home

secure-file.info

MB MANAGEMENT GROUP

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Seattle, Washington within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
GoDaddy.com, LLC

Server location:
Washington, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Whois:
2 secure-file.info records

Scanner detections:
Detections  (68% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Rainmaker.Installer.Meta (L), PUP.Rainmaker.ProPCCle.Installer.Meta (L), PUP.Rainmaker.SANDDOLL.Installer.Meta (L)
100.00%

The domain secure-file.info has been seen to resolve to the following 48 IP addresses.

54.192.18.33
server-54-192-18-33.iad12.r.cloudfront.net
January 4, 2016

54.192.18.250
server-54-192-18-250.iad12.r.cloudfront.net
January 4, 2016

54.192.18.233
server-54-192-18-233.iad12.r.cloudfront.net
January 4, 2016

54.192.18.226
server-54-192-18-226.iad12.r.cloudfront.net
January 4, 2016

54.192.18.157
server-54-192-18-157.iad12.r.cloudfront.net
January 4, 2016

54.192.18.130
server-54-192-18-130.iad12.r.cloudfront.net
January 4, 2016

54.192.18.109
server-54-192-18-109.iad12.r.cloudfront.net
January 4, 2016

54.192.18.42
server-54-192-18-42.iad12.r.cloudfront.net
January 4, 2016

54.230.193.59
server-54-230-193-59.iad53.r.cloudfront.net
January 2, 2016

54.230.193.229
server-54-230-193-229.iad53.r.cloudfront.net
January 2, 2016

54.230.193.167
server-54-230-193-167.iad53.r.cloudfront.net
January 2, 2016

54.230.193.154
server-54-230-193-154.iad53.r.cloudfront.net
January 2, 2016

54.230.193.143
server-54-230-193-143.iad53.r.cloudfront.net
January 2, 2016

54.230.193.93
server-54-230-193-93.iad53.r.cloudfront.net
January 2, 2016

54.230.193.74
server-54-230-193-74.iad53.r.cloudfront.net
January 2, 2016

54.230.193.73
server-54-230-193-73.iad53.r.cloudfront.net
January 2, 2016

54.230.102.29
server-54-230-102-29.iad2.r.cloudfront.net
December 4, 2015

54.230.100.12
server-54-230-100-12.iad2.r.cloudfront.net
December 4, 2015

54.192.103.101
server-54-192-103-101.iad2.r.cloudfront.net
December 4, 2015

54.192.102.153
server-54-192-102-153.iad2.r.cloudfront.net
December 4, 2015

54.192.100.212
server-54-192-100-212.iad2.r.cloudfront.net
December 4, 2015

216.137.33.174
server-216-137-33-174.iad2.r.cloudfront.net
December 4, 2015

54.230.103.151
server-54-230-103-151.iad2.r.cloudfront.net
December 4, 2015

54.230.103.37
server-54-230-103-37.iad2.r.cloudfront.net
December 4, 2015

54.230.193.163
server-54-230-193-163.iad53.r.cloudfront.net
October 20, 2015

54.192.195.245
server-54-192-195-245.iad53.r.cloudfront.net
October 20, 2015

54.192.195.199
server-54-192-195-199.iad53.r.cloudfront.net
October 20, 2015

54.192.195.194
server-54-192-195-194.iad53.r.cloudfront.net
October 20, 2015

54.192.195.62
server-54-192-195-62.iad53.r.cloudfront.net
October 20, 2015

54.239.152.252
server-54-239-152-252.iad53.r.cloudfront.net
October 20, 2015

 
Showing 30 of 48 IP Addresses

File downloads found at URLs served by secure-file.info.

0 / 68
https://secure-file.info/.../ProPCCleanerSetup.exe  (b531294ec55c4cb6bc259c762f6a3324)

1 / 68      (PUP)
http://secure-file.info/.../ProPCCleanerSetup.exe  (b861a4fc9ec392cd99634f185fa6cad8)

1 / 68      (PUP)
https://secure-file.info/.../ProPCCleanerSetup.exe  (propccleanersetup5.exe)

1 / 68      (PUP)
https://secure-file.info/.../ProPCCleanerSetup.exe  (1qfdcmepqtg==151.exe)

1 / 68      (PUP)
https://secure-file.info/.../ProPCCleanerSetup.exe  (5bdbaa5037bcba195fdf7dca052e3d25)

1 / 68      (PUP)
https://secure-file.info/.../ProPCCleanerSetup.exe  (1p1m8l01stw==53.exe)

1 / 68      (PUP)
https://secure-file.info/w/.../PROPCCleanerSoftwareSetup.exe  (5fc687b92fd9934ac58a306b9d05856b)

1 / 68      (PUP)
https://secure-file.info/.../ProPCCleanerSetup.exe  (1qfdcmepqtg==3.exe)

0 / 68
https://secure-file.info/ProPrivacyGuardSetup.exe  (badc196f41fc414791ee29e27bcdc1cd)

1 / 68      (PUP)
http://secure-file.info/w/.../ProfessionalPCCleanerSetup.exe  (apptemp.1.exe)

1 / 68      (PUP)
http://secure-file.info/w/.../PROPCCleanerSoftSetup.exe  (propccleanersoftsetup8.exe)

0 / 68
https://secure-file.info/.../ProPCCleanerSetup.exe  (propccleaner.exe)

1 / 68      (PUP)
https://secure-file.info/.../ProPCCleanerSetup.exe  (propccleaner.exe)

0 / 68
http://secure-file.info/w/.../ProfessionalPCCleanerSetup.exe  (28_10-09_30.exe)

1 / 68      (PUP)
http://secure-file.info/w/.../ProfessionalPCCleanerSetup.exe  (apptemp.1.exe)

1 / 68      (PUP)
https://secure-file.info/w/.../PROPCCleanerSoftwareSetup.exe  (b11c4a0d0fae50d222370a02db78fe8a)

0 / 68
http://secure-file.info/w/.../PROPCCleanerSoftwareSetup.exe  (141bc9b9badf89c967aaabc168cc18d2)

0 / 68
http://secure-file.info/.../ProPCCleanerSetup.exe  (48ffca70e3c1aa17cbaf67aeeb69bea5)

1 / 68      (PUP)
https://secure-file.info/.../ProPCCleanerSetup.exe  (86ab8a6e513450ffa6ff8ad6f623f697)

The following 2 files have been seen to comunicate with secure-file.info in live environments.

TCP » 54.192.195.245:443
produpd.exe (Vest's software office by Vest')

TCP » 54.230.16.55:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

URL:
http://secure-file.info/

Title:
“secure-file.info”

Network:
Amazon Cloudfront

SSL certificate subject:
CN=secure-file.info, OU=COMODO SSL, OU=Domain Control Validated

SSL certificate issuer:
CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.