home

a.roundtriptrack.com

Whois Privacy Corp.

Domain Information

The domain a.roundtriptrack.com registered by Whois Privacy Corp. was initially registered in March of 2015 through TLD REGISTRAR SOLUTIONS LTD. Currently this domain has been known to host various forms of malware. The hosted servers are located in Dublin, Dublin City within Ireland which resides on the Amazon Technologies Inc. network.
Registrar:
TLD REGISTRAR SOLUTIONS LTD

Server location:
Dublin City, Ireland (IE)

Create date:
Saturday, March 7, 2015

Expires date:
Tuesday, March 7, 2017

Updated date:
Tuesday, March 8, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
roundtriptrack.com

Whois:
2 roundtriptrack.com records

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

The domain a.roundtriptrack.com has been seen to resolve to the following 4 IP addresses.

54.72.130.67
ns1.ibspark.com
April 12, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 7, 2015

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 7, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 7, 2015

File downloads found at URLs served by a.roundtriptrack.com.

1 / 68      (Malware)
http://a.roundtriptrack.com/hp/?q=DSFigTf9vS1optvqom2Sg2zFLYF0bIziyHNEI9PuLKB 4i8ywOh745qFvWIRzaarPTKV 5p M1ujoPrLyC759PXgpb6jvjG1pJdt3R5azLKX5Hnpxtraw0MVn CzxOA9kJTEslvX6RjWKfv6ZbwdF8/FxgrpyRL0qxNqi679nQ0T/Nuj1SpxbVG7QnKbgTAQETsxhQB EBoUoE6OHT1Km/wFY35c29WTGsBq2NZEZR3m4hhh8bR9J3rpN3eanasCHz8me5zsVo6Czk5qh8iRMbzIqAglvRIsHuUAaPEGQpLBhRJe1n vW/ukV3pl/.../kFfi13aXw15gbTDrXodQjy9LzzbRerI1BoJihYc&external_id=1435618042979931961  (crack karafun studio 1 18.exe)

1 / 68      (Malware)
http://a.roundtriptrack.com/hp/?q=bH laFa4XxcHbLFHwymDqrSCUthf4iW6pco5zquClyK tQbRM8IsHy6ZdQzEe1fwQ7SyeFZ8wA0AnHK NWIuASRDHetfvqu8AT KOuTmq0uTMZIYaUav5mu2RqEOt3P1iVp2WYnHFwNF7ahvnRPXod5uHQpbqMa18srVpIk9s4pgplMoxOMzFmi1Qbu2ixWirS1r8rLpVIhMBAlYLc Ktq2jam4IgjvBy ApuGOOpH8alX6MqvaIlOyjO/.../TprBmRcVYjDYaA3dYh0tPUMhUFTYPFUViHsIsm52tiHXwGCmsZ6MPYC6HDKmQWpqbwOrp6LiJxFReujB7YFynsuVfEhNpxLfpkuWT daCzhERSNWOPQ9pSFV1WIIOUTSnf2ThaI&external_id=1435620136328093654  (cam frog pro 5.1.exe)

1 / 68      (Malware)
http://a.roundtriptrack.com/hp/?q=g9Pupl/SS/0LBCDWYSJSX5ZsnBc4vWEOtfxvd7/CQCJMmNWrT3Hq0d3nXBUDXbzZCj0dYplJSidjwEuuLZy8eKDmH3rGWPfI gq 45GrDUi55VrlstIytkLS3OV3WkZ5yOSaJ4NJLcvXpaqFtDFajRfMxk5QV7VryOpCFFNCA4uK/IwE0EixbVGEXelo Mt VXF Mo/mLyMINGA8G51VJZFhcx0wdl3XTwQOUmBtXlpHxNYhUyxA4KvTjNhf5kCwoRY EqxYFTFn7Pn0KSPwgFxHYe4G/j1x1SxMh DejBbVWNk97dBLyRsPVW2sYiItLLyrc3kdkAnNapHKdkNs2xDj79uP1shdodhbrwyPxBO5sYlM2ATxzbuEjsxgP/YWFiSYiaIrVof26xx3G7wD55mSuhPuf0JDDc82UyDrSls lAkI/.../9dkXkpzSZZkkba5j6DoM95YTxiuc3mtVy0AYYmTvBu0&external_id=1435613640811022002  (all about my mother 1999 english subs included.exe)

1 / 68      (Malware)
http://a.roundtriptrack.com/hp/?q=8fp4wDzl mlC5surpnbZCxb2Z9EONHC2UiY1ytypAtCJsdvnO78yaIYObu3BRL826RPRO8PdXSN2zHCsh1v2lqDj2YeJY2NLf UDxuK8IiEaEX9tT60RznOVglB7tWBBHwqMwoZtWr YA/.../3NFPpXMPqZONwhvki0b29rdEIGt1vGIjn9 y1nIELK4kk1kQWIum2 XGM5O6WTDJXVIX5lywSe8eLz5cOhvjU8CzG9wrmY1cVbcv5z9uF8eN0VLB2DDni7UvC0w7ogL8X6 tRtGIMdYOr6chk lA1Jw0prxzaPmyMMM8y 9yIeFEjVA 5U3rDTroh4Mh842Q7S4TeOplCzWa BnOT8MJo7yoLchtsUmdkxZsmjidKpcxGdeClKyi1w8l1ByJ&external_id=1435606769340599402  (samantha schutz - i don.exe)

The following 144 files have been seen to comunicate with a.roundtriptrack.com in live environments.

TCP » 54.72.130.67:80
simplefilesupdater.exe (SimpleFiles Application by http://simple-files.com/)

TCP » 54.72.130.67:80
yourfileupdater.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
uninstall12590625.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
uninstall5322109.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
yourfileupdater.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
uninstall190602.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
yourfileupdater.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
googleupdate.exe

TCP » 54.72.130.67:80
browserserver.exe

TCP » 54.72.130.67:80
sm.exe (System Monitor)

TCP » 54.72.130.67:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.72.130.67:80
uninstall129231.exe (SimpleFiles Application by http://simple-files.com/)

TCP » 54.72.130.67:80
sfupdater.exe (SimpleFiles Application by http://simple-files.com/)

TCP » 54.72.130.67:80
kometa.exe (Kometa by @COMPANY_FULLNAME@)

TCP » 54.72.130.67:80
TBNotifier.exe (Ask TBNotifier by APN)

TCP » 54.72.130.67:80
pepperzip.exe

TCP » 54.72.130.67:80
internetenhancer.exe (Internet Enhancer)

TCP » 54.72.130.67:80
ssn.exe (ssn)

TCP » 54.72.130.67:443
mintcast_updater_service.exe (AutomaticUpdater)

TCP » 54.72.130.67:80
yacqq.exe

 
Latest 20 of 157 files

URL:
http://a.roundtriptrack.com/

Title:
“roundtriptrack.com”

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.