home

fullion.info

Oleg Zaharov

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
1&1 Internet SE

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Whois:
1 fullion.info record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.WebPick.StepanRy (M), PUP.WebPick (M)
100.00%

The domain fullion.info has been seen to resolve to the following 3 IP addresses.

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
May 21, 2016

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
May 21, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
May 21, 2016

File downloads found at URLs served by fullion.info.

1 / 68      (Adware)
http://fullion.info/v21773?self_redirect=0&product_name=The Vaccines Weirdo.mp3&filesize=8.87 MB&product_title=The Vaccines Weirdo.mp3&installer_file_name=The Vaccines Weirdo.mp3&product_file_name=The Vaccines Weirdo.mp3&q=The Vaccines Weirdo.mp3&product_download_url=http://.../fil.php?s=srv0001&id=383166373230662f53495a4539333033323230&t=The vaccines - Weirdo.mp3&dl=1  (the vaccines weirdo.mp3.exe)

1 / 68      (Adware)
http://fullion.info/v3500?self_redirect=0&product_name=From Table to Able: Combating Disabling Diseases with Food.mp3&file size=&product_title=From Table to Able: Combating Disabling Diseases with Food.mp3&installer_file_name=From Table to Able: Combating Disabling Diseases with Food.mp3&product_file_name=From Table to Able: Combating Disabling Diseases with Food.mp3&product_download_url=http://srv57.vidtomp3.com/download/.../From Table to Able: Combating Disabling Diseases with Food.mp3  (from table to able_ combating disabling diseases with food.mp3.exe)

The following 2 files have been seen to comunicate with fullion.info in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.