home

a.levelsecondpro.info

Nikolay Myagkov

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
OnlineNIC, Inc.

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
levelsecondpro.info

Whois:
2 levelsecondpro.info records

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

F-Secure
Gen:Variant.Adware.Mplug
50.00%

Dr.Web
Trojan.Crossrider1.36852
50.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.Mplug.47
50.00%

ESET NOD32
Win32/Adware.MultiPlug.MI application
50.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.Mplug.47
50.00%

Avira AntiVirus
TR/Crypt.XPACK.Gen
50.00%

Norman
Gen:Variant.Adware.Mplug.47
50.00%

MicroWorld eScan
Gen:Variant.Adware.Mplug.47
50.00%

McAfee
Multiplug-FAD
50.00%

Arcabit
Trojan.Adware.Mplug.47
50.00%

Bitdefender
Gen:Variant.Adware.Mplug.47
50.00%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
50.00%

AhnLab V3 Security
PUP/Win32.MultiPlug
50.00%

G Data
Gen:Variant.Adware.Mplug.47
50.00%

The domain a.levelsecondpro.info has been seen to resolve to the following 8 IP addresses.

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
April 10, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
April 10, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
April 10, 2016

52.11.167.137
ec2-52-11-167-137.us-west-2.compute.amazonaws.com
July 1, 2015

52.27.23.115
ec2-52-27-23-115.us-west-2.compute.amazonaws.com
July 1, 2015

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.levelsecondpro.info.

1 / 68      (Malware)
http://a.levelsecondpro.info/hp/?q=Lc7P2qqnjFZxXZTVNP E1dhfSPwe wpZYgX3MyTibQcSFJTFRD6LErXwmxB 7s1T2aYCLbBCQXz0MULNlyIak0ZCplSaW3pmfo/jiq9GCG D7sbhSivFLb5fDiH8GO5t53oT8EytE/.../tIQkthEDzMUb697NU0Fj9 CZBwX4j7m31ICSQlJUVt9dtOImPuWwYl15JovWuMW78kSpMKMczyc7vaH CbVhckAnzRU2MYhFqrln4XU1xwhkxaonjLMFLoU3FacJDUcr9iT2rnOksz3Emt Cu2PnJ3P6ATUXWq  (pokemon dark rising 2 complete.zip.exe)

1 / 68      (Malware)
http://a.levelsecondpro.info/hp/?q=EG6N1 6Xxy13zQIKEGrmb/RTvuYz7CnUpsvvz8Lpop8n7562dN5bs9bY1mzNz3vkAf3SLQBkhDunMUdCGV6eI23FiBBrduQbrju2kJj/hYySAdQKbtzuzcgXz9TSCuUz9B0MLLMDBC9nbhajsMgHvQvUwjrFuo LaNR xWr3z9ZNa9UtIhpw5OyHAp7zrfDtuo FwclXD PQIfG7Cgn9N17rB9bWv4Ps5lf0KJ/vWQ6HHXreHNa/.../XpHiqvojZ5QtmiijLwhutjYAR l  (_hienzo__voli_pantai.rar.exe)

19 / 68    (PUP)
http://a.levelsecondpro.info/hp/?q=117P2rtqaUJN0mjlha6GPG6cHLdQ33Ky/2s bl9BcgKt4zU/zpOUJfuuQbp3YsPFpbfVnL15w/hPdbZSJsPevnxIYfkKwQM/QtLHVirrJCwWhQYA3Lok8ua/jxTJBuRLBEMEqGKdwN8eEHBYGookIDl6zsF gZHHaqBrkMQbIrLTD53GQKRd4wY6Wo1CUAbCWbZljxVC78M66JWN6PNDetTaN0u qpEh6LdiBjglkEZFLNRVjmEy4NTm8LJXvhjU4nvhZG9jhOT1R2iMYZgmV7MX0RBU4MgL6PP8VY2cky0SqpEhkqCmic6NynR UyzVFyuQHtb3i9CbWm0knaPw4m8mbQiJKMCjed4ZKN/sBimgsojv4iADXR5DPIfUwEdhxyB0eMb3g9YP4zaFWU2CwveOfYkGpL4PpkQPyp2Vjx8vKH/m5iPBGbuci2uj3ynOF3kpayooolPFWhfGZKqaqFmf14NpTaiot SDqE92wfsB lfuJkTWYYm/kg1vYd1swBU6 zVTQFmBV/K9v1DNgiz7NN62QarVK3dyIcsaXrOOOCBzKyBeYO6XVU5SrBhBCXHNlXj Irrac8/ya9dkfq2QSO1JMAnzRWXJqQcOt/lvh GPpswUkzkPex FnSdlpq5To0zWqC0e3E3tSWvISLcyO0geX2t0ju6X3nf8Kf62JshTAAMqzet1VbjuYq/gtrGQ2j6aA2C/.../iiJUYjBmxU4svNPev2vr2Uo KWH30I3omv7TJ3khArySUAk5tv0XNbpHsFR9tPDJCvcNKXEhw G36V kV7Z9SmKj4fWeDBnokXJaJowaY7Ft2YjWYnEGaxzUV4ZCD9Anj0gjPh7A2R4NzsBYcX4B4sDIchUrQ4  (photomatix pro 5.0.5 full crack.exe)

17 / 68    (PUP)
http://a.levelsecondpro.info/hp/?q=EOxhIzVRCIL5gqomjl4tNfmoydWevKMF qIHJvC3nsw8Sfm/EmzcLBiMdZ3lxKxHur6MyOvpmiBoGsSvZ5bLq8F8so9iplrFBDgbBNiz2uUMUbW0O0iCVVu nDeyb/6FNg48ZAfIn7V22Ii/.../GxgkQutuxcz7qc  (watremover.exe)

The following 6 files have been seen to comunicate with a.levelsecondpro.info in live environments.

TCP » 52.11.167.137:80
download.exe

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.