» starticles.info
Overview
Analysis
IPs Addresses (8)
Downloads (13)
Network (5)
Website Detail

starticles.info

Tzvi Fashlesky

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.

Registrant:

Tzvi Fashlesky

Registrar:

Dynadot, LLC (R259-LRMS)

Server location:

Oregon, United States (US)

ASN:

AS16509 AMAZON-02 - Amazon.com, Inc.,US

Whois:

1 starticles.info record

Google Safe Browsing:

unwanted

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.WebPick, Threat.Win.Reputation.IMP, Adware.BrowserPlugin.Meta (M), PUP.WebPick.StepanRy (M)

91.67%

Emsisoft Anti-Malware

Gen:Variant.Adware.Symmi.49687, Gen:Variant.Adware.MPlug.29, Gen:Variant.Adware.Kazy.552220, Gen:Variant.Adware.MPLug.35

66.67%

AVG

Adware Generic6.KDR, Adware Generic6.JDP, Adware Generic6.MKM

66.67%

Lavasoft Ad-Aware

Gen:Variant.Adware.Symmi.49687, Gen:Variant.Adware.MPlug.29, Gen:Variant.Adware.Kazy.552220, Gen:Variant.Adware.MPLug.35

66.67%

MicroWorld eScan

Gen:Variant.Adware.Symmi.49687, Gen:Variant.Adware.MPlug.29, Win32.Ramnit, Gen:Variant.Adware.Kazy.552220, Gen:Variant.Adware.MPLug.35

66.67%

K7 AntiVirus

Unwanted-Program , Virus

66.67%

Bitdefender

Gen:Variant.Adware.Symmi.49687, Gen:Variant.Adware.MPlug.29, Win32.Ramnit, Gen:Variant.Adware.Kazy.552220, Gen:Variant.Adware.MPLug.35

66.67%

Avira AntiVirus

ADWARE/MultiPlug.Gen4, W32/Ramnit.A, ADWARE/MultiPlug.Gen7, TR/Crypt.XPACK.Gen

66.67%

G Data

Gen:Variant.Adware.Symmi.49687, Gen:Variant.Adware.MPlug.29, Win32.Ramnit, Gen:Variant.Adware.Kazy.552220, Gen:Variant.Adware.MPLug.35

66.67%

AhnLab V3 Security

PUP/Win32.MultiPlug, Win32/Ramnit.B

66.67%

McAfee

MultiPlug-FUV, Program.MultiPlug-FUV, Program.MultiPlug-FVF, Program.Multiplug-FVQ, Program.MultiPlug-FWG, Program.MultiPlug-FRG

66.67%

F-Secure

Gen:Variant.Adware.Symmi.49687, Gen:Variant.Adware.MPlug.29, Gen:Variant.Adware.Kazy.552220, Gen:Variant.Adware.Multiplug

58.33%

ESET NOD32

Win32/Adware.MultiPlug.ED application, Win32/Adware.MultiPlug.EP application, Win32/Adware.MultiPlug.ES application

58.33%

Sophos

PUA 'MultiPlug' (of type Adware), Virus 'W32/Patched-I'

58.33%

NANO AntiVirus

Riskware.Win32.MultiPlug.dmylzc, Riskware.Win32.MultiPlug.dmxvvq, Virus.Win32.Nimnul.bpchjo, Riskware.Win32.MultiPlug.dnbqjp

58.33%

The domain starticles.info has been seen to resolve to the following 8 IP addresses.

52.27.128.56

ec2-52-27-128-56.us-west-2.compute.amazonaws.com

August 11, 2015

52.27.128.62

ec2-52-27-128-62.us-west-2.compute.amazonaws.com

August 11, 2015

52.27.128.59

ec2-52-27-128-59.us-west-2.compute.amazonaws.com

August 11, 2015

52.26.142.209

ec2-52-26-142-209.us-west-2.compute.amazonaws.com

July 1, 2015

52.11.167.137

ec2-52-11-167-137.us-west-2.compute.amazonaws.com

July 1, 2015

54.69.228.231

ec2-54-69-228-231.us-west-2.compute.amazonaws.com

May 4, 2015

54.149.241.47

ec2-54-149-241-47.us-west-2.compute.amazonaws.com

May 4, 2015

54.148.67.213

ec2-54-148-67-213.us-west-2.compute.amazonaws.com

February 13, 2015

File downloads found at URLs served by starticles.info.

1 / 68 (Adware)

http://starticles.info/v2606?self_redirect=0&product_name=Interview With Death Row Serial Killer - Douglas Feldman - Werner Herzog Full Documentary.mp3&filesize=&product_title=ListenToYouTube.com&installer_file_name=Interview With Death Row Serial Killer - Douglas Feldman - Werner Herzog Full Documentary.mp3&product_file_name=Interview With Death Row Serial Killer - Douglas Feldman - Werner Herzog Full Documentary.mp3&product_download_url=http://srv39.listentoyoutube.com/download/.../Interview With Death Row Serial Killer - Douglas Feldman - Werner Herzog Full Documentary.mp3 (823391972140555829686d45c9fdea81)

1 / 68 (PUP)

http://starticles.info/v20014?self_redirect=0&product_name=Agatha Christies Poirot Murder in the Mews S01E02 Polish 1CD&file size=&product_title=Agatha Christies Poirot Murder in the Mews (1989)&installer_file_name=agatha-christies-poirot-murder-in-the-mews-pol-3340795&product_file_name=agatha-christies-poirot-murder-in-the-mews-pol-3340795.zip&product_download_url=http://dl.opensubtitles.org/pl/download/.../3340795 (agatha-christies-poirot-murder-in-the-mews-pol-3340795.exe)

