February 2009 - Posts

ALERT: Please treat all content from yourdirectmedia.com with extreme caution

The following comment was posted to my blog a short while ago:

"Be cautious of Yourdirectmedia . Tried to pass us HP ads with malware and gave us Olympicmedia.net, Atlantmedia.net and Ads2revnue for their references."

Cite: http://msmvps.com/blogs/spywaresucks/archive/2009/01/05/1658482.aspx#1674640

 

As you will know, I posted about malvertizements featuring HP earlier today.

Regular readers of my blog will recognise olympicmedia.net and atlantmedia.net as known bad actors.

ads2revenue also has a bad reputation (cite: http://www.google.com/search?hl=en&q=ads2revenue)

There is something else interesting about ads2revenue.  The site has similar content to that at realcastmedia.com and p-mediaonline.com.  Yes, we have encountered realcastmedia.com and p-mediaonline.com before - I wrote about them back in April 2008 as you can see here: http://msmvps.com/blogs/spywaresucks/archive/2008/04/27/1606072.aspx

I think it goes without saying that any agency that supplies known bad actors as references should be avoided like the plague.

It should also be noted that the website yourdirectmedia.com has content very similar to that at aceinfowayindia.com/web-startegy.html

 

The next question is, "who are yourdirectmedia.com"?  They seem clean when we look for traditional red flags:

yourdirectmedia.com
ICANN Registrar: Moniker Online Services, Inc
Created 4 December 2008 (this is a red flag because it is a new domain)

Registrant [1628123]:
Jason Newman (webmaster@no3affiliates.com) ("Jason Newman" owns 46 other domains)
Main str. 11 (I am sure I have seen this address before, but can't remember where)
Philadelphia
PA
76221
US

IP: 93.190.140.94 - Netherlands, Worldstream

Sharing IP with clubmed-corp.com and talbots-corp.com.  Both domains should be treated with extreme caution.  After considering recent history, I would also strongly warn readers that they watch out for advertising campaigns featuring Club Med and Talbots.

clubmed-corp.com and talbots-corp.com are both very new, having been registered on 21 January 2009 via Moniker Online Services, Inc.  WHOIS information is hidden behind Moniker's Privacy Service.  Both domains are live, but are simply redirecting to another page on the same domain.  We can expect that to change at any moment.

 

Ok, so let's take a look at the no3affiliates.com:

no3affiliates.com
ICANN Registrar: Moniker Online Services, Inc
Created 4 December 2008 (again, red flagged because it is a new domain)

Registrant [1628014]:
Peeter Mitauskas (peetmit@gmail.com) ("Peeter Mitauskas" owns 4 other domains)
Punane 61, , ,
Tallin
Harjumaa region
13619
EE

IP: 208.73.210.50  New York, Oversee.net

Sharing IP with 314,622 other sites

*****

There is more than one version of the malicious HP advertisements in circulation, and they are hitting more than one bad domain:

Bad HP advert 1:  Hits aboutmonitoring.com and securityclick.net
Bad HP advert 2:  Hits traffic-analytics.com and securityclick.net

*****

aboutmonitoring.com
ICANN Registrar: DIRECTI <-- yes, them again
Created 6 February 2009

IP: 91.211.64.43 - Kyyiv, Kiev, Pp Info-Center

WHOIS hidden behind Privacyprotect.org

Shares IP with ab-outstat.com and ab-outstat.net.  Regular readers will know that aboutstat.com and aboutstat.net have a bad reputation, and that registering new domains identical to known bad domains (except for the addition of a hyphen) is a trick well known to be used by the infamous "Serg Moon".

traffic-analytics.com
ICANN Registrar: DIRECTI <-- sigh.
Created 6 February 2009

IP: 79.135.187.99 - Istanbul, Serv2u.com International Backbone Tr

WHOIS hidden behind Privacyprotect.org

Dedicated IP, but a search of the IP range reveals many suspicious domains (see my article about the Best Western malvertizements at http://msmvps.com/blogs/spywaresucks/archive/2009/02/26/1674103.aspx)

securityclick.net
ICANN Registrar: ENOM, INC
Created 25 March 2008

IP: 212.117.165.128 - Luxembourg, Root

Registrant Contact:
   noo
   Serg Moons (moon.serg@gmail.com)
   Fax:
   st.1st
   as, CA 90210
   US

Administrative Contact:
   noo
   Serg Moons (moon.serg@gmail.com)
   +1.123456
   Fax: +1.123456
   st.1st
   as, CA 90210
   US

Sharing IP with advertpanda.com, clickanalytic.com, extrabigad.com, greatad.net, waytotheprofit.com and whoisadvert.com - all domains should be treated with extreme caution.  waytotheprofit.com has been around for a long time and is well known to be bad.

I'll close this article out with an observation that shows just how lazy (or careless) the people behind these domains are.  By way of explanation, web sites can be given a "title" within a page's source code.  Let's look at the "title" of some of the above domains:

advertpanda.com - "Spyware Scanner Online: Scan in Progress..."
clickanalytic.com - "My computer Online Scan"
extrabigad.com - "Spyware Scanner Online: Scan in Progress..."
greatad.net - "Spyware Scanner Online: Scan in Progress..."
securityclick.net - "Virus Scan In Progress"

 

Screenshots of similar text on web pages:

image

 

image

 

image

 

image

 

image

Posted by sandi with 1 comment(s)
Filed under: ,

ALERT: malvertizement featuring HP

I’ve first saw this malvert on 18 February, but am seeing a sudden noticeable upspike in distribution.   I’ll post about the domains being used to facilitate the hijack later.

image

image

image

image

image

image

Posted by sandi with no comments
Filed under: ,

Heated toilet seats!

Yep, that is an enduring impression that I will take away from my visit to Google’s offices – heated toilet seats; that and the slide from one floor to another that went down the stairwell  :o)

I was very excited to have been offered the opportunity to visit Google while I was in town.  It was immediately obvious that Google’s offices have a completely different ambiance to Microsoft – there was lots of open plan floor space, lots of spots of primary color, and fun names for meeting rooms – it was much lighter and brighter than many of the buildings that I have visited at Redmond and the view was amazing (there was even one of those coin operated pedestal binoculars, but it didn’t require coins).  Sadly I didn’t dare to ask if I could take any pictures of the offices to share with my readers.

To my hosts – thank you!  It was time well spent and enjoyed, and I hope we get the opportunity to meet again some time in the not to distant future.

