home

1l-go.mail.ru

MGL Mail.ru Internet Assets Limited

Domain Information

The domain 1l-go.mail.ru registered by MGL Mail.ru Internet Assets Limited was initially registered in September of 1997 through RU-CENTER-RU. The hosted servers are located in Moscow, Moscow City within Russia which resides on the RIPE Network Coordination Centre network.
Registrar:
RU-CENTER-RU

Server location:
Moscow City, Russia (RU)

Create date:
Saturday, September 27, 1997

Expires date:
Saturday, October 1, 2016

ASN:
AS47764 MAILRU-AS Limited liability company Mail.Ru,RU

Root domain:
mail.ru

Whois:
1 mail.ru record

The domain 1l-go.mail.ru has been seen to resolve to the following 6 IP addresses.

178.22.89.56
2link8.ext.terrhq.ru
December 25, 2015

178.22.89.38
2link3.ext.terrhq.ru
December 25, 2015

178.22.88.111
2link5.1l.mail.ru
December 25, 2015

178.22.88.110
2link4.1l.mail.ru
December 25, 2015

178.22.88.98
2link0.1l.mail.ru
December 25, 2015

178.22.89.57
2link9.ext.terrhq.ru
December 25, 2015

File downloads found at URLs served by 1l-go.mail.ru.

0 / 68
http://1l-go.mail.ru/r/adid/2089098_0/pid/102/pof/1/f/1/url/https://.../JuggerLoader.exe  (juggerloader_8cbf5d7723f22eb720e2abaece16052d.exe)

0 / 68
http://1l-go.mail.ru/r/adid/2068236_0/pid/100022/pof/1/f/3/url/.../ArmwarffLoader.exe  (armwarffloader_af406586fe63febf311bff32a67c2933.exe)

1 / 68      (Malware)
http://1l-go.mail.ru/r/adid/2102390_0/pid/102/pof/1/f/1/url/https://.../amigo_setup.exe  (5de4da194df8c498e472bae90ce0b5e0)

0 / 68
http://1l-go.mail.ru/r/adid/2089098_0/pid/102/pof/1/f/1/url/https://.../JuggerLoader.exe  (juggerloader_09e8fa76391f723c267210e915f2f310.exe)

0 / 68
http://1l-go.mail.ru/r/adid/2089098_0/pid/102/pof/1/f/1/url/https://.../JuggerLoader.exe  (juggerloader_f6a955f0154e1dc5b7bd71006b041e40.exe)

1 / 68      (Malware)
http://1l-go.mail.ru/r/adid/2102390_0/pid/102/pof/1/f/1/url/https://.../amigo_setup.exe  (3a457fd239994d92f8caafc86b9e5e59)

1 / 68      (Malware)
http://1l-go.mail.ru/r/adid/2102390_0/pid/102/pof/1/f/1/url/https://.../amigo_setup.exe  (1cb1dc74dd67819394550c326f800aa8)

0 / 68
http://1l-go.mail.ru/r/adid/2089098_0/pid/102/pof/1/f/1/url/https://.../JuggerLoader.exe  (juggerloader_7b57161679c3937d7d2df48469d2fd75.exe)

3 / 68      (PUP)
http://1l-go.mail.ru/r/adid/2084336_0/pid/344/pof/1/f/1/url/https://.../tanks_amigo.exe  (2a29feafdd8f6f37e238f0d814d88ffe)

The following 14 files have been seen to comunicate with 1l-go.mail.ru in live environments.

TCP » 178.22.89.38:443
kometa.exe (Kometa by @COMPANY_FULLNAME@)

TCP » 178.22.89.57:443
kometa.exe (Kometa by @COMPANY_FULLNAME@)

TCP » 178.22.89.38:443
kometa.exe (Kometa by Kometa Authors)

TCP » 178.22.88.110:80
amigo.exe (Amigo by Mail.Ru)

TCP » 178.22.88.111:443
kometa.exe (Kometa by @COMPANY_FULLNAME@)

TCP » 178.22.88.111:443
amigo.exe (Amigo by Mail.Ru)

TCP » 178.22.89.57:443
kometa.exe (Kometa by Kometa Authors)

TCP » 178.22.88.110:80
beamrise.exe (Beamrise by The Beamrise Authors)

TCP » 178.22.89.57:443
beamrise.exe (Beamrise by The Beamrise Authors)

TCP » 178.22.89.57:443
kometa.exe (Kometa (39.34) by Kometa Authors)

TCP » 178.22.89.57:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 178.22.88.110:443
UCBrowser.exe (by UCWeb)

TCP » 178.22.89.56:443
kometa.exe (Kometa (39.34) by Kometa Authors)

TCP » 178.22.88.111:443
uran.exe (Uran by uCoz Media and Chromium Authors)

TCP » 178.22.88.110:443
kometa.exe (Kometa by @COMPANY_FULLNAME@)

TCP » 178.22.89.38:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 178.22.89.38:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 178.22.89.56:443
apptrailers.exe

TCP » 178.22.88.111:80
mrswitcher.exe (Mail.Ru Switcher by Mail.Ru)

TCP » 178.22.88.98:80
kometa.exe (Kometa by @COMPANY_FULLNAME@)

 
Latest 20 of 49 files

URL:
http://1l-go.mail.ru/

SSL certificate subject:
CN=dl.mail.ru, OU=IT, O=LLC Mail.Ru, L=Moscow, S=RUSSIAN FEDERATION, C=RU

SSL certificate issuer:
CN=GeoTrust SSL CA - G3, O=GeoTrust Inc., C=US

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.