home

cs12.userfiles.me

Whois Privacy Protection Service, Inc.  (Proxy Registrant)

Domain Information

The domain cs12.userfiles.me is registered by proxy through Name.com LLC R79-ME (625) and was originally registered in November of 2012. The hosted servers are located in Nuremberg, Bayern within Germany which resides on the RIPE Network Coordination Centre network.
Registrar:
Name.com LLC R79-ME (625)

Server location:
Bayern, Germany (DE)

Create date:
Thursday, November 1, 2012

Expires date:
Sunday, November 1, 2015

Updated date:
Friday, October 31, 2014

ASN:
AS24940 HETZNER-AS Hetzner Online AG,DE

Root domain:
userfiles.me

Whois:
2 userfiles.me records

The domain cs12.userfiles.me has been seen to resolve to the following 2 IP addresses.

144.76.95.2
cs12.userfiles.me
November 29, 2014

148.251.40.51
cs12.userfiles.me
January 31, 2014

File downloads found at URLs served by cs12.userfiles.me.

0 / 68
http://cs12.userfiles.me/f/087022153177027235243210047127168091147209006212241224/1414680524/8519595/0/.../ZzedSetup-spaces.ru.exe  (617c0c405225af052e582761bbe1f5c0)

0 / 68
http://cs12.userfiles.me/f/083110102163074196083121087137070059121220139194198076/1416166956/42511188/0/.../winrar-x64-500b6ru-spaces.ru.exe  (winrar-x64-500b6ru.exe)

0 / 68
http://cs12.userfiles.me/f/0/1391271953/19328979/0/.../Aktivator_windows7-spaces.ru.exe  (7aaaff0e91511fce6ac95a5c96e9e122)

0 / 68
http://cs12.userfiles.me/f/0/1391272046/17258769/0/.../w7lxe-3010-ru-ru-spaces.ru.exe  (fb08c1bf16315160530b36f99cce7857)

0 / 68
http://cs12.userfiles.me/f/0/1391089994/44612696/0/.../Vector-spaces.ru.exe  (vector.exe)

0 / 68
http://cs12.userfiles.me/f/0/1391146119/17245041/0/.../start-spaces.ru.exe  (c85a7612a831f4ad20418a855e022d78)

0 / 68
http://cs12.userfiles.me/f/0/1391168398/23524997/0/.../CS.Source_dlja_online-spaces.ru.exe  (c3e1f7f4eb5ec52083d1286b1f5b1bfb)

0 / 68
http://cs12.userfiles.me/f/0/1397297540/45200035/0/.../AssassinsCreedIVBlackFlagDeluxeinclFreed.exe  (cd0a9a59bd323a2f729536e6d002ed79)

26 / 68    (Malware)
http://cs12.userfiles.me/f/0/1392410015/41994569/0/.../Sims_4-spaces.ru.exe  (c5b6661f05dd70ed0ba4435edc96632a)

2 / 68      (inconclusive)
http://cs12.userfiles.me/f/0/1392412553/7823111/0/.../PACMAN-spaces.ru.exe  (c8d68ce6239ba82df7a45d727f719977)

1 / 68
http://cs12.userfiles.me/f/0/1391706586/45502940/0/.../tdsskiller-spaces.ru.exe  (TDSSKiller.exe)

0 / 68
http://cs12.userfiles.me/f/0/1391271953/19328979/0/.../Aktivator_windows7-spaces.ru.exe  (047da51bd2e95d43d8c9289431ed95bc)

0 / 68
http://cs12.userfiles.me/f/0/1391272046/17258769/0/.../w7lxe-3010-ru-ru-spaces.ru.exe  (21c6f9be2f300ea0d3d25b27e972ce25)

2 / 68
http://cs12.userfiles.me/f/091140197204012090038102131012029192120090198056252162/1390915467/45338445/0/.../Recuva_vostanovlenie_s_flewki-spaces.ru.exe  (rcsetup149.exe)

The following file have been seen to comunicate with cs12.userfiles.me in live environments.

TCP » 144.76.95.2:80
AdBlock.Agent.exe (Adguard by Adshows)

URL:
http://cs12.userfiles.me/

Title:
“Welcome to nginx!”

Web server:
nginx/1.1.19

superfiles.me

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.