home

a.engineer-web.info

Tomer Berel

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
Dynadot, LLC (R259-LRMS)

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
engineer-web.info

Whois:
1 engineer-web.info record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

ESET NOD32
Win32/Adware.MultiPlug.MI application
50.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.MPLug.35
50.00%

F-Secure
Gen:Variant.Adware.MPLug
50.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.MPLug.35
50.00%

Avira AntiVirus
TR/Crypt.XPACK.Gen
50.00%

Norman
Gen:Variant.Adware.MPLug.35
50.00%

MicroWorld eScan
Gen:Variant.Adware.MPLug.35
50.00%

McAfee
Multiplug-FAD
50.00%

K7 AntiVirus
Adware
50.00%

Arcabit
Trojan.Adware.MPLug.35
50.00%

Bitdefender
Gen:Variant.Adware.MPLug.35
50.00%

Agnitum Outpost
PUA.MultiPlug
50.00%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
50.00%

AhnLab V3 Security
PUP/Win32.MultiPlug
50.00%

The domain a.engineer-web.info has been seen to resolve to the following 5 IP addresses.

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
June 19, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
June 19, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.engineer-web.info.

1 / 68      (Malware)
http://a.engineer-web.info/hp/?q=2OLnkWqjBbg3Jikg01A qvfDNQlwxTQXekoU0JwJU7YkCvaPioiLfLeDnOjHVxChMloqeTuUWMzkk81p0Y4Qi1c1qRnlhQY2a55vaXoX2bftZwAkNi5xIm230RYq613qVPebcqDrm9gl5sGR3d6T2i/kKnSrAU5uyQQ9VLrJVBi1KdqMPTKN8zE7k11r35LeROk6OEBneNVBDlLSXbgqeXp6ZfTaT61C8G4dCDfJYFPdsGQl atb9YRCV7IUYA84PuunVkNNci7pMSx6ZebLinVFPl9iaf6E/vQmx8/Km SCIHU0MBMAjppbZCqFpFM3YpvUIiGMcOn8CNRl6LIbej9kVXl oNRIvp7QGUHDNFwQr n2m62JBpCZM8hYX43PWSQpk/Ibb06jMcUS6SlWAG/GG/xng0PAlzlmeXZB/4NXgBSh4HnCFGpGV7JxLPK1Q7TBIaajRD3AyTQBy8KAzP9yeEar0m5RKdhvqJOfAhx9T/uBE7GQKSRQ/.../m zyAEx4aBwVG 6xaWltx6uoAWpG4szbqcokZZV8Cyxjig8OgH  (babes 14 01 27 megan salinas under my skin xxx 1080p mp4-ktr.exe)

18 / 68    (PUP)
http://a.engineer-web.info/hp/?q=q1Jpi6DJtTE9Pjlhab7xH5w5OuDky/4zn9QZV9qzpbWLznOXydh2bKDyDuMg2fdvvpmT3lr9GVusdCn0JwBTfhUttZMN5ZbZ/7UTgxQJao567JRf09h79UA4NY9lHzVFhuYfvnVERHceUAUv6gGP3t8B8bLndnhuMXqqz7dd0RcmSK6RjMOfAho42wBSiA8LBCDeedYyleoiEflAqnFEpZHrtWBysMYC3 8gvt6iClnEnZR3gA8u9 2OtZBw/pa83KP6ls06pXhvInN5i28Y0KsLxAlvtFz BtewKAu0/.../nE09Clpr9sRRe3Mj4qMk8gLky48jB9ulgWeX7Fl  (jurassic world {2015} new hqcam x264 ac3-mrg.exe)

The following 7 files have been seen to comunicate with a.engineer-web.info in live environments.

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

TCP » 54.69.228.231:80
download.exe

URL:
http://a.engineer-web.info/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.