home

down.tututool.com

Xiamen eName Network Co., Ltd.

Domain Information

The domain down.tututool.com registered by Xiamen eName Network Co., Ltd. was initially registered in June of 2011 through ENAME TECHNOLOGY CO., LTD.. The hosted servers are located in Hangzhou, Zhejiang within China which resides on the Asia Pacific Network Information Centre network.
Registrar:
ENAME TECHNOLOGY CO., LTD.

Server location:
Zhejiang, China (CN)

Create date:
Tuesday, June 21, 2011

Expires date:
Friday, June 21, 2019

Updated date:
Saturday, August 10, 2013

ASN:
AS37963 CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd.,CN

Root domain:
tututool.com

Whois:
2 tututool.com records

Google Safe Browsing:
malware

Scan engine
Details
Detections

McAfee
Artemis!685658F57A4C, Artemis!63A8238D4AE8, Artemis!DD91C1DD42D1, Artemis!69DCE5295AD9, Artemis!AA948F60FB73
71.43%

avast!
Win32:Rootkit-gen [Rtk], Win32:Malware-gen
71.43%

IKARUS anti.virus
Win32.Malware, AdWare.Downloader
71.43%

Trend Micro House Call
TROJ_GEN.F47V0509, Suspicious_GEN.F47V0618, Suspicious_GEN.F47V0710
42.86%

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
42.86%

SUPERAntiSpyware
Trojan.Agent/Gen-Rootkit
28.57%

G Data
Win32.Trojan.Agent.XC53QJ, Win32.Application.Agent.T0ZQCK
28.57%

Dr.Web
BackDoor.Infector.133, Adware.Softcnapp.4
28.57%

Malwarebytes
Trojan.Agent.NS
14.29%

Zillya! Antivirus
Adware.Adwapper.Win32.7898
14.29%

AegisLab AV Signature
Win.Troj.m8Gz
14.29%

Clam AntiVirus
Win.Trojan.11306639-1
14.29%

Kaspersky
not-a-virus:Downloader.Win32.AdLoad
14.29%

NANO AntiVirus
Riskware.Win32.Softcnapp.edpiso
14.29%

Comodo Security
Application.Win32.InstallSoft.PAB
14.29%

The domain down.tututool.com has been seen to resolve to the following 9 IP addresses.

115.28.105.76
June 7, 2016

115.29.200.128
June 7, 2016

182.92.22.32
September 5, 2014

115.28.112.30
ip28.hichina.com
September 5, 2014

223.6.249.106
September 5, 2014

115.28.146.64
ip28.hichina.com
March 15, 2014

115.28.147.213
ip28.hichina.com
March 15, 2014

115.29.229.207
AY140120154205Z
March 15, 2014

115.29.9.31
AY140120154204Z
March 15, 2014

File downloads found at URLs served by down.tututool.com.

14 / 68    (PUP)
http://down.tututool.com/down.asp?id=186  (setup1687.exe)

0 / 68
http://down.tututool.com/down.asp?id=162  (setup_t162.exe)

2 / 68
http://down.tututool.com/down.asp?id=46  (setup_t024.exe)

6 / 68      (Malware)
http://down.tututool.com/down.asp?id=46  (setup_t024.exe)

6 / 68      (Malware)
http://down.tututool.com/down.asp?id=163  (setup1664.exe)

3 / 68      (inconclusive)
http://down.tututool.com/down.asp?id=405  (setup_t405.exe)

5 / 68      (Malware)
http://down.tututool.com/down4.asp?id=162  (setup_t002.exe)

5 / 68      (Malware)
http://down.tututool.com/down.asp?id=162  (setup_t002.exe)

1 / 68      (inconclusive)
http://down.tututool.com/down2.asp?id=99  (setup_t014.exe)

1 / 68      (inconclusive)
http://down.tututool.com/down.asp?id=99  (setup_t014.exe)

1 / 68      (inconclusive)
http://down.tututool.com/down1.asp?id=24  (setup_t014.exe)

1 / 68      (inconclusive)
http://down.tututool.com/down.asp?id=24  (setup_t014.exe)

URL:
http://down.tututool.com/

Web server:
ASP.NET (ASP.NET) (ASP.NET) (ASP.NET)

dns-vip.net

haharili.com

vstart.net

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.