Edit: Yes, yes, I know... this posting is pure fluff but what can I say - I signed an NDA :-D

Posted by sandi with no comments
Filed under:

Developments in the FTC versus Innovative Marketing lawsuit

Well well, it looks like Sam Jain, fugitive from justice, is still around...

Court activity:

17 February 2009 - RESPONSE in Opposition re MOTION for Other Relief Order Holding Sam Jain and Kristy Ross In Contempt Of Court And Requiring The Repatriation Of Their Assets filed by Sam Jain. Replies due by 3 March 2009. (Entered: 17 February 2009)

17 February 2009 - RESPONSE in Opposition re MOTION for Other Relief Order Holding Sam Jain and Kristy Ross In Contempt Of Court And Requiring The Repatriation Of Their Assets (PROTECTIVE MEMORANDUM) filed by Kristy Ross. Replies due by 3 March 2009. (Entered: 17 February 2009)

17 February 2009 - MOTION to Modify Preliminary Injunction re Preliminary Injunction by Sam Jain Responses due by 6 March 2009 (Entered: 17 February 2009)

17 February 2009 - Paperless ORDER granting Consent Motion to Withdraw Motion to Dismiss (relevant to the FTC/James Reno Consent Motion) (Entered: 17 February 2009)

17 February 2009 - MOTION to Dismiss Complaint by Sam Jain. Responses due by 6 March 2009 (Entered: 17 February 2009)

17 February 2009 - MOTION to Dismiss COMPLAINT by Kristy Ross. Responses due by 6 March 2009 (Entered: 17 February 2009)

19 February 2009 - RESPONSE in Opposition re MOTION to Dismiss Complaint, MOTION to Dismiss COMPLAINT filed by Federal Trade Commission. Replies due by 5 March 2009 (Entered: 19 February 2009)
20 February 2009 - ACKNOWLEDGEMENT OF SERVICE Executed Acknowledgement filed by Federal Trade Commission (Entered: 20 February 2009)

23 February 2009 - MOTION for Alternative Service as to Daniel Sundin by Federal Trade Commission. Responses due by 12 March 2009 (Entered: 23 February 2009)

23 February 2009 - REPLY to Response to Motion re MOTION to Strike, MOTION for Other Relief Order Holding Sam Jain and Kristy Ross In Contempt Of Court And Requiring The Repatriation Of Their Assets OR IN THE ALTERNATIVE MOTION to Strike, MOTION for Other Relief Order Holding Sam Jain and Kristy Ross In Contempt Of Court And Requiring The Repatriation Of Their Assets OR IN THE ALTERNATIVE MOTION for Extension of Time filed by Kristy Ross. (Entered: 23 February 2009)

24 February 2009 - ORDER granting Motion for Alternative Service of Process on Daniel Sundin. Signed by Judge Richard D Bennett on 23 February 09. (Entered: 24 February 2009)

 

Sam Jain's Motion to Dismiss (17 February) asked that the Court "dismiss Plaintiff Federal Trade Commission’s complaint for failure to join Innovative Marketing, Inc., a necessary and indispensable party."  You may recall from my previous reports that IM was served in the USA when the Process Server served documents on a licensed attorney by the name of Jack Palladino.  Palladino was served at Jain's residence (which also happens to be Palladino's "satellite office").  According to the Process Server who served the documents on Palladino, Palladino said to the Process Server that he would accept service, that he was "expecting these documents" and that he "had a lot of reading to do".  Be that as it may, Jain claims in his motion that Palladino was not authorized to accept service and that, therefore, IM has not been properly served (aka joined).

Unfortunately for Jain, Innovative Marketing, Inc. was also legally served in Belize on 6 January 2009 by a Process Server who served the Preliminary Injunction and Contempt Order on IM by serving IM’s registered agent at IM’s registered office, Apex Trust Corporation Limited, in Belize.  Belize is not a signatory to the Hague Convention (nor is the Ukraine, btw) but that does not matter, because the FTC has still achieved service of the documents upon Innovative Marketing, and that service of documents is "specifically authorized under the laws of Belize".

The FTC did not file a proof of service about the service of documents on Innovative Marketing in Belize because their position is that the initial proof of service on Palladino is valid and binding.  It is to avoid delay and keep things moving that they have now submitted a second proof of service.

In the other motions Jain complains that the U.S. Attorney’s Office for the Northern District of Illinois is conducting an ongoing criminal investigation of Innovative Marketing, Mr. Jain, and others for alleged wire fraud and computer fraud, and that in late September 2008 Mr. Jain’s criminal counsel met with an Assistant U.S. Attorney and two FBI agents in Chicago, who stated unequivocally that Mr. Jain will be indicted on those fraud charges as a result of the Illinois Investigation “sooner rather than later.” and that the FTC’s complaint raised "grave Fifth Amendment conflicts" (specifically "self incrimination") in relation to the Illinois investigation.

Kristy Ross’s motion to dismiss depends on, and repeats, Jain’s argument.  If Jain’s motion is denied because IM *was* legally served *before* the motion to dismiss was filed, then Ross’s motion can also be denied.  Ross has also presented the argument that the FTC has not proven that she is "currently" an officer of Innovative Marketing, and claims that just because she signed an affidavit nearly two years ago admitting that she is an officer of IM does not mean that she is one *now*.  But at the same time as making this claim, she does not want to provide proof that she is not because, she says, to do so will resulting her waiving her Fifth Amendment (self incrimination) privilege.  She cites the precedent Three Grand Jury Subpoenas Duces Tecum dated January 29 1999, 191 F.3d 173 178-83 (2d Cir. 1999) (holding that a former employee can assert Fifth Amendment protection against production of corporate records in his possession).

In other developments, Maurice D'Souza now has legal representation.  Daniel Sundin continues to evade personal service of the court documents, but an Order has been issued allowing alternative service (by email, by service on his attorneys, and service of the documents on the registered agent for Innovative Marketing, and by publication of a notice in certain newspapers in the UK and Sweden for a period of 3 weeks).

Finally, my favorite quote from the FTC's consolidated opposition to Sam Jain and Kristy Ross’s motion to dismiss the FTC complaint is:

"The Motion to Dismiss filed by Sam Jain and joined by Kristy Ross establishes a new high-water mark for evasion and delay by the defendants."

Posted by sandi with no comments
Filed under: ,

Interesting comment – Best Western malvertizing

The comment was posted here.  I quote:

My company was approached by a client claiming to represent Best Western with a lower tech version of this.  We were give a static JPG, third one from the top and instructions to paste some odd-looking Javascript with the image. 

