» www.cyclefilestours.com
Overview
Analysis
IPs Addresses (11)
Downloads (23)
Network (6)

www.cyclefilestours.com

Privacy Protection Service INC d/b/a PrivacyProtect.org (Proxy Registrant)

Domain Information

The domain www.cyclefilestours.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in February of 2016. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.

Registrant:

Privacy Protection Service INC d/b/a PrivacyProtect.org

Registrar:

PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:

Oregon, United States (US)

Create date:

Sunday, February 28, 2016

Expires date:

Tuesday, February 28, 2017

Updated date:

Sunday, February 28, 2016

ASN:

AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:

cyclefilestours.com

Whois:

1 cyclefilestours.com record

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.InstallCore.Bundler (M), PUP.InstallCore.Installer.Installer (M), PUP.InstallCore (M), PUP.InstallCore.FC.Installer (M), PUP.InstallCore.11 (M)

100.00%

Kaspersky

not-a-virus:Downloader.Win32.InstallMonster

8.70%

ESET NOD32

Win32/InstallCore.ACH.gen potentially unwanted application

8.70%

The domain www.cyclefilestours.com has been seen to resolve to the following 11 IP addresses.

52.25.41.73

ec2-52-25-41-73.us-west-2.compute.amazonaws.com

May 16, 2016

52.24.26.116

ec2-52-24-26-116.us-west-2.compute.amazonaws.com

May 16, 2016

54.69.198.37

ec2-54-69-198-37.us-west-2.compute.amazonaws.com

April 16, 2016

54.148.57.212

ec2-54-148-57-212.us-west-2.compute.amazonaws.com

April 16, 2016

52.26.95.11

ec2-52-26-95-11.us-west-2.compute.amazonaws.com

April 16, 2016

54.191.37.5

ec2-54-191-37-5.us-west-2.compute.amazonaws.com

April 10, 2016

54.69.11.66

ec2-54-69-11-66.us-west-2.compute.amazonaws.com

April 10, 2016

52.88.159.85

ec2-52-88-159-85.us-west-2.compute.amazonaws.com

April 10, 2016

52.35.10.15

ec2-52-35-10-15.us-west-2.compute.amazonaws.com

April 10, 2016

52.34.170.106

ec2-52-34-170-106.us-west-2.compute.amazonaws.com

April 10, 2016

52.25.23.136

ec2-52-25-23-136.us-west-2.compute.amazonaws.com

April 10, 2016

File downloads found at URLs served by www.cyclefilestours.com.

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=XpZC2yALmt4wPb q9IJFQPKGapVfC4mb6RLeNWaTv/o=&c=tRI0ts/wpuX1I3Nc/6920bILep41tEsq9pnTB FKschSzRwV9MWhisiig7enMLuvj3PVY6bbCcJpOsjwaRune/pHiRoiPID20BPABQE3k0SwnUrhSS26kSooGt wjBDAF/4OyzGdXFbCEsi8wVMJE7yJxa41kGrEF7cnKSc3XXlVWGVf8KLC3htVHTBnzPNR&fallback_url=http://cdn04.foxitsoftware.com/pub/foxit/editor/desktop/win/3.x/3.0/.../FoxitAdvancedPDFEditor305_enu_Setup.exe&downloadAs=Foxit-Advanced-PDF-Editor-20595-dp.exe (ca83bf3710e04796c7ace894b30f48db)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=AWwE6cZ09f8ArBYcUzBF9UTm/5Q9YGpkG4H6sAju7AE=&c=Ap4u9Df/d4JCNLpJqFVtvS6u2grCKcbCOwK8UZiSF/LawujFRD7boVbMhj0j4Iy7u/OHVCPY71UE20Km/hmgaff25MEKoBPQwX vH1qR7uuzh0gBWowxoBq2mbFMAcTYyavFRCnMmIdZnSrGEh6zP3VzhaitM9vB/mhsqlbilsUrRiFEc9p B4PkFpG/0g2/&fallback_url=http://digibit5.nazwa.pl/.../testy2016oficjalnesetup.exe&downloadAs=Testy-na-prawo-jazdy-2015-kat.-ABCDT-24282-dp.exe (d450cb61207c58612691e92e9f515561)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=Ayo5rfvwEii2NGBjCPjHJxUKj8OCNVQmlWADLiAoBvI=&c=yLEGNkoRoxchb36fMi7pAdWaumJS4jVIk0iwdyzkYIM6OAht5HF53Krpmj/9OPp/Ug beiD1vL/zv0wwuuKhCituKp Jcq10IZE4/GCWqvTCMO9vxBmO0SSxXUzB6eMv&fallback_url=http://download.skype.com/.../SkypeSetupFull.exe&downloadAs=Skype-13018-dp.exe (865c85ef9f87afccd3f2877daf3dfdef)

