home

www.worldcleartours.com

Domain Information

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
worldcleartours.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Bibado.BibadoInvestments.Bundler (M), PUP.Bibado.BibadoIn.Bundler (M)
100.00%

The domain www.worldcleartours.com has been seen to resolve to the following 11 IP addresses.

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 19, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 19, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 17, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 17, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 17, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
April 1, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
April 1, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
April 1, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
April 1, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
April 1, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
April 1, 2016

File downloads found at URLs served by www.worldcleartours.com.

1 / 68      (Adware)
http://www.worldcleartours.com/c?x= yqshiUSU8/f9zT6tn1isv/ZOmU6NikdSVI4xtWlJ9Y=&c=CNIT57OmniOHXr9CozdknrN/eHSixrP1xACg4BcsazAPDDFwwKw3SFsUypKcpVepJx46rfsJ3FTweXCi6x7MgLzMM0X5wQCCaWjMdcSzy1Pq MwvJQfpZxEDQnQ/dNpl&downloadAs=microsoft-office-2010.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455393714/en/8/.../83929-92631-microsoft-office-2010.exe  (3af41dfd1a98ffcdf2b62d0d684e8655)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=OSMJHJTFioVq4EEcggXbaJOuGL1IIihNp /byN5jl2E=&c=hom5qI8azdPv1Bp9BAZ67TSPWKD45z/8Da8JVPV/QgJG9n6hwX8DGKQhyjECmJLOkpNW1tUuEPPWI9rdnAFWJAKZ/fBOaRM1Kt4VOwqMhwPlrU9nlKt/Z61/QKgGyPZC&downloadAs=iphone-unlock-toolkit-1.0.0.1.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455407113/es/4/.../46207-1797314-iphone-unlock-toolkit.exe  (89add8f5a45b7508af56d4be935c863c)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=hEUK3YP09n5nruWaTHkh0L0P04FVSqdIP9DTdB2kWCc=&c=oXdH6JPjBXbyVkaf3i9oO0LtW3p9AyNVSZDVDuVTIzuhNJcZCTtsJkPCY25xhrtaen3ZbfI4gLCCuAnhD29nsY3WqaXFvrpduWVFN4w4tuEcnOtKAIlrvymtRePNdBKJ&downloadAs=black-white-2.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455395728/fr/.../2/225350-652606-black-white-2.exe  (ba4bcf06e36ba8472b410b407b7271b6)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=G7BvcK67WJEExx/cUgHKmu7ksx4qv8oVtVt2sjiVE8k=&c=Zop3pNsU6nZrq/lp9HHA8mwC8i/d8ZZrxsV0/xkcaO NdZG6Urgp7MdpYnZ0kiY7cS8kKlVUPqO1ebEQCQVifkSg8nFxP7rztQ2IeFtmU 51NJADfIUjSYYGiz4z8DMu&downloadAs=windows-media-player-12.exe&fallback_url=http://windows.microsoft.com/en-us/.../download-windows-media-player  (4444b59418f7396a282189f0ed5821df)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=KL3LtFlirQlwj8Jg9dyfRJTubZ1c96J2qYRMBwlSHwM=&c=5K mHVUhytLH Cdsd1v/vNSRkWmmMFb6fqkNuV9FLpJPOg8aoFIDYEsE7L5C9DLzmi30Q ekkX44ZIg6H YaKdqdGagRAl UAf8eZPnJiXU9v4FxhdteV9cVGVK xqHo&downloadAs=illustrator-cs6.