home

dl.metabar.ru

YANDEX, LLC.

Domain Information

The domain dl.metabar.ru registered by YANDEX, LLC. was initially registered in January of 2010 through RU-CENTER-REG-RIPN. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Moscow, Moscow City within Russia which resides on the RIPE Network Coordination Centre network.
Registrar:
RU-CENTER-RU

Server location:
Moscow City, Russia (RU)

Create date:
Wednesday, January 20, 2010

Expires date:
Friday, January 20, 2017

ASN:
AS13238 YANDEX Yandex LLC, RU

Root domain:
metabar.ru

Whois:
2 metabar.ru records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.OOOMetabar.L, PUP.OOOMetabar.J, PUP.OOOMetabar (M), PUP.OOOMetab (M), PUP (M)
100.00%

SUPERAntiSpyware
Adware.Metabar/Variant
50.00%

Trend Micro House Call
TROJ_GEN.F47V0402, TROJ_GEN.F47V0509, TROJ_GEN.F47V0409
50.00%

ESET NOD32
Win32/Toolbar.Metabar (variant)
50.00%

McAfee
Artemis!65DF028DD1E8
33.33%

Agnitum Outpost
PUA.Toolbar.Metabar
33.33%

Dr.Web
Adware.Toolbar.267
33.33%

IKARUS anti.virus
PUA.Toolbar.Metabar
33.33%

The domain dl.metabar.ru has been seen to resolve to the following 2 IP addresses.

87.250.250.41
sovetnik.market.http.yandex.ru
April 19, 2016

151.236.101.222
May 21, 2014

File downloads found at URLs served by dl.metabar.ru.

1 / 68      (Adware)
https://dl.metabar.ru/partner/.../fc-zenit_chrome_sign.exe  (fc-zenit_chrome.exe)

1 / 68      (Adware)
https://dl.metabar.ru/partner/.../rusplt_chrome_sign.exe  (rusplt_chrome.exe)

8 / 68      (Adware)
https://dl.metabar.ru/partner/.../mk_chrome_sign.exe  (mk_chrome.exe)

1 / 68      (Adware)
http://dl.metabar.ru/partner/.../mk_chrome_sign.exe  (mk_chrome.exe)

4 / 68      (Adware)
https://dl.metabar.ru/partner/.../zarplata-online_chrome_sign.exe  (zarplata-online_chrome.exe)

8 / 68      (Adware)
https://dl.metabar.ru/partner/.../elle_chrome_sign.exe  (elle_chrome.exe)

The following 24 files have been seen to comunicate with dl.metabar.ru in live environments.

TCP » 87.250.250.41:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 87.250.250.41:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 87.250.250.41:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 87.250.250.41:443
browser.exe (Yandex by YANDEX)

TCP » 87.250.250.41:443
uran.exe (Uran by uCoz Media and Chromium Authors)

TCP » 87.250.250.41:443
browser.exe (Yandex by YANDEX)

TCP » 87.250.250.41:443
UCBrowser.exe (by UCWeb)

TCP » 87.250.250.41:443
UCBrowser.exe (by UCWeb)

TCP » 87.250.250.41:443
UCBrowser.exe (by UCWeb)

TCP » 87.250.250.41:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 87.250.250.41:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 87.250.250.41:443
crossbrowse.exe (Crossbrowse)

TCP » 87.250.250.41:443
UCBrowser.exe (by UCWeb)

TCP » 87.250.250.41:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 87.250.250.41:443
ntcontrolsvc.exe (by RapidLights)

TCP » 87.250.250.41:443
UCBrowser.exe (by UCWeb)

TCP » 87.250.250.41:443
client.exe (ClientWrapper)

TCP » 87.250.250.41:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 87.250.250.41:443
valueapps.exe (ValueApps.exe by Conduit)

TCP » 87.250.250.41:443
httpfilter.exe

 
Latest 20 of 58 files

URL:
http://dl.metabar.ru/

SSL certificate subject:
CN=dl.metabar.ru, S=Russian Federation, L=Moscow, OU=ITO, O=Yandex LLC, C=RU

SSL certificate issuer:
CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.