I ran the code in AddOps tools and it did nothing.  Getting suspicious I checked the src URL for the Javascript which was "http:// st-aticglobalsources.com" and found a lot of trouble associated with it. 

We refused to run the ad with the code. Client claimed ignorance saying code came from their client and would provide new tags.  New tags arrived, similar to the first but sourcing the J-script from "http:// st-ation-appraisals.net" this time.  Running this code through AdOps tools at least generates a Best Western banner, but I ran the URL through search engines, found associated with ITmeter INC, and did not run the ad.

As my regular readers will know, both of the URLs are well known to those of us who study malvertizing.  I hope that the commentator will tell us the name and email addresses used by the person who tried to sell them the malicious advertisement.

st-aticglobalsources.com (79.135.187.86 - Istanbul - Istanbul - Serv2u.com International Backbone Tr)

Registrant Contact:
   ITmeter INC
   Sergey Belonozhko (sergbelo@gmail.com)
   Fax: 
   Dmitrienko 7
   Odessa, State 65000
   UA

st-ation-appraisals.net (79.135.187.89 - Istanbul - Istanbul - Serv2u.com International Backbone Tr)

Registrant Contact:
   ITmeter INC
   Sergey Belonozhko (sergbelo@gmail.com)
   Fax: 
   Dmitrienko 7
   Odessa, State 65000
   UA

It is important to note that although both bad domains have “dedicated hosting” and unique IP addresses, they are both hosted by the same company, and are within the same IP range.  A check of the entire IP range, 79.135.187.% reveals 266 domains, all of which should be treated with extreme caution.

1spam.ru | 1yandex.ru | Abusehost.ru | Abuzhost.ru | Advert1.ru | Aloincognito.ru | Buildhost.ru | Business-orders.ru | Cammin.ru | Compaq-hp-dv.ru | Cpammagazin4.ru | Detiamdo.ru | Email-s.ru | Email-spam.ru | Emailspam.ru | Enterboom.ru | Evroreklama.ru | Farma-reklama.ru | Flovermag.ru | Forum-it.ru | Generatorcompany.ru | Goohost.ru | Goosoft.ru | Gottobe.ru | Hotmailer.ru | Hrumer2007.ru | Igrushki-detiam.ru | Irkmailer.ru | Junar-trade.com | Kuklasex.ru | Magazinreklamy.ru | Mailadvertising.ru | Mnogonarodu.ru | Montenegrovilla.ru | Neintim.ru | Nochklub.ru | Notebook7.ru | O-la-la.ru | Online-email.ru | Online-mailer.ru | Online-master.ru | Online-standart.ru | Ppkurort.ru | Proektclty.ru | Reklamabiznesa.ru | Reklamict.ru | Reklmagazin.ru | Robotraff.ru | Rukinomania.ru | Saitbaz.ru | Seosuper.ru | Setevaya-reklama.ru | Shablon1.ru | Sitepostroim.ru | Spam502.ru | Spamarena.ru | Spamchik.ru | Spamim.ru | Spammagazin.ru | Spammagazine3.ru | Spammagazine5.ru | Spmagazin.ru | Starshe18.ru | Super-fuel-max.ru | Super-mailer.ru | Turistmag.ru | Wmir.biz | Wreklama.ru | Wsws.ru | Wtorg.ru | Xmailer.ru | Yandex1.ru | L-state.com | P-state.com | R-state.com | V-state.com | 4utraffic.cc | 4utraffic.net | Cashpopup.cc | Cashpopup.info | Newprogress.tv | Einrock.com | Makomset.com | Ribcot.com | Megavipsite.cn | Installing.cc | Loader.cc | Windowscentersite.com | Tgspk.com | Statbroun.com | Loots-leg.com | Newprogress.asia | Newprogress.biz | Alertplump.com | Bdgerggggs.com | Beatstrust.com | Chiefgracious.com | Circlesensational.com | Clearorganized.com | Eagermulti.com | Fizzpeak.com | Fizzslick.com | Hardyfab.com | Humbleoxygen.com | Notablebase.com | Proudlucky.com | Royalmeek.com | Rx13.com | Safetyunselfish.com | Sdggfdfgd.com | Serviceclear.com | Sfdgsvddsdfs.com | Sgdfgdfgdf.com | Sgdfgsdfsddfgdf.com | Sjbisdgergess.com | Stayunsurpassed.com | Thankfulmountain.com | Topseductive.com | Usdrugstorebest.com | Westcharming.com | Zestloyal.com | Zipbold.com | Skype-security.net | Afrogruster.com | Agiromentop.com | Agrostergio.com | Akierodentos.com | Aportobrasok.com | Atopresorgo.com | Aviorebato.com | Awrentoblasgo.com | Beshragos.com | Counterprise.com | Diomertona.com | Dresmondas.com | Equalcrowd.ru | Frododkoone.com | Frododkotwo.com | Hortesoda.com | Kioretions.com | Kordanoser.com | Krombustor.com | Massachuret.com | Notifisarto.com | Privatesecuritycenter.com | Rx-online-order.com | Twopgoslyso.com | Filarmon.info | Gvatemal.biz | Jumpingo.org | Grandtraf.com | Loaddasig.com | Zetross.com | 5traff.cn | Axa3.cn | Beencn.cn | Centerifart.cn | Ftalyl.cn | Londoncn.cn | Mostdey.cn | Originalcn.cn | Traxxk.cn | Typecn.cn | Hibucks.com | Moviesforall.info | Musicscollection.com | Welovemovie.com | Ds1ff.com | Googlesearchingweb.net | Index938.com | 2ndattempt.net | Angelok.org | Anxietypedia.net | Anxinews.org | Any-doctor.net | Availmeds.com | Balmpro.net | Balzaks.net | Bighealthy.net | Bigremedy.net | Caremedicals.net | Delivery-services.net | Discountmeds.name | Docclive.net | Doctor11.net | Doctor5.net | Doctor6.net | Doctorlive.net | Doctorr.org | Easy-meds.org | Fresh-infa.net | Generecs.net | Generikes.net | Generiks.net | Getphen.net | Gomedy.net | Healtn.net | Helth-life.net | Hotnewlette.net | Hotnewslette.net | Hotnewsletter.net | Hotnewsletter.ru | Hydrophen.com | Index333.com | Index345.com | Lodono.com | Medguide.in | Medicalaz.net | Medsizi.net | Most900.com | Mostsearch.net | My-order.org | Myangst.net | Myhomemed.net | Noconsult.net | Normalmed.net | Opapapa.net | Pharmaenergi.net | Phenhydro.net | Rx-free.net | Rxfair.net | Rxneds.com | Rxneds.net | Savehealth.net | Search-traffic.net | Seedeals.net | Singleslady.com | Suicide-forum.com | Theclinical.net | Track-order.com | Trialpack.net | Vicod.net | Vicodi.net | Webadvices.net | Webremedies.net | Winyourhealth.net | Wwwhotnewsletter.net | Officialstat.net | Ne-wstat.net | Of-ficialstat.com | Ourstats-online.com | Statgroup.net | St-at-diagnostic-imaging.net | St-atetstr.com | Stats-manager-online.com | St-atgroup.net | Staticglobalsources.net | Traffic-ad-manager.com | Station-appraisals.com | St-athisranch.com | St-athisranch.net | St-athome.net | St-aticglobalsources.com | St-aticglobalsources.net | St-ation-appraisals.com | St-ation-appraisals.net | S-tatetstr.com | S-tathisranch.com | S-tathisranch.net | Track-your-stats.com | S-tatgroup.net | Freegreenstats.com | Of-ficialstat.net | Themonitoring.net | Statstrackingmanager.com | Traffic-analytics.com

