Spyware Sucks

The other day I wrote the following advice:

"Here are my suggestions for the checks that advertising networks should make when deciding whether to accept content from anybody. 

Don't just do a credit check.  Don't just run a WHOIS.  Don't just make sure that they respond to emails and that the phone number is not disconnected.  Check who hosts their mail servers. Check who hosts their name servers.  It's amazing how often you will find a connection between a particular domain or IP address and known bad guys every single time we run an analysis of an advertising campaign.  Proximogroup is one in particular that keeps on popping up, as did netmediagroup.com for a while there.

For example, let's pretend that you are contacted by somebody at wearegoodguyshonest.com - the WHOIS may look ok. They may pass a credit check. But then, when you look at the name servers for wearegoodguyshonest.com you may discover that the name server is in an IP range that is associated with many bad names.  In such circumstances it would be wise to decide it is safer not to do business with wearegoodguyshonest.com."

Let's expand the above advice a little, and show you just one way to make those extra checks.  I'll also highlight what may indicate that the advertising or hosting agreement we are about to enter into may be risky. 

A lot comes down to experience.  You have to watch the market, watch the blogs, watch the news, watch the online chatter - you need to know who is being or has been mentioned in association with unauthorised advertising campaigns and malicious advertisements.  Then you can take that knowledge and use it.  The following is just one example of how staying informed can save you from potential grief.

Let's have a quick look at few danger signs you may encounter when deciding whether or not to accept advertising from whoever.  What we want to do is try to decide whether we trust the bona fides of a company.  In this example, I am going to show you how to use a particular service, www.robtex.com, as an investigatory step.

In this example, let's take a closer look at prevedmarketing.com, proximogroup and netmediagroup, names that has appeared in association with the facilitation of malicious advertising campaigns.

A robtex search reveals that the IP address of prevedmarketing at time of writing is 190.15.73.254:
http://www.robtex.com/dns/prevedmarketing.com.html

Now that we have an IP address, we can take a look at what is hosted in the same IP range.  Therefore, we use Robtex to search the (incomplete) IP range, that is,  190.15.73:
http://www.robtex.com/cnet/190.15.73.html

The IP search proves to be very revealing, and triggers very loud alarm bells for anybody who has been analysing, or reading an analysis of, malicious advertising campaign incidents.

Have a look at what is hosted at 190.15.73.221... and 222, 223, 251, 252 etc

Anybody with a historical knowledge of malicious banner advertisement incidents would look at the robtex search results and realise that the IP search reveals domain names under the list of name servers, and mail servers, and domain name hosting, that have been associated with documented incidents of malicious advertisements, and/or fraudware.

Now, what about proximogroup, which has been associated with the sale of advertising that has been proven to be unauthorised and/or malicious....

The IP address for proximogroup.com is 130.117.78.25 which seems innocent enough, but more importantly, it's name server IP addresses are 190.15.73.251, 252 and 221 which I am sure are by now familiar to you.

The list of names sharing an IP with proximogroup and prevedmarketing is impressive - many you will recognise - to highlight the significance of what we are seeing I have bolded those that I have *personal* experience of, and that I know are either fraudware sites, or domains that have been directly implicated in facilitating malicious advertising campaigns, whether it be by gathering statistics, hosting malicious content, or selling malicious content.

domains sharing nameservers

ad2cash.net  
adtraff.com  
adzyclon.com  
bestadmedia.com  
bestsearchnet.com  
bucksbill.com  
burnads.com  
casinoaceking.com  
cryptdrive.com  
fileprotector.com  
forceup.com  
freetvnow.net  
fulsearch.com  
getfreecar.com  
greyhathosting.com   (this one has been used to send emails allegedly from "Jim Burch", who calls himself "project manager at NetMediaGroup Advertising Agency" to victim sites)

installprovider.com  
libresystm.com  
magicsearcher.com  
moneypalacecash.com  
myhealth-life.org  
myonlinefinance.com  
netmediagroup.net  
netturbopro.com  
newbieadguide.com  
pcsupercharger.com  
popsmedia.com  
popupnukerpro.com  
prizesforyou.com  
searchcolours.com  
searchoperation.com  
sellmoresoft.net  
sellmysoft.net  
sharpadverts.com  
softwcs.com  
tallgrass-seach.com  
theringtonesource.com  
traffalo.com  
unicsearch.com  
uniqads.com  
vitecmedia.com  
wewillfind.com  
windefender.com  
workhomecenter.com  
yourseeker.com  
yourteacheronline.com  
zappinads.com  

