» www.timeserver.ru
Overview
Analysis
IPs Addresses (1)
Downloads (6)
Network (24)
Website Detail
Statistics
Related Domains (13)

www.timeserver.ru

Private Person (Proxy Registrant)

Domain Information

The domain www.timeserver.ru is registered by proxy through RU-CENTER-RU and was originally registered in March of 2008. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Sloboda, Voronezh within Russia which resides on the RIPE Network Coordination Centre network.

Registrant:

Private Person

Registrar:

RU-CENTER-RU

Server location:

Voronezh, Russia (RU)

Create date:

Monday, March 17, 2008

Expires date:

Friday, March 17, 2017

ASN:

AS29470 RETNNET-AS JSC _RetnNet_,RU

Root domain:

timeserver.ru

Whois:

1 timeserver.ru record

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.MediaFrog.ROSTPAY.Installer (M)

100.00%

avast!

Win32:Agent-AYCR [PUP]

50.00%

Dr.Web

Program.Unwanted.1012, Program.Unwanted.328

50.00%

K7 AntiVirus

Riskware

25.00%

The domain www.timeserver.ru has been seen to resolve to the following IP address.

46.46.160.235

February 28, 2016

File downloads found at URLs served by www.timeserver.ru.

4 / 68 (PUP)

http://www.timeserver.ru/go.html?save=1&url=http://www.carambis.ru/download.php?name=/.../cleaner.exe&aff=timeserver&to=&utm_source=TimeServer&utm_medium=banner&utm_term=13789&utm_campaign=city_page&type=Carambis_Cleaner&place=city (installercc-1.3.2.4385.exe)

1 / 68 (PUP)

http://www.timeserver.ru/go.html?save=1&url=http://www.carambis.ru/download.php?name=/.../cleaner.exe&aff=timeserver&to=&utm_source=TimeServer&utm_medium=banner&utm_term=6023&utm_campaign=city_page&type=Carambis_Cleaner&place=city (installercc-1.3.3.5315.exe)

1 / 68 (PUP)

http://www.timeserver.ru/go.html?save=1&url=http://www.carambis.ru/download.php?name=/.../cleaner.exe&aff=timeserver&to=&utm_source=TimeServer&utm_medium=banner&utm_term=11878&utm_campaign=city_page&type=Carambis_Cleaner&place=city (installercc-1.3.3.5315.exe)

1 / 68 (PUP)

http://www.timeserver.ru/.../TimeServerSetup.exe (timeserver.exe)

3 / 68 (PUP)

http://www.timeserver.ru/.../TimeServerSetup.exe (216a35e6185aca33a65163178059734a)

4 / 68 (PUP)

http://www.timeserver.ru/go.html?save=1&url=http://www.carambis.ru/download.php?name=/.../cleaner.exe&aff=timeserver&to=&utm_source=TimeServer&utm_medium=banner&utm_term=39948&utm_campaign=city_page&type=Carambis_Cleaner&place=city (installercc-1.3.2.4385.exe)

The following 24 files have been seen to comunicate with www.timeserver.ru in live environments.

TCP » 46.46.160.235:80

comboplayerinstaller.exe (ComboPlayer Installer by ROSTPAY)

TCP » 46.46.160.235:80

carambis_driver_updater_ab60d9637d6d15fbcb446cd135c55a60bd7ee00d.exe

TCP » 46.46.160.235:80

comboplayer-silent-installer.exe (ComboPlayer Installer by ROSTPAY)

TCP » 46.46.160.235:443

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:80

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:80

comboplayerinstaller.exe (ComboPlayer Installer by ROSTPAY)

TCP » 46.46.160.235:443

carambis_driver_updater_ab60d9637d6d15fbcb446cd135c55a60bd7ee00d.exe

TCP » 46.46.160.235:80

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:80

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:80

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:80

carambis_driver_updater_142a09cc71d44bb5813296336cc515d7965cb751.exe

TCP » 46.46.160.235:80

comboplayer-silent-installer.exe (ComboPlayer Installer by ROSTPAY)

TCP » 46.46.160.235:443

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:443

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:80

fontmanager.exe (FontManager by ROSTPAY)

TCP » 46.46.160.235:443

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:443

carambis_driver_updater_142a09cc71d44bb5813296336cc515d7965cb751.exe

TCP » 46.46.160.235:80

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:443

comboplayer.exe (ComboPlayer by ROSTPAY)

TCP » 46.46.160.235:80

carambis_cleaner_7b20f19cb1ad9352c6414314167fbb32aa31fb54.exe

Latest 20 of 27 files

URL:

http://www.timeserver.ru/

Google Analytics:

UA-753548

Title:

“Точное текущее время в городах России, Европы, странах Латинской и Северной Америки (США и Канада). Узнайте сколько время!”

Web server:

nginx

Facebook:

Likes: 122

Shares: 22

Comments: 3

Statistics are for the previous month.

Related Domains

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.