More Scam Sites

More Scam Sites

Following are the list of malicious sites that host Trojans

Site Name: Downloaditrightnow.com
Site Name: Ilovethatdownload.com
Site Name: Gogodownnn.com
IP Address: 77.92.88.15

The trojan downloaded from these sites install a malicious BHO which displays the following scam error messages

These error messages then takes the user to following Fake/Scare scan pages

Site Name: Free-viruscan.com
IP Address: 58.65.238.34

Site Name: Fast-viruscanner.com
IP Address: 89.149.226.22


Finally it downloads IE-Antivirus a rogue application from IE-Defender family

Site Name: IE-Antivirus.com
Site Name: IEAvdownloadstart.com
IP Address: 77.92.88.80


Site Name: IEAvfreedownload.com
IP Address: 78.129.202.15


Stay safe and don't visit any of these sites.

Bharath M N

Zlob sites update

Zlob sites update

Zlob Trojan Distributing site:
Site Name: Movupdate.com
IP Address: 77.91.231.201

Site Name: Flwdirection.com
IP Address: 85.255.120.106

Scam Internet Security Page:
Site Name: Homesecurepage.com
IP Address: 85.255.116.210

404Errorpage Scam:
Site Name: Nopagedns.com
IP Address: 85.255.118.245

Security Guide Scam Page:
Site Name: Warningurls.com
IP Address: 85.255.118.37

Reference pages:
www.Warningurls(dot)com/soft/?c=05333
www.Warningurls(dot)com/test/?c=05434

Ad-Server-Gate Pages:
Site Name: Gatebs.com
IP Address: 85.255.118.37

Site Name: Gatefc.com
IP Address: 85.255.118.214

Reference links:
gatebs(dot)com/gatevc.php?pn=srch0p1total7s2&c=55832
gatefc(dot)com/gatevc.php?id=icn02

The Ad-Server-Gate pages redirects to fake Security center site Anysafereviews.com which promotes Rogue security applications.

Site Name: Anysafereviews.com
IP Address: 85.255.118.212

anysafereviews(dot).com/pp/01-byu8kl/

Other component sites

Site Name: Sysmergerer.com
IP Address: 85.255.117.204

http://www.sysmergerer(dot)com/get.php?partner=192 -> downloads Antispycheck Rogue security application

Site Name: Iexplorergate.com
IP Address: 216.255.179.245

Site Name: Wspscanner.com

http://www.iexplorergate(dot)com/redirect.php -> redirects to scan.wspscanner.com, which is a fake/scare scan page used to push WinSpywareProtect rogue security application.

All the above mentioned sites advertise/push well documented Rogue security applications. Stay away from these sites.

Bharath M N

Advanced Antivirus

Advanced Antivirus

Advanced Antivirus is the latest rogue from the SSH Zlob Trojan family. The application is a clone of AntiVirus 2008 rogue security application.

Site Name: AAV2008.com
IP address: 216.255.186.252

Screenshot of Advanced Antivirus site

Screenshot of Advanced Antivirus application

Stay away from this site.

Bharath M N

An Absolute Scam

An Absolute Scam

While I was surfing suddenly this screen popped up. A NOD32 Antivirus alert?

Well, I was wondering when did I install NOD32 on my system? Then I remembered that I had seen that screenshot on S!Ri’ s blog here and recently seen on Paperghost’s blog here.

Further digging revealed that my system was free from infection and the popup that displayed was actually a webpage.

Screenshot of the popups used by the scammers

Well here’s the website detail;

Site Name: Entiremedianet.com
IP Address: 63.219.178.162

The site is involved in distributing well documented rogue security applications like Pc-Antispyware and Pc-Cleaner

Here is the list of other sites that is used in this scam.

Site Name: Antispyware-review.biz
Site Name: Antispyware-reviews.biz
IP Address: 67.19.120.130

Site Name: Pc-Antispyware.com
IP Address: 209.8.45.26

Site Name: Pc-Cleaner.com
IP Address: 209.8.45.18

Reference links:
http://entiremedianet(dot)com/P/s1/
http://entiremedianet(dot)com/P/s2/
http://entiremedianet(dot)com/P/s3/
http://entiremedianet(dot)com/P/s5/

Stay away from all these sites.

