home

tfs.ezdownloadpro.info

Rafael Leviev  (via a Proxy Registrant)

Domain Information

The domain tfs.ezdownloadpro.info is registered by proxy through Active Registrar, Inc. (R469-LRMS). This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter. The domain is associated with the publisher Rafael Leviev who is located in Shfela, Israel.
Registrar:
Active Registrar, Inc. (R469-LRMS)

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
ezdownloadpro.info

Whois:
1 ezdownloadpro.info record

Google Safe Browsing:
unwanted

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8516
100.00%

Dr.Web
Trojan.DownLoader12.34992
100.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8516
100.00%

ESET NOD32
Win32/Adware.MultiPlug.FH application
100.00%

McAfee
Program.MultiPlug-FWG
100.00%

Sophos
PUA 'MultiPlug' (of type Adware)
100.00%

MicroWorld eScan
Gen:Variant.Adware.Mikey.8516
100.00%

Malwarebytes
PUP.Optional.Unizeto
100.00%

K7 AntiVirus
Unwanted-Program
100.00%

Bitdefender
Gen:Variant.Adware.Mikey.8516
100.00%

NANO AntiVirus
Riskware.Win32.MultiPlug.dopuoz
100.00%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
100.00%

Avira AntiVirus
ADWARE/MultiPlug.Gen
100.00%

AhnLab V3 Security
PUP/Win32.MultiPlug
100.00%

The domain tfs.ezdownloadpro.info has been seen to resolve to the following 2 IP addresses.

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
May 2, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
May 2, 2015

File downloads found at URLs served by tfs.ezdownloadpro.info.

24 / 68    (PUP)
http://tfs.ezdownloadpro.info/hp/?q=EvVyuH4//lK/TVNPRJz0ZNxvP76 DF04M2 mKyrgjE5zYSrigX4Ndm4W5CbSRL2N6EDu8cNiR2tUD0lnT3yp7yU1T4YQKEcTzkrHy5JtSEe9IQplDUoOlahFXgJGpBhUjHQDLEmP6kvRN6BTcNPkX67BbA0JQtorkrrKm RG8vT1crH1qQqDqJ5QSfhIptgmA0E0 ZPY92HoYvGOy8LJTM8OKnq1RQ/LowHXSAUuid2dgD85ElcZMn3HvfQI2QlXwy/tLOuQ4x8L16EzBCfklqlnpFOP75pbAeycxIk7enRCN0rm3rYTXLmQfYBsxHtafVutSfaGtfdqlgf8KIYObozDXu3gXEc87MwJAayx/AMoxOSaf79tSfdxROH2o0kLcVYmEJZUayIYJYhu72y2cKpuGOXpwALO 21FIL2Y r DDiIvphldcJrG8/AQLY3gUWt2c/reTwPPE/tSQY22eDuHAamDMkXGSfcMfPMnqYvlShH16JwIxrWMdJXF1tAfKZouBmQkEAopeOYl7V7owJa5GTrZjuI4vqvizs7oJcWoFE04MmDnyTdlzv67E7Z824Pj0KRXVxJQqa/KaBoL4nKdyhS1kv5DIp QsMbPdXiGLzKiCcQQP9JHygHFQ5FfOvUEnxJPO2ZDZPp8gS4NHJGO8Q52Q8EzLbJ3cEIkXF lTeRd7c5IpHL6ICCsu/IhAhlx5f XJJgpK XHIccWyXEejaa0zDeJZyRopqfHeWP76yFMl pHQ1rlgJrRJdWiYEs6Fjf1yGycT94lnVqIkMbbeNmglIih0AOUYaqfZYwjWWzJxTm8verK1mgmMHHRQ1dVWejAGctDqxerj FsEBysTCBg9 ozJfob/.../0 FKhH4N ALjFcUnMMu  (download big hero 6 torrents - kickasstorrents proxy.exe)

21 / 68    (PUP)
http://tfs.ezdownloadpro.info/hp/?q=8g laLi2EFg1xrpnikdz4Ql6qtq0kB/kSzrA9AvSSP/Ej3HUfiGSbGB/DTWtjI292EdgFBY Zfedl53dUfmKvRazuB2hMajqvlsZFU/5NhMWewrt80Pr/vf3oCPePflBuCDYAnq2ASu0wUVxS2FPS8IYRNhzRttaeE40eNIVSx46XRc0nOyosUMYVflVzIYwCwA1k9wJMMPwGZp8mqCSw0 CsVSHQwylogHyK Cm2wT5va62/.../oLi8nAwMCIomNbHYb 1Y6zge8GzULmf3eC1O742jLyEgv3y8cgWwt2PkgpyPAjASIAHW1dLCSRSyVf&external_id=1425254658538612309&uuid=o58TG3ngn35JLjKps2foBvJj7ymz1IaXpat5CJdJZUL5bRLrXqdfK9NMDxAgS4UmscQ2uFwmAbIN8tC3abFGXGY5udRBnzCZHG3Pjax1K6kGcGIiNugfoxhEW07n3hUR4vl1b4uzFVZCM7YtU83YZ5NMURMR35lTfjPMQqQV8QvCzWc9H  (the-blacklist-s02e12-spanish-subtitle.exe)

The following 3 files have been seen to comunicate with tfs.ezdownloadpro.info in live environments.

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.69.228.231:80
download.exe

URL:
http://tfs.ezdownloadpro.info/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.