1 / 68 (PUP)

http://www.cyclefilestours.com/c?x=gqQ/t /fBk06Z/cBvMBH0A/RcKnMb/rLjqjpONUhD/s=&c=ds1rECRfuVCUCYS5 gv6PT7VshPE/CG6myY1XoPwNR3j2xYmsLb9C/QhkYRMDg8A0Yaz/ALvFF032OEyUmBaXjevVMolyJ7Ab4qy7PmxAmKoJBH y9MA7ywkdIGsIAmG&fallback_url=http://.../ccsetup515.exe&downloadAs=CCleaner-13061-dp.exe (803a119e225a1cb512ac76c75b65b004)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=BSGJO h6i5vJiT1CyzX4f1ItfoHOgqviuhsaQtP KB0=&c=VOMCOZT3o6geH6Lj7nCMJfukhv7LXxqUmZnsE6aHjF2RyYE9whsGXbCgrHre57 gmXfy5RHvAaIEulyOGapbc99/IBrFYF4rNG02LtdnV/69Z6QbvfqD4bikwPDggcn9&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe (571677c5d0799e9d5f20ae99943e2074)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=MSUGIG5hjt pn4ucwqF4X sDY 2FRG dPn7KVo1qATc=&c=v 1wMXhiriSJFKQ3MUQYWWAeUD2Manl0v2oxNQLF7Y/KPMdLL2PmYETHneY6biXypQ91Df/y vSLvJURe XMI4Vjq5y0kXqwfuWAxNDxTJonZHl1zHznytfl2L6tl8Gm&fallback_url=http://www.allplayer.org/.../ALLPlayerPL.exe&downloadAs=ALLPlayer-13217-dp.exe (53aba58c8ec376c030e1b7323408ef02)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=fKQ3N70go9siTsm7fpCrVab8Mfz0MTAci6n7IOr1SPU=&c=aD1IrSUDohxub5zwW28J1stnHCmjC8aFpG8csc9Ra6Myem mW2/M7RkJh3ORpIGi4e1JfWHIU1owV0WZ1D4o1FAFO2 lG3ndx432fh7F99tw8Z1hDNSlt878GoDCu2QZGMfoV9wj UUE8potH4G7YNs6gCGZtxo 2e7JlGUGZ3h5g2nj/Or8aLGYwyqOvLed&fallback_url=http://download.techsmith.com/camtasiastudio/.../camtasia.msi&downloadAs=Camtasia-Studio-12665-dp.exe (clickoncesetup-1456438982.exe)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=YdmmSQlldKYyzHIGLjBhZVrjqWViGUfYgnZa0 2AmrY=&c=vLk6p8AO 0Yf5XI5aXMT6eiJytW4fpaAqEBS7j7GfVmy0pEhdRWHI6AIrPhZhnLS051u5Emu LXBFcJSEo0FQs TaH/AiZOaeti1FCJxWgyJqgHR73rXlkrCnB5JG LyDhga7w0MsWjyR5VhR3S9jKmmSGZuR9/egtuJrjepxzD7eBYJz1gN8u23uYByLY1v&fallback_url=http://storage.dobreprogramy.pl/.../phtkinst(dobreprogramy.pl).exe&downloadAs=Photo-Toolkit-12149-dp.exe (8450d724160dd9efbe0266a9e2b417f5)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=JVX3kqoNCkK6Q10XFVG7SghcuznWmUWiZXdkmJ2u4qs=&c=JZopEmTfDfuY8YYwqtLeJxb66USVDDotdLgW3 AVAD7uoFCrPQCpgvA2G40W9NLZN8rQENNZNhheq9ynKprCoavOYlKZn/ngR1p5mR1S8l8UsHy48fD6id3qbryWNNyxA7DTWgBqCtU/pdTp1QNjjcMdlpdmuuWqwZYRx0tuoR X5UptrZlODU6mabTEMSZL&fallback_url=http://aimp.su/storage/.../aimp_4.00.1697.exe&downloadAs=AIMP-12499-dp.exe (icreinstall_aimp-12499-dp.exe)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=M9hZbtL6UPUfHuhjvrQ /Ye4IU0Im0I1E19tHKhrzwQ=&c=ndqfnow9iUpiEggTILX4o5iwzwp 5fivuo5AUUmpo9SJKUFw46aHPobzfeT6uh/i54rEhzwtqXRF/PldIqYxe0pLtgWLciRLdHD1c7hXJw9336T 3Rr0M5bZ7YdiHGHO7U/ IpGJjCcteQ1n3GQtE32dMT4KZIhLQ8sOQpXniw9fTDjGtcrL2eJcejSJv6J&fallback_url=http://storage.dobreprogramy.pl/.../DreamMail4692_Setup(dobreprogramy.pl).exe&downloadAs=DreamMail-12080-dp.exe (18f220df9ec3c3d156bc02da26e8dddf)

