» www.fastfileftp.info
Overview
Analysis
IPs Addresses (2)
Downloads (15)
Network (231)
Website Detail

www.fastfileftp.info

Whois Proof LLP (Proxy Registrant)

Domain Information

The domain www.fastfileftp.info is registered by proxy through eNom, Inc. (R126-LRMS) and was originally registered in February of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Belfast, Northern Ireland within United Kingdom which resides on the RIPE Network Coordination Centre network.

Registrant:

Whois Proof LLP

Registrar:

eNom, Inc. (R126-LRMS)

Server location:

Northern Ireland, United Kingdom (GB)

Create date:

Friday, February 15, 2013

Expires date:

Saturday, February 15, 2014

Updated date:

Tuesday, December 31, 2013

Root domain:

fastfileftp.info

Whois:

1 fastfileftp.info record

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

Adware.WebPick.Installer.V, Adware.WebPick.Installer.EE, Adware.WebPick.Installer.N, Adware.WebPick.Installer.X, Adware.WebPick.Installer (M), Adware (M)

100.00%

Dr.Web

Adware.Downware.1166, Adware.Downware.893, Adware.Downware.1166, Adware.Downware.893, Adware.Downware.980

36.36%

VIPRE Antivirus

Installerex/WebPick, Threat.4753027

36.36%

avast!

Win32:InstalleRex-Q [PUP], Win32:Downloader-UZF [PUP], Win32:InstalleRex-Y [PUP]

36.36%

F-Prot

W32/InstallRex.B, W32/InstallRex.B.gen

36.36%

Kaspersky

not-a-virus:AdWare.Win32.Agent, not-a-virus:HEUR:Downloader.Win32.AdLoad

36.36%

AVG

MalSign.Skodna.Pick, Adware AdInstaller.P

36.36%

Malwarebytes

PUP.Optional.Installex, PUP.Optional.InstallRex, PUP.Optional.InstalleRex

36.36%

K7 AntiVirus

Trojan , Unwanted-Program

36.36%

NANO AntiVirus

Riskware.Win32.Adware.crcapm, Riskware.Win32.Agent.crfikv, Riskware.Win32.Downware.cscrfw, Riskware.Win32.Downware.crunuw

36.36%

Comodo Security

Application.Win32.InstalleRex.KG, Application.Win32.Agent.V

36.36%

Zillya! Antivirus

Dropper.Injector.Win32.55108, Dropper.Agent.Win32.131592, Trojan.Badur.Win32.1370, Dropper.Agent.Win32.147349

36.36%

Sophos

InstallRex, PUA 'InstallRex'

36.36%

Avira AntiVirus

ADWARE/InstallRex.Gen

36.36%

G Data

Win32.Application.InstalleRex, Gen:Variant.Application.Bundler.InstallRex

36.36%

The domain www.fastfileftp.info has been seen to resolve to the following 2 IP addresses.

92.242.140.21

unallocated.barefruit.co.uk

May 5, 2015

54.201.215.30

ec2-54-201-215-30.us-west-2.compute.amazonaws.com

February 8, 2014

File downloads found at URLs served by www.fastfileftp.info.

1 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=atn.zip&product_name=atn.zip&product_download_url=http://fs08n4.sendspace.com/dllp/a43984f703a6e96845ea673ea729b510/513860e3/000000/la2iki/atn.zip&reffer=http://www.sendspace.com/.../la2iki&uuid= (atn.zip.exe)

1 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=Lil_Wayne-I_Am_Not_A_Human_Being_II-Deluxe_Edition-RapGodFathers.info.zip&product_name=Lil_Wayne-I_Am_Not_A_Human_Being_II-(Deluxe_Edition)-(RapGodFathers.info).zip&product_download_url=http://fs13n3.sendspace.com/dllp/8b7429c53c091757b329f2333ec62205/514c1e57/000000/mmpf7x/Lil_Wayne-I_Am_Not_A_Human_Being_II-(Deluxe_Edition)-(RapGodFathers.info).zip&reffer=http://www.sendspace.com/.../mmpf7x&uuid= (lil_wayne-i_am_not_a_human_being_ii-deluxe_edition-rapgodfathers.info.zip.exe)

1 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=THE PROFOUND BOND trailer.wmv&product_name=THE PROFOUND BOND trailer.wmv&product_download_url=http://fs13n1.sendspace.com/dllp/5cc52ecc6112e98404b000dbdb44606a/5151b87f/000000/bqj2ft/THE PROFOUND BOND trailer.wmv&reffer=http://www.sendspace.com/.../bqj2ft&uuid= (the profound bond trailer.wmv.exe)

1 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=CD LA Hinchada DEL ROJO PARTE 1 soydiablo_com_ar.mp3&product_name=CD LA Hinchada DEL ROJO PARTE 1 soydiablo_com_ar.mp3&product_download_url=http://fs05n1.sendspace.com/dllp/563852240341ef07de553a2d3131b214/513cdf32/000000/fhxvy8/CD LA Hinchada DEL ROJO PARTE 1 soydiablo_com_ar.mp3&reffer=http://www.sendspace.com/.../fhxvy8&uuid= (cd la hinchada del rojo parte 1 soydiablo_com_ar.mp3.exe)

1 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=instalador de Jos Dream - Cafe Organico.rar&product_name=instalador de Jos Dream - Cafe Organico.rar&product_download_url=http://fs09n5.sendspace.com/dllp/e47608b2f788d2fe228c7d933aa5bbc3/514254f0/000000/14xwi6/instalador de Jos Dream - Cafe Organico.rar&reffer=http://www.sendspace.com/.../14xwi6&uuid= (instalador de jos dream - cafe organico.rar.exe)

