home

tornnow.com

NameFind LLC

Domain Information

The domain tornnow.com registered by NameFind LLC was initially registered in August of 2014 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.
Registrar:
GODADDY.COM, LLC

Server location:
Arizona, United States (US)

Create date:
Sunday, August 3, 2014

Expires date:
Wednesday, August 3, 2016

Updated date:
Tuesday, April 5, 2016

ASN:
AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC,US

Whois:
3 tornnow.com records

Scanner detections:
Detections  (89% detected)

Scan engine
Details
Detections

NANO AntiVirus
Trojan.Nsis.Yotoon.deckrr, Trojan.Win32.MLW.doamla
85.19%

Sophos
Generic PUA DC, CoolMirage
77.78%

Reason Heuristics
PUP.VASSANAKONGSOONGNERN.n, PUP.VASSANAKONGSOONGNERN.FF, PUP.VASSANAKONGSOONGNERN.i, PUP.VASSANAKONGSOONGNERN.?, PUP.VASSANAKONGSOONGNERN.k, PUP.CoolMirage.VASSANAK.Installer (M)
77.78%

Dr.Web
Adware.Yontoo.54, Adware.Downware.8319, Detection.Undefined
74.07%

K7 AntiVirus
Adware
74.07%

AVG
Generic, Could be an adware MultiBundle
74.07%

VIPRE Antivirus
CoolMirage Ltd
70.37%

Avira AntiVirus
ADWARE/Adware.Gen, APPL/Downloader.Gen
66.67%

ESET NOD32
Win32/Adware.1ClickDownload.AJ, NSIS/TrojanDropper.Agent.CB, Win32/Adware.1ClickDownload.AY
66.67%

Qihoo 360 Security
Win32/Virus.Adware.47b, Win32/Virus.Downloader.e28
51.85%

McAfee
Artemis!FA761D2EC0BE, Artemis!E5316666B523, Artemis!D3626BEA51AB, Artemis!E5639A81F7BF, Artemis!0B395897DA2E, Artemis!D47A8842051B, Artemis!61FEAB187343, Artemis!692F7346029A, Artemis!C175864F28C5
48.15%

AhnLab V3 Security
Win-PUP/CrossRider, PUP/Win32.Helper
48.15%

Kaspersky
not-a-virus:AdWare.NSIS.Yontoo, not-a-virus:Downloader.Win32.TornTV
44.44%

Baidu Antivirus
Adware.NSIS.Yontoo, Adware.Win32.1ClickDownload, Hacktool.Win32.TornTV
44.44%

Trend Micro House Call
Suspicious_GEN.F47V1225, ADW_YONTOO, Suspicious_GEN.F47V0124, Suspicious_GEN.F47V0128, Suspicious_GEN.F47V0202, Suspici.EDD0D2A5
33.33%

The domain tornnow.com has been seen to resolve to the following 9 IP addresses.

208.73.211.70
April 13, 2016

141.8.224.239
February 6, 2016

50.63.202.57
ip-50-63-202-57.ip.secureserver.net
August 12, 2015

54.246.120.161
ec2-54-246-120-161.eu-west-1.compute.amazonaws.com
June 26, 2015

176.34.107.151
ec2-176-34-107-151.eu-west-1.compute.amazonaws.com
June 18, 2015

54.217.233.226
ec2-54-217-233-226.eu-west-1.compute.amazonaws.com
May 4, 2015

54.228.201.246
ec2-54-228-201-246.eu-west-1.compute.amazonaws.com
May 4, 2015

184.169.157.32
ec2-184-169-157-32.us-west-1.compute.amazonaws.com
January 13, 2015

50.18.168.176
ec2-50-18-168-176.us-west-1.compute.amazonaws.com
January 12, 2015

File downloads found at URLs served by tornnow.com.

11 / 68    (Adware)
http://tornnow.com/.../unibomber2.php?pub=trze7--search&file=&name=sbeovqqra vyyrtny puvyqera cbea shpxvat qrsybengvba encr Nfvna oynpx cneg2 Shyy&fall=1  (sleepy_hollow_s02e01_hdtv_x264_killers_mp4.exe)

15 / 68    (Adware)
http://tornnow.com/common/unibomber2.php?pub=extra--banner&file=uggc://rkgengbeerag.pp/.../3771500&name=Rx Ivyynva (2014) - 720c - Oyh-Enl - k264 - QGF [QQE]&fall=1&fall=1  ([gtfs]timeranger_vs_gogo_v_mkv.exe)

1 / 68      (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Zneiryf Ntragf bs F U V R Y Q F02R01 UQGI k264 XVYYREF enegi&name=Zneiryf Ntragf bs F U V R Y Q F02R01 UQGI k264 XVYYREF enegi&fall=1  (torntv_setup.exe)

