home

www.citytodaycontent.com

Communigal Communication Ltd

Domain Information

The domain www.citytodaycontent.com registered by Communigal Communication Ltd was initially registered in November of 2015 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Friday, November 13, 2015

Expires date:
Sunday, November 13, 2016

Updated date:
Friday, November 13, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
citytodaycontent.com

Whois:
1 citytodaycontent.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.NewMedia.Installer.Installer (M), PUP.NewMedia.NMH.Bundler (M)
100.00%

The domain www.citytodaycontent.com has been seen to resolve to the following 11 IP addresses.

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 16, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 16, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 18, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 18, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 18, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
January 31, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
January 31, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
January 31, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
January 31, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
January 31, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
January 31, 2016

File downloads found at URLs served by www.citytodaycontent.com.

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=pPut/zC1ykpSg25SylpqpWu5YlwY4kvLLp3UrhJmQfY=&c=/dlweAsxAW2e5MKBHXhWEoV15bzcTCN/1SA0Vn0ycXf46CTIoimiJtXq5MqQROYYopvJIesXfyf8LTRz2NFGfLZt97NfJF5GSHyxjkmMm4qb7khvsViQzGAJCAQDHV2JHRL5VUEsujelUb GVh5O1w==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe  (f647d142649d5a5476ecb024f9e1d731)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=bf24tp LhargHerD8thREoTQNZM60m3UReudicXT8dk=&c=4auM62fk5K/qjnTXUNZ3zw 65iVI/TfpyweZh qrFsik8SwxXnHXrGXE68UzV4q0nVJMVKsRM8bqHQqPESwgzSZB8ngQ64E3X7DIWyNy2STc1F/IgB8p9zUG8q3yy23Xfj/NIBcEef6wat/8sz528A==&fallback_url=http://download.microsoft.com/download/E/F/B/.../IE11-Windows6.1-x64-pl-pl.exe&downloadAs=Internet-Explorer-49184-dp.exe  (3c37ee7b320fdfd76e40b1afd06bcd74)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=CDkvvMtf wmqgzAN5 J5YC0tTNgoW/6v3FPm/uW5e0k=&c=UCAarKfiyzxOfEPOs186zhkMl4v5L7qekT/TNhaK9juLbWZm9nrwjho1pBk1zynidR nvGX2tycNbnFMS6m9mjcqKN25MU10uis8DnoKKxMT/V5UQ1sbTQvji4TWUvaewm7c3IJbBMazZf mAIC4HA==&fallback_url=http://www.rarlab.com/.../winrar-x64-530.exe&downloadAs=WinRAR-12398-dp.exe  (6f5103211751251dbf22c769c3d95489)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=hVXFl8NqekOc HwqVGi 6pHHvByYypciy7y8vvVFGd8=&c=bHu6g0fLbyurqV8MAR6HzzaLMD hgny90Bp2Ks0GYkpIE20jBItk/7ocGFJn8/qAjnNE/4ONzFNbrGucuILFppMLKhxR6 x3CCzGlnEpp7Wat0Iyqhi9CjJCwRuocOUpDrCf42Joa7Ok6SDR07Ztng==&fallback_url=http://dl.google.com/.../picasa39-setup.exe&downloadAs=Picasa-12733-dp.exe  (8645b393d9e8b050d3bb44e2cd04c966)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=HwdPM2fueAvYjlZhsSIH5HSQ2lzD0zmEjnGgs2GtcxU=&c=91l3uYibaKVyPLEPDb7uxErTLsAWBVFfoCN5zewJ7bY1DaZTuppFG 18/ZhMWrlUY00YTBbYXdUgdgniqwYQ5rkNpYGwgSQJ XVB9VMtaHzZvRk5UrO vSPF jJt3XO04l6mAPItFLUq6T1rTYW gQ==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe  (f647d142649d5a5476ecb024f9e1d731)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=jtIfIP0AyQXmBta4kgyxhhpEQKmbrZvFVKe3ILK8pHQ=&c=6IViRZDOgnHxGwAVYR9gOnDXzH5N5xap9dynSKdFyxUe7dEwnbzvkooDg5cIYWoWSRiJvzcOU6fzxLslkAMN14Pjo70bCLtcWDnlvCXjozWPC9Le6B9NaAaUJpMQVsoK