Zlob Trojan Distributing Sites:
Site Name: wmvsolution.com
IP address: 85.255.120.109
Site Name: mpgapplication.com
IP address: 85.255.118.180
The component sites associated with Zlob Trojan:
Site Name: pageforsafety.com
IP address: 85.255.116.210
This is a Scam Internet Security Page advertising Rogue security applications.
Site Name: dnserrorslist.com
IP address: 85.255.118.246
This is a fake DNS Error Page; the site also advertises Rogue Security applications. (Currently it’s advertising WinSecureAV a Rogue Security application from Winfixer family)
Here is a list of sites directly connected to SSH Family.
Site Name: Entertainaround.com
Site Name: secureinformway.com
Site Name: Gatekl.com
Site Name: Gatecs.com
All the sites shares the IP address: 85.255.118.246
Site Name: gatexv.com
IP address: 85.255.118.214
Site Name: Gatenu.com
Site Name: Onlinehelptool.com
All the sites shares the IP address: 85.255.118.214
Site Name: gateqa.com
Site Name: asafetyoffice.com
Site Name: gateqa.com
All the sites shares the IP address: 85.255.118.213
Site Name: gatews.com
Site Name: securitybrochure.com
Site Name: Gatevj.com
Site Name: Gateow.com
Site Name: Entertainallday.com
All the sites shares the IP address: 85.255.118.35
All the above mentioned sites Registrar is ESTDOMAINS, INC. The above mentioned sites which belong to SSH family are created to run scam and lure user to purchase Rogue security application.
Site Name: Websoft-c.com
IP Address: 202.71.102.101
This site pushes Trojan horse disguised as Fake codec.
New Rogue Security applications:
Site Name: TheSpyBot.com
IP Address: 78.108.183.32
IP Address: 78.108.183.32
This Group is busy again cloning their applications and spreading it on internet.
Site Name: Mastertools.us
IP Address: 85.255.121.76
ScreenShot of SpyKillerPro Application
The site distributes SpyKillerPro a well documented rogue Security applciation. More on the Rogue Security aplication here.
Stay safe and do not visit any of these sites.
Bharath M N
