The domain ttb.popdls.com is registered by proxy through SOLUCIONES CORPORATIVAS IP, SL and was originally registered in December of 2012. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter. The domain is associated with the publisher Tuguu SL who is located in Adeje, Santa Cruz De Tenerife in Spain.
Registrant:
Only contact by email, all postal mail will be rejected on behalf of
Tuguu SLRegistrar:
SOLUCIONES CORPORATIVAS IP, SL
Server location:
Oregon, United States (US)
Create date:
Wednesday, December 19, 2012
Expires date:
Monday, December 19, 2016
Updated date:
Thursday, December 31, 2015
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Scanner detections:
Detections (94% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.SmartSecureSoftwareSl.J, PUP.AVSoftwareEOOD.J, PUP.SmartSecureSoftwareSl.I, PUP.VolvanPremiumSL.N, PUP.Softpulse, PUP.Installer.Softpulse, PUP.Bundler.Softpulse, PUP.Softpulse.VolvanPremium.Bundler (M), PUP.Softpulse.SmartSecureSoftwareSl.Bundler (M), PUP.Softpulse.SmartSec.Bundler (M), PUP.Softpulse.Bundler (M), PUP.Softpulse (M)
94.44%
VIPRE Antivirus
Threat.4783262, Threat.4150696, Threat.4783235
44.44%
AVG
Found Win32/DH{gRJ UIEHeVRPFVGBFYEJHFOBE0GBDw}, Generic, Found Win32/DH{gRIxflCBB3lUTxVRgQkcU4ET}, Found Win32/DH{gRIxfX5QgQd5VE8VUYEVgQkcU4ETQYEP}
44.44%
McAfee
Socrydo, SoftPulse, SoftPulse.a, Program.SoftPulse
44.44%
avast!
Win32:GenMalicious-HN [PUP], Win32:SoftPulse-V [PUP], Win32:SoftPulse-BJ [PUP], Win32:SoftPulse-AH [PUP], Win32:SoftPulse-DE [Adw]
38.89%
Avira AntiVirus
TR/Dropper.Gen, APPL/Softpulse.oang, PUA/SoftPulse.oanj, PUA/SoftPulse.oang
38.89%
Panda Antivirus
Trj/Genetic.gen
38.89%
Dr.Web
Trojan.DownLoader11.24441, Trojan.Click3.3888, Adware.SoftPules.3, Adware.SoftPules.3, Trojan.Click3.3888
33.33%
ESET NOD32
Win32/SoftPulse.J potentially unwanted application, Win32/SoftPulse.H potentially unwanted application, Win32/SoftPulse.R potentially unwanted application
33.33%
K7 AntiVirus
Unwanted-Program
33.33%
Sophos
Smart Secure Software, PUA 'Smart Secure Software' (of type Adware), PUA 'SoftPulse' (of type Adware)
33.33%
AhnLab V3 Security
PUP/Win32.DomaIQ, Win-PUP/DomaIQ.Gen, PUP/Win32.SoftPulse
33.33%
Kaspersky
Trojan.Win32.Buzus, HEUR:Trojan.Win32.Generic, Trojan.Win32.Inject, not-a-virus:AdWare.Win32.SoftPulse
33.33%
Norman
Malware, Gen:Variant.Application.Bundler.SoftPulse.4, Gen:Variant.Adware.Graftor.165890
27.78%
NANO AntiVirus
Trojan.Win32.DownLoader11.ddvhzo, Trojan.Win32.Buzus.ddtjxz, Riskware.Win32.SoftPulse.dmopks
27.78%
The domain ttb.popdls.com has been seen to resolve to the following 4 IP addresses.
ec2-52-10-156-255.us-west-2.compute.amazonaws.com
January 30, 2016
ec2-54-149-159-30.us-west-2.compute.amazonaws.com
January 30, 2016
ec2-50-112-177-75.us-west-2.compute.amazonaws.com
August 19, 2014
ec2-54-201-201-245.us-west-2.compute.amazonaws.com
August 19, 2014
File downloads found at URLs served by ttb.popdls.com.
The following 2 files have been seen to comunicate with ttb.popdls.com in live environments.
URL:
http://ttb.popdls.com/
Network:
Amazon Web Services (AWS), running an EC2 instance
Web server:
nginx (PHP/5.3.10-1ubuntu3.17)
Related Domains