17 / 68    (Adware)
http://tornnow.com/common/unibomber2.php?pub=mejor&file=rq2x://.../&name=Ry senapbgvenqbe.&fall=1  (amandine_bourgeois_20m2.exe)

12 / 68    (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Tenaq Gursg Nhgb Ivpr Pvgl CP Tenaq Gursg Nhgb Ivpr Pvgl TGN IP CP&name=Tenaq Gursg Nhgb Ivpr Pvgl CP Tenaq Gursg Nhgb Ivpr Pvgl TGN IP CP&fall=1  (microsoft_office_2010_professional_plus_x86_x64_en_us_final_007_[ctrg].exe)

8 / 68      (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Gur Vagreivrj (2014) (1080)c JRO QY k264 NNP ZreelKznf&name=Gur Vagreivrj (2014) (1080)c JRO QY k264 NNP ZreelKznf&fall=1  (ac_dc_back_in_black_320_kbps_by_pondus74.exe)

6 / 68      (PUP)
http://tornnow.com/common/unibomber2_ab.php?pub=1337x&file=uggc://gbeentr.pbz/.../R696PN80N31R24Q79NS4729PO5769974N7N33N94.gbeerag&name=Zhxhaqn (2014) - 1PQ - CerQIQEVC - K264 - Gryhth Zbivr&fall=1  (mukunda__-_1cd_-_predvdrip_-_x264_-_telugu_movie.exe)

6 / 68      (PUP)
http://tornnow.com/common/unibomber2_ab.php?pub=1337x&file=uggc://gbeentr.pbz/.../699N45OQR55SOP5R404745946O0R174QR1N3O41O.gbeerag&name=Gb Abben Jvgu Ybir 2014 Znynlnynz-Enmbe-Kivq-MvcclZbivrm&fall=1  (to_noora_with_love_2014_malayalam-razor-xvid-zippymoviez.exe)

6 / 68      (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Gjb naq n Unys Zra F12r021 ZXI (1080)c NP3 5 1 NNP 2 0 RAT AY fhof ol OW&name=Gjb naq n Unys Zra F12r021 ZXI (1080)c NP3 5 1 NNP 2 0 RAT AY fhof ol OW&fall=1  (total_super_cuties_angie_full.exe)

12 / 68    (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Pevzvany Zvaqf F10R12 Nabalzbhf 720c JRO QY QQ5 1 U 264 PgeyUQ enegi&name=Pevzvany Zvaqf F10R12 Nabalzbhf 720c JRO QY QQ5 1 U 264 PgeyUQ enegi&fall=1  (microsoft_office_proplus_2010_version__activator_full_dec_english.exe)

17 / 68    (Adware)
http://tornnow.com/common/unibomber2.php?pub=1337x&file=uggc://gbeentr.pbz/.../4374S7QO1P28N3NRR0843P2N026O06Q7266O283Q.gbeerag&name=Sbbgonyy Znantre 2015 CP shyy tnzr ^^abfGRNZ^^&fall=1  (amandine_bourgeois_20m2.exe)

2 / 68      (false positives)
http://tornnow.com/common/unibomber2.php?pub=extra--banner&file=uggc://rkgengbeerag.pp/.../4034681&name=Gur Ybiref (2015) 720c JRO-QY U264 QQ5.1 ArqFhof GOF&fall=1&fall=1  (wrar420.exe)

15 / 68    (Adware)
http://tornnow.com/common/unibomber2.php?pub=mejor&file=uggc://jjj.zrwbegbeerag.pbz/hcybnqf/gbeeragf/.../Uvtu.Fpubby.Zhfvpny.3.Fhof.Vapehfgnqbf.2008.FNAVFU.QIQEVC.KIVQ.[GbQbGbeeragr.pbz].gbeeragC&name=Uvtu.Fpubby.Zhfvpny.3.Fhof.Vapehfgnqbf.2008.FNAVFU.QIQEVC.KIVQ.[GbQbGbeeragr.pbz...&fall=1  (hotel_ruanda_-_hotel_rwanda_-2004-_[dvdrip.xvid.exe)

16 / 68    (Adware)
http://tornnow.com/common/unibomber2.php?pub=extra&file=uggc://rkgengbeerag.pp/qbjaybnq/.../Znzr 32 Cbeghtûrf Oenfvyrveb CG_OE&name=Znzr_32_Cbeghtrf_Oenfvyrveb_CG_OE&fall=1&fall=1  (dikdakkers-oef-oef-2012-mp3-nlt-release.exe)

