The domain liversions.net registered by PROTECTSERVICE, LTD. was initially registered in July of 2014 through EVOPLUS LTD. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dublin, Dublin City within Ireland which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the EU (Ireland) region datacenter.
Registrant:
PROTECTSERVICE, LTD.
Server location:
Dublin City, Ireland (IE)
Create date:
Wednesday, July 30, 2014
Expires date:
Saturday, July 30, 2016
Updated date:
Friday, January 30, 2015
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Google Safe Browsing:
unwanted
Scanner detections:
Detections (96% detected)
Scan engine
Details
Detections
avast!
Win32:MultiPlug-IZ [PUP], Win32:MultiPlug-MP [PUP], Win32:MultiPlug-ND [PUP], Win32:MultiPlug-GP [PUP], Win32:Agent-AYLT [PUP], Win32:MultiPlug-ABC [PUP], Win32:FakeDownload-G [PUP]
68.09%
AVG
Adware Generic_r.VD, Adware Generic_r.WW, Adware Generic5.CMSE, Generic6, Adware Generic_r.XD, Adware Generic5.BUMH, Adware Generic_r.UH
59.57%
ESET NOD32
Win32/AdWare.MultiPlug.CN application, Win32/Adware.MultiPlug.DP application, Win32/Adware.MultiPlug.DW application, Win32/Adware.MultiPlug.DV application, Win32/Adware.MultiPlug.JX application, Win32/AdWare.MultiPlug.CT application
55.32%
McAfee
MultiPlug-FRO, MultiPlug-FSS, MultiPlug-FTA, Program.MultiPlug-FRE, Program.MultiPlug-FPF, Program.MultiPlug-FTA, Program.MultiPlug-FQV, Program.MultiPlug-FRO
51.06%
Dr.Web
Trojan.WebPick.2984, Trojan.Crossrider.36840, Trojan.DownLoader11.48932, Trojan.WebPick.3009, BackDoor.Andromeda.493, Trojan.Crossrider.37597, Trojan.Crossrider.37867
51.06%
Emsisoft Anti-Malware
Gen:Variant.Adware.MPlug.15, Gen:Variant.Adware.Mplug.18, Gen:Variant.Adware.MultiPlug, Gen:Variant.Adware.Mplug.21, Gen:Variant.Adware.Kazy.511922, Gen:Variant.Adware.MPlug.10, Gen:Variant.Adware.MPlug.16
44.68%
Kaspersky
not-a-virus:AdWare.Win32.MultiPlug, HEUR:Trojan.Win32.Generic, not-a-virus:HEUR:AdWare.Win32.MultiPlug
44.68%
Reason Heuristics
PUP.OlehAleksyuk.U, PUP.OlehAleksyuk.b, PUP.OlehAleksyuk (M), Threat.Win.Reputation.IMP, PUP.OlehAlek (M), Adware.Amonetize.Meta (M), PUP (M)
34.04%
Microsoft Security Essentials
Threat.Undefined
31.91%
Norman
Gen:Variant.Adware.MultiPlug.4, Gen:Variant.Adware.MPlug.5, Gen:Variant.Adware.Mplug.21, Gen:Variant.Adware.Kazy.511922
29.79%
Sophos
MultiPlug, PUA 'MultiPlug' (of type Adware)
25.53%
NANO AntiVirus
Riskware.Win32.MultiPlug.dfjscb, Trojan.Win32.XPACK.djfdse, Trojan.Win32.XPACK.djcihv, Riskware.Win32.MultiPlug.djihgj, Riskware.Win32.MultiPlug.djnjti
19.15%
F-Prot
W32/A-fe9dd143, W32/A-c26d7ccd, W32/A-b5918a94, W32/MultiPlug.E.gen, W32/A-8332c920, W32/A-1123bd76
19.15%
K7 AntiVirus
Unwanted-Program
17.02%
Comodo Security
Application.Win32.Multiplug.CT, Application.Win32.Multiplug.JYX, Application.Win32.MultiPlug.PNU
17.02%
The domain liversions.net has been seen to resolve to the following 8 IP addresses.
ec2-54-72-9-115.eu-west-1.compute.amazonaws.com
July 31, 2016
ec2-52-27-166-51.us-west-2.compute.amazonaws.com
January 27, 2016
ec2-52-24-161-49.us-west-2.compute.amazonaws.com
July 7, 2015
ec2-54-68-145-207.us-west-2.compute.amazonaws.com
December 18, 2014
ec2-54-68-171-13.us-west-2.compute.amazonaws.com
November 29, 2014
ec2-54-148-67-213.us-west-2.compute.amazonaws.com
November 29, 2014
ec2-54-68-142-187.us-west-2.compute.amazonaws.com
September 15, 2014
ec2-54-68-85-18.us-west-2.compute.amazonaws.com
September 15, 2014
File downloads found at URLs served by liversions.net.
Latest 30 of 75 download URLs
The following 253 files have been seen to comunicate with liversions.net in live environments.
Subdomains
URL:
http://liversions.net/
Network:
Amazon Web Services (AWS), running an EC2 instance
Web server:
ngx_openresty (PHP/5.4.37)