Quote of the day

“It's a business continuity measure - this way, if a meteor takes out our data centre, we can all run around like chickens with our heads cut off, rather than lie around dead.” – name withheld to protect the not so innocent :)

Posted by sandi with no comments
Filed under:

ALERT: malvertizement on display at jeuxvideo.com

Hat tip to Malekal

Deja vu – guess what domains are involved in the jeuxvideo.com incident – adclickmate.net and smartadserver.net.

IMPORTANT NOTE: PLEASE DO NOT CONFUSE THE MALICIOUS DOMAIN SMARTADSERVER.NET WITH THE LEGITIMATE SMARTADSERVER.COM.

image

Adopstools results – positive:
http://www.adopstools.com/index.asp?page=quicklink&id=GOS8G5jCpshG1DtK

 

Malicious code is hidden within the SWF creative as dynamic text:

image

image 

 

 

We saw an incident involving adclickmate.net back in January described hereKimberley also posted a warning about smartadserver.net on 30 January.  How unsurprising it is to see that Directi has done nothing to shut down adclickmate.  The WHOIS and IP information for adclickmate.net remain unchanged (except for the fact that the IP address 212.95.37.133 is now listed as Turkey, Netdirect-lnwservers.

adclickmate.net

Registrar: DIRECTI (yet again)
Created 24 March 2008
NS1.ADCLICKMATE.NET
NS2.ADCLICKMATE.NET

IP: 212.95.37.133 - Turkey, Netdirekt
WHOIS hidden behind privacy protect (note the nonsense

Domain originally registered via ESTDOMAINS - WHOIS protection temporary removed around late August 2008, which revealed:

Domain Corp.
Jacob Tua (jackyouthere@gmail.com)
Maltiskam 12-67
Belgrade
Belgrade, 11008
RS
Tel: +381.113114094

Later changing to:

Domain Names copr.
markhaagland@gmail.com
Tallin
Harjumaa, 13514
EE
Tel. +37.26201114

WHOIS was again hidden behind PrivacyProtect on or about 9 January 2009.

 

smartadserver.net

Registrar: INTERNET/BS CORP
Created 18 November 2008
NS1.SMARTADSERVER.NET
NS2.SMARTADSERVER.NET

IP: 85.17.177.176 - Netherlands, Blue-ace-inc

WHOIS hidden behind the privacy protection service "privatewhois.net".  Note the nonsense telephone number +1.23456789

It is interesting note that the web page at smartadserver.net used to display the text “adserver.adtechie.net” (adtechie.net is a DIRECTI registered domain, now suspended).  That text has since been changed to “smartadserver.net”.

 

image

image

The domain adtechie.net is interesting in and of itself; it was involved in the malvertizing incident that hit Fox News back in November 2008.  You can see my report here.  Its IP address has changed from “212.95.37.206” to “212.95.37.133” and now shares IP with the domain mojocounter.biz.

mojocounter.biz

Registrar: DIRECTI
Created 16 January 2009
NS1.MOJOCOUNTER.BIZ
NS2.MOJOCOUNTER.BIZ

IP: 212.95.37.133 - Turkey, Netdirect-lnwservers

Registrant:
Andelka Kucinic (andelkakucinic@rocketmail.com)
Gosposka ulica 101
Nova Gorica
Pomurska
S15000
Slovenia
+386.031939326

Posted by sandi with no comments
Filed under: ,

Developments in the FTC v Innovative Marketing et al lawsuit…

image Filed - Consent motion to withdraw motion to dismiss for lack of personal jurisdiction of defendants James Reno and ByteHosting Internet Services, LLC - 12 February 2009

By agreement of the Plaintiff the Federal Trade Commission and Defendants James Reno and ByteHosting Internet Services, LLC, and in anticipation of resolution of the claims against said Defendants in the near future, which is under discussion, the parties hereby move to withdraw the Motion to Dismiss for Lack of Personal Jurisdiction of Defendants James Reno and ByteHosting Internet Services, LLC (Doc. 50), without waiving any defences.

Filed - Plaintiff's consolidated opposition to the motions for a temporary stay filed by defendants Sam Jain and Kristy Ross - 12 February 2009

Defendants Sam Jain and Kristy Ross are making a mockery of this proceeding.  After evading service of the complaint, ignoring this Court's order to appear at the preliminary injunction hearing, and wilfully disobeying the mandates of both the Temporary Restraining Order and Preliminary Injunction issued by this Court, defendants Jain and Ross now ask this Court for extraordinary relief: an indefinite stay of proceedings.  In making this request, defendants neglect to mention that Jain is the subject of a recently-issued bench warrant, which was executed after Jain absconded from an unrelated criminal proceeding currently pending in California.

...

The FTC is informed by the Assistant United States Attorney prosecuting the case that as of the date of this Opposition, Jain remains on the lam.

...

In a brief footnote to each of their briefs, Jain and Ross ask this Court to modify the asset freeze currently in place and allow them to pay their criminal defense counsel with the proceeds of their unlawful enterprise(2).  Despite the defendants' assertions to the contrary, they have no right to spend ill-gotten gains on attorneys' fees, much less retain counsel of their choice with unlawfully-acquired assets.  Furthermore, the defendants' request to release frozen funds cannot be justified in this case, where the defendants have provided no evidence to demonstrate a need for these funds, and the funds available for consumer redress are dwarfed by the consumer injury caused by the defendants.

