PDF Arranger and TeraBox Referrals: Lamer Than Malware

Threat Intel
, , ,
1

Last Updated: 2026-07-24T20:39:21Z

What’s Happening

PDF Arranger, a legitimate FOSS application, has picked up a fake download site at pdfarranger[.]net.

image
image1314×931 113 KB

The site is of course using SEO Poisoning to get into top search results for the project.

image
image808×915 84.7 KB

We’ve seen instances before of fake installer sites. Usually the payload is directly observable. Not so in this case. In fact, the hashes for the downloaded files match what’s on GitHub.

So what’s the catch?

image
image596×333 16.9 KB

The linked downloads files are hosted on TeraBox, a “legitimate” Japan-based file hosting/sharing service that offers 1TB of free storage. They’ve been around for a while, and appear to be real. But also, they’re real shady in terms of business practices.

First, you have to sign up for an account to download any shared files—which I did with a burner account. The downloads are agonizingly slow, so don’t bother. Again, the downloads are the real PDF Arranger!

Here’s the angle, near as I can tell. TeraBox has a Referral Program that promises cash for new users who sign up to download files you shared.

image
image640×317 54.4 KB

So basic internet hustle garbage, but using FOSS software for it is extra grody.

Actions

In addition to blocking this particular fake site, I would also block TeraBox for general ick. Search first to confirm low frequency in your environment, then go for it.

Indicators

Value Type Description
pdfarranger[.]net Domain Fake PDF Arranger site
terabox[.]com Domain File sharing site with a gross referral program
teraboxcdn[.]com Domain TeraBox’s CDN

Notes

I’m really curious what other projects have picked up one of these.

2

TLDR: Technical and OSINT evidence all strongly correlates with Terabox being a Chinese (Baidu) front company.

First interesting artifact is Terabox[.]com’s SSL certificate Issuer Common Name issued 2026-02-27, which is very unique:

DigiCert Secure Site Pro G2 TLS CN RSA4096 SHA256 2022 CA1

In our data, I can only find 358 domains with that Issuer CN. Despite Terabox being a Japanese company, only two domains there are in the .jp TLD: airchina[.]jp and baidu[.]jp. 45 domains are .cn and 43 domains are .com[.]cn.

In aggregating hosting-IP-by-country, the top hosting country is China with 231 domains out of 358. The next-nearest entry is the US, with 104.

The most common mailserver domains are qq[.]com, icbc[.]com[.]cn, baidu[.]com, 263[.]net, shifen[.]com, and aliyun[.]com.

The most common nameserver domains are baidu[.]com, alidns[.]com, and icbc[.]com[.]cn.

The most common SSL certificate organizations (ie when a domain has multiple SSL certs) are Baidu, Industrial and Commercial Bank of China, Air China, Bank of Taizhou, and Lenovo Beijing.

I don’t want to start firing off individuals’ names from OSINT, but OSINT on individuals supports this.

Multiple information technology content farms can be found with clearly sponsored posts about how the parent company Flextech is “100% Japanese.”

Were we to ascribe this to a technical error on Terabox’s part, I shall quote a 2024 Terabox press release: “TeraBox’s commitment to security is unparalleled, employing advanced measures like TLS/SSL protocols, encryption algorithms, and access control.”

TeraBox was originally called DuBox, and was a Baidu-developed project. Technical artefacts of the early DuBox domains clearly show Chinese infrastructure connections. DuBox was handed off to what appears to be a shell company in Japan, but is clearly still maintained and sitting on Baidu-specific, Chinese-specific infrastructure.

Happy to go deeper on this, but it’s Friday afternoon and it’s been a long week.

1 Like
3

Yeah, looks like a known problem site that’s fairly prevalent in SEA: