyi988fURwyeMzAUmLd9HFPhpiYgydtbplUwKFQNEkVKANxVqkUiWBICpyNJ0Kg  (nexus 2 full setup.exe)

The following 2 files have been seen to comunicate with cfs.ezdownloadpro.info in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

URL:
http://cfs.ezdownloadpro.info/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.