...

The Defendants have no right to use the proceeds of their fraud to fund the best defense money can buy.  Moreover, the defendants' refusal to account for their assets, or offer any proof that they lack access to non-frozen funds, is fatal to their applications to modify the asset freeze imposed by this Court.  As a result, this Court should deny the defendants' request to modify the asset freeze.

(2) It is unclear whether Ross's motion requests frozen funds for her civil defense counsel as well.  The footnote request merely says that she ‘joins in Mr Jain's request to modify the asset freeze to permit her to pay for defense counsel.’”

It is worth noting that Maurice D'Souza, Innovative Marketing itself and Daniel Sundin are still unrepresented in these proceedings (Marc D'Souza, Sam Jain, Kristy Ross and Daniel Sundin are all officers of Innovative Marketing, but it does not mean that Innovative is represented simply because some of its officers have responded to the suit).  I was hoping that the latest documents would reveal whether or not Innovative Marketing have paid to the Court part or all of the penalty applied to it ($8,000 per day) but, alas, there is no mention.

 

It will be very interesting to see what resolution will be agreed between the FTC and James Reno.  Let’s not forget that Reno had got into trouble before because of his association with Innovative Marketing and Sam Jain:

Reno claimed in his now-deleted missive, which is riddled with spelling mistakes, that “11 years of {his} hard work and 11 years of {his} life, as well as, {ByteHosting's} history have been ruined in 30-seconds by a single court action”.  No James – everything that has happened and will happen is your own fault.  You chose to do business with Jain and Innovative et al and you chose to continue the business relationship even after the Symantec lawsuit.

The fact that Reno continued to do business with Jain and Innovative et al despite the successful Symantec lawsuit leads me to the conclusion that the FTC should throw the book at Reno, and not let him get off lightly.    And, I certainly hope that any settlement will not be “confidential”.  It seems that no lessons were learned by Reno in 2004 when he was embroiled in the Symantec lawsuit, and I do not feel at all confident that Reno will learn the necessary lessons this time, especially when I consider the statement that he posted on ByteHosting's home page.  If Reno believes that it is/was ok to supply even part of the infrastructure supporting such a massive fraud even after becoming embroiled in the Symantec lawsuit (infrastructure being technical support and a call center for the victims of fraudware call), and if the Symantec lawsuit was not enough to make him stop supplying such infrastructure - then I fear that he will simply do it again if asked.

The FTC lawsuit is a big fall from grace for Reno.  Not many people know that back in 2007, Bytehosting was named “small business employer of the year” by the Clermont County's Business Advisory Council (perhaps the Council know about the Symantec lawsuit from a few years before.  If they did check into ByteHosting's background did they ask hard questions like “is Jain/Innovative still a customer of Bytehosting?”).  I also found it interesting to read that Bytehosting was originally started as a school project.

 

image By the way, I suspect the “AR” that Reno refers to in his web site missive is Alpha Red – a hosting provider with two datacenters in Houston.  The CEO of Alpha Red, James Reed McCreary IV, and the company itself, were sued by Washington state Attorney General Robert McKenna in September 2008.  The lawsuit claimed that McCreary/Alpha Red were selling scareware that tricked Windows XP users into believing that their registry had become "damaged and corrupted".  Alpha Red filed for Chapter 11 Bankruptcy late last year.

Posted by sandi with 3 comment(s)
Filed under: ,

Please do NOT advise your users to turn off automatic updates because of *one* problem update

The latest “Rollup for ActiveX Killbits for Windows” (KB960715) is causing problems for some third party applications that are dependent on the disabled controls.

One application that has problems, “Office Tools Professional”, is advising its users to not only uninstall the Killbit patch (thereby restoring the broken functionality), but also to “turn off automatic updates”.  Please do not turn off automatic updates.  Simply uninstall the problem patch.

Office Tools Professional is wrong to tell its customers to “turn off automatic updates” just because *their* program has been negatively impacted by *one* patch.  Yes, they should tell their customers warn them of the problem and to uninstall 960715 until OTP has been updated to resolve the problem - yes they should put an alert up on their support site and a new article in their Knowledge Base about the issue – BUT THEY SHOULD ALSO tell their clients to read the relevant Security Advisory so that their clients understand what they are doing, are aware of the impact that removing the update will have, and are aware of any available workarounds that can be used in place of the patch.  They should also make sure to tell their clients that if they “turn off automatic updates” they may be exposed to elevated risk because future security updates will not be installed unless their clients remember to go out and get them manually.

I can understand that OTP may be worried that users who have set their systems to automatically download and install patches may be impacted again next month, but there is no reason why they cannot supply step by step instructions to their customers to show them how to change their patching protocols to “download but do not install” and then selectively install all but the problem patch.

What happens to their customers next month if/when the next round of security patches come out if automatic updates has been turned off completely?  What if there is a patch for a show-stopper security vulnerability that is actively being exploited?  What if their clients don’t install *that* patch because of OTP’s advice, and they then get hit by a nasty?  Historically, I have seen plenty of software companies tell customers to “turn off automatic updates” when a problem with a particular patch is discovered that affects their software, but I cannot remember a single time when the same company has sent out another email later saying “ok, problem fixed, turn AU back on again”.  Nor have I seen software companies send out emails to say “we told you to turn off AU last month; please make sure you manually download and install this months patches but don’t install patch X”.

Announcement: specialized malvertizing search engine portal

The Google Anti-Malvertizing Team have created a “custom search engine intended to help ad network customers conduct quick background checks on prospective partners" that can be seen here:

Google Malvertizing Research

The search engine pulls content from various dedicated forums and blogs, including Spyware Sucks.  It can certainly help reduce the “signal to noise” ratio that can affect other search engines.  I hope you will find it useful.

Posted by sandi with no comments
Filed under: ,

Lifestyles of the Rich and Infamous, and an update about the status of the FTC versus Innovative Marketing et al lawsuit

I'll include some history of events so that you can get a sense of perspective with regards to the time frame around these events.   It is especially important to note that the FTC lawsuit is not the only problem that Jain is facing.  He has been indicted in the State of California and is facing several criminal charges there, and there are pending charges against him in Illinois.  Events relevant to the California criminal charges and the Illinois investigation are highlighted.

You’ll see that the lifestyle enjoyed by Kristy Ross as revealed by her credit card statements was nothing if not lavish.

