[Fixed]AVAST block SITE CyberLocker http://www.idup.in/

Viruses and worms
1

This a CyberLocker of great quality used by several release groups.

Heres de Virus Total scan:
Of the Site Itself:
https://www.virustotal.com/pt/url/8b885d93b7cbb5065cd8a43609e0c3acb8ab017a285ae25fb04206ff401f7019/analysis/1425335081/

And one Download Link:
https://www.virustotal.com/pt/url/ed0db0b9f577500012f27838b97c493e424e432e4e5e532db807aed00d3317cf/analysis/1425335247/

2

This is the object I tracked: scheme host path type query aid cid date patterns objects name affilition
htxp://xch.directrev.com/js/gb.min.js?s=S0006198 htxp xch.directrev.com /js/gb.min.js ad s=S0006198 1405 2398 2015-03-02 23:35:42 .directrev.com htxp://xch.directrev.com/js/gb.min.js?s=S0006198 DirectREV
This link checked: htxps://adrich.cash/
Reverse Entries for MX records issue. WARNING: MX records duplicates (same IP address):
38.113.116.213: [mx1.mail.name.com. mx3.mail.name.com.]
Tries to prove it is above board: http://adrich.cash.webstatsdomain.org/ it might well be, but because it is down it might well be abused on -ns3sxz.name.com . -adrich.cash,50.62.194.71,-ns3sxz.name.com,Parked/expired,

I think the block is legit,

polonus (volunteer website security analyst and website error-hunter)

3

Also consider: http://www.antispam.ru/cgi-bin/1/whois?query=ns3sxz.name.com&targetnic=auto
IP followed by -http://anti-hacker-alliance.com/index.php?details=98.124.246.2

Damian

4

This CyberLocker is pretty DECENT, barely have ADS, DOES NOT ask to download “download managers” or any .EXE what so EVER, just straight UP DIRECT LINK for file download, with FULL SPEED.

I am worry cuz it is USED by TOP release groups like GANOOL and OTHERS. That’s how TORRENT uploaders get the files and MAKE available for everyone ELSE

AVAST team, please HELP the site be available AGAIN for us AVAST fans.

PS: [size=12pt]@ polonus[/size]
Hello friend, hope you are WELL.
Thanks for drop by, hopefully we’ll get this issue straighten out as well with the SITE back ON for AVAST users everywhere.

5
This a CyberLocker of great quality used by several release groups.
Sure... 100.000's of Lemmings can't be wrong as they jump of a cliff ::)
barely have ADS
So it is addware(!)

http://www.urlvoid.com/scan/idup.in/
http://zulu.zscaler.com/submission/show/ee8b484676d4fad500682a8be275c078-1425348460

Ganool is offering illegal downloads(!)

VT is not scanning websites(!)

It is time you stop visiting malicious websites and do illegal things.

https://www.virustotal.com/pt/url/ed0db0b9f577500012f27838b97c493e424e432e4e5e532db807aed00d3317cf/analysis/1425335247/
That is not a download link, it is a html page.