home

thewrapapp.com

1&1 Internet Inc

Domain Information

The domain thewrapapp.com registered by 1&1 Internet Inc was initially registered in March of 2016 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Chesterbrook, Pennsylvania within the United States which resides on the 1&1 Internet Inc. network.
Registrar:
1&1 INTERNET SE

Server location:
Pennsylvania, United States (US)

Create date:
Thursday, March 3, 2016

Expires date:
Friday, March 3, 2017

Updated date:
Thursday, March 3, 2016

ASN:
AS8560 ONEANDONE-AS 1&1 Internet AG,DE

Whois:
3 thewrapapp.com records

Scanner detections:
Detections  (83% detected)

Scan engine
Details
Detections

Malwarebytes
PUP.Adware.RelevantKnowledge, PUP.Optional.Conduit.A, PUP.Optional.RKN
83.33%

Dr.Web
Adware.Relevant.81, Threat.Undefined, Adware.Relevant.119, Adware.Conduit.315
83.33%

VIPRE Antivirus
Wajam, Threat.4785227, Marketscore.RelevantKnowledge
83.33%

G Data
Adware.Relevant.BH, Win32.Adware.Conduit
83.33%

avast!
Win32:PUP-gen [PUP], NSIS:InstMonetizer-AD [PUP]
66.67%

Bitdefender
Adware.Relevant.BH
66.67%

Emsisoft Anti-Malware
Adware.Relevant.BH
66.67%

Comodo Security
ApplicUnwnt.Win32.AdWare.RK.~E
66.67%

Avira AntiVirus
ADSPY/NaviPromo.J, ADWARE/Adware.Gen
66.67%

ESET NOD32
Win32/Adware.RK.AQ, Win32/Adware.MarketScore
66.67%

AVG
RelevantKnowledge, Skodna.Generic_c
66.67%

NANO AntiVirus
Riskware.Win32.Conduit.deoucv, Trojan.Win32.Relevant.cbpeni, Trojan.Win32.Relevant.crgfum, Riskware.Win32.Conduit.dxppsi
66.67%

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
66.67%

Rising Antivirus
NS:PUF.SilenceInstaller!1.9DDF, PE:Malware.Generic/QRS!1.9E2D [F], PUA.Conduit!8.122-Ily1xduZE3V (Cloud)
66.67%

Agnitum Outpost
Adware.MarketScore
50.00%

The domain thewrapapp.com has been seen to resolve to the following 3 IP addresses.

192.195.77.35
perfora.net
April 4, 2016

50.63.202.85
ip-50-63-202-85.ip.secureserver.net
January 6, 2016

64.79.81.174
ae.51.4f.static.xlhost.com
November 1, 2014

File downloads found at URLs served by thewrapapp.com.

1 / 68      (inconclusive)
http://thewrapapp.com/www/delivery/ck.php?oaparams=2__bannerid=507__zoneid=9__OXLCA=1__cb=6c3f4bbbd5__oadest=http://www.wrapapp.net/apps/bullguard/downloads/.../BullGuardSetup_CH.exe  (770f8742d1cb4e0c4df5c495fe927696)

27 / 68    (PUP)
http://thewrapapp.com/www/delivery/ck.php?oaparams=2__bannerid=226__zoneid=16__OXLCA=1__cb=2d13da9ed9__oadest=http://www.wrapapp.net/apps/ImageBoost/downloads/.../ImageBoostSetup_CH.exe  (867823e3c3be1766b9dc38fc7d3b4838)

14 / 68    (PUP)
http://thewrapapp.com/www/delivery/ck.php?oaparams=2__bannerid=85__zoneid=2__OXLCA=1__cb=b923c60ec0__oadest=http://www.wrapapp.net/apps/mymusictube/downloads/.../mymusictubesetup_CH.exe  (mymusictubesetup_ff.exe)

23 / 68    (PUP)
http://thewrapapp.com/www/delivery/ck.php?oaparams=2__bannerid=63__zoneid=2__OXLCA=1__cb=b0a4da56bf__oadest=http://www.wrapapp.net/apps/mymusictube/downloads/int/.../mymusictubesetup_CH.exe  (0b76196206531239dd0e3afc8cc23d9b)

21 / 68    (PUP)
http://thewrapapp.com/www/delivery/ck.php?oaparams=2__bannerid=460__zoneid=57__OXLCA=1__cb=bcb20fa9d6__oadest=http://www.wrapapp.net/apps/BMICalculator/downloads/.../BMICalculatorSetup_CH.exe  (f855790e241cb56eed843976dfe0fb5f)

12 / 68    (PUP)
http://thewrapapp.com/www/delivery/ck.php?oaparams=2__bannerid=605__zoneid=80__source=affid=400435&sid=3260&hid=1002026528&c1=1029e249ff98842ef7ac82e00241fa__OXLCA=1__cb=0655bb5945__oadest=http://www.wrapapp.net/.../downloader.aspx?vid=5&affid=400435&sid=3260&hid=1002026528&c1=1029e249ff98842ef7ac82e00241fa  (panicattack-ebooksetup_v4-958.exe)

The following file have been seen to comunicate with thewrapapp.com in live environments.

TCP » 50.63.202.85:80
tunnel.exe (by Microsoft)

URL:
http://thewrapapp.com/

Web server:
Apache

abstime.com

compcollection.work

facecores.com

installspeed.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.