 

Defendants Kristy Ross and Sam Jain (who were (are?) boyfriend and girlfriend):

26 March 2008 - US District Court, San Jose, California: USA v Shaileshkumar Jain - four counts being criminal copyright infringement, trafficking in counterfeit goods, wire fraud and mail fraud (for activities that took place in 2003) (CR-08-00197-HRL) (charges relate to events on 12 and 26 January and the sale of fake Symantec software).  The Grand Jury indictment requests the forfeiture of "approximately $13,522,080 in United States currency or after acquired assets traceable thereto".  Sam Jain's full name is Shaileshkumar Jain.

"late September" 2008 - Ted W Cassman (he and his firm Arguedas, Cassman & Headley LLP represent(ed) Jain in the ongoing California criminal proceedings and the ongoing investigation in Illinois) met with Assistant US Attorney and two agents of the FBI in Chicago, Illinois.  The Assistant US Attorney "unequivocally stated that Mr Jain will be indicted for wire fraud and computer fraud charges as a result of the Illinois Investigation 'sooner rather than later.' " (cite: Declaration of Ted W Cassman dated 18 December 2008)

2 December 2008 - FTC requests and receives a temporary restraining order.

12 December 2008 - temporary restraining order expires.  The defendants did not turn up in Court and they failed to comply with the TRO.  Order to show cause issued.

17 December 2008 - appearances entered for Mark D'Souza and Sam Jain.  Joint response to order to show cause filed by Jain and Ross, promising to "fully comply with the terms of the TRO and PI by 23 December 2008"  Mark D'Souza also files a response, promising to comply with the requirements of the TRO and PI by 4.00pm on 23 December 2008. 

18 December 2008 - Cassman declaration signed describing the events of "late September" 2008.

23 December 2008 - a letter was sent to FTC on 23 December by the law firm Patton Boggs explaining that Jain had no intention of complying with the Court orders because to do so "would require Jain to incriminate himself" (the letter stated that Jain "is the target of a criminal investigation in the Northern District of Illinois covering the same conduct as the Commission's suit" and claimed that Jain cannot take any steps in relation to the FTC lawsuit without "waiving his Fifth Amendment privilege and making admissions that could be used against him in the criminal case").  Kristy Ross made the same argument. 

(Sandi note: bearing in mind the events of "late September" 2008 as described by Ted Cassman and detailed in his declaration signed 18 December 2008, why did Jain promise to "fully comply with the terms of the TRO and PI by 23 December 2008” – he must have known about the Illinois investigation and the possibility of criminal charges?  I do not know if criminal charges have yet been laid in Illinois)

29 January 2009 - the FTC filed a "memorandum of points and authorities in support of its motion for an order holding defendants Sam Jain and Kristy Ross in contempt of Court and requiring the repatriation of their assets".  I quote:

"Defendant Ross, for example, spent the year 2008 visiting the world's finest resorts (including multiple visits to the Four Seasons Resort in Nevis, as well as the British Colonial Hilton in the Bahamas, enjoying extravagant meals (including multiple $800+ meals), and gorging herself on luxury items from the world's most exclusive retailers, including Harrods of London (nearly $30,000 spent in 2008), Louis Vuitton (more than $23,000 spent in 2008) and Dolce & Gabbana (more than $13,000 spent in 2008).

...

To date, despite extensive efforts, the FTC has been unable to locate a single dollar of domestic assets held by either Jain or Ross."

The above information was taken from credit card statements for Kristy Ross that were submitted to the FTC by JP Morgan Chase and BMW Bank of North America - the "extravagant meals" included a series of meals totaling over $500 as well as at least two meals totaling more than $800.  The charges were incurred by Ross in locations all over the world including London, Toronto, Kiev, Brussels, Zurich, Nevis, Frankfurt and Montreal.  Ross stopped using the credit cards in or about September 2008. (cite: declaration of Sheryl Drexler dated 29 January 2009)

Two credit card accounts held by Kristy Ross and a safe deposit box held by Sam Jain have been discovered but apart from that "after weeks of searching, the FTC has located only $174,000 of the defendants' assets. ... The bulk of these funds belong to James Reno.  To date, the FTC has not located a single dollar of domestic assets held by either Jain or Ross." (cite: Plaintiff's memorandum of points and authorities in support of its motion for an order holding defendants Sam Jain and Kristy Ross in contempt of Court and requiring the repatriation of their assets filed 29 January 2009)

According to documents filed in the Canadian litigation (the "Canadian litigation" being the lawsuit filed by Innovative Marketing against Marc D'Souza and Maurice D'Souza in the Ontario Superior Court of Justice), the defendants' income from the sale of their products between 2004-2006 totaled more than $74 million! (cite: Plaintiff's memorandum of points and authorities in support of its motion for an order holding defendants Sam Jain and Kristy Ross in contempt of Court and requiring the repatriation of their assets filed 29 January 2009).

The FTC have requested that "this Court hold Jain and Ross in civil contempt, and order them incarcerated until such time as they comply with the PI...".

5 January 2009 - a completed Consent to Release of Financial Records form was finally received from Ross (the foreign account holders (ie overseas financial institutions) have not, as far as I know, supplied the requested information).

12 January 2009 - Jain failed to appear in court to face criminal charges (Criminal Minute Order, USA v Shaileshkumar Jain, CR-08-00197-RMW).  Bench Warrant issued, and stayed until 26 January 2009.

14 January 2009 - a completed Consent to Release of Financial Records form was finally received from Jain (the foreign account holders (ie overseas financial institutions) have not, as far as I know, supplied the requested information).

26 January 2009 - Jain requests a stay of the FTC proceedings because of the criminal proceedings in the Northern District of Illinois, until the criminal proceedings are resolved.

26 January 2009 - Sam Jain became a fugitive after the Bench Warrant stay was lifted.  Jain forfeited a $250,000 cash bond. 

(Sandi note: Bearing in mind the fact that the FTC claims that Jain/Ross were able to achieve revenues in excess of $100 million, the amount of $250,000 would seem a small price to pay (even after taking into consideration the fact that Ross was going through money hand over fist in 2008).

29 January 2009 - Ross requests a stay of the FTC proceedings because of the criminal proceedings in the Northern District of Illinois, until the criminal proceedings are resolved.

5 February 2009 - Ross files a "Motion to Strike or, in the alternative, for extension of time to respond", moving for the Court to strike the FTC's motion for an order holding Jain and Ross in contempt of court and requiring repatriation of their assets "as premature and procedurally improper". 

5 February 2009 - Jain joins Ross's motion to strike

(Sandi note: Isn't it interesting that Jain, who has been a fugitive since 26 January 2009 and whose whereabouts are apparently unknown (see FTC document filed 9 January 2009), was able to join Kristy Ross's Motion to Strike on 5 February 2009?).

