home

ifs.ezdownloadpro.info

Rafael Leviev  (via a Proxy Registrant)

Domain Information

The domain ifs.ezdownloadpro.info is registered by proxy through Active Registrar, Inc. (R469-LRMS). Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter. The domain is associated with the publisher Rafael Leviev who is located in Shfela, Israel.
Registrar:
Active Registrar, Inc. (R469-LRMS)

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
ezdownloadpro.info

Whois:
1 ezdownloadpro.info record

Google Safe Browsing:
unwanted

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

The domain ifs.ezdownloadpro.info has been seen to resolve to the following 5 IP addresses.

185.53.177.6
July 15, 2016

185.53.177.10
May 17, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 7, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 7, 2015

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 7, 2015

File downloads found at URLs served by ifs.ezdownloadpro.info.

1 / 68      (Malware)
http://ifs.ezdownloadpro.info/hp/?q=Z3 laLik2FiD9EG xziXb7yLclnqx/SMboh QOUIwWtSPMUdvTpxyJG1VHJLTVqoZclh6LpRNdnHygO6X4iunbbuAVKcowcPblvBIu8XERmRErbz5YChWvxbJIa0X3rvf7I29r3No11i86HK7pQDZT6a1pqMGcvhC11fj3CsqYrkvHPdDwiYVId0fYSrDMaXalIV 3Xl787ErBmuYOPidUaOgClq0rLBiQlSE02J2 Ga46VrSsZCGT39CqErvMbtrigSme8nGlnkAK5RUe8rCn8c2mGOt/zURKxKpmiXYIZZGTwcA6fp JbvAkLNF1 YHjh7lCJjmPPP/.../kWwArZhZReZpqfvammRw69eXWpKf1CYh&external_id=1424989753306982832&uuid=aud0kbJWChaw02fj5f05yVSWSwbxTk2jnoPt5BEfeGzap5C3ya4EbLn0sUHXgGNzuPYnzOK1KEjL7ZORIJeMPY44g518w8hRcoqsUYiTxTc5LZmIlmiWld87AZbXftkCIoX1FigFuyu5BcQaVcQNCHJOhmJvDRoUEJggtyzw3r5xdYtvOkDqREQnEDUSzQAaa8AyP0XuYlafHrfW54Ig2k40xyWWpuLyHfQhwW1M3NRxvCmZU2k6pAG5qFdm9goGILPXkzEK9mRnYncNPERrYES1OwWSx1d2lrbVWmU2c9xJ424l4FrDomNSwk7HViC96e3ZnInGxTI8LIojyDaFVvN7hjE4mTIIYshe5yeekBvdhNzonpIyVvspMnjK7g9rq6h96srUbEFPjzMjL1OBX7aZw1YhEEXMvCMLWTriLIuo7AaIoO8KB  (clash of clans.exe)

1 / 68      (Malware)
http://ifs.ezdownloadpro.info/hp/?q=X6lBDySOwk yUMOQIKs1VMkiN/tPyGDND8yi30 UQ99VVDJYYa6iA3fDbe/Lv55osGOEkYYzCjAUnrLVyuhdbOnujISP0vKJqMMFa yloHf5LfCmqfgAw0JFGKeI59qfbMriW gnPoeoX7/KhQWnPnO6cIq tJSYUTWbyUZxFA9cxmlXn9QHQnIjplfqHDCiZFON2AufsvJ5RjccMfZyg/UNZUvNHWj1VstPNI2hW/u1c4GHRy9ZllPGKwUq9Puad5AcNTat t650eiAq4Zt1y2m/FEqalftDAjSNPJgWeiofc5Js yXb5EyW10Ii6dXlmWo8OhsFpRj8oBJ/KD5Ise299jp4dnfgBhI 4tdYyXm5PR O EU mCjlcykHCu41AO0a IOB2hOKQ4YcLo8oxH1xgE7c1GzUoz54Tvwrmv5m5r7LJTdhaGGAtsrZ oZa7YEsQGNKpsUFyXi9mrZHKVgqN5shf2VT6aWsYg8UG6eba0jTkgItC96JtuOhYAsO2tUksikyy1za3PpdlvWEb9/.../HCkW93xL9HsOfTKxeu0R3uB 41I8dlM462o UAkeUDDo28Eup3AempdkHrsmXW566IQWCO76pXDahz bJnJZnxlZzUGbSvqM&external_id=1424986818522761171&uuid=ps2RLWRAO1WGxQSuT7fj1aBsN977vp31QIfdWoagcejVQCgulGzerHTIhpMKMWnhOHjVp9Llt4lI9m5xnavqQExQqxnh8tHeOcTNH1Dxfaco8mtPTtS2yQDgMvFk9rHzm0yuCkvT5SvaO0I0bsCp0F60yuKhHOUy0rCNd8ygPyuJP2HlQwOUbwCf0NaycVDRbxRuFIUyQiQeoQ9UkdodTFBNSANc9Cj7aZAzhuMbZgVmQrVX1Vwbz1nQhpZ1DM  (outlast.exe)

