home

rfs.ezdownloadpro.info

Rafael Leviev

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter. The domain is associated with the publisher Rafael Leviev who is located in Shfela, Israel.
Registrar:
1API GmbH

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
ezdownloadpro.info

Whois:
2 ezdownloadpro.info records

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8516, Gen:Variant.Adware.MPLug.35
40.00%

F-Secure
Gen:Variant.Adware.Mikey.8516, Gen:Variant.Adware.MPLug
40.00%

McAfee
Program.MultiPlug-FWG
40.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8516, Gen:Variant.Adware.MPLug.35
40.00%

ESET NOD32
Win32/Adware.MultiPlug.FA application, Win32/Adware.MultiPlug.FC application
40.00%

Norman
Gen:Trojan.Heur.JP.avW@aKIcpyei, Gen:Trojan.Heur.JP.@uW@aOpEf4mi
40.00%

Sophos
PUA 'MultiPlug' (of type Adware)
40.00%

MicroWorld eScan
Gen:Variant.Adware.Mikey.8516, Gen:Variant.Adware.MPLug.35
40.00%

Malwarebytes
PUP.Optional.Unizeto
40.00%

K7 AntiVirus
Unwanted-Program
40.00%

F-Prot
W32/S-4ef98cc5, W32/MultiPlug.H.gen
40.00%

Bitdefender
Gen:Variant.Adware.Mikey.8516, Gen:Variant.Adware.MPLug.35
40.00%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
40.00%

G Data
Gen:Variant.Adware.Mikey.8516, Gen:Variant.Adware.MPLug.35
40.00%

The domain rfs.ezdownloadpro.info has been seen to resolve to the following 7 IP addresses.

185.53.177.6
July 30, 2016

185.53.177.10
April 17, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
November 10, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
November 10, 2015

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
November 10, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
May 15, 2015

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
May 15, 2015

File downloads found at URLs served by rfs.ezdownloadpro.info.

1 / 68      (Malware)
http://rfs.ezdownloadpro.info/hp/?q=7fOtqoh7S4MaPjlhab7y4G04u0fyE/w2YjFFCNcavaAIM3FNbK9DtOT6IBjv8Emh MqcSDfPoLUrCv3c5FjvflZ1sPaB Mqx0TO716DIBUMnqY JhL5ulPkwI58P3MlWqUGGyEK4vBWG3H4bWLeuVsUNCgK2iVLS5ctpwFFHVNudDjyTQbs3N672LXT9bAgmOamRwx9c1VUrX4j78RsxnHKw4Zz BteKQnBzfxRCNHWFu/FZAySjR4ND8pFtqnU1BR8YcxhBK1622d6eXqglvHivgAMqqJWx0WJMZg6fJSpx2/ LzW2 JHDjvmPyxF82icoKXNGBbmRessLxcC62WDfQ7YPJX4VyKnJoCXqlHnyXH6JemXmxUprwDKDjhX9K4Pn8vG83rzStDkkb3KGbn2WTR5GQhA7lamibAT25wJV9yFJnzXsE 23AUmR1kkRy8soIrCVKZRdYsxcDtG7efojQ1OtWUjFt0g2o8Ens6zVHH6v5gBNuAQ16/FvUr 2d9rn8jyToqunlvkS1pfXj8czMG9Pvn54JaPwe6SRAZ l3hqkQm1l7hC995ltO9zuKfxaMYX 0cMDSSzjnMfe9EFb9wzUMgD04P3UIvkBTSxk8KOTd9Iwq4R3/AfDqwB0Lws1Xl9dWPB40pMkBXjOEQkqUd3srKNrg bhIv2GOyMMq5E25rNEBoh59D KOysXxtvqFu/FeOcvn25d0tIo0Zdjvfl9bXnupTgGXAqySOarPnUeV0dv5Ehr3AbmQlJTwmA62nNbXM2ErAWn2i0csmaAZpFMe1NJwYdiwhrpliGuAmiRfXgDd0aw4xGvU 7wGoi71zJoZULRIvtpV5wN4FI2EaUGn/.../HEMeAk8JGR7IrVukRdNTqEBxChxeTGlTcsKTb518dxVleMqao sUMh5TFmHU88t8NHrsrMq7KOu WL6  (enrique iglesias - noche y de dia ft. yandel, juan magan.mp3.exe)