9 January 2009 - The FTC opposed the Motion to Strike, filing a "consolidated opposition to motion of defendants Kristy Ross and Sam Jain to strike or in the alternative for an extension of time" on 9 January 2009.  The FTC notes in that document that "to allow these defendants to flaunt the Court's orders, and then escape the consequences of these actions by pointing to a possible criminal proceeding, would set bad precedent and invite similar conduct from future defendants.".

The FTC document notes that Jain is a fugitive, and that his whereabouts are (were?) unknown.

Defendants: James Reno and Bytehosting Internet Services

Bytehosting/Reno are now represented.  A further extension of time was granted, pushing out the deadline from 23 January to 30 January 2009.

Reno/Bytehosting then filed a Motion to dismiss for lack of personal jurisdiction (claiming the court has no jurisdiction) on 30 January 2009.  Reno/Bytehosting claim to have been "merely under contract to provide services, namely technical support and a call center, to Defendant Innovative Marketing".  It is also claimed that their "involvement with Innovative Marketing was limited to internal technical support and post-sale support for customers through a call center".

Reno swore an affidavit which basically says the same thing on 30 January 2009.

(Sandi note: Uh, yeah – where I come from being aware that something bad is going on via my business because of a rogue client and not doing anything about it is as bad as being the rogue client, and there’s no way Reno could NOT have known what Innovative Marketing et al were doing, especially after the Symantec lawsuit that Reno was a party to)

BTW, I have come across the name eFront a few times in association with Reno and Jain – a couple of comments have been posted referring to them ... would anybody like to share what they know about *that* story?
http://www.google.com/search?hl=en&q=efront+reno+jain (eFront CEO was Sam Jain, CTO was James Reno?)  Why do I get the feeling that the association between Reno and Jain is more than the typical “arms length, he just walked in off the street, wouldn’t know him from Adam” client/supplier relationship?

Defendants: Daniel Sundin, Maurice D'Souza, Innovative Marketing Inc

These defendants are still unrepresented and silent in this action.  Also, I have found no evidence that Innovative Marketing has paid any of the $8,000 per day fine that was imposed after it failed to comply with the Temporary Restraining Order.

Upcoming deadlines:

12 February 2009 (Response)
17 February 2009 (Response x3)
23 February 2009 (Response x2 and reply x1)

I just knew I'd find DIRECTI in there somewhere...

Sunbelt reports that there is a new fraudware domain, being ie-security.com.

Let's look at the domain details for ie-security.com:

ICANN Registrar: BIZCN.COM, Inc (a name that is appearing far too often in association with malware)
Date created: 22 January 2009
NS1.IE-SECURITY.COM
NS2.IE-SECURITY.COM

IP: 216.240.151.135 - Los Angeles, Atmlink Inc

Shares IP with magavidon.cn, secured-software-order.com, webfreescan.cn and windefender2009.cn

Registrant:

Nexton Limited
Sergey Ryabov (director@climbing-games.com)
+79219270961
Scherbakova st., 6-38
Saint-Petersburg 197375
RU

*****

Ok, the email address in the WHOIS (director@climbing-games.com) is interesting.  Let's have a look at the domain climbing-games.com:

ICANN Registrar: DIRECTI
Created: 23 October 2007
NS5.PUBLIC-NS.COM
NS6.PUBLIC-NS.COM

IP: 66.230.161.250 - Brooklyn, Reality Check Network Corp

Registrant:

Sigurd s.r.o
Sergey (sigurd@adultinter.com)
Scherbakova st., 6-38
St-Petersburg
null, 197349
RU
Tel: +79219270961

As you can see, there are very similar WHOIS details.

*****

Ok, so what about adultinter.com?

ICANN Registrar:  DIRECTI
Created: 22 January 2004
NS1.ADVANCEDHOSTERS.COM
NS2.ADVANCEDHOSTERS.COM

IP: 209.8.19.218 - Silver Spring - Beyond The Network America Inc

Shares IP with adult-gateway.com, adultbeerparty.com, alterinter.com, northvenice.ru

Registrant: Andrei Akalovich (sax@elitistclub.com)
ul. Zrzaveho 12/1083
Praha-6
null,16300
CZ
Tel: +42.0774532108

*****

Let's look at elitistclub.com:

ICANN Registrar: DIRECTI
Created: 25 January 2007
NS5.PUBLIC-NS.COM
NS6.PUBLIC-NS.COM

IP: 205.252.166.170 - Washington, Beyond The Network America Inc

Registrant: Andrei Akalovich (sax@elitistclub.com)
ul. Zrzaveho 12/1083
Praha-6
null,16300
CZ
Tel: +42.0774532108

*****************************************************************************************

We find DIRECTI again when we take a look at another domain reported on Sunbelt, being total-defender.com.

The (now defunct?) total-defender.com (registered via ENOM INC) is listed at IP address 94.247.2.41 (the domain is currently not resolving), and that IP address is (was) shared with just two other domains, being webfreefind.com and rusexportal.com.

webfreefind.com (status ACTIVE)
ICANN Registrar: DIRECTI
Created 5 May 2006

NS1.TOTAL-DEFENDER.COM <--- !!! (there is no denying an association now)
NS2.TOTAL-DEFENDER.COM

Registrant: DiabloCompany (info@gangstabros.com)
Garvand 2-10
Oklahoma
null,655158
ES
Tel: +91.2228797504

*****

rusexportal.com (status: ACTIVE)
ICANN Registrar: DIRECTI
Created 19 October 2008

NS1.REG.RU
NS2.REG.RU

Registrant: Pavel Antonov (petra-nova@yandex.ru)
Pyatnitskaya, 10, 4
Moska, 148952
Tel: +7 495 0000000

*****

gangstabros.com (status: ACTIVE)
ICANN Registrar: DIRECTI
Created 14 February 2006

NS1.GANGSTABROS.COM
NS2.GANGSTABROS.COM

Registrant: Yura Inc
Yuriy Vasilyev (diablo@divaporn.com)
Yubileynaya 2-10
Chernogorsk
Khakasia,655158
RU
Tel: +7.9061905092

(What a coincidence, gangstabros.com and webfreefind.com both have street number "2-10", both use the same code "655158" despite being, apparently, in different countries!  Methinks all three domains could be reported to ICANN for fake WHOIS information (what do you think the chances are that the phone number for rusexportal.com is legitimate?)

