home

goto.media-serving.com

Tatami Solutions Limited

Domain Information

The domain goto.media-serving.com registered by Tatami Solutions Limited was initially registered in November of 2014 through GANDI SAS. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Roubaix, Nord-Pas-De-Calais within France which resides on the RIPE Network Coordination Centre network.
Registrar:
GANDI SAS

Server location:
Nord-Pas-De-Calais, France (FR)

Create date:
Monday, November 17, 2014

Expires date:
Thursday, November 17, 2016

Updated date:
Monday, November 16, 2015

ASN:
AS16276 OVH OVH SAS,FR

Root domain:
media-serving.com

Whois:
1 media-serving.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.PCCare.Advanced.Installer.Meta (L)
100.00%

The domain goto.media-serving.com has been seen to resolve to the following 2 IP addresses.

46.105.156.73
w03.ttms.eu
August 27, 2016

46.105.156.71
w01.ttms.eu
August 27, 2016

File downloads found at URLs served by goto.media-serving.com.

1 / 68      (PUP)
http://goto.media-serving.com/?&ptrack=JFC1785&version=1&par4=clntb64&params=anNhZHh8Tkx8cmV2ZW51ZWhpdHN8MC4wMDAxfDAuMDAwMjh8MTE1ODF8Sk1DMTE1MV8xMjcyXzIyMTc2fG1pam4uaW5nLm5sfGh0dHAlM0ElMkYlMkZjbGtmZWVkLmNvbSUyRmFkU2VydmUlMkZmZWVkY2xpY2slM0ZzJTNESDJfQmpZRHl4ZElvX2VvcUNhY29jTWpxUHBZRDlMVG1IMnM3S2ZwOHNwdE9JczNFMDJQN2ZWZjlvRE94TWJsTVlaLW83OFE2bmdOV0RyZjFmcE9TUzVFNGNvang2c0NWTHAzYW10Q2pqaV9YcjFOYm9sZ0xON2xJdVdjOTF1NEFDWFNnRy1LMHlkUHBDandxaGRldzBzcV9IVFQ0Y2NUQUZ6TGVxT2tKUU5yTVN5NE90eS1BdkJkSXd6YUVUVGtNR2cyQ3BfQjNreXhSbVY4WUpvVWR5RGNfa0ZOTFVIc1kwdGJJMDBnM2I4WU5tR3JLYllidGtRekZneEhDS3hMSmJoUXBWY3NoU0FPcmFnaVZwU0Y3ajRsNHBvX3NyVjdDQ1lYSEZ5Ti1YYU5hTkdVRnFfTWhuMDU1Z1pWLXdEYVRONmYxRFpxWGRRSl9sQ3dQZkFWWHE0dGlfdUFqckZuVTVTRC1hYlVfNldKb09iUnJ6RzdiVXNhQmNEUWpBUHhtQlUtT1JRMUo5ZFB2X3FZZThNRXJaNlVnQ0o3aGdBZlEwdnFiZ1dXTXN2SHNETlMxbWh4S3Y0RWp1eHQxejdzVzF6WUYwVnl2RWJrfFI3Nzk0MDUzMTI0NzI5NTQ1MTQ2ODYxOTY2MnwxNDY4NjE5NjYyfDExNTF8NjMyMTF8MTc5OXxjanN8ZGVza3RvcHxlZTA1MmQ3ZDdiYzQ1ZTg5OTg1ZTYxMGUzNTBjMDdmOQ==  (apcsetupwclk.exe)

The following 123 files have been seen to comunicate with goto.media-serving.com in live environments.

TCP » 46.105.156.71:80
bdsetup.exe

TCP » 46.105.156.71:80
onlysetup.exe

TCP » 46.105.156.71:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 46.105.156.71:80
stormwatchbrowser.exe

TCP » 46.105.156.71:80
safeup.exe

TCP » 46.105.156.71:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 46.105.156.71:80
UCBrowser.exe (by UCWeb)

TCP » 46.105.156.71:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 46.105.156.71:80
updateadmin.exe

TCP » 46.105.156.71:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 46.105.156.71:80
wikithemes.exe

TCP » 46.105.156.71:80
kometa.exe (Kometa by @COMPANY_FULLNAME@)

TCP » 46.105.156.71:80
UCBrowser.exe (by UCWeb)

TCP » 46.105.156.71:80
binkiland.exe

TCP » 46.105.156.71:80
updateadmin.exe

TCP » 46.105.156.71:80
dailybee.exe

TCP » 46.105.156.71:80
crossbrowser.exe (CrossBrowser by The CrossBrowser Authors)

TCP » 46.105.156.71:443
bobrowser.exe (BoBrowser by The BoBrowser Authors)

TCP » 46.105.156.71:80
swiftmediaconverterbrowser.exe

TCP » 46.105.156.71:80
crossbrowse.exe (Crossbrowse)

 
Latest 20 of 185 files

URL:
http://goto.media-serving.com/

Web server:
nginx

bycontext.com

contextualyield.com

tatami-solutions.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.