1

Browser alerts about a download with a URL:

mapuser?providerid={number}&userid={longcapitalstring} ({number} bytes)

It gives me the option to save. This looks incredibly suspicious, but it also looks like some type of tracker since both providerid and userid look like identifiers of some type.

Is this a possible malware, virus or other potentially harmful file?

Thanks to all; I had to hunt this down, but I found the URL domain origin:

usync.nexage.com

That's all it provides. usync.nexage.com and then mapuser?providerid={number}&userid={longcapitalstring}. I get a 404. This also look suspicious because it appears to look like USNYC, but it's actually misspelled, which is a common technique in compromise.

6
  • 2
    Possible? Yes. But not that likely.
    – user155462
    May 23 '18 at 13:58
  • 1
    There's nothing wrong with that URL bit, but it's not complete (the domain is missing, and that can be useful info for assessing its trustability). A file might be harmful anyway, regardless of the URL you download it from. It's not clear what you did exactly and what kind of alerts you are getting.
    – reed
    May 23 '18 at 14:24
  • 2
    Im my opinion this question can not be answered based on the few information provided. In general it is already hard from a URL taken out of context to determine if it leads to malicious content. And you don't even provide the full URL but only fragments of it in an abstract form which makes it practically impossible to get a reliable answer. Therefore I consider the question as too broad. May 23 '18 at 14:33
  • @SteffenUllrich Thx, added the URL once I found it. May 23 '18 at 16:31
  • @KriyanshAurik: "...added the URL once I found it..." - you did not add the URL, you only added the domain name. With a full URL (i.e. http://host/path?query) one could try to lookup what the server returns (but even this can change depending on location, type of browser, time ... - so it is not fully reliable). With only partial information like you provided one could maybe check who owns the domain (or at least claims to own) but not really much more. May 23 '18 at 17:44
2

After digging a bit, I found the same url mentioned in another mentioned on another StackOverflow question that match OP's description :

http://ums.adtechjp.com/mapuser?providerid=1074;userid=AapfqIzytwl7ks8AA_qiU_BNUs8AAAFYqnZh4Q  

So your link might be from an adtech{countrycode}.com domain. According to Wikipedia :

Adtech AG is a German–American digital marketing company that retails products to manage, serve and evaluate online advertising campaigns (including display, video and mobile formats). The company was founded in 1998 in Frankfurt, Germany, and was acquired by AOL on May 15, 2007.

Adtech provides an integrated ad serving platform. This product allows publishers, advertisers, agencies and ad networks the ability to manage their display, video and mobile digital advertising campaigns.

Adtech's ad server responds to banner requests, prompted by user’s browsers, through XML and delivers it to the specified end system — the only provision being the terminals must be online.

So, my theory is that your browser alerted you about the said url because :

  1. The domain is extremely shady.

  2. Depending of the individual/company behind the link itself, it might actually be a spyware like this one.

Now that's kind of a blind shot, as OP didn't mentioned what kind of file was downloaded but well, it's an ad network, so there's clearly no reason to download nor to open the said file.

2
  • Good answer! Probably not the same company, but it appears to be very similar (or maybe a company derivative?) and shady. May 23 '18 at 16:33
  • Indeed, the domain I found wasn't the same as yours, but searching for the owner of nexage.com bring us back to AOL (look at the email adresses).
    – Yves C.
    May 24 '18 at 9:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.