ip1.installpack.net

WHOISGUARD, INC.  (Proxy Registrant)

Domain Information

The domain ip1.installpack.net is registered by proxy through ENOM, INC. and was originally registered in July of 2015. Currently this domain has been known to host various forms of malware. The hosted servers are located in Gunzenhausen, Bayern within Germany which resides on the RIPE Network Coordination Centre network.
Registrar:
ENOM, INC.

Server location:
Bayern, Germany (DE)

Create date:
Friday, July 3, 2015

Expires date:
Monday, July 3, 2017

Updated date:
Sunday, June 5, 2016

ASN:
AS24940 HETZNER-AS Hetzner Online AG,DE

Root domain:

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
nbsp;
100.00%

The domain ip1.installpack.net has been seen to resolve to the following 3 IP addresses.

85-10-200-21.clients.your-server.de
June 5, 2016

static.85-10-196-94.clients.your-server.de
June 5, 2016

static.158.40.63.178.clients.your-server.de
June 5, 2016

File downloads found at URLs served by ip1.installpack.net.

1 / 68      (Malware)
http://ip1.installpack.net/InstallPack.exe  (installpack_n_ebc3e.exe)

The following 7 files have been seen to comunicate with ip1.installpack.net in live environments.

URL:
http://ip1.installpack.net/

Web server:
nginx/1.9.10