1 / 68 (PUP)

http://www.cyclefilestours.com/c?x=gLXQyN3SzVq6T6rBBjGHg8amrPJX/cUqCnOdLZxFi7s=&c=xZ8 p8NYYUaPVtYgWETMu TctxzDxI/8w 9UbIUZmtZwk6tTmwL OI6sQv3eYcmA7HyG HDmmYcFgwMqS3r4mydc6KxKgqT/35JmChwHi9CKZqbrypBuV 5hkyjkqXBi&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe (a28db5ed2e96f18ffc57d701c22129ad)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=04MeG0zMJ4TL3FrX t v07KGZBr FQoBdosz8ohMnQA=&c=Cdn7cToywJV /U8gZWsgHMOjaPoJ3JBrxFsOmMwGL2SqCpAif6aaAEFPeCbih6cIeCz4rq/gEtjsv4Ip3zbEOoaSGPAA1aC8Qtld8lNhT8Lyn1GOEglDyRqVEtHcCx9RLiaDkw9hlYXzesr3eZ6fHSdsGH3tyUdBt6 LcAc dtAuGVfZmy04u3S0qyiXinUc&fallback_url=http://storage.dobreprogramy.pl/.../winamp5666_full_pl-pl.exe&downloadAs=Winamp-12928-dp.exe (4ce062578d4dd0ac409413d4f624d3a9)

3 / 68 (PUP)

http://www.cyclefilestours.com/c?x=vO4Lzfl86rxFkmJk/hJThoZHnbek0m Jn8ReRQhfLbU=&c=CcMgyLzcH1BiXq4mnWde4M/JCxVwjQ/PqetMOu39WWQ3RJ0aC9DDlAw42LU8YFY2x8jrYra/DghygnPm1OTD8waWoMNhggOgytODLgw7aTa4f/XX1Do4n6fEA2wu3vPneH4jrFVUzqnlpd4hOo7aQY7OODupRBX4y5 xrNM3 n7Pbjt7TzaOKDFIxjZDT510&fallback_url=http://dl2.bestplayer.com.pl/.../BESTplayer.exe&downloadAs=BESTplayer-12658-dp.exe (9fd7.tmp)

