home

www.toursfileclean.com

Communigal Communication Ltd

Domain Information

The domain www.toursfileclean.com registered by Communigal Communication Ltd was initially registered in January of 2016 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Friday, January 15, 2016

Expires date:
Sunday, January 15, 2017

Updated date:
Friday, January 15, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
toursfileclean.com

Whois:
1 toursfileclean.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.Installer.Installer (M), PUP.InstallCore.SoftWeb.Installer.Meta (M), PUP.InstallCore.FC.Installer (M)
100.00%

The domain www.toursfileclean.com has been seen to resolve to the following 11 IP addresses.

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 17, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 17, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 17, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 17, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 17, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
February 26, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
February 26, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
February 26, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
February 26, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
February 26, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
February 26, 2016

File downloads found at URLs served by www.toursfileclean.com.

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=SC7HB1D1fcT1hy5rXmRViWHSfkIW8ruP77Wz4/5/ye8=&c=KS0Vq4wlV799qYWDdjSa1viSlDwfki 3TpiLFuPwdNreVek3ChBdaCOJuVWszYc3qNjQwQiiaROiIxajj7yz7IC17rtiT4rgxZAKjN10dnD4UBff/cwU8GClC499iJ17&fallback_url=http://www.allplayer.org/.../ALLPlayerPL.exe&downloadAs=ALLPlayer-13217-dp.exe  (3b36c576df315356bef971f3895e2fe9)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=NzkV5DtfM0m5t3YC 0a1pXDmbXglDE45HNB7lVOkEAI=&c=E7sMK WFNz80SHQDE8N40C998u2iwnRQE9IzFb6qJDUEkm qb /o8vsteXFql VoVpmtegO 82HjobUPmIqJxA9XJ5EpyTvBJwyGxJVuRhr3kNzcFC9zdmYCsF9ico09&fallback_url=http://www.karafun.com/down/.../karafunplayer_setup.exe&downloadAs=KaraFun-12132-dp.exe  (e09493221d60393a3ba0c781467b89fc)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=MXqp89ULT6X9q7hJOpWVgnl1aBgSqyad4Tt4oaSuhwk=&c=EG74v4Ahsa R3 /EqYGNWIz3RxEIiYHmvjKx6gLaEZqLqeRmlT6Fkaf4OT9Hs7f7XMd8Yv5pZN6fPnD81eW4L3rsnzbL6AamfnqSdVXjDHsHC3QoH7glo7QGmDrdRIly&fallback_url=http://dpstorage.pl//.../K-Lite_Codec_Pack_1185_Full.exe&downloadAs=KLite-Codec-Pack-13137-dp.exe  (2aa557834e991dfa4c1bda054672a40a)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=rxpxCN/VZov8n4vyfEwm78zod7dB3Dw3VqQrxqXzPUk=&c=bGHkT9hramRFkgTg3suptYsvAugRizaWYHe53POqv4C6/tQDbIzAbJJhTlvaQgnRZjX2JP3WPEGIeWxBLiJ08h28KXyDxuK3YGVCU1PYa4GYbFXujbzbre6QJrXQugeS&fallback_url=http://storage.dobreprogramy.pl/.../uTorrent.exe&downloadAs=uTorrent-13270-dp.exe  (3861942fad7c5b69bfa4f2abdb2ff9aa)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=aAeSOFVgpXkxxeIa1de EsVastcWpYumW12mp4Z3ho4=&c=XpBOfXQi0OI7dZZy9x6bNVo9aZXL61tzgtC9aLQls nEZD6JBQkcQAqxD4GIgR5ZuLQGpGrtiXoEdtpogv4dBWUWgFkm49BTx76sc8aPBdl8TJ5r IO5Emk/lPtBWRWR&fallback_url=http://www.rarlab.com/.../winrar-x64-530.exe&downloadAs=WinRAR-12398-dp.exe  (1325ae5783df50c7c36d953166fef8cb)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=Va5/DwM4de2Jes856BoxHb h8WPn66kNTYiLgnpunn8=&c=HkuoT vfzQjjYBYtzlX1 0EbGRHm8gBpSz3yOoAiRm03G5ZPxSS94RWanetebUaV/PNeTo0eo6I68RlE/eFbfd5OAELxeJfr27EktlZ0 hORw42/FVyIuItGs1fgd2tB&fallback_url=http://.../iplasetup.exe&downloadAs=ipla-13125-dp.exe  (43d9a44a1bb73aa701ef5373d17de6ba)