Gs4pO6NXDoRZitZjrciOw==&fallback_url=http://off.dvdvideosoft.net/.../FreeTorrentDownload.exe&downloadAs=Free-Torrent-Download-57214-dp.exe  (40f33599eefd9423904ff8cdfbf4d8a1)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=h9nUZQTePzRXWKYpRLUi8E01MB3GwCju7G7O37Qmk6I=&c=r2SCHy6XtRw/kVJ/7e5Dy2svXjAbHBs3CQJdKWDNIbTRBTe2/MFdbM6Tqm7eWoglfE4Z3ioKzqd6n6eIpEWrlzzl1ns8kHwOU vlvJIJ90OAgxtH U6mt4jzTIL4/rGSucDyx4sllAvyAka3Zzuk4w==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe  (f647d142649d5a5476ecb024f9e1d731)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=OJjR67Esleo7TcXSLzblxSVOdtxfPF8OTmaMvW4WVOo=&c=SUZyRp7LA4vnce3TjzYcPMq7s4gSbRk9PqGfHNO0ZKZg/zXjUs5rVIZHRQGNMJ4dR 1wnuNJyjlndIos03SmMCHCgsZasoavpc6Cg Iicv95cg/trDvohPJUESMsXmlfjrwBx/q3q/RZfR0Fq59R4w==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.2/win64/.../Firefox Setup 43.0.2.exe&downloadAs=Firefox-13108-dp.exe  (b1999146d63abcaee4999a320d6a1eb4)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=/2os61xhvgkY/ePGYn8wxBocd8UewptXXFa1Gwt2PPM=&c=h5O9mGZkCiqyC96m/1VfyhkbOSrV5kYx21HswaU2X5sAsqICdqCYCAzVg6KQRs21dBgFs18AwlKiw xOHEHM/UCpG8uIEkAJQxEFhkIMgUBsKC0jaCJgj8 Jh2CgOLJqXW1LMNNNdmW9wVV6gZcr1A==&fallback_url=http://storage.dobreprogramy.pl/.../winamp5666_full_pl-pl.exe&downloadAs=Winamp-12928-dp.exe  (b6235c898c014acd0b1946556ed9c46b)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=ilhyMNI/gXpqNpsOuYmfx0yShxP omknMMZT7KYYxLQ=&c=NpYbfyDV3TH25wO8UAqCPN8yR1UwTLeOmPhztLzNoqqfcylKDrS4wrpjPf7teKfu1yHBlzJpOw4wEwaAm qEPbW4xWcPJEGnpJ3EuN2v6Qy Q ENDNax5aPY3M96fqIV4ff8FftPp92YoR5Gr wilw==&fallback_url=http://download.calibre-ebook.com/.../calibre-2.47.0.msi&downloadAs=Calibre-24518-dp.exe  (76c7fcf73ee953c24c8ee9be05fd3e76)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=CBHVEQZ1ybi sohp0jxUOLLnN1agx0Pmv 2uKJYQss4=&c=cJHhaIOoNmxMEImjKt3sWefQLkRF8OjGIKJMH6cfZaYHj6/Xvcpi16mJVFC2ZjaohjM2n8uP8CRL1Uf4GKkrpXSWDO0EPXYqxIV JaVonnHN75kZ8XOZzCaVjLbitmfIhBw3QT99WXaGuNssT87GYg==&fallback_url=http://ltspice.linear.com/.../LTspiceIV.exe&downloadAs=LTspice-IV-21180-dp.exe  (c550ebd5475bfe6eeb2566134dd534dc)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=lW05 oUcocrjE7ANJ5CKOSeN/Vq3ms9fPNAa9F3CS2o=&c=Sib0SGrPAVsAnQYnSkLL8ZiPWI4Vd0rb5/d/Szs4o8xocQBrAbK8ZcyowLQkKdaKV8NbEslvaUupDU QMZtt0Ww4UBbslN76hTH3PIc2B9zM5PPZsb7pVcRx qSQbo89m6Yk8vVU3hux8vgQ xiQ3A==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.2/win64/.../Firefox Setup 43.0.2.exe&downloadAs=Firefox-13108-dp.exe  (b1999146d63abcaee4999a320d6a1eb4)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=atDUGsg8oz4dhu3mFYODLn2fPERHIB1NSGiIJ1oHa/4=&c=MNEDyyLdXrDEZ2wLPfDIf2xXuCLMSIX6g1q v YFBzYMACDaHD4ZFslgRxYawFhCrDH2HXJn5ZIjRAVs4BJTXckuQ3mSxd7cy0G3sPvQpzBbha78wJWv2JFsm1eSEQ75vqqAYeHZQ 69vjkw81W9JA==&fallback_url=http://.../PXCViewer_x64.msi&downloadAs=PDFXChange-Viewer-15117-dp.exe  (4692b88d24560788874c6d220efc30c6)

1 / 68      (Adware)
http://www.citytodaycontent.com/c?x=HTaaVQm5irYW0NOiOnoHBdIpkzRrlEt8oKtCZfobh0E=&c=UHRvuntmeCNt9Z2S5zzN9K/6IuRg/XTyvS4tidv85JfjwmFdu6tfcJO5X7hJLuv9QqUKyxGS4WsNP6rwkDqPzdLc22DkKgXFZL7LXX/fxoSMFk9T1X/xHzdgRV1RyQH2FO/NrXwEzqwTu8xFW5k Eg==&fallback_url=http://mirrors.kodi.tv/releases/.../kodi-15.2-Isengard.exe&downloadAs=Kodi-22117-dp.exe  (bc76660bf0c1d2f3dac98877f0184571)

The following 6 files have been seen to comunicate with www.citytodaycontent.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.