Bharath M N

List of Malicious Sites

List of Malicious Sites

Zlob sites update:

Zlob Trojan Distributing site:
Site Name: Aviexecution.com
IP Address: 77.91.231.183

Site Name: Mpegupdate.com
IP Address: 85.255.120.108

Site Name: Flwassistant.com
IP Address: 77.91.231.201

Site Name: Aviinstrument.com
IP Address: 85.255.120.106

Scam Internet Security Page:
Site Name: Dobrowsesecure.com
IP Address: 85.255.116.214

404Errorpage Scam:
Site Name: Errorallhere.com
IP Address: 85.255.118.244

Security Guide Scam Page:
Site Name: Truesafetyrules.com
IP Address: 85.255.118.213

Reference pages:
www.truesafetyrules(dot)com/soft/?c=05333
www.truesafetyrules(dot)com/test/?c=05434

Ad-Server-Gate Pages:
Site Name: Gatezx.com
IP Address: 85.255.118.37

Site Name: Gateiu.com
IP Address: 85.255.118.37

The Ad-Server-Gate pages redirects to fake Security center site Securitycenteralerts.com which promotes Rogue security applications.

Site Name: Securitycenteralerts.com
IP Address: 85.255.118.38

Also the following site is used in Zlob tool bar to redirect users to malicious domains.

Site Name: Toolbargate.com
IP Address: 85.255.118.35

The Zlob trojan is now pushing Antispycheck, Pest-Patrol and other well documented rogue security applications.

DNS Changer Trojan Distributing sites:

Site Name: Vivaticket.net
IP Address: 64.28.184.175

Site Name: Wotticket.net
IP Address: 64.28.184.176

A list of new scam sites used by old Rogues:

WinSpywareProtect uses the following new sites:

Site Name: Winspywarescanner.com
IP Address: 71.6.202.216

Site Name: Winspywareprotects.com
Site Name: Wspsale.com
IP Address: 85.255.119.26

Reference links:
scan(dot)winspywarescanner.com/227/503
scan(dot)winspywareprotects.com/227/501

MalWarrior uses the following new sites:

Site Name: Malwarrior2008.com
Site Name: Wspdl.com
IP Address: 85.255.119.26

Stay away from all these sites.

Bharath MN

Ultimate Antivirus 2008

Ultimate Antivirus 2008

Ultimate Antivirus 2008 is a yet another rogue from the SSH Zlob Trojan family. The application is a clone of Windows Antivirus 2008 rogue security application.

Site Name: Uav2008.com
IP address: 77.91.229.98

Screenshot of Ultimate Antivirus 2008 site

Stay away from this site.

Bharath M N

MalwareProtector2008

MalwareProtector2008

MalwareProtector2008 is a new rogue security application from WinIFixer family of Rogue security applications. As usual this rogue is pushed by Fake codecs.

Site Name: MalwareProtector2008.com
IP address: 216.240.139.169

Screenshot of Fake/Scare Scan used by MalwareProtector2008

Stay away from this site.

Bharath M N

Vista Antivirus 2008

Vista Antivirus 2008

Vista Antivirus 2008 is a yet another rogue from the SSH Zlob Trojan family. The application is a clone of Windows Antivirus 2008 rogue security application.

Site Name: Vav2008.com
IP address: 77.91.229.98

Screenshot of Vista Antivirus 2008 site

Screenshot of Vista Antivirus 2008 application

Stay away from this site.

Bharath M N

System Antivirus 2008

System Antivirus 2008

System Antivirus 2008 is a new rogue from the SSH Zlob Trojan family. The application is a clone of Windows Antivirus 2008 rogue security application.

Site Name: Sav2008.com
IP address: 77.91.225.234

Screenshot of System Antivirus 2008 site

Screenshot of System Antivirus 2008 application

Following are the list of sites that distributes Rogue security application and shares the same IP 77.91.225.234.

Dr-protection-adv.com
Dr-protection.com
Guard-center-adv.com
Guard-center.com
Killspy-adv.com
Killspy.org
Liveantispy-adv.com
Liveantispy.com
Liveprotection-adv.net
Liveprotection.net
Online-guard-adv.net
Online-guard.net
Stopingspy-adv.com
Stopingspy.com
Winantiviruspro.net

Stay away from all these sites.

Bharath M N

Malicious Domains

Malicious Domains

DNS Changer Trojan Distributing sites

Site Name: Cleanticket.net
IP Address: 64.28.184.174

Trojan-Downloader Distributing sites

Site Name: Sexysoftwaredom.com
Site Name: Csoftddl.com
IP Address: 78.129.208.105

Stay away from these malicious sites.

Bharath M N