home

www.townsafehost.com

Domain Information

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
townsafehost.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Bibado.BibadoInvestments.Bundler (M), PUP.Bibado.BibadoIn.Bundler (M)
100.00%

The domain www.townsafehost.com has been seen to resolve to the following 10 IP addresses.

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 21, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 21, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 16, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 16, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
April 3, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
April 3, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
April 3, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
April 3, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
April 3, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
April 3, 2016

File downloads found at URLs served by www.townsafehost.com.

1 / 68      (Adware)
http://www.townsafehost.com/c?x=6/H6kHu43nRZGh50Tsdn0sK/FTA1kzaGuUozgjAOAAI=&c=5iUihowQyO/mps/OHLGvcWRgNzj4X5NCxZGPLDur1GNzyNk6zCEgot8kDlXjiYHdsvDuah1saLeow68BVEgV3ai0BHIH3o0Q18L kgHyxKt2tGU3nUsehgewaXfL7NYx&downloadAs=hotspot-shield-5.1.7.exe&fallback_url=http://mydati.com//download/.../HSS-773.exe  (79aafa2f3bffc6ecd19e05897927d61f)

1 / 68      (Adware)
http://www.townsafehost.com/c?x=yq84ZeRYRJ4pHP6vUuHB5JcVYJOW/31QesYvvV9Swzg=&c=yb203I830RWziFhBHgQYKbbN1AO/MG7P2SdlAYT 4Y3SlpL/T3tgZGDJCN ZCp11FKzO UPtn/oFXtpTvScR12raC6l878syVE7ffXrtDNv8HD uGGsiHb 4xNi9CRYb&downloadAs=openoffice-4.1.0.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455610281/fr/2/.../25829-1801115-openoffice.exe  (73a075fbef5e8fcff12f68bac92ac122)

1 / 68      (Adware)
http://www.townsafehost.com/c?x=ubAEMQzrjKUdNuWKKFZiXlDUPa3 BQZw9bmCYssxeug=&c=BGy7QY5i/AtjqnZZldD9TalbKWXBKhodefnTTI9AHHVg5XZRbm9Ka3OrHGjJ51y2uAm4uZj3/uQi3CUF2LaMigSiid MvWwIyrJvV0rSl6lDKjYP7bHXF6qKSqxjqQtq&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline  (ea3a1495a274041ae7b37fb2bdfde18f)

1 / 68      (Adware)
http://www.townsafehost.com/c?x=vP3jBI4JLJ52Lmbz7PacqX5tKi9iahfIgSP hScRIWg=&c=YsbbI3RXKtdHwmLmWDIswJ8nYgb79jHFYYYIhZzIvXO 98iF87i5Y4F1rLr3Aq8FtjS6wazRY6H2sGC0daljupnAYuyIy/u/WnHUvAyBYEnQ35clzzic8HfwAc7GPzER&downloadAs=hotspot-shield-5.1.7.exe&fallback_url=http://mydati.com//download/.../HSS-773.exe  (fab08e54edc20de78846282a472a733a)

1 / 68      (Adware)
http://www.townsafehost.com/c?x=6G u1DLIhRitdSj17ei3kq9ynnSPGxMLD NmaGHxUYc=&c=cOtFl9KzsTlxmkoJhhkXu5lJj/VPan/X3gCU0vAEtVJcktOxM4ERQC1xl35w0ZXzM95IfkMbTFjKziN3STomoiqm6mRejWE6azAPQRnItbBtTwJl6JgyB1qAauUbOLTm&downloadAs=azureus-5.1.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455610507/it/2/.../25534-1794364-azureus.exe  (df6ff42839c841235592edcf869a1360)

1 / 68      (Adware)
http://www.townsafehost.com/c?x=kv uALNXgTOV/Drtf6FEkpH2Sjhp9P8f33h5z7C/TJ4=&c=59PExRbz3gexwIGkNDYAkUdMLFnKOj58DLW0x8TSUr3EB1eItb9a1rq47OhNT16XJmlc6kB UEaV6Uo96lOrfuuEZzkc XPuxWmH 6wIK5iJnEGb79sM98Mz6skw3jD2&downloadAs=microsoft-office-professional-2007.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455610529/en/4/.../46039-1800344-microsoft-office-professional-2007.exe  (0e3055463393558396ffc36850d08a05)

1 / 68      (Adware)
http://www.townsafehost.com/c?x=pwh4911JQAcY/4cJOYvqBLhkG9qrXe9U6K qHNVrWa4=&c=5bLAbH4eIrZ8Z5dQnpsYkCC3wqafXuohgPuc/o9ZcRNALslCvCw7goa1AItL1n7xBLYm6Sm7Ll3k8nVhF2wKJU0 fX6bfPtVKHMxsT52NIJX2FS3NngDmiSzSVN NBXk&downloadAs=yahoo-multi-messenger-8.0.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455609922/en/3/.../34032-1791955-yahoo-multi-messenger.zip  (a256387433280a6bb65df908a6ca863f)

1 / 68      (Adware)
http://www.townsafehost.com/c?x=/F1Dq7//2G9TTGnrmkPfVoxNg7rDlfKzEIAB0QIJpfY=&c=Ozhk2fyLkHaev MXu3fOYtyty1Pchpx9CPTRDaQ5GrFqycZpvvUgM4XEI6yCCqllTDbBAU3zeVO6JA/m31fbWKU7PLO YRV/5TO5l6HycMWJYrosGccwvhDJXeoOfvLb&downloadAs=hotspot-shield-5.1.7.exe&fallback_url=http://mydati.com//download/.../HSS-773.exe  (79aafa2f3bffc6ecd19e05897927d61f)

1 / 68      (Adware)
http://www.townsafehost.com/c?x=QPW9FIFR3UUDP0HokLlj9Dp8u7pMDnVtO9cpUEzodjQ=&c=ljukhv19FBaszYvSd4az06IA lp/C31ZmdXIzprEKqfT5x0cTQp1FDKIGaLcVgbF/NNVazFcYb8GbLHlf6Cq5TYOM3eTnu9lKG8IYzeJtZ8 K9Vqxw H10x4oChEkLXR&downloadAs=ytd-video-downloader-5.1.1.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455602703/en/9/.../961374-1808908-ytd-video-downloader.exe  (093b1e5154c105e84eb068c3a5113499)

The following 6 files have been seen to comunicate with www.townsafehost.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.