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455412864/en/2/.../230971-667197-illustrator-cs6.exe  (9c5fcedc5d244a630ade3fbbd9065473)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=6qwsd1yXQFTq4rTFR1vKUap/mtojJIFjexpiZzAHa1c=&c=iNXdw8KJIJJKlybAG/HL/BEzoEVyXHsKGHbXyRnP/6jBg7zlULgw4mbdq5QRA3kmWEUfY2yxrKWLWYnBuPt6cr3TRXo0 Z/EBanrq6 l33ROZBeFtfjnYfuLlmajRnw &downloadAs=microsoft-office-2010.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455409925/en/8/.../83929-92631-microsoft-office-2010.exe  (4339c128be480efef26501b28d025d24)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=Rzbkwthx18voF9VZS8cjhRaPKNWSU6djpSAr5iHyl5o=&c=QI6krqSdaC38cacotTnK9WUDhFob7xJuLahkyplJ9Y9KwvpwKJxNmDs3ZOfi3l1eUH1isM82/Y5Wxf1b4dRNQlsyFmiUPjk60/s 7wDTFZlNABHU2Po2k4XpjNwCBl9U&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline  (ea3a1495a274041ae7b37fb2bdfde18f)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=rFVD7/w3NjC4mCthH/GBP1J4vDLfofIBa nZba3qRhY=&c=LQ1Wjhu0cbQB/PseM4XAvs/7SzhlGEzSww/cMfEmQpi4clEvxmgjWkakuR22kG6UTbg1qOQOdt5IaGIgrgPF8Es2Em4zLRoxanZqOUhgwafXI gs0GAnitm9cJdGWSkz&downloadAs=windows-media-player-12.exe&fallback_url=http://windows.microsoft.com/en-us/.../download-windows-media-player  (4165b327041f977558c39ce4405a27fb)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=grja7WSqwXNrlUvBAfXFW7S4GPzArY9ebbEoXbEnFZU=&c=dMPN0Wcb Vr9ayF8UA1RTofKkjEQIkHiTeLpu/xBaH05YfceKLx2OjhRTSaukbCIHhqcSKFI49ltdVzL3v5NSubH9popu1YdLBoa0vVQHOTBnJ/nXwP/LQpgrDJRWAoo&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../  (733fad92c3b56c8d6019e2b4ee884f23)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=SlHFpUEGpzXqiKzz90F418qe 22jfqJglznYqG3n4zs=&c=CWALXUbi3s3GA4skknHxQlSG7iX8IO 02 F/MYokvVR65TYtpE/5lB1 olCCb3PVs1ESowsc2CbtfeizzfANThHU//ajocU6AFrhuY3oGRSq457xcUWHeAADpQFb69V8&downloadAs=plants-vs-zombies-2-4.4.1.exe&fallback_url=https://itunes.apple.com/app/.../id597986893?mt=8  (6012a6c09134b5e00e360ac228b24986)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=a4Zm/xXOfukYoQE5nPEngEiTSfaw1zeQ8qucAZcKLc8=&c=VWSXgVqRw3aa1Mlk4ZC53KUfQpE vEBoQ E SKNpqWCylhE2eER4QL5XoR95OFwJp7002FzU/OuqBN7EIvROgDXxvc AIaS 2PRIef5zNcy2y8xvOGRAz 2vTXh4TmKS&downloadAs=hotspot-shield-5.1.7.exe&fallback_url=http://mydati.com//download/.../HSS-773.exe  (79aafa2f3bffc6ecd19e05897927d61f)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=zvyXjjjf 0fSF7 Dy5DKcTYVBcE1RpRIdoK6RIGIQ2s=&c=KYNQcVJeSMMHoBZrUgqDanUeKQZa6wrolVSN7a717A7e14bzIAxZnTtSySm s1ktpbsYLiDOXj7lwwLrbqQGVKvB708BUMiPDM0cY2gGEyMAL/wVI86Xjrmb8unWvAgL&downloadAs=plants-vs-zombies-3.1.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455408265/es/.../2/225052-1797354-plants-vs-zombies.exe  (d3ef29775723d2d1259ffb96b414dae4)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=QGGZCo5Hh42efjYkZ8DHRkakCbks8R9XW/gPr5vOzYE=&c=pylZ7ZG9B4MFQSSAWxz/yDrGEbGtnLfjHZAv82pmso5veXeaXkdS4kBIh 8GyXAN5mp3PEMz0haUNmisdnMRafVaUUHrtNfz7vc7I71kvkxTizvnL6mipFphBDHs ATG&downloadAs=microsoft-office-2010-professional.