3 / 68 (PUP)

http://www.cyclefilestours.com/c?x=9YPfO7h790VUtRQnDHpghTTUBbx31gqB8PFvf knUMM=&c=UHQ81ygsuC8OL4ya/KtnkvSH6SDw5660V71QuCafATtGBEBe0wEdEBiLNXeaNbxNPbPZuoxN2eWvh0pgabx0PsmyyF0d1B9twVMAY0aMmzKfaxkmJRWxw4fYXVaDPyJGfyTCWLU/ZZ6LsqDQqtrIldAK//inubQXJ7 ZwUMoPRAbAWFxKqrMFBKIALI7qezz&fallback_url=http://www.allplayer.org/.../ALLPlayerPL.exe&downloadAs=ALLPlayer-13217-dp.exe (28a.tmp)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=7eMr3pGCTA9EmuYlU4ulqtpVQfFWJyaG2za8zrgBR3A=&c=Q06fmHgsDsw1VA6uPSTQBP55DVhpznCL7UfBS3VKDwhh/Plaxz0WbmP39EMomownDpXnXxuYETlcyMP5CoB9hdtvsjc AsSHAfIkwyzDCnbfD31jkceNrGMnUZl8Ql0z&fallback_url=http://storage.dobreprogramy.pl/.../picasa39-setup.exe&downloadAs=Picasa-12733-dp.exe (6d3a89b499186c2e4717443a3d184250)

1 / 68 (PUP)

