home

ok.cdnmail.ru

MGL Mail.ru Internet Assets Limited

Domain Information

The domain ok.cdnmail.ru registered by MGL Mail.ru Internet Assets Limited was initially registered in November of 2008 through RU-CENTER-RU. Currently this domain has been known to host various forms of malware. The hosted servers are located in Moscow, Moscow City within Russia which resides on the RIPE Network Coordination Centre network.
Registrar:
RU-CENTER-RU

Server location:
Moscow City, Russia (RU)

Create date:
Friday, November 21, 2008

Expires date:
Monday, November 21, 2016

ASN:
AS47764 MAILRU-AS Limited liability company Mail.Ru

Root domain:
cdnmail.ru

Whois:
1 cdnmail.ru record

Google Safe Browsing:
unwanted

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.MailRu.K, Win32.Generic
100.00%

Rising Antivirus
PE:Trojan.RuMail!1.6574
50.00%

The domain ok.cdnmail.ru has been seen to resolve to the following IP address.

94.100.180.110
moscow.cdnmail.ru
April 6, 2016

File downloads found at URLs served by ok.cdnmail.ru.

1 / 68      (Malware)
http://ok.cdnmail.ru/InternetOk.exe  (3dfb33c4a5cd25bbe12f24937ab4ccd0)

2 / 68      (PUP)
http://ok.cdnmail.ru/InternetOk.exe  (2ae2f695097c591275940755cf9d9e93)

The following 2556 files have been seen to comunicate with ok.cdnmail.ru in live environments.

TCP » 94.100.180.110:443
mrswitcher.exe (Mail.Ru Switcher by Mail.Ru)

TCP » 94.100.180.110:80
lz0pyia11di2.exe (MailRuSputnik)

TCP » 94.100.180.110:80
MailRuUpdater.exe (MailRuUpdater by Mail.Ru)

TCP » 94.100.180.110:80
mrupdater.exe.dul! (MailRuUpdater by Mail.Ru)

TCP » 94.100.180.110:443
amigo_bundle.exe (Mail.Ru Launcher by Mail.Ru)

TCP » 94.100.180.110:80
mrutmp.exe (MailRuUpdater by Mail.Ru)

TCP » 94.100.180.110:80
0kvsaydztly2.exe (Amigo@Mail.Ru by Mail.Ru)

TCP » 94.100.180.110:443
launcher.exe (Mail.Ru Launcher by Mail.Ru)

TCP » 94.100.180.110:80
assassins_creed_unity__v_1.5.0__dlcs__2014_pc__repack_ot_r.g._mehaniki.torrent.exe (PackageForTheWeb Stub by InstallShield Software)

TCP » 94.100.180.110:443
d004-88d9-f907-dfe3 (Amigo@Mail.Ru by Mail.Ru)

TCP » 94.100.180.110:443
thumbnail.exe (Kometa Start Button by Kometa LCC)

TCP » 94.100.180.110:80
sanonmp250.exe (PackageForTheWeb Stub by InstallShield Software)

TCP » 94.100.180.110:80
amigo.exe (Amigo by Mail.Ru)

TCP » 94.100.180.110:443
amigo_bundle.exe (Mail.Ru Launcher by Mail.Ru)

TCP » 94.100.180.110:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 94.100.180.110:443
amigo_bundle.exe (Mail.Ru Launcher by Mail.Ru)

TCP » 94.100.180.110:443
amigo_dkit.exe (Mail.Ru Launcher by Mail.Ru)

TCP » 94.100.180.110:80
free_minecraft_intro.exe (PackageForTheWeb Stub by InstallShield Software)

TCP » 94.100.180.110:443
amigo_bndl.exe (Mail.Ru Launcher by Mail.Ru)

TCP » 94.100.180.110:443
amigo_bndl.exe (Mail.Ru Launcher by Mail.Ru)

 
Latest 20 of 2,568 files

URL:
http://ok.cdnmail.ru/

SSL certificate subject:
CN=*.mail.ru, OU=IT, O=LLC Mail.Ru, L=Moscow, S=RUSSIAN FEDERATION, C=RU

SSL certificate issuer:
CN=GeoTrust SSL CA - G3, O=GeoTrust Inc., C=US

Web server:
nginx

mail.ru

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.