home

a.engineer4u.link

Domain Information

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
engineer4u.link

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

F-Secure
Gen:Variant.Adware.Strictor
50.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.Strictor.61661
50.00%

ESET NOD32
Win32/Adware.MultiPlug.MI application
50.00%

VIPRE Antivirus
Threat.4657539
50.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.Strictor.61661
50.00%

Norman
Gen:Variant.Adware.Strictor.61661
50.00%

MicroWorld eScan
Gen:Variant.Adware.Strictor.61661
50.00%

Arcabit
Trojan.Adware.Strictor.DF0DD
50.00%

Bitdefender
Gen:Variant.Adware.Strictor.61661
50.00%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
50.00%

Avira AntiVirus
TR/Crypt.XPACK.Gen
50.00%

AhnLab V3 Security
PUP/Win32.MultiPlug
50.00%

G Data
Gen:Variant.Adware.Strictor.61661
50.00%

Vba32 AntiVirus
suspected of Heur.Malware-Cryptor.Multiplug
50.00%

The domain a.engineer4u.link has been seen to resolve to the following 4 IP addresses.

52.27.23.115
ec2-52-27-23-115.us-west-2.compute.amazonaws.com
July 1, 2015

52.26.142.209
ec2-52-26-142-209.us-west-2.compute.amazonaws.com
July 1, 2015

52.11.167.137
ec2-52-11-167-137.us-west-2.compute.amazonaws.com
July 1, 2015

52.10.67.234
ec2-52-10-67-234.us-west-2.compute.amazonaws.com
July 1, 2015

File downloads found at URLs served by a.engineer4u.link.

1 / 68      (Malware)
http://a.engineer4u.link/hp/?q=dbwgRH48lJybQCDWYSJToXKlaen38cCCgOFtx7kQf0WYWDJZ 2 H/RzNurJ/WZMmr0FMm FmC 7Dut9mGa9vyw7SMBxwFNDJCv8FU0Upeo 1oPTuClfwHhsCKPC6 6fF9SuA4Y/MjFKNJK6cFRNF3eIXyqgi EkF8zW9AZVrfm/ p43nx obo36Xdm/F4SqWbpt9TB1DDB5I5hc5DxreJi/lOpZ8VLhbuf UveWD1E5qRYQO16BV7PBZAW sgoJNGwAKlNi9ZKbEyEDM1thYuMEIon a Xj3MXlcYK/rLpAT8Jy8kM2WkcDsiJciwEhJQfvpVEO6vmaxJrEAsLj51ZcbmDkIiQRG0TyhjH69MVMbG7x9nJWZw6tLs7NdBAp0HnQQm2uw19itNLX7vlnu/.../KzDIxt6Zw9qJ0oxKHRmCG3TEKW4Bk8Q8krwbmQihxtwVGlp90ChswChHqU oJyf9Uzz9cdjArWadk9KR 5lmApz  (le bourgeois gentilhomme de molire par la compagnie tryd.exe)

22 / 68    (PUP)
http://a.engineer4u.link/hp/?q=2h3ZVWqb lu0L789/XQJHbkCFOEMXswJGsxfSP/L2L/DW/umHrEz1uButxYgWQe st8zk/tSXHmrRua8vWIez9SbVR40yj/iug7MQXbXKFi95Kuevium2C/jkFVhJzFxUv4HSXFcyqstrZq3o78nNxu23Ol3GQ/vG2IxwzH6XBUPfnK kmub4AHGrYjqPiZVT1hUZVxUMp/vlCdJ3Ol9U/5zHCuGInxVX8lndp7X75VuuEBs1YcLjiHSTSth78UJ2Me1IUU3phk5GQ9ntWmW0qUdKhFVV0ujM dNphDq2ui9q8BnBuRmYUgtg XZRPAWjk6xs7mvKCcUchG9opHbebc5/4jrbdHRlwzSJOaSgD2E4zsUKSrd6DlVEFL9g7S1mZZabXrilD36fdIffL8ybpaz3R KkCA9Y0CXcFMt v8m/koEga/zGwJNkJlOusYJOamFkcgx5KKVgxDjIxQ b0ODu3iFWXmwbcMmAjRmPU3pLjlUWEyxf7Dg0z8o5t b3H5XSf9thZrsRef2Ht/.../RSza32xJS0Lm8cRDlIAT6HLWidXAcGrgh9ZsEVU9MDrQoIgPThi2CW8HqXw0omU 8BY5DXQRY059FXK72o4h6 vGKic4awOj548kNolfZAyAvOAW80stsANxgEvGYhzdgXGbQrUNo8NYBtoOTD wrvo1lvplS  (darkstalkers 3.exe)

The following file have been seen to comunicate with a.engineer4u.link in live environments.

TCP » 52.11.167.137:80
download.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.