home

wrapapp.net

NCIS Technologies Limited

Domain Information

The domain wrapapp.net registered by NCIS Technologies Limited was initially registered in November of 2011 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.
Registrar:
GODADDY.COM, LLC

Server location:
Arizona, United States (US)

Create date:
Tuesday, November 29, 2011

Expires date:
Tuesday, November 29, 2016

Updated date:
Friday, December 11, 2015

ASN:
AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC,US

Whois:
2 wrapapp.net records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Malwarebytes
Adware.RKN, PUP.Optional.Conduit.A, PUP.Adware.RelevantKnowledge, PUP.Optional.RelevantKnowledge
70.00%

avast!
Win32:PUP-gen [PUP], Rootkit-gen [Rtk], NSIS:InstMonetizer-AI [PUP], Relevant-S [PUP]
70.00%

NANO AntiVirus
Trojan.Win32.Relevant.cbpeni, Riskware.Win32.Conduit.deoucv, Riskware.Win32.InstallToolbar.bcidbl, Riskware.Win32.InstallToolbar.buivaf
70.00%

Dr.Web
Adware.Relevant.81, Threat.Undefined, Adware.Conduit.3
70.00%

VIPRE Antivirus
Marketscore.RelevantKnowledge, Threat.4785227, Wajam, Threat.4753064
70.00%

G Data
Adware.Relevant.BH, Win32.Adware.Conduit, Dropped:Adware.Relevant.CA
70.00%

Reason Heuristics
PUP.Installer.Amazecell.k, PUP.Installer.Amazecell.m, PUP.Installer.Amazecell.h, PUP.TMRG.Amazecell.Installer (M), PUP.VastTechSupport.Installer (M)
70.00%

MicroWorld eScan
Adware.Relevant.BH, Dropped:Adware.Relevant.CA
60.00%

Agnitum Outpost
Adware.MarketScore
60.00%

Bitdefender
Adware.Relevant.BH, Dropped:Adware.Relevant.CA
60.00%

Comodo Security
ApplicUnwnt.Win32.AdWare.RK.~E
60.00%

F-Secure
Adware.Relevant.BH, Dropped:Adware.Relevant.CA
60.00%

Avira AntiVirus
ADSPY/NaviPromo.J
60.00%

AVG
RelevantKnowledge, Potentially harmful program RelevantKnowledge
60.00%

Trend Micro House Call
TROJ_GEN.F47V0321, TROJ_GEN.F47V0511, TROJ_GEN.F47V0618, TROJ_GEN.F47V0715, TROJ_GEN.F47V0721
50.00%

The domain wrapapp.net has been seen to resolve to the following 2 IP addresses.

50.63.202.78
ip-50-63-202-78.ip.secureserver.net
December 25, 2015

209.135.141.122
iits02122.inlink.com
April 26, 2014

File downloads found at URLs served by wrapapp.net.

13 / 68    (PUP)
http://wrapapp.net/WS/game.aspx?p=80006&gt=f&nme=american-racing-2&spth=http://www.lilili.net/.../37011129336.swf  (sports-heads--game_9869_v9-869.exe)

13 / 68    (PUP)
http://wrapapp.net/WS/game.aspx?p=80006&gt=f&nme=home-sheep-home-2&spth=http://www.lilili.net/.../15233611459.swf  (sports-heads--game_9869_v9-869.exe)

1 / 68      (Adware)
http://wrapapp.net/.../TriviaSetup_982004622_400612_2828.exe  (677ccb1d7002682dcc715d88b20a1651)

1 / 68      (PUP)
http://wrapapp.net/WS/omg.aspx?p=20004&vid=3&nme=omg&spth=http://itioffer.omgto.safecart.com/.../download&hid=102ac00249c6e9839afaf688f5a2d0&affid=12  (omgtotalsetup_v1-358.exe)

1 / 68      (Adware)
http://wrapapp.net/.../SkateboardCitySetup_981618461_400612_2863.exe  (fecfd16af1d248bd5a2c2f3e6bea9b4e)

21 / 68    (PUP)
http://wrapapp.net/apps/ImageBoost/downloads/.../ImageBoostSetup_FF.exe  (f6f6a37a09380b6074dba0c33f19c362)

20 / 68    (Adware)
http://wrapapp.net/.../FacebookEmoticonsSetup_988465885_400612_3035.exe  (ab88373de8a363b68a92ff934275a015)

21 / 68    (Adware)
http://wrapapp.net/.../FaceBookZoomSetup_988465873_400612_3033.exe  (568437cdab174a77fa3ed3e7cd221126)

21 / 68    (Adware)
http://wrapapp.net/.../YouTubeDownloaderSetup_988714543_400612_3037.exe  (a84c511326aa67a2fd37c39803fb0bb6)

21 / 68    (Adware)
http://wrapapp.net/.../getio.aspx?affid=400612&sid=3036&c1=1326&c2=102ae7f43f6e363cccdd41618bf3ce&c3=&vid=6  (blockyoutubeadssetup_986581002_400612_3036.exe)

21 / 68    (PUP)
http://wrapapp.net/apps/Skateboard-City/downloads/.../SkateboardCitySetup_CH.exe  (1126bea71b85f7f7f2ad5567689697a2)

The following 2 files have been seen to comunicate with wrapapp.net in live environments.

TCP » 50.63.202.78:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.63.202.78:80
produpd.exe (produpd.exe by Vested Development, Inc)

April 26, 2014
www.wrapapp.net

URL:
http://wrapapp.net/

Web server:
Microsoft-IIS/7.5 (ASP.NET) (Version: 4.0.30319)

adscseed.info

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.