2ndrequest.me

WhoisGuard, Inc.  (Proxy Registrant)

Domain Information

The domain 2ndrequest.me is registered by proxy through eNom Inc R32-ME (48) and was originally registered in September of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Reykjavik, Hofuoborgarsvaoio within IS which resides on the RIPE Network Coordination Centre network.
Registrar:
eNom Inc R32-ME (48)

Server location:
Hofuoborgarsvaoio, IS (IS)

Create date:
Tuesday, September 2, 2014

Expires date:
Friday, September 2, 2016

Updated date:
Saturday, January 30, 2016

ASN:
AS50613 THORDC-AS THOR Data Center ehf,IS

Scanner detections:
Detections  (86% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Resoft.MYPOPSHOP, PUP.SearchVortex.J, PUP.Installer.CLARALABSOFTWARE.X, PUP.MaLin.S, PUP.ShulanHou.z, PUP.ShulanHou.n, PUP.XiaoqingLiu.l, PUP.XiaoqingLiu.FF, PUP.SearchVortex.FF, PUP.CNBTECHNOLOGIES, PUP.Ma Lin, PUP.Yontoo, PUP.ELEX.YuxinWANG (M), PUP.Gencolabs.Installer (M), PUP.AdPeak.CNBTECHNOLOGIES.Installer (M), PUP.Yontoo.PlainSavings.Installer (M), PUP.Gencolab.Installer (M), PUP.ClaraLabs.Installer.Meta (M), PUP.Yontoo.PlainSav.Installer (M), PUP.Yontoo.SearchVo.Installer (M)
76.19%

K7 AntiVirus
Unwanted-Program , Trojan , Virus
30.95%

Dr.Web
Adware.Linkury.10, infected with Trojan.BPlug.181, Adware.Mutabaha.84, Trojan.Amonetize.342, Adware.Mutabaha.91, Adware.Mutabaha.122, Adware.Mutabaha.111
30.95%

McAfee
Artemis!6F67E1B655F1, Artemis!A5496B7F8124, Trojan.Artemis!CC955B6E6DD2, RDN/Generic PUP.x!cq3, Artemis!5A4D9963667E, RDN/Generic.tfr!ei, Trojan.Artemis!3DF2895D70E4
30.95%

Baidu Antivirus
Adware.Win32.DealPly, Adware.Win64.BrowseFox, PUA.Win32.LiMo, Adware.Win32.Amonetize, Adware.Win32.ELEX, PUA.Win32.Aspackage
28.57%

AVG
Generic5, BrowseFox, Win32/Zbot.G, BrowseFox.H, Win32/Parite
28.57%

ESET NOD32
Win32/BrowseFox.C potentially unwanted application, Win32/LiMo.C potentially unwanted application, Win32/Amonetize.BQ potentially unwanted application, Win32/Parite.B virus
28.57%

VIPRE Antivirus
Trojan.Win32.Generic, Threat.4150696, Threat.4726263, Threat.4732184
26.19%

Emsisoft Anti-Malware
Adware.BrowseFox.U, Gen:Application.Elex, Trojan.Generic.12368233, Adware.BrowseFox.BJ, Win32.Parite
26.19%

NANO AntiVirus
Riskware.Win32.Linkury.dcvwxz, Trojan.Win32.BPlug.dfsehz, Riskware.Win32.Mutabaha.djrxwq, Riskware.Win32.Amonetize.dkoipa
21.43%

Avira AntiVirus
APPL/Linkury.G.2, ADWARE/Adware.Gen7, TR/Elex.165136, Adware/VOPack.276517, ADWARE/BrowseFox.Gen, TR/Patched.Gen
21.43%

Sophos
PennyBee, Generic PUA FF, Generic PUA LL, Generic PUA JE, Elex, Generic PUA KP, Generic PUA EE, Generic PUA CE, Generic PUA AF
21.43%

Vba32 AntiVirus
AdWare.MSIL.PennyBee, suspected of Trojan.Downloader.gen.h, AdWare.Amonetize, AdWare.MSIL.Swift
21.43%

Malwarebytes
PUP.Optional.BPlug, PUP.Optional.Clara.A, PUP.Optional.Bundle, PUP.Optional.Babylon
21.43%

G Data
Adware.BrowseFox, Gen:Application.Elex, Trojan.Generic.12368233, Adware.BrowseFox.BJ, Win32.Adware.Adpeak
21.43%

The domain 2ndrequest.me has been seen to resolve to the following IP address.

February 4, 2016

File downloads found at URLs served by 2ndrequest.me.

3 / 68      (Adware)
http://2ndrequest.me/.../310714_l.exe  (35c69c40b53c1a6d8475ce2b0085abac)

1 / 68      (PUP)

8 / 68      (PUP)
http://2ndrequest.me/.../310714_bb.exe  (f3074e2a-b970-49c5-9c03-c410986d50d6.exe)

1 / 68      (Adware)
http://2ndrequest.me/.../240714_t3.exe  (vk3uqblgx53xeqek5mldzixpvk3uqblgx53xeqek5mldzixp_t3.exe)

12 / 68    (Adware)
http://2ndrequest.me/.../310714_a7.exe  (oiuoe3gw3gjwhax6xx6amchye1voiuoe3gw3gjwhax6xx6amchye1v_a7.exe)

9 / 68      (Infected)
http://2ndrequest.me/.../310714_a9.exe  (4368ce3ca317990a069cdc90c8ee7807)

8 / 68      (Infected)
http://2ndrequest.me/.../310714_am2.exe  (db3c8612f2ff645696d4774c0e453018)

22 / 68    (Adware)

0 / 68

4 / 68      (inconclusive)
http://2ndrequest.me/.../310714_h2.exe  (d44aon6cddhpkn7dneourd44aon6cddhpkn7dneour_h2.exe)

4 / 68      (Adware)
http://2ndrequest.me/.../310714_a8.exe  (df9djpdry22cpsmx7ranyxebgcxdf9djpdry22cpsmx7ranyxebgcx_a8.exe)

13 / 68    (PUP)
http://2ndrequest.me/.../310714_as.exe  (cbuteof7ibuaczc8giobcbuteof7ibuaczc8giob_as.exe)

February 4, 2016

URL:
http://2ndrequest.me/

Title:
“Em manutencao”

Web server:
nginx/1.0.15 (PHP/5.6.13)

30 of 43 related domains