domains sharing nameservers
   ad2cash.net
   adcomatoz.com
   adtraff.com
   adverdaemon.com
   adverlounge.com
   adzyclon.com
   b2adz.com
   bestadmedia.com
   bestsearchnet.com
   bizadverts.com
   blessedads.com
   bucksbill.com
   burnads.com
   candid-search.com
   casinoaceking.com
   cryptdrive.com
   fileprotector.com
   forceup.com
   freetvnow.net
   friedads.com
   fulsearch.com
   getfreecar.com
   greyhathosting.com    (this one has been used to send emails allegedly from "Jim Burch", who calls himself "project manager at NetMediaGroup Advertising Agency" to victim sites)

   installprovider.com
   libresystm.com
   loffersearch.com
   magicsearcher.com
   manage-search.com
   megashopcity.com
   mightyfaq.com
   misc-search.com
   moneycometrue.com
   moneypalacecash.com
   myhealth-life.org
   myonlinefinance.com
   mysurvey4u.com
   netmediagroup.net
   netturbopro.com
   newbieadguide.com
   pcsupercharger.com
   popadprovider.com
   popsmedia.com
   popupnukerpro.com
   prevedmarketing.com
   prizesforyou.com
   r2d2adverising.com
   rocktheads.com
   roller-search.com
   rombic-search.com
   se7ensearch.com
   search-expand.com
   search-the-prey.com
   searchcolours.com
   searchmandrake.com
   searchonline-ease.com
   searchoperation.com
   searchvirtuoso.com
   sellmoresoft.net
   sellmysoft.net
   sharpadverts.com
   shivanetworking.com
   simplesamplesearch.com
   softwcs.com
   stratosearch.com
   tallgrass-seach.com
   theringtonesource.com
   traffalo.com
   traveltray.com
   treekindsearch.com
   unicsearch.com
   uniqads.com
   upg-soft.net
   vitecmedia.com
   wewillfind.com
   windefender.com
   wontu-search.com
   workhomecenter.com
   yourseeker.com
   yourshopz.com
   yourteacheronline.com
   zappinads.com
   zooworld-search.com
subdomains
   *.proximogroup.com
   mail.proximogroup.com
   ns1.proximogroup.com
   ns2.proximogroup.com

Ok, now for netmediagroup.net, accused by some web sites of selling malicious advertising campaigns:

netmediagroup.net IP = 84.243.252.91

There are some domains we recognise, again, as participating in the facilitation of malicious advertising campaigns at IP range 84.243.252:

84.243.252.84 adtraff.com  
84.243.252.85 burnads.com  
84.243.252.88 forceup.com  
84.243.252.91 netmediagroup.net  
84.243.252.94 traffalo.com  
84.243.252.97 uniqads.com

Name servers and mail servers are at an IP address that, again, I am sure you will recognise...

ns1.netmediagroup.net 190.15.73.251
ns2.netmediagroup.net 190.15.73.252
mail.netmediagroup.net 190.15.73.221

Are we beginning to see a pattern here?

Let me repeat one more time...

Don't just do a credit check.  Don't just run a WHOIS.  Don't just make sure that they respond to emails and that the phone number is not disconnected.  Check who hosts their mail servers. Check who hosts their name servers.  It's amazing how often you will find a connection between a particular domain or IP address and known bad guys every single time we run an analysis of an advertising campaign.  Proximogroup is one in particular that keeps on popping up, as did netmediagroup.com for a while there.

I would also say, do not trust alleged "letters of mandate".  Why? Because I have an email from the from the Chief Technology Officer at skyauction.com and he has quite a story to tell.  Here is a quote from his email - information shared with permission:

"We were contacted by another company today that were duped into hosting one of the fraudulent ads for a couple of days (which have since been taken down). It seems that the source of the ads is a company called NetMediaGroup (http://www.netmediagroup.net). They are claiming to represent us and even provided a fake letter of mandate" (which I can email you) to one of their targets saying that they represent us.  As with our logo, they were pretty sloppy creating this fake "mandate" because there are some obvious errors. In this case, someone with the pseudonym (one can only guess) of "Jim Burch" (jim@netmediagroup.net) contacted the site claiming to represent us and asking to put up ads on the contact's site. The the ads go up and deliver the fake malcious Skyauction ads until someone complains and they are finally taken down. NetMediaGroup appears at first glance to be a real company, but they are probably a completely fraudelent one. The domain name is registered to some organization in Germany, but the contact us phone number seems to be in the Netherlands. All of the names on the web site are just generic (i.e. they don't give full names)."

The checks listed suggested above will take only moments, but may save you a lot of grief.  You should also conduct a comprehensive web search of any domain that you know is associated with the sale or hosting or distribution of an advertising campaign.