More information about Olympic Media shenanigans

Ok, when the hijack triggered via the Olympic Media supplied javascript URL that I mentioned in my previous article triggers successfully we hit:

admediastats.com/ts/in.cgi?{{redacted}}

From there we end up at sg12scanner.com/{{redacted}}

From there to dlsg09.com/sysgd09/install.php?track_id={{redacted}}

Javascript in use:

sg12scanner.com/js/jquery-1.2.5.pack.js
sg12scanner.com/js/jquery.timers.js (just for fun I will point out that that the JS contains the comment "Yeah this is major overkill...")
sg12scanner.com/js/file_names.js

Installer URL: 89.149.236.86/sysgd09/install.php?track_id={{redacted}}

Tries to download "SystemGuard2009.exe"

admediastats.com (status: LOCKED)
ICANN Registrar: ENOM, INC
Created 4 January 2009

ns1.admediastats.com - 91.211.64.71 - Russian Federation Ural Industrial Limited Company
ns2.admediastats.com - 116.50.15.1 - Hong Kong Hostfresh
ns3.admediastats.com - 89.146.226.121 - Germany De-nic
ns4.admediastats.com - 212.117.162.90 - Luxembourg Root Esolutions

IP: 84.243.252.179 - Berlin, Gfx-cust-worldstream

Registrant: WhoisGuard Protected

*****

sg12scanner.com
ICANN Registrar: REGTIME LTD
Created 14 January 2009
NS1.DLDNSSG09.COM
NS2.DLDNSSG09.COM

IP: 78.26.179.253 - Odessa, Renome-service: Joint Multimedia Cable Network

Shares IP with Dldnssg09.com, Dlsg09.com, Dlsgd2.com, Dlsgd3.com, Gbpings.com, Getsg09.com, Getsgd2.com, Getsgd3.com, Getsysgd09.com, Gosg09.com, Gosgd2.com, Gosgd3.com, Gosysgd09.com, Prdnssg09.com, Scannersg.com, Scansguard.com, Sg10scanner.com, Sg11scanner.com, Sg12scanner.com, Sg9scanner.com, Sgproduct.com, Sgproductm.com, Sgscanner.com, Sguardscan.com, Sgviralscan.com, Spywareguard2009.com, Spywareguard2009m.com, Systemguard2009.com and Systemguard2009m.com, all of which should be treated with extreme caution.

Registrant: Kire Serona (kiresl1540@yahoo.com) - owns 2 other domains
Ilichova 16, Ljubljana.

*****

dlsg09.com
ICANN Registrar: REGTIME LTD
Created 14 January 2009
NS1.DLDNSSG09.COM
NS2.DLDNSSG09.COM

IP: 78.26.179.253 - Odessa, Renome-service: Joint Multimedia Cable Network

Shares IP with Dldnssg09.com, Dlsg09.com, Dlsgd2.com, Dlsgd3.com, Gbpings.com, Getsg09.com, Getsgd2.com, Getsgd3.com, Getsysgd09.com, Gosg09.com, Gosgd2.com, Gosgd3.com, Gosysgd09.com, Prdnssg09.com, Scannersg.com, Scansguard.com, Sg10scanner.com, Sg11scanner.com, Sg12scanner.com, Sg9scanner.com, Sgproduct.com, Sgproductm.com, Sgscanner.com, Sguardscan.com, Sgviralscan.com, Spywareguard2009.com, Spywareguard2009m.com, Systemguard2009.com and Systemguard2009m.com, all of which should be treated with extreme caution.

Registrant: Damir Sbil (damirsbils791@gmail.com) - owns 6 other domains
Tavcarjeva 109, Skofja vas.

*****

89.149.236.86 - China Gibibits-Ltd (89-149-236-86.internetserviceteam.com - Netdirekt).  Known spam IP.

Olympic Media are still active

I’ve warned about Olympic Media several times – they continue to be active.

The latest reports indicate they are claiming to be operating out of Canada and are supplying javascript code referring to admin.securityclick.net as follows:

 

image

 

Other domains being used are onlinepromostats.com and admediastats.com.

This type of trickery, supplying javascript pointing to malicious domains under the control of the fraudsters, is becoming more and more common.  From there, the bad guys control who does (or does not) see malicious code (see this blog entry for an example).

 

And, they still haven’t fixed their site typos  :)

image

image

 

securityclick.net (status: LOCKED)
ICANN Registrar: ENOM, INC
Created 25 March 2008

NS1.SECURITYCLICK.NET - 208.79.82.50 - Tranquil Hosting
NS2.SECURITYCLICK.NET - 208.79.82.66 - Tranquil Hosting
NS3.SECURITYCLICK.NET - 77.73.98.2 - Belgium Nucleus Bvba
NS4.SECURITYCLICK.NET - 77.73.98.4 - Belgium Nucleus Bvba
NS5.SECURITYCLICK.NET - 89.149.244.29 - Germany Netdirekt E.k (internetserviceteam.com)
NS6.SECURITYCLICK.NET - 217.20.116.59 - Germany Netdirekt E.k (finnzi.com)
NS7.SECURITYCLICK.NET - 88.198.62.171 - Germany Hetzner-rz-nbg-net

IP: 76.74.249.30 - Virgin Islands, Soft.sol.inc

Registrant contact:
Serg Moons (moon.serg@gmail.com)

Inaccurate WHOIS report submitted via ICANN on 27 January 2009

Sharing IP with adnetserver.com, adverlounge.com, beststatserver.com, bizadsonline.net, bizmarketads.com, greatad.net, iddqdmarketing.com, intervarioclick.com, invulnerableads.com, luckyadcoin.com, moneycometrue.com, statisticsmanager.com, statsreportserver.com, waytotheprofit.com and widestatsnow.com - all of these domains should be treated with extreme caution.

*****

onlinepromostats.com (status: LOCKED)
ICANN Registrar: ENOM, INC
Created 3 July 2008

NS1.ONLINEPROMOSTATS.COM - 208.79.82.50 - Tranquil Hosting
NS2.ONLINEPROMOSTATS.COM - 208.79.82.66 - Tranquil Hosting
NS3.ONLINEPROMOSTATS.COM - 77.73.98.2 - Belgium Nucleus Bvba
NS4.ONLINEPROMOSTATS.COM - 77.73.98.4 - Belgium Nucleus Bvba
NS5.ONLINEPROMOSTATS.COM - 89.149.244.29 - Germany Netdirekt E.k (internetserviceteam.com)
NS6.ONLINEPROMOSTATS.COM - 217.20.116.59 - