home

www.hostfilestours.com

Domain Information

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
hostfilestours.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.Installer.Installer (M), PUP.InstallCore.FC.Installer (M)
100.00%

The domain www.hostfilestours.com has been seen to resolve to the following 11 IP addresses.

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 20, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 20, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 19, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 19, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 19, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
April 9, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
April 9, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
April 9, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
April 9, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
April 9, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
April 9, 2016

File downloads found at URLs served by www.hostfilestours.com.

1 / 68      (Adware)
http://www.hostfilestours.com/c?x=m6TY/jVztoB7TOFTvwSDaxtsDfOT6d2n hAsTSbAZlE=&c=XE/FeOz2IAV/ptuxPYPJL/Ias8YwHNlOFkHpRMu07Qed3zaaro/28RGFDtclJ4TY/ffk8C bB/RymVp3Xo5L4WueGCei8pmUPcdnXcOa vnPPsfE4mIWyseedkAiUfxi&fallback_url=https://addons.opera.com/extensions/details/.../&downloadAs=installer_AdBlock_Plus_sciagnij.exe  (19cc32009e77ed178fddd5d1b78f3ed0)

1 / 68      (Adware)
http://www.hostfilestours.com/c?x=V1KdDXW9 2iyzQKOwfHHq03 Ot86K0EX56puxHecbmU=&c=qXAW4Lh3u6x9EFxcneoaIXRa0VjKrr92roBXFQgUTxj41ItlV4joGXUxgeIliQ1XGpwX8qM1QD6YKFXopvHM6SImab aUwMdftmrYSy2sb6trI11kkQ2mCfwQExzl3sy&fallback_url=http://bi.sciagnij.pl/0/.../InstallFreeSpell45.exe&downloadAs=installer_FreeSpell_sciagnij.exe  (627b04e10d18f8cf6cd7472423cf82e0)

1 / 68      (Adware)
http://www.hostfilestours.com/c?x=7Alf8NPjqSfrOIgKfMBuOSRYPaqEaQEaX3Ideq91CJI=&c=45YTG01muOp2VHjtrD0 PDkojBYYQQdxLkgXpR OyOyxxjSiL nrSExNHZOvYVFGt8PpznabfkiyTOQjaKkAIVmXWK2WSyFYk3N/QH0dRBlsqhOOZdQRniGslEIx0ZGL&fallback_url=http://bi.sciagnij.pl/0/.../zyczu-mc.zip&downloadAs=installer_Minecraft_Launcher_by_Zyczu_sciagnij.exe  (62acefc2d4bb16747b166dd23f8244de)

1 / 68      (Adware)
http://www.hostfilestours.com/c?x=0XaqZBsNU8TbNAW2AYxIxBLAgskqbuRe/2X5Pl4fVXY=&c=joO6Xa/WHfhVtpR4bfrYwNxX d34LWqWWxjk9KEkRmOXl GEaknSTwiHnF0LN9Hwck6gyMKomsEJkQD rT/UsDUWPkcW01dY0cuEyq2WGpBmjtdoJt7PD51l1CJJtLJz&fallback_url=http://polygamia.pl/.../1,108240,14251821,The_Walking_Dead__400_Days__Solidna_przystawka_przed.html&downloadAs=installer_The_Walking_Dead:_400_Days_sciagnij.exe  (installer_the_walking_dead-_400_days_sciagnij.exe)

The following 6 files have been seen to comunicate with www.hostfilestours.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.