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455404591/es/8/.../84962-1797817-microsoft-office-2010-professional.exe  (06ed375fd8d5e41084929d80cdeb7e8f)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=RIIAD5L5rkkbon86gXB4p/ieVO1TIPzUE/xNGPXOvNw=&c=OyFh2Ce3ymAy1kH/N3HV1Awb1fL0XuPa7m2zTUmELjGhzjD4sPTpU/lCkRTQ5VLJHN2EahEMdRpLA1A5XQDHfLlN0xjDySgJLndYT8K67Omdw iUnlj9vegzTMwC8WQE&downloadAs=ytd-video-downloader-5.1.1.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455399286/en/9/.../961374-1808908-ytd-video-downloader.exe  (76b2f509cb35eafbaa4eef96c673838f)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=5HeAbeA zqxEGh9e8nwCTRQAzdjSvwnj9DY26 ID5UA=&c=gpKazqyvZbY6XXHO xvTQgbEZfNxjybiPA4vCCnpP0uvta5S7lE3tjJ76VdL3GpnXyj cWSrUwJvpBIqhNKpX29CQqI7EgjV4lqslmz/dnoB6sepJ5jbAOSzu9XK8kQ6&downloadAs=dynomite-deluxe-2.71.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455404727/en/4/.../40471-1792046-dynomite-deluxe.exe  (84602cace196505b4c8d069ab5fd73ed)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=3wvlIqc5nCvR/HwWWkwpCjaV9FidfyTEcMmA2v1hxPA=&c=UZgjLN7VG1Quq5wUOgMwiM4ZLH7/WUhmII62tpa81 qo/HyhrDLBmdGZ4rvllaCZZ7mbctcHooXnIVEDAUfNdYu8y0VxEabI2b1BFQPIGtmeabIkiRS5v4k agNFj4PL&downloadAs=facebook-chat-instant-messenger-1.1.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455407558/en/2/.../230961-1796934-facebook-chat-instant-messenger.exe  (d571000556caec1d4b10760ca95c1ae4)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=k5fDgtHluBFP 2P/k9BHsLHk 9hpD4MeuAo24VvuTe0=&c=p5zk33qUt1NC4nH522ayp4J5PIy0MDIoeIx6CqoCq QaoZY14L6tOJJpOpIFJUIhosAkU69ZvCn9i1k47wzONGp ib1aVZpsM6X9cblOePJV1CGqrhFDU4SoKPEMoU26&downloadAs=autocad-2016.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455400597/fr/.../2/227021-1806203-autocad.exe  (c578a9cd68adf978fadcd4504c5fe167)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=kJ4lMdu 8DdL6J74BYF1QmtW9aNTHflde0ROf94g9yk=&c=6jhvhp4eqQ1OATMc7o0HjFkfP15FjKjlgQzXaPutCQ 8PizEEpYnx28NwbCnTqgXjdFGOewMvLr3kA5pToeLU6m3jTcUU4PUTMQMhH0qm51xR/yDAFfBBdotEaRPSydy&downloadAs=minecraft-1.7.2.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455393131/es/.../2/227519-1797500-minecraft.dmg  (05cba6a40f722edc336bfedec8f8aad4)

1 / 68      (Adware)
http://www.worldcleartours.com/c?x=X0/NRwkN2gDuTkpj7pfdF6BLf8Bl/ysLd4WuA1jN3ys=&c=ntxFliwc8j2AniYcEoMLuaLM4 INpwHgsiAqWgykg7STdJO/sXjLz4mXJy5pOQcvZy2sh 4JIm FseH8FVBpEaWRHJwyp4S0fk7Ne/mhgukzHzG09spDxwLvZfbs1jU4&downloadAs=aol-for-windows-10.1.exe&fallback_url=http://pf.benjaminstrahs.com/s/1455394972/en/5/.../53254-248446-aol-for-windows.exe  (00547413975c4de34148bb7ee591aa03)

The following 6 files have been seen to comunicate with www.worldcleartours.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.