http://www.cyclefilestours.com/c?x=0yIVupcD BBYx4SPEi8K87JGEYLg/K5jql9ZCOFtHUU=&c=xMGutgrbQF6 aDtxh5nTM5tWUAzqvgPTuZ /IHeyDREFT6TnndRWuP0KYOnYhvsUKlaMArsJWSVnbtvT6IaMlAUyl3YBqsjiyJ4vUaNZNOp7pXcDfAsYiThdTOKDRcJq&fallback_url=http://download.microsoft.com/download/E/F/B/.../IE11-Windows6.1-x64-pl-pl.exe&downloadAs=Internet-Explorer-49184-dp.exe (81ea7a4925b0c51123c5b712becb6f9c)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=tqBa4pfCMhzRlJArolGVdCxNoAccysPHftQ2EXLvPuE=&c=WiymaLi/uPO8LloD7tamPAwT0mypXPbLPkcVcFjCd8uuhjSIylnDfRxi4TK3US38Qe/pAbOgDB gv1eiBB3qIcOViZrP9fp7w3R4XvuBMk1lLWCjqxC75HxO60Oa76dnJBIB9t0md2sDFBCzG9d4tzYJUeK rSX4sC8fdiDee IerNHbiVz4av slWP88hcc&fallback_url=http://storage.dobreprogramy.pl/.../uTorrent.exe&downloadAs=uTorrent-13270-dp.exe (916c70bdf8d63b1c84da82f335364684)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=GEZwEXB39gqGd3dwi5iy68/SCata6YNy4n7iV2nKLtI=&c=5IGPFpT4Hl/AQW5kSQ0BLhWNkkRsDStqMatH9Ph7f5Y7LpfhY182QR2kry4aNC8c8Hpq6neI MFJNKGcmzzrecwCjArYX4ibRC I4C8vJU3RqGhQalqIQaiQW8pWQ5aw&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe (615805826153a9b015d40cfade0b5c84)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=mkRegitkLLFd9G8JehNlNbkrQy9WoBpP5AXdxgAL/Gc=&c=w UI3jqHuG6m4h2rE4hL0wzM8efXsrn/WGcWrMVAByrd45z0OKAHnx ZmVEMRO3VjpStC9Rzd2K4cCVgGiHmW8r6JS7FFav3D sm1rZowgrYpSIC3 sIPteuUwWalBR/gUfF3ldySAP5IU CzpXoG6bcKg 49LPOWevr9ZPHSOrerSpvhtL3jnkrdkaV6l7S&fallback_url=http://ardownload.adobe.com/pub/adobe/reader/win/9.x/9.5.0/.../AdbeRdr950_pl_PL.exe&downloadAs=Adobe-Reader-12627-dp.exe (clickoncesetup-1456467918.exe)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=LYLsOs5Jk eAtvJnVKZ6Uc bNSZSLgNgMxoUvpovzkA=&c=/ uvE4Ak2N/mS1DUbzIigh557tPP5wWVHYOpRayeGt4akGBxM0GdXPx3Hb1zE1pPUZGc5Xqs8gkO1S2Js7v7udhtzWy1gMq6YfBmLVh4SvZmyP ba2HvqVKNPuZzVoBVMwQ/Slvn7j8Q7xfbK//HFou8danRM8ZR3V/GuSJB2xtljMKYsUo0Zv/JDqU/aAId&fallback_url=http://www.fookes.com/ftp/.../EzThmb_Setup.exe&downloadAs=Easy-Thumbnails-12169-dp.exe (8fb13c88280f39e96f3ab2830e616852)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=BOCdYZmTqTTesumPlKiB1H9fDoJv7VImaKKJvxQy3Rs=&c=e9KWVUWgAWhXmfP/wtUohYMG6R4rmmZPzNWZfMFTG679XErWpbQk3qlfgOfParowgYnRQHxlSqbB18nTF9mgGQfxQHZe7i ZxbHv3M v6Pe6ApsuEg4q 8vyYfEaNejtGUp6O5O5urQyfHbge9bX9bRDo3Ky9fgLh1vey5VQAIyVtaDDY2htGRyvgMoS95XQ&fallback_url=http://storage.dobreprogramy.pl/.../ffdshow_rev4533_20140929_clsid_x64.exe&downloadAs=FFDShow-13336-dp.exe (62c2982070616580dea1f725abb0f9b7)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=3HtN6IDvSDCWP5u3AAw wjt xeBflA23oqXT9O45LvI=&c=3nujoF0s1JhJfS7KfvrRzptRC3gKzQSyPdzaXUwx4DL4ZAtXxbOwfzvzoihVrDpkC YOrULSrYvyrRoxOisBlCtUg8GTMRtm/wMQlyyJdldoYQCfczZ5e1psNFGJO29aND fy/xtkT9Cnr17DVhiicPH89Oio4ExNnougBr4EcXEbddpvTs6nKwQoCa6hU/a&fallback_url=http://www.mediacoder.net/download/.../MediaCoder-x64-0.8.41.5818.exe&downloadAs=MediaCoder-13316-dp.exe (0c4836e16dabbe698c2d9b3b6f1f3abb)

1 / 68 (Adware)

http://www.cyclefilestours.com/c?x=gPPcKgFDBrfSU909h26mQN BAnsUsKzpGQlL7WodKBc=&c=64Z5McQDxM3ZgFL4VcZ5cNh6hpJ90 k0rRDru2C/ug63q52Hb02EZlo08hLV/6iJYQfGpyGCnXE//dBSK/MOysIdKXQZ4T2czA2zS8e4zwSa/g4iXwM8RN5ACK5Jo1BX7tzI2wBHIPGrFUBlqs2JyZeDdpOTX03cFKJBkwTQfIXHXqEuwyFwhl8bcwrZKMnN&fallback_url=http://dl.maxthon.com/.../mx4.9.1.1000.exe&downloadAs=Maxthon-13264-dp.exe (b7bca36b967695c831ad5735f43ebea0)

The following 6 files have been seen to comunicate with www.cyclefilestours.com in live environments.

TCP » 52.24.26.116:443

online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443

online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443

rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443

036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443

rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443

Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.