17 / 68    (Adware)
http://tornnow.com/common/custom/unibomber2_mejor.php?pub=mejor&file=uggc://jjj.zrwbegbeerag.pbz/hcybnqf/gbeeragf/.../Vagrerfgryne_GF_Fperrare.gbeerag&name=Vagrerfgryne_GF_Fperrare.gbeerag&fall=1  ({blocked}.exe)

9 / 68      (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Sbkpngpure (2014) UQEvc KivQ NP3 RIB&name=Sbkpngpure (2014) UQEvc KivQ NP3 RIB&fall=1  (mastodon_once_more_round_the_sun_direct.exe)

4 / 68      (inconclusive)
http://tornnow.com/.../unibomber2.php?pub=trze7--search&file=&name=wnzrf obaq 007 oybbq fgbar cp tnzr Shyy&fall=1  (z0oegi3z.exe)

9 / 68      (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=ZngYNO (2012)n 7 14 0 739 Frghc Xrl&name=ZngYNO (2012)n 7 14 0 739 Frghc Xrl&fall=1  (mastodon_once_more_round_the_sun_direct.exe)

11 / 68    (Adware)
http://tornnow.com/common/unibomber2mejor1.php?pub=mejor--1&file=uggc://jjj.zrwbegbeerag.pbz/hcybnqf/gbeeragf/.../tbng-fvzhyngbe-ratyvfucp.gbeerag&name=tbng-fvzhyngbe-ratyvfucp.gbeerag&fall=1  (toy_story-_el_tiempo_perdido..exe)

14 / 68    (Adware)
http://tornnow.com/common/custom/unibomber2_mejor.php?pub=mejor&file=uggc://jjj.zrwbegbeerag.pbz/hcybnqf/gbeeragf/.../vfnory-3-01.gbeerag&name=vfnory-3-01.gbeerag&fall=1  (bliss__season_3_(2004,_canadian_tv_anthology).exe)

0 / 68
http://tornnow.com/common/unibomber2.php?pub=mejor&file=uggc://jjj.zrwbegbeerag.pbz/hcybnqf/gbeeragf/.../ubzrynaq-3-01.gbeerag&name=ubzrynaq-3-01.gbeerag&fall=1  (exodus_gods_and_kings_2014_bluray_dts_x264_dcs-_4playhd.exe)

14 / 68    (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Cer Pbqr Ubyyljbbq Frk Vzzbenyvgl Naq Vafheerpgvba Va Nzrevpna Pvarzn Gubznf Qburegl (1930) (1934) Svyz Naq Phygher Frevrf cqs Mmmmm&name=Cer Pbqr Ubyyljbbq Frk Vzzbenyvgl Naq Vafheerpgvba Va Nzrevpna Pvarzn Gubznf Qburegl (1930) (1934) Svyz Naq Phygher Frevrf cqs Mmmmm&fall=1  (kylesa.exe)

11 / 68    (Adware)
http://tornnow.com/common/unibomber2.php?pub=&file=uggc://vgbeeragf.bet/.../91N24R86O6QO17ORR5P771N320OO24R2O8PQO503.gbeerag?gvgyr=Gur Yvba Xvat (1994%2P 2014%2P Yrtnpl Pbyyrpgvba)&name=Gur Yvba Xvat (1994, 2014, Yrtnpl Pbyyrpgvba)&fall=1  (torntv_setup.exe)

8 / 68      (Adware)
http://tornnow.com/common/unibomber2_ab.php?pub=1337x&file=uggc://gbeentr.pbz/.../501576705QN4RNR86R4P858735476Q50S8NRO556.gbeerag&name=Gvrfgb Genapr Qvfpbtencul (Vafcveba)&fall=1  (ac_dc_back_in_black_320_kbps_by_pondus74.exe)

11 / 68    (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Fnvagf naq Fbyqvref Gur Ibvq (2014) 720c UD NP3 QQ5 1 Rat AYfhof GOF&name=Fnvagf naq Fbyqvref Gur Ibvq (2014) 720c UD NP3 QQ5 1 Rat AYfhof GOF&fall=1  (sleepy_hollow_s02e01_hdtv_x264_killers_mp4.exe)

12 / 68    (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Frnfba 2 &name=Frnfba 2 &fall=1  (microsoft_office_2010_professional_plus_x86_x64_en_us_final_007_[ctrg].exe)

11 / 68    (Adware)
http://tornnow.com/common/unibomber2_ab.php?pub=1337x&file=uggc://gbeentr.pbz/.../2O78RQSQQP87QP9605SO285997N80O787888P884.gbeerag&name=Vagrefgryyne.2014.GF.KIvQ.NP3.ZeFrrA-FvZCYR&fall=1  (sleepy_hollow_s02e01_hdtv_x264_killers_mp4.exe)

