setup.mediadrug.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain setup.mediadrug.com is registered by proxy through DOMAINCONTEXT, INC. and was originally registered in May of 2010. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Steinsel, Luxembourg within Luxembourg which resides on the RIPE Network Coordination Centre network.
Registrar:
DOMAINCONTEXT, INC.

Server location:
Luxembourg, Luxembourg (LU)

Create date:
Monday, May 31, 2010

Expires date:
Wednesday, May 31, 2017

Updated date:
Wednesday, May 4, 2016

ASN:
AS5577 ROOT root SA,LU

Root domain:

Scanner detections:
Detections  (88% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.Installer, PUP.MediaDrug.Installer.Meta, PUP.MediaDrug.Installer.Meta (M), Win32.Generic, PUP.MediaDrug (M)
100.00%

VIPRE Antivirus
Trojan.Win32.Generic
26.67%

ESET NOD32
Win32/MediaDrug (variant), Win32/MediaDrug.A potentially unwanted (variant)
26.67%

IKARUS anti.virus
PUA.SkyTech, PUA.MediaDrug
26.67%

Trend Micro House Call
Suspicious_GEN.F47V1227, Suspicious_GEN.F47V1225, TROJ_GEN.R0C1C0ODU15
20.00%

McAfee
Artemis!5241AB13FF21, Artemis!88B3DD290C71, Artemis!6FBB9C09A521
20.00%

Sophos
Generic PUA JN
13.33%

Panda Antivirus
Trj/Genetic.gen
13.33%

Malwarebytes
PUP.Optional.MediaDrug.C
13.33%

K7 AntiVirus
Adware
13.33%

avast!
Win32:Malware-gen, Win32:Trojan-gen
13.33%

NANO AntiVirus
Trojan.Win32.DownLoader12.dqeumy, Riskware.Win32.MediaDrug.duaflm
13.33%

Dr.Web
Trojan.DownLoader12.56194, Program.VKontakteDJ.2
13.33%

Avira AntiVirus
ADWARE/MediaDrug.372736.1, ADWARE/MediaDrug.377976
13.33%

G Data
Win32.Application.Agent.M79AXX, Adware.Agent.PSN
13.33%

The domain setup.mediadrug.com has been seen to resolve to the following IP address.

ip-static-94-242-221-153.as5577.net
May 29, 2014

File downloads found at URLs served by setup.mediadrug.com.

 
Latest 30 of 258 download URLs

The following 2 files have been seen to comunicate with setup.mediadrug.com in live environments.

URL:
http://setup.mediadrug.com/

Web server:
nginx