ttb.playmediaplayer.com

Corp New Ventures Services

Domain Information

The domain ttb.playmediaplayer.com registered by Corp New Ventures Services was initially registered in December of 2014 through SOLUCIONES CORPORATIVAS IP,SLU. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Vitoria-Gasteiz, Pais Vasco within Spain which resides on the RIPE Network Coordination Centre network.
Remove Malware from ttb.playmediaplayer.com - Powered by Reason Core Security
Registrar:
! #1 HOST KOREA, INC.

Server location:
Pais Vasco, Spain (ES)

Create date:
Saturday, December 13, 2014

Expires date:
Tuesday, December 13, 2016

Updated date:
Friday, October 30, 2015

ASN:
AS57910 SCIP-AS Soluciones Corporativas IP, SL,ES

Scanner detections:
Detections  (94% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.TuguuIsrael.F, PUP.Installer.TuguuSLU.I, PUP.Installer.TuguuSL.F, PUP.Installer.TUGUUSL.F, PUP.Installer.Groovecom.F, PUP.Installer.BundloreLimited.F, PUP.Installer.TuguuSLU.F, PUP.Installer.InstallManager.F, PUP.Installer.Fileangels.F, PUP.Bundler.Air Software, Threat.Tuguu.Bundler, PUP.Tuguu.TuguuU.Bundler (M), Threat.Win.Reputation.IMP, PUP.Tuguu.Bundler (M), PUP.OutBrowse.MultiplyROI.Bundler (M), PUP.InstallCore.Installer.Installer (M), PUP.Tuguu.TuguuIsrael.Bundler (M), PUP.Solimba.Bechiro.Bundler (M)
91.18%

Dr.Web
Win32.Sector.21, Trojan.Packed.24553, Trojan.PayInt.9, Adware.Downware.1827, Threat.Undefined, Trojan.PayInt.14, Adware.Downware.2285
50.00%

Malwarebytes
PUP.Optional.DomaIQ, PUP.Optional.BundleInstaller.A, PUP.Optional.Bundlore, PUP.Optional.Domalq, PUP.Optional.AirAdInstaller
47.06%

Avira AntiVirus
W32/Sality.AT, APPL/DomaIQ.Gen7, APPL/DomaIQ.Gen2, APPL/DomaIQ.G.2, APPL/Downloader.Gen, TR/Drop.Agent.460232, ADWARE/Adware.Gen
44.12%

NANO AntiVirus
Trojan.Win32.DomaIQ.csqtgn, Riskware.Win32.PayInt.cscjoi, Riskware.Win32.DomaIQ.crviun, Riskware.Win32.Downware.crgjbr, Trojan.Win32.PayInt.csffwn
44.12%

VIPRE Antivirus
DomaIQ, Threat.4150696, Threat.4783369, Threat.4783235, Threat.4784938, Threat.4778314, Threat.4783262, Threat.4782985
44.12%

AVG
AdLoad.B, Skodna.Generic_r, Adware Skodna.Generic_r.HZ, Adware Skodna.Generic_r.IA, Bundlo, Adware Skodna.Bundle_r.Q, AdPlugin
44.12%

K7 AntiVirus
Unwanted-Program , Trojan
41.18%

avast!
Win32:PUP-gen [PUP], Win32:DomaIQ-T [PUP], Adware-OH [Adw], Win32:DomaIQ-CM [PUP], Malware-gen, Win32:Adware-gen [Adw], Win32:DomaIQ-BH [PUP]
41.18%

Agnitum Outpost
PUA.DomaIQ, Riskware.Agent, Adware.DomaIQ, PUA.AirAd, PUA.Agent
41.18%

Sophos
DomainIQ pay-per install, Download Admin, Bundlore, AirInstaller, iBryte Premium Installer, PUA 'DomainIQ pay-per install'
41.18%

Vba32 AntiVirus
AdWare.MSIL.DomaIQ, BScope.Downware.DomaIQ, suspected of Trojan.Downloader.gen.h, OScope.Downware.DomaIQ, AdWare.AirAdInstaller
41.18%

Antiy Labs AVL
Spyware[AdWare:not-a-virus]/MSIL.DomaIQ, Trojan/Win32.SGeneric, Trojan/Win32.TSGeneric, Trojan[:HEUR]/Win32.AGeneric, GrayWare[AdWare:not-a-virus]/Win32.iBryte.hjiq
41.18%

F-Prot
W32/Sality.gen2, W32/DomaIQ.B.gen, W32/Bundlore.B.gen, W32/MSIL_Troj.CL.gen, W32/A-ad198980, W32/A-34fffba4, W32/S-39b8184f
38.24%

MicroWorld eScan
Adware.DomaIQ.T, Dropped:Adware.Generic.655825, Dropped:Adware.Generic.652889, Application.Bundler.DomaIQ.C, Application.Generic.630257
38.24%

The domain ttb.playmediaplayer.com has been seen to resolve to the following 7 IP addresses.

May 3, 2015

www.renewyourexpireddomain.com
October 9, 2014

ec2-54-201-201-245.us-west-2.compute.amazonaws.com
July 7, 2014

ec2-50-112-177-75.us-west-2.compute.amazonaws.com
July 7, 2014

ec2-54-186-202-243.us-west-2.compute.amazonaws.com
June 13, 2014

ec2-54-213-26-232.us-west-2.compute.amazonaws.com
February 3, 2014

ec2-54-201-207-166.us-west-2.compute.amazonaws.com
December 22, 2013

File downloads found at URLs served by ttb.playmediaplayer.com.

 
Latest 30 of 35 download URLs

The following 2 files have been seen to comunicate with ttb.playmediaplayer.com in live environments.

URL:
http://ttb.playmediaplayer.com/

Google Analytics:
UA-19309218

Title:
“playmediaplayer.com”

Description:
“This website is for sale! playmediaplayer.com is your first and best source for information about playmediaplayer . Here you will also find topics relating to issues of general interest. We hope you find what you are looking for!”

Web server:
nginx (PHP/5.3.3-7+squeeze28)

30 of 34 related domains

Remove Malware from ttb.playmediaplayer.com - Powered by Reason Core Security