home

files.terraria-z.ru

Private Person  (Proxy Registrant)

Domain Information

The domain files.terraria-z.ru is registered by proxy through R01-RU and was originally registered in December of 2014. The hosted servers are located in Moscow, Moskva within Russia which resides on the RIPE Network Coordination Centre network.
Registrar:
R01-RU

Server location:
Moskva, Russia (RU)

Create date:
Thursday, December 18, 2014

Expires date:
Sunday, December 18, 2016

ASN:
AS48666 AS-MAROSNET Moscow, Russia, RU

Root domain:
terraria-z.ru

Whois:
1 terraria-z.ru record

The domain files.terraria-z.ru has been seen to resolve to the following 2 IP addresses.

193.124.179.142
web09-cp.marosnet.net
September 16, 2016

193.124.57.253
unspecified.mtw.ru
February 25, 2016

File downloads found at URLs served by files.terraria-z.ru.

1 / 68      (Adware)
http://files.terraria-z.ru/?file=YTo2OntzOjc6InNpdGVfaWQiO3M6MzoiNjM4IjtzOjg6ImZpbGVfdXJsIjtzOjQzOiJodHRwOi8vaS50ZXJyYXoucnUvVGVycmFyaWElMjAxLjMlMjBSVVMuZXhlIjtzOjk6ImZpbGVfbmFtZSI7czoyMDoiVGVycmFyaWEgMS4zIFJVUy5leGUiO3M6OToiZmlsZV90eXBlIjtzOjU6InNldHVwIjtzOjk6ImZpbGVfc2l6ZSI7czo4OiI3OTAzOTA3OSI7czo2OiJyYW5kb20iO2k6NTk3MjQyODI5O30,  (terraria_1_3_rus.exe)

1 / 68      (inconclusive)
http://files.terraria-z.ru/?file=YTo2OntzOjc6InNpdGVfaWQiO3M6MzoiNjM4IjtzOjg6ImZpbGVfdXJsIjtzOjQzOiJodHRwOi8vaS50ZXJyYXoucnUvVGVycmFyaWElMjAxLjMlMjBSVVMuZXhlIjtzOjk6ImZpbGVfbmFtZSI7czoyMDoiVGVycmFyaWEgMS4zIFJVUy5leGUiO3M6OToiZmlsZV90eXBlIjtzOjU6InNldHVwIjtzOjk6ImZpbGVfc2l6ZSI7czo4OiI3OTAzOTA3OSI7czo2OiJyYW5kb20iO2k6NTk3MjQyODI5O30,  (terraria 1.3 rus.exe)

1 / 68      (Adware)
http://files.terraria-z.ru/?file=YTo2OntzOjc6InNpdGVfaWQiO3M6MzoiNjM4IjtzOjg6ImZpbGVfdXJsIjtzOjM3OiJodHRwOi8vaS50ZXJyYXoucnUvVGVycmFyaWElMjAxLjMuZXhlIjtzOjk6ImZpbGVfbmFtZSI7czoxNjoiVGVycmFyaWEgMS4zLmV4ZSI7czo5OiJmaWxlX3R5cGUiO3M6NToic2V0dXAiO3M6OToiZmlsZV9zaXplIjtzOjg6IjgwNzQwMTY3IjtzOjY6InJhbmRvbSI7aToyMTEyMzk1MTczO30,  (terraria_1_3.exe)

4 / 68      (inconclusive)
http://files.terraria-z.ru/?file=YTo2OntzOjc6InNpdGVfaWQiO3M6MzoiNjM4IjtzOjg6ImZpbGVfdXJsIjtzOjQzOiJodHRwOi8vaS50ZXJyYXoucnUvVGVycmFyaWEgMS4yLjQuMSBSVVMuZXhlIjtzOjk6ImZpbGVfbmFtZSI7czoyNDoiVGVycmFyaWEgMS4yLjQuMSBSVVMuZXhlIjtzOjk6ImZpbGVfdHlwZSI7czo1OiJzZXR1cCI7czo5OiJmaWxlX3NpemUiO3M6ODoiNTQ4MTMwMTQiO3M6NjoicmFuZG9tIjtpOjE4MTM5Mzg5MzU7fQ,,  (terraria 1.2.4.1 rus.exe)

0 / 68
http://files.terraria-z.ru/?file=YTo2OntzOjc6InNpdGVfaWQiO3M6MzoiNjM4IjtzOjg6ImZpbGVfdXJsIjtzOjM3OiJodHRwOi8vaS50ZXJyYXoucnUvVGVycmFyaWElMjAxLjMuZXhlIjtzOjk6ImZpbGVfbmFtZSI7czoxNjoiVGVycmFyaWEgMS4zLmV4ZSI7czo5OiJmaWxlX3R5cGUiO3M6NToic2V0dXAiO3M6OToiZmlsZV9zaXplIjtzOjg6IjgwNzQwMTY3IjtzOjY6InJhbmRvbSI7aToyMTEyMzk1MTczO30,  (terraria 1.3.exe)

1 / 68      (Adware)
http://files.terraria-z.ru/?file=YTo2OntzOjc6InNpdGVfaWQiO3M6MzoiNjM4IjtzOjg6ImZpbGVfdXJsIjtzOjQzOiJodHRwOi8vaS50ZXJyYXoucnUvVGVycmFyaWElMjAxLjMlMjBSVVMuZXhlIjtzOjk6ImZpbGVfbmFtZSI7czoyMDoiVGVycmFyaWEgMS4zIFJVUy5leGUiO3M6OToiZmlsZV90eXBlIjtzOjU6InNldHVwIjtzOjk6ImZpbGVfc2l6ZSI7czo4OiI3OTAzOTA3OSI7czo2OiJyYW5kb20iO2k6NTk3MjQyODI5O30,  (terraria_1_3_rus.exe)

The following 2 files have been seen to comunicate with files.terraria-z.ru in live environments.

TCP » 193.124.179.142:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 193.124.179.142:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 193.124.179.142:80
produpd.exe (produpd.exe by Vested Development, Inc)

URL:
http://files.terraria-z.ru/

Title:
“TerraZ”

Web server:
nginx (PHP/5.4.9)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.