11 / 68    (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Whfgva Gvzoreynxr Gur 20 20 Rkcrevrapr jvgu UVQQRA GENPX &name=Whfgva Gvzoreynxr Gur 20 20 Rkcrevrapr jvgu UVQQRA GENPX &fall=1  (avast_premier_2015_10.0.exe)

9 / 68      (Adware)
http://tornnow.com/common/unibomber2_ab.php?pub=1337x&file=uggc://gbeentr.pbz/.../QR73OS736268Q3S9S33202366N864077Q3NQOQP3.gbeerag&name=Gur.Fvfgreubbq.bs.gur.Geniryvat.Cnagf.2005.QIQEvc.QviK-QHDN&fall=1  (mastodon_once_more_round_the_sun_direct.exe)

10 / 68    (Adware)
http://tornnow.com/.../unibomber2_iso.php?pub=ap1015106&file=Gevor Pbby Perj 16 UbeevoyrFhof 720c zxi&name=Gevor Pbby Perj 16 UbeevoyrFhof 720c zxi&fall=1  ({blocked}.exe)

 
Latest 30 of 65 download URLs

The following 185 files have been seen to comunicate with tornnow.com in live environments.

TCP » 50.63.202.57:80
googleupdate.exe13d7b73 (globalUpdate Update by globalUpdate)

TCP » 50.63.202.57:80
e495bdf6-9a57-4e3d-b197-6843614cf54a-10.exe (CinemaPlus-3.2cV01.04 by Cinema PlusV01.04)

TCP » 50.63.202.57:80
e29193b0-b61f-4d86-ada8-6277dd849368-4.exe (PlusHD-V1.9 by PlusHDv1.9)

TCP » 50.63.202.57:80
1ba10cc1-64c0-4cfb-a952-7e3c3d44e8bb-10.exe (CinemaPlus-3.2cV03.04 by Cinema PlusV03.04)

TCP » 50.63.202.57:80
2625774f-f7e8-4f07-b5d5-0b4f9aaa81f8-11.exe (Plus-HD-9.5 by Plus HD)

TCP » 50.63.202.57:80
uninstallbrw.exe (SavePass 1.1 by OB)

TCP » 50.63.202.57:80
e29193b0-b61f-4d86-ada8-6277dd849368-5.exe (PlusHD-V1.9 by PlusHDv1.9)

TCP » 50.63.202.57:80
64d5b3d7-f9f6-433f-afe2-74bbfe31ec2d-4.exe (HD-V1.8 by InfoHD-V1.8)

TCP » 50.63.202.57:80
a0906c4a-9cdf-4d7c-a9c3-5361ca848b88-4.exe (Discount_Frenzy by DiscountFrenzy)

TCP » 50.63.202.57:80
2900f03e-6554-4c03-bb19-fe1e0d65e4b1-4.exe (SavePass by OutBrowse)

TCP » 50.63.202.57:80
dc1e5181-aff2-4398-ad6d-d5585f4a830c-1-7.exe (SavePass 1.1 by OB)

TCP » 50.63.202.57:80
9e9f1241-3234-4d8e-9e19-0c438065dfa0-4.exe (iWebar)

TCP » 50.63.202.57:80
80dd94df-dd99-4633-ae3f-fe711c3cf1b.exe

TCP » 50.63.202.57:80
3a71d3b7-58bb-44d3-bdfd-3fa2f68ff603-10.exe (Ge-Force by Webar)

TCP » 50.63.202.57:80
e495bdf6-9a57-4e3d-b197-6843614cf54a-1-7.exe (CinemaPlus-3.2cV01.04 by Cinema PlusV01.04)

TCP » 50.63.202.57:80
dc1e5181-aff2-4398-ad6d-d5585f4a830c-10.exe (SavePass 1.1 by OB)

TCP » 50.63.202.57:80
4835.exe (CinemaP-1.8cV06.04 by Cinema PlusV06.04)

TCP » 50.63.202.57:80
sense-codedownloader.exe (Sense by Object Browser)

TCP » 50.63.202.57:80
8f8a488d-e50e-4e84-bae6-a1e96108ab49-10.exe (I - Cinema by iCinema)

TCP » 50.63.202.57:80
da5fafb2-fe4a-4ffa-8ff0-3c951192dd7b-4.exe (PlusVid by Phoenix Media)

 
Latest 20 of 186 files

URL:
http://tornnow.com/

Title:
“tornnow.com”

Web server:
Apache

Facebook:
Shares:  2

Statistics above are for the previous month of March 2024.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.