1 / 68 (Malware)

http://starticles.info/v2606?self_redirect=0&product_name=Ariana Grande ft. Big Sean - Best Mistake Lyrics.mp3&filesize=&product_title=ListenToYouTube.com&installer_file_name=Ariana Grande ft. Big Sean - Best Mistake Lyrics.mp3&product_file_name=Ariana Grande ft. Big Sean - Best Mistake Lyrics.mp3&product_download_url=http://srv46.listentoyoutube.com/download/.../Ariana Grande ft. Big Sean - Best Mistake Lyrics.mp3 (ariana grande ft. big sean - best mistake lyrics.mp3.exe)

1 / 68 (Malware)

http://starticles.info/v3500?self_redirect=0&product_name=Justice - We Are Your Friends [HQ Sound].mp3&filesize=&product_title=Vidtomp3.com&installer_file_name=Justice - We Are Your Friends [HQ Sound].mp3&product_file_name=Justice - We Are Your Friends [HQ Sound].mp3&product_download_url=http://srv74.vidtomp3.com/download/.../Justice - We Are Your Friends [HQ Sound].mp3 (justice - we are your friends [hq sound].mp3.exe)

1 / 68 (Malware)

25 / 68 (PUP)

http://starticles.info/v20014?self_redirect=0&product_name=Star Wars Portuguese 1CD&file size=&product_title=Star Wars (1977)&installer_file_name=star-wars-por-4890743&product_file_name=star-wars-por-4890743.zip&product_download_url=http://dl.opensubtitles.org/pt/download/.../4890743 (star-wars-por-4890743.exe)

24 / 68 (PUP)

http://starticles.info/v2111?self_redirect=0&product_name=All-Star Baseball 2001&file size=&product_title=All-Star Baseball 2001&installer_file_name=All-Star Baseball 2001&product_file_name=All-Star Baseball 2001.exe&product_download_url=http://n64.freeroms.com/n64-roms/3/allstarbaseball2001.zip&reffer=http://.../dm_download.php?system=N64&game_id=3944&affiliate_id=n64&affiliate_id=n64 (b41762c44bb99d0a42b72d8b8f15303d)

23 / 68 (Adware)

http://starticles.info/v2606?self_redirect=0&product_name=Season 5 2015 Login Screen with Music - League of Legends.mp3&filesize=&product_title=ListenToYouTube.com&installer_file_name=Season 5 2015 Login Screen with Music - League of Legends.mp3&product_file_name=Season 5 2015 Login Screen with Music - League of Legends.mp3&product_download_url=http://srv78.listentoyoutube.com/download/.../Season 5 2015 Login Screen with Music - League of Legends.mp3 (season 5 2015 login screen with music - league of legends.mp3.exe)

23 / 68 (Adware)

17 / 68 (PUP)

http://starticles.info/v20014?self_redirect=0&product_name=Dawn of the Planet of the Apes Italian 1CD&file size=&product_title=Dawn of the Planet of the Apes (2014)&installer_file_name=dawn-of-the-planet-of-the-apes-ita-5895075&product_file_name=dawn-of-the-planet-of-the-apes-ita-5895075.zip&product_download_url=http://dl.opensubtitles.org/it/download/.../5895075 (dawn-of-the-planet-of-the-apes-ita-5895075.exe)

22 / 68 (PUP)

http://starticles.info/v2606?self_redirect=0&product_name=James Brown - Living in America.mp3&filesize=&product_title=ListenToYouTube.com&installer_file_name=James Brown - Living in America.mp3&product_file_name=James Brown - Living in America.mp3&product_download_url=http://srv77.listentoyoutube.com/download/.../James Brown - Living in America.mp3 (james brown - living in america.mp3.exe)

41 / 68 (PUP)

http://starticles.info/v21773?self_redirect=0&product_name=Dispatch Two Coins.mp3&filesize=7.18 MB&product_title=Dispatch Two Coins.mp3&installer_file_name=Dispatch Two Coins.mp3&product_file_name=Dispatch Two Coins.mp3&q=Dispatch Two Coins.mp3&product_download_url=http://.../fil.php?s=srv0004&id=31313137353632365f37313937393738362f53495a4537353332393137&t=Dispatch - Two coins.mp3&dl=1 (dispatch two coins.mp3.exe)

26 / 68 (PUP)

http://starticles.info/v2606?self_redirect=0&product_name=O.T. Genasis - CoCo [Music Video].mp3&filesize=&product_title=ListenToYouTube.com&installer_file_name=O.T. Genasis - CoCo [Music Video].mp3&product_file_name=O.T. Genasis - CoCo [Music Video].mp3&product_download_url=http://srv74.listentoyoutube.com/download/.../O.T. Genasis - CoCo [Music Video].mp3 (o.t. genasis - coco [music video].mp3.exe)

The following 5 files have been seen to comunicate with starticles.info in live environments.

TCP » 52.11.167.137:80

download.exe

TCP » 52.27.128.56:80

updating.exe

TCP » 52.27.128.59:80

download.exe

TCP » 52.27.128.62:80

updating.exe

TCP » 54.149.241.47:80

papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80

installer_game develop.exe

TCP » 54.69.228.231:80

download.exe

URL:

http://starticles.info/

Network:

Amazon Web Services (AWS), running an EC2 instance

Web server:

openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.