home

www.magebot.net

Whois Data Protection Sp. z o.o.

Domain Information

The domain www.magebot.net registered by Whois Data Protection Sp. z o.o. was initially registered in February of 2014 through NETART SP Z O.O. Currently this domain has been known to host various forms of malware. The hosted servers are located in Roubaix, Nord-Pas-De-Calais within France which resides on the RIPE Network Coordination Centre network.
Registrar:
NETART SP Z O.O

Server location:
Nord-Pas-De-Calais, France (FR)

Create date:
Monday, February 3, 2014

Expires date:
Friday, February 3, 2017

Updated date:
Wednesday, January 6, 2016

ASN:
AS16276 OVH OVH SAS,FR

Root domain:
magebot.net

Whois:
1 magebot.net record

Scanner detections:
Malware distribution  (67% detected)

Scan engine
Details
Detections

Bkav FE
W32.HfsAtITPSINF, W32.HfsAtITIST
100.00%

MicroWorld eScan
Trojan.GenericKD.2982390, Trojan.GenericKD.2988507
100.00%

Quick Heal
TrojanAPT.Crypt.r5
100.00%

Bitdefender
Trojan.GenericKD.2982390, Trojan.GenericKD.2988507
100.00%

Arcabit
Trojan.Generic.D2D81F6, Trojan.Generic.D2D99DB
100.00%

ESET NOD32
Win32/Obfuscated.Autoit, Win32/Injector.Autoit.CAL (variant)
100.00%

Kaspersky
Trojan.Win32.Inject
100.00%

Lavasoft Ad-Aware
Trojan.GenericKD.2982390, Trojan.GenericKD.2988507
100.00%

Emsisoft Anti-Malware
Trojan.GenericKD.2982390, Trojan.GenericKD.2988507
100.00%

F-Secure
Trojan.GenericKD.2982390, Trojan.GenericKD.2988507
100.00%

G Data
Trojan.GenericKD.2982390, Trojan.GenericKD.2988507
100.00%

nProtect
Trojan.GenericKD.2982390
50.00%

avast!
Win32:Malware-gen
50.00%

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D [F]
50.00%

VIPRE Antivirus
Trojan.Win32.Generic
50.00%

The domain www.magebot.net has been seen to resolve to the following IP address.

188.165.242.132
ks390189.kimsufi.com
February 16, 2016

File downloads found at URLs served by www.magebot.net.

0 / 68
http://www.magebot.net/MagebotSetupvT1090.exe  (767166b595b03598ce082da645730c78)

14 / 68    (Malware)
http://www.magebot.net/MagebotSetupvT1090.exe  (d78f47eada7820fd4583763fb43a8531)

19 / 68    (Malware)
http://www.magebot.net/MagebotSetupvT1090.exe  (bb9c679ce716f969358ad7db75cf27d8)

URL:
http://www.magebot.net/

Google Analytics:
UA-939770

Title:
“MageBot - The best Tibia Bot”

Description:
“MageBot is new professional client modification for the MMORPG Tibia. Built mainly for the druid and sorcerer class but adaptable for any class.”

Web server:
Apache/2.2.16 (Debian)

cdburnerxp.se

tibiadb.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.