1 / 68      (Malware)
http://rfs.ezdownloadpro.info/hp/?q=APIqm3icxV1ZTVNPRJzhcu/t DSDdKfiy9V5uVpGSfe8Xh04T4800etM31A5jDNyMIiJmUSu6obbj6PAhmYL/i15Ejkl tPmMOpD 9D uliIpRUuJHVqlzA81EsZLhlBgGsAd2uchjlwNEjvvBer6ojb7MNWOuShDmJwOkJTDzKHCWvpIR7pTH9DDhbv2m /8uCWhyNZ/yYZC5AJN/OFecqEGUigjb9S3/pHESr4cITRCyV/y8/mJRZQOabfVu9ihInSDktthfsKgbcdGUL5qlkr7UfxGDeaSX3Mz3X6uSqN4buuIc2tI4LeUcMoHVogcEYhEmtHR8Mi3vWjpVP0 hdzD5C2TGsZijntO8SAaZiTSRO3gW7D29/PHltR 9spQaGk9ZdVYerLJz6K/k51BCQ6NvaOYKNxAox6SIfl2sQ/yj3fTYgDoaoXIATu8O5W5xUpHlt1vHRHC9L9roBxcdA/h7CsqYR9Ga/2W5vtmV6HlRq5QHwicd4afelnrXqDgJJC7u2chQVnntvMO5/474HPMDrH8Td/j6yX8YB0WL5wveAJJjAC gREVQgJhL9i3iALIhpHESJdXasZSqVrHEA86citFd1K0lYzfi/fvBXnb3M7gMTKPiZSYWy4nRW1jnJ H53EEv6q29XoG8OXRLCsixLeSvBw/SJ hzGZgytmqLuKRWrFau FIM9aO6CWidlvTpGmQSpLwRsxjE2vfPOERIveq9JCHpi6R/E/biY9TakmFSzXlhjI0nfBlpXYKGI r/zTVv1hXeGIFGEPTHMXOpmGAD50ywlerDdGaKneg9fhaM/4qZtsuSlFJ 46I/.../APNQ1t1mD6txfnVs  (szrke tven rnyalata teljes film.avi.exe)

1 / 68      (Malware)
http://rfs.ezdownloadpro.info/hp/?q=Swn5yV9S9qhEbcdefAZC2LCYC2LxFJzTlVAotOZys0ROnelPrzZEXBNpGpa8qYR9ka7ST6dhLZGhTt7TP1zAif TMd48oE0eE/lqhslgvWL4qVApyGbFonrMhN5QSs2cgPD7HC0R4deSQRV8SpecfCSEGyK xIf1wDzmLI NnjD7 9YzutxDnnkkceFMgPYkj3cQ65HpCVimTL6BPuWEEmzhSQnCJYw7y8h9VyWrEnND0srPXUAVKZVFy00F0/B fl4NVF23aINMuzYHScpGSfne513dqY3VJZIo/yFTYaTZVrIbQXpD nr597FQVdnlhkL5ESwQK0voj0EgrB3K14xQtgJBBZyBUnKOcMolbNaBKR140VVHs4TGK9UQ9IkpaITfgDZFAWCjFIwyJSLNWFOO7KWfTexe2AzYRp r/p2kCFP6mPNtK6COZgmvm8CbJj1xcVpBYJDpzqvO8GfORCage6Fz4XOIuA8J3OpJgciixvxZqYHwH60e9KYzA/6cdIN 3jf3Sd46o01Xhrz/1a0n4wqFowR9R2p7TuXnjiHgY12chjShwNWyFfjCxZu4AbxY Msmc1gosEidt9nM3YJlOo3L4imIu7wG61FPsLUXQ8oYTCDGoNLy5g/LwXrKnHWEFTK4s9LhPuEyXYB ejCt4tQeArKXAr g0/9sOK M7SSDo1Tx1thfBt2QKTxdIve1XApxBqpwIh3eV7JzklEKvG8PPVTsSOhkhd/knvC/o0aWnJwt2wcTeqGqNUSOR2sJq9cluWKcFw02WWeMT3oRTDlboN9x4F93 vkO1lo7z2UpUNgS9zmtlIHarBkhe48 3wtDlC0G4eWnMuJ05gq MwYSCTWc /VKL4zQvdBc3wpHESEmKZzai2wIR12w2FVLxeZFKxgW4RcbOQa9Ne/KgPf/.../r8yKZVpbK99y3qaXZHWvuF3AQYJPI8G  (autocad 2012 keygen patch _ dhizka - free download software, games, antivirus, utilities full vers)