1 / 68      (Malware)
http://ifs.ezdownloadpro.info/hp/?q=GOwgRHeAUxVDwwysurhOLdju ipY4ibg7tI12CBdQkiFDQ0G1hJxc//PhxC113Vr3JoGPiZUqWvLZMPRegmt gE1EBaGz3EOFDYknekRBbQD9zV3P30efOMDjzrFL7k/INI ERmhPu8nBVVHXqdN1q 3N5i9G5RxU5qRXZR5t51nr7R0Z2y/dYOEuWib fpeTpmDvwERGyjEKliJoYfop5cYbQGQAMa9h03doSKAqvbnMZ3blxThQTKaZ2xR/9pdwJdLDCzHeOUNaqU6xW9laiyRg76pTPvj/kXzXCZSzBy0cYnuIH5mTKOL Q0QljraN/GZ/git4BSyFrUrCv4bD TLBj1qQpj8vBLnPrA1BqOWb1MEWeNBUmWbflHN2LCV65BXY1mbNYCH1PhHUt/i9XD8O/JensjdnK0YXD1 M C9ETkFrr3g/t6nLN0rkIF0HJjyQcuEP2r0lDActQoxOv4uQp3GNbCTRWgMHlOCZ9Bo1XMNl8/2tny12 eymXFAvH mvpfm8gqMgG5ZOrjL3XpyUD4MhhRw5AUfQb0cZxjiyBZHeClLwIn3wInb2EWH0GGMjRTFqBt2FrQztEkqd0484bxNispAAKJdtvbRKL9WsnWQ2LzQEkdVvqN5m7uYqwFNUV8xnsnE0UsnC5cAbFjX6Du0JoGv47K 8xokAkpjBZIbfVLNh21PGLzBMVHT/9wtYLc6hQ6W2poj8QShG9QJBRbtQGU0kKm CMZG63GbAb58yqmwwpHktOf/Ydzz6Fp5dDe6Qp4umnvCo/4zhLKhqFOkbatsivyy kFFawt/.../6qZ14ZwP&external_id=1425012210925223451&uuid=GYlSuN3TmTYHv94ARCWFrnaPaiExiFgaXI4Hc8xHFvnlbvCR0kSAmAwOdjnY3nOF6u2f7bbx  (kmspico_9_2_3_final_rar_downloader.exe)