1 / 68      (PUP)
http://www.toursfileclean.com/c?x=CW50CBRGI4 yHgV940BoACP zkv3jc4bYmu ot6LX64=&c=k3i6bJqGX2Ln5YV7qMPrCF7RO3W1leN16whi2UUH4jsSP3WkadX7XRWysSkfHHF7z0495 7x99IEvOv/uWTnVp34mg01SXvVEkojdDqTSD6Azx9abwrkqo5736BefO4j&fallback_url=http://storage.dobreprogramy.pl/.../Faktury_7_setup(dobreprogramy.pl).exe&downloadAs=Faktury-Express-12203-dp.exe  (f800089e959e0ad2d2daa1b807c7ecbb)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=LmwR1tpL2SRpKoTUkracPmngiHK6N5A8ZIv0QBt4ntk=&c=KaSHe9utzXftS42n9up5OjPl5q1YwI7ZVJxgpoPmT2YVWaPcxrhuRUP3rloWyI47o9khp8nfgXMj0uvnNmyZXakk1sVZTZR7uN5S8RZYChFkmHcogWIHKyTxSfuL4Y6o&fallback_url=http://download.ucweb.com/files/UCBrowser/en-us/.../UCBrowser_V5.5.9936.1004_windows_pf101_(Build16011217).exe&downloadAs=UC-Browser-62254-dp.exe  (bad72e08bf2b9ee1aef70e04958bb981)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=NhRfeI5Eq9jvVTsPK7BDMP3sq9lqZ/X6DazUPkO4yJU=&c=zGt KMcIP1AGC7ARX7mjsyZlpTKURhT1Oqq2BT/7grre1eHCZIS51I1o8Bu34uZVFJ1drJUp0PYzn5O 8O3A34RejZF C/NgmZNOBuWxsszRjC yDfm82MLY/Jmp6HwA&fallback_url=http://download.freemake.net/.../FreemakeVideoConverterFull.exe&downloadAs=Freemake-Video-Converter-20113-dp.exe  (06668367ad2793cf57b6f48fee97e0f8)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=6/Wx9TLq t3L02RUl/SemvLP58Ic3vSwg n6I1MVYYI=&c=cP5dB5Gjx U LCTdjUfNbYCFi3xa8jXDkUOcJiF 3 2dcBBkoqbi3RT8iRJiMY4he1DefQm/Thz8XnBq2/ kbAvrKH6MKfUGB59zoAUtfXFH8FIIeXsdbjtW3J5bUFFH&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe  (e9745326690ce90226659dc8c05eac19)

1 / 68      (PUP)
http://www.toursfileclean.com/c?x=5k3DRhODRSqYfFgHZ8RNNfqodsUBU2Zmb0oY0HT2A7w=&c=9YGk1Ek2k8lF7OdPA/ITOSYjyILzMtEwmly8 c4qSS 448JmHTH7JEcDxWiFN7fZDuWZ1zArbpzAvlQoKRa39V3QSbsUXQ79H58aAjNZa9dnXupBrksaMrxYwqVlB2AX&fallback_url=http://storage.dobreprogramy.pl/.../k3d-setup-0.8.0.1.exe&downloadAs=K3D-12643-dp.exe  (0d354e9253f13dcd5e9d1b279c9bc485)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=Geh/zrEOzLl1indczGACCk rdrRWjVOha Ry/z2HG4E=&c=Wkc76KFin/kAWvspfxUJZqlLjd9kA7izPZFXWRXZx6SQqYg6MMCrTuPDHcW3ducWmckDxl5HvIHFl0t6qgAjyApfHQJEr0KzT9zxueQpuYWX3vMkoVBjhoRjrqBIo0DO&fallback_url=http://storage.dobreprogramy.pl/.../DP5_PL_dla_dobreprogramy_pl.exe&downloadAs=DesignPro-11693-dp.exe  (eecaf2ece1121dced57a284fb3898ee1)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=eg0mzUX fiBbuSwqzxY2Qq9G6Ez/c tBdXSrGBWLyJo=&c=7kQaFcs6eCMJpy4BQX1i5z4IXHgvpqI3NpPBEZXmyVRBf/4gmlPcnq/af3pjL4Z2rGVSKCja2 j9/YaehUwDZGZUDMFY4zSBdUxP2OYiD5muDyLlvky3sBZ6KS9w1FdP&fallback_url=http://netix.dl.sourceforge.net/project/scribus/scribus/.../scribus-1.4.6-windows-x64.exe&downloadAs=Scribus-13199-dp.exe  (337b7d3814843e940f76ae7b5c9b4c21)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=mc3O9ghs68pkehassNqvWc6BGU12k4KmTfYmAWTKNjw=&c=C82jOUkqle6z4JumpFc/8zSJx/ftAvrb8qWl65zUVN1n9giScUVn3SKn5VeP f7N3tAk6yCkjkL5kpThs8Yk4dxjK0Y6a zU7dPAddkZRzs2YsXqshjw9wv54snCmCH&fallback_url=https://inkscape.global.ssl.fastly.net/media/resources/.../inkscape-0.91-x64.msi&downloadAs=Inkscape-12218-dp.exe  (148cc951c05ef49443ead0b984ebf664)

1 / 68      (Adware)
http://www.toursfileclean.com/c?x=mCQIr rvjlIj8pgEzIU 7EAws7kg5nI0aN88SIGKYX4=&c=aLaPxFwTbhGtn5UpZrsHs HfaOu3jrEuLUfyF2ahEwDfrQKbLXLzyA8C4D1ZYMNWExt/lEtICPHf1ZGeLaYOfp/0eeCKwZbp1g0rdoRYrhCfWxMDRVaDIrJaZJObOts2&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe  (2f96fa6e08b4c64c049f86e02da3841d)

The following 6 files have been seen to comunicate with www.toursfileclean.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.