home

ttb.videoplayernow.com

Domain Information

Server location:
Dublin City, Ireland (IE)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.

Root domain:
videoplayernow.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.TuguuSLU.I, PUP.Tuguu.LunacomI.Bundler (M), PUP.Tuguu.TuguuU.Bundler (M), PUP.Tuguu.Bundler (M)
100.00%

avast!
DomaIQ-AS [PUP]
16.67%

McAfee
Program.CryptDomaIQ
16.67%

Dr.Web
Adware.Downware.1674
16.67%

ESET NOD32
Win32/DomaIQ.AM potentially unwanted application
16.67%

Lavasoft Ad-Aware
Dropped:Application.Bundler.DomaIQ.Q
16.67%

F-Secure
Riskware.Dropped:Application.Bundler.DomaIQ
16.67%

VIPRE Antivirus
Threat.4150696
16.67%

Clam AntiVirus
Win.Adware.Domaiq-168
16.67%

Kaspersky
not-a-virus:AdWare.MSIL.DomaIQ
16.67%

Emsisoft Anti-Malware
Dropped:Application.Bundler.DomaIQ.Q
16.67%

AVG
Adware Skodna.Bundle_r.P
16.67%

Norman
Dropped:Application.Bundler.DomaIQ.Q
16.67%

Sophos
PUA 'DomainIQ pay-per install'
16.67%

MicroWorld eScan
Dropped:Application.Bundler.DomaIQ.Q
16.67%

The domain ttb.videoplayernow.com has been seen to resolve to the following 2 IP addresses.

54.72.9.51
ec2-54-72-9-51.eu-west-1.compute.amazonaws.com
June 25, 2016

185.53.179.10
May 22, 2016

File downloads found at URLs served by ttb.videoplayernow.com.

1 / 68      (Adware)
http://ttb.videoplayernow.com/download/request/.../XO91fuOl?ClickID=1064--487--1385884176.8951--957e3cabe3&cb=957e3cabe3  (setup_v2.exe)

1 / 68      (Adware)
http://ttb.videoplayernow.com/download/request/.../9bZNLcBg?ClickID=777--768--1385775237.846--321ad25a80&cb=321ad25a80  (parent.txt)

1 / 68      (Adware)
http://ttb.videoplayernow.com/download/request/.../9bZNLcBg?ClickID=965--1120--1385138114.5469--d4d138d5f7&cb=d4d138d5f7  (setup_v2.exe)

1 / 68      (Adware)
http://ttb.videoplayernow.com/download/request/.../9bZNLcBg?ClickID=777--768--1385775237.846--321ad25a80&cb=321ad25a80  (setup_v2.exe)

1 / 68      (Adware)
http://ttb.videoplayernow.com/download/request/.../9bZNLcBg?ClickID=769--487--1384903473.9635--4ca204740b&cb=4ca204740b  (setup_v2.exe)

32 / 68    (Adware)
http://ttb.videoplayernow.com/download/request/.../9bZNLcBg?ClickID=777--768--1385269492.0535--e31c8c41b5&cb=e31c8c41b5  (setup_v2.exe)

The following 215 files have been seen to comunicate with ttb.videoplayernow.com in live environments.

TCP » 54.72.9.51:80
toolbarupdaterservice.exe

TCP » 54.72.9.51:80
hdnInstaller.exe (hdnInstaller)

TCP » 54.72.9.51:80
onedrvup.exe

TCP » 54.72.9.51:80
hdnInstaller.exe (hdnInstaller)

TCP » 54.72.9.51:80
247843.ftf (Optimizer Pro v3.2 by PC Utilities Software Limited)

TCP » 54.72.9.51:80
1799877.exe

TCP » 54.72.9.51:80
IEError.exe (IEError)

TCP » 54.72.9.51:80
install_flashplayer14x32_x64md_aaa_aih.exe (bon joueur)

TCP » 54.72.9.51:80
optimizerproinstaller.exe (Optimizer Pro v3.2 by PCUtilities Software Limited)

TCP » 54.72.9.51:80
charles.exe (by Apple)

TCP » 54.72.9.51:80
onedrv.exe

TCP » 54.72.9.51:80
IEError.exe (IEError)

TCP » 54.72.9.51:80
updater27793.exe (CouponDropDown Plugin by Innovative Apps)

TCP » 54.72.9.51:80
install_flashplayer16x33_masp_aaa_aih.exe (by Apple)

TCP » 54.72.9.51:80
toolbarupdaterservice.exe

TCP » 54.72.9.51:80
hdnInstaller.exe (hdnInstaller)

TCP » 54.72.9.51:80
g.jpg

TCP » 54.72.9.51:80
smlb.jpg

TCP » 54.72.9.51:80
smlb.jpg

TCP » 54.72.9.51:80
hqghumeaylnlf.exe (Optimizer Pro v3.2 by PC Utilities Software Limited)

 
Latest 20 of 219 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.