1 / 68      (Malware)
http://ifs.ezdownloadpro.info/hp/?q=V8YGAYkA3VC3ztvqom2TQxeXrowIU S CQCycCP8Rlfjo1oCH4NgBi5U4rCLyMg9vrcA03valxOKaClWfBxwXPfamiwcFaBCWr bi CvnVHJypfTXiXGeqK25gNyTNDTYAwX6oyrrhCmd6b1IiuGUpe0nkIuwWB8cEFs0NihStx23yO8z9SOZ36x9XSzSvDjmFXEV9EiRr2g 6DuMC4P2IZ1MsJ9BeVY0hV RTU1cnx/sHbzi9xK 94cnkgZWbQ/nbDSUSmChD7rtF9U1plfss0qhGdrdTv/FTHOssreNcen7YIxSSemUqokoa6HhN0E4e1KEpDxliHLkBWE4Fe1rs9ceddR1wrlNyuhVpSIwxi3qnzTXQaGtk3hyzxpCJ9yMmQzDzxr1BLvYL8fnurKNG62xYNGrjjaJ4oUQsJZhPi/nJcgEKZMsL2aY3GlQAY1qRZzO1IS5SIcHePXUq2TyocZ4Vwb36Eej10E7AykVYekitBoCU16QKzNHb9wLM3MzDS/sd/MpgS1J32YcLoB4qt5lLAf3iHMtt/GP5FtfNjXvPR0dNreRcSSl kKmQ4TFIrwiJFyOLa2jNjFLqvwSRI0W9JopcSJMt2KZ 8Tvjq19tMSDVwOB7MXcsv8WVmAi6CoCDA9FxPqlZ7ncqAOzX7HcFIbLUuYj6DRNfxBDcvVhrrKirtnVp/Kl Ek2E6G66z2Yuv4crXYYeoov4O2VCtKPUOLbNIpc8NwmzStvJeDjGFTPBS4YYwgpPpDFIHL HZg2u6CYQsi1LCzx7EUf3fD64J24wmrsYpGSuoes7Xl8uV2EP7WNfl3AwHX5NYBXRiAHb16VYcs6KH/1kSfrnvLKQ8aQ4Gj0FWwyp/.../Yge1nVO&external_id=1424990186891028342&uuid=AA858XOArglNldQbaoqIHMJfCHu6B  (s6102jpma3_s6102ojpma3_egy--www.samsony.net--.exe)

1 / 68      (Malware)
http://ifs.ezdownloadpro.info/hp/?q=eZXF6WqiGfPRikg012B0b/EnL8OLLtas2wSvIOuqYlN /tAc2nMmRPHI VgoTLCbw23XQXHZuV tkuTG0nsakDIPBhBlmqHiT qtUbKHratvfu5xBCdhI6YKozm9GYXzfernJwlhiXy5bpTtf4O8AroOCIB9qFyYzlw3xmV8fCR6Is7DLzDpHReaK4QIAJyMMGs0tCi9fXJlR5Jxorm99XQIKgKtmiI6093642KRhhjDP9nlufe3kBc73xxF/.../UzEFxs0T6RoCaXwcF drL1D0F0gNW7Fzsnun2m0fgnPhxxK1QpzZBsyU&external_id=1424991295648215448&uuid=tTkMtOT6hh2DtUrgFXo2vu41iFbP9rRpAc1RE4NcPT1I8XuKGxVJl7jyhfqvor7gYAy2ixj87jDQHpQygmuIx632wagaTdwQK1J4cMcVi5VYOaOvDu8M7bPirOYPN128J5mIWXwk57A17qUabFgQ1iNhfq2NvZAAaWpsSfk73sfQp2YgYAnBHnDj2zDraHyn0gjLpKaLC7YCLYfQLPLCZU3m7TFtxnelFVPM6ljLatiV2SCYhjYlO64KfP6J0AvsTB1lSAeE8pL4y5Mi0qEoF537CUMkZEMzT2VpAqJxjr8R5uO8Oze1IkZ33g5QoXmrly9zXx8edyzUrUUEPZfqu8PU8Dlh2CmZPk7T6dUnt4I0u5J5SmaWhJ1NdIezKPcjssKZI9SHYzeZpZgd6FE1W3DdWHtH7w2TudbnDDpni90Tmfxy3rQtIH64MsxsPmhAykl63Tcs2EM8Of8TPB3PegMzvzES2OLeoyna37Sg0Og0vuN144e4v3lvGuhaXKWvDBMN9  (whatsapp.exe)

The following 2 files have been seen to comunicate with ifs.ezdownloadpro.info in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

URL:
http://ifs.ezdownloadpro.info/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.