1 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=Thizzler.com amp So True Music Group present Highway Rue.zip&product_name=Thizzler.com &_So_True_Music_Group_present_Highway_Rue_zip=&product_download_url=http://fs07n5.sendspace.com/dllp/557e705e2f7dfd9457acedb1f2b5c8d0/5131439c/000000/xel6iw/Thizzler.com & So True Music Group present Highway Rue.zip&reffer=http://www.sendspace.com/.../xel6iw&uuid= (thizzler.com amp so true music group present highway rue.zip.exe)

33 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=Scrunchies amp Headbands_ The 90s RnB Mix.mp3&product_name=Scrunchies &_Headbands__The_90s_RnB_Mix_mp3=&product_download_url=http://fs09n2.sendspace.com/dllp/0002220a45c405f50d790c086782a780/514207c1/000000/4eb63j/Scrunchies & Headbands_ The 90s RnB Mix.mp3&reffer=http://www.sendspace.com/.../4eb63j&uuid= (scrunchies amp headbands_ the 90s rnb mix.mp3.exe)

25 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=Synapse.Audio.DUNE.VSTi.zip&product_name=Synapse.Audio.DUNE.VSTi.zip&product_download_url=http://fs09n1.sendspace.com/dllp/1de4eed98ae9aa6c7c0bdfdf1ff5d293/512e88f1/000000/2j76yn/Synapse.Audio.DUNE.VSTi.zip&reffer=http://www.sendspace.com/.../2j76yn&uuid= (synapse.audio.dune.vsti.zip.exe)

26 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=CliffDive3.zip&product_name=CliffDive3.zip&product_download_url=http://fs03n2.sendspace.com/dllp/a5b7fd079846554b821d91d2d4e2548f/518274b7/000000/8tcgir/CliffDive3.zip&reffer=http://www.sendspace.com/.../8tcgir&uuid= (cliffdive3.zip.exe)

26 / 68 (Adware)

http://www.fastfileftp.info/v34?installer_file_name=CliffDive3.zip&product_name=CliffDive3.zip&product_download_url=http://fs03n2.sendspace.com/dllp/a5b7fd079846554b821d91d2d4e2548f/518274b7/000000/8tcgir/CliffDive3.zip&reffer=http://www.sendspace.com/.../8tcgir (cliffdive3.zip.exe)

39 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=Flikken.Maastricht.S07E10.Kick.mkv&product_name=Flikken.Maastricht.S07E10.Kick.mkv&product_download_url=http://fs13n4.sendspace.com/dllp/0ccd1c982ae705a39ebb0ee0e44ddca4/51934b25/000000/zmlg1e/Flikken.Maastricht.S07E10.Kick.mkv&reffer=http://www.sendspace.com/.../zmlg1e&uuid= (flikken.maastricht.s07e10.kick.mkv.exe)

39 / 68 (Adware)

http://www.fastfileftp.info/v34?installer_file_name=Flikken.Maastricht.S07E10.Kick.mkv&product_name=Flikken.Maastricht.S07E10.Kick.mkv&product_download_url=http://fs13n4.sendspace.com/dllp/0ccd1c982ae705a39ebb0ee0e44ddca4/51934b25/000000/zmlg1e/Flikken.Maastricht.S07E10.Kick.mkv&reffer=http://www.sendspace.com/.../zmlg1e (flikken.maastricht.s07e10.kick.mkv.exe)

1 / 68 (Adware)

http://www.fastfileftp.info/v34/?installer_file_name=Lightroom_3_LS11x32.7z&product_name=Lightroom_3_LS11x32.7z&product_download_url=http://fs05n1.sendspace.com/dllp/df8dce70e4322fa13db787047c401a50/512399f9/000000/mvhcr1/Lightroom_3_LS11x32.7z&reffer=http://www.sendspace.com/.../mvhcr1 (lightroom_3_ls11x32.7z.exe)

The following 231 files have been seen to comunicate with www.fastfileftp.info in live environments.

TCP » 92.242.140.21:80

smelled.exe (Smelled)

TCP » 92.242.140.21:443

dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80

marini.exe (Marini)

TCP » 92.242.140.21:443

client.exe (ClientWrapper)

TCP » 92.242.140.21:80

thebrowser.exe (TheBrowser by Goobzo)

TCP » 92.242.140.21:443

dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:443

WindowService.exe (WindowService)

TCP » 92.242.140.21:443

ciuninstall.exe

TCP » 92.242.140.21:1866

jutched.exe

TCP » 92.242.140.21:443

dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80

masterupdater.exe

TCP » 54.201.215.30:80

whd 7.2.exe (SnowApp)

TCP » 92.242.140.21:80

pricemeterexpress.crx

TCP » 92.242.140.21:80

chrome.crx

TCP » 92.242.140.21:80

app-center.crx

TCP » 92.242.140.21:80

ntp.crx

TCP » 92.242.140.21:80

3dayinvite.crx

TCP » 92.242.140.21:80

twitter.crx

TCP » 92.242.140.21:80

viewlater.crx

TCP » 92.242.140.21:80

rss.crx

Latest 20 of 231 files

URL:

http://www.fastfileftp.info/

Title:

“Welcome to nginx!”

Web server:

nginx/1.0.15

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.