26 / 68    (PUP)
http://rfs.ezdownloadpro.info/hp/?q=g1s1Ll/MWus1EWYSUMFt U3BB4gDWadk6/8whc7M/VvLCbWZnIoSLTuLYrkF947n9e0MPKGpoOnh1xVS14oTFn7puz7d507G0E3ejPRpE54C2yk/PY9bjeKwkJSt1bZNSDxKWMqlt/HMADN68kFGGc4xmeeDQBok9VE5h5CvD3S1bPlV6sQDJSlKwbglj5BzeaAwGcjRXNix5Q9DHnypQqURDi6RYhLLz48tbywnMNLNZLwHMX2imv172oSiKLs0eFEOYLwQ Vt1P7AcEA1m1gn8htV/YjBDi3t1LjblLOjDxtkV5wQ9amivWL5LhftT9AszSeccdEZFlAmbJjtuc4GUd13iArL56VNeIHCIY0uaABa/tS8igXlVxqRzaUiFk8xGoSz05BBnbP54Y3u5JcLLykvdMAW 5Q6bKx 1YIbJlpcUHow6DzskUH5Hw/Za0HFaEFpiGPVnWr9UA9O7xIbF0O0hwNARN3y1wFRZ/KnGyB5nZgYLdPc2FvgHxOB4 cU4q p7OWDIc949/.../PAl GRaXjIu2ukdTucvrIi6sRK9oCegkFrV37FNlebDdif4i5cbVpYpGCNtOUECTNpeuUYGVSv4zo5T1iSTMbU EvecQgTpB8t2Xny7AynB6Yq0&external_id=1425209471409375541&uuid=PqHLsTEnF3S4simHAXf5HxVmHocoKhQ5TJSyYBmORxcwcJSg4DEWWhp2G3VBjiDXKR6AkrIArvkCtePKXFfCipmHMOkz8tGbxyi7ELa6qTU2z7hkrRWYs9gCJC1Zf3T9Gal7ofHVISZaYxP4uf8ub9FWKmfvtXtlGH3qpBgpBkGU8guDgHWKF  (broshuis_tieflader_by_gamerspalace.zip.exe)

26 / 68    (PUP)
http://rfs.ezdownloadpro.info/hp/?q=dDVyuH481yW6MOQIKEucXdlu6h6kEimrBLBrgKwCci225zAdXb/ok 2S50l7ssEQMQtBsV77Ii875tg 8cIp9YJHlg51yilwwR0tGY6dSSea9FwVBm5VNGkaO2wXcE9uP5nTcM5OW253qi4GWMQGC5U60G4 7xM1o119P1xYFRPSlKnZzzzYk0NmO5yfYgZtqQh2J/JWGjzhbiqz7Jx3Wk3u8lNoRWCwGeqrpKRKpMvnM29wVCgGPv6xwXYzEwEBK/D3ZdWmhCuTJnUKxvI/Ab5ebiI2X4vIBmdCmQF16tUYgZpustnsTf4ljCOgcFOUtmm7RRhOnOuxdyHFhrpRb 8oi20yWs2MAkGNbuiCMjrSY7h0sxOgl9xRTlqr/KDixRWTFd7J XHHpoj8QQBxfK1ef36PrwiZPnrWSE32rWNNoJQNLRizXD8GKymjoCZ5a1VD S9smRpJIwX2zu5AQ7emU75Qzj8dVbXzgFlnrhoVMTuJ/lsw27vfoORvahrD9DprzW5RIRLD5SeGFyp9mx EpNKzL9FFuxgR54yKDCuGJydM12XVGKQqgre2nuEloo7k H1SFNYPzeCynEUA4LvB3HtXEvd37MdX25qfZuH8/.../vekoeBoBQtEufcoVFo3CMl5UXhSs0HIoqpNqq0G27Ial4NE9pIdcfcka9yxlZMyQN7&external_id=1425214269845228109&uuid=57fqeNDJeqCckCZBlGuJljWLhvAuTud2bBSTImXAtu1HSHJbWIjCBeygGxHArgPwszOAQT1VlrIIxadq4ghMxDflhIAxxJTGUZ71fXp9uqILKlZU4jFwOGkGRH4S6wvg6gCCnsDDqQvqvKMRisuH7mJFhwbtl6rsRJPNFH3j2czyeXHHyxotZ4OWcdKaVO6iypLHVVAwp4QnIW5NACk92AU2OA7MrDzvF  (unlocker (32.exe)

The following 5 files have been seen to comunicate with rfs.ezdownloadpro.info in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.69.228.231:80
download.exe

URL:
http://rfs.ezdownloadpro.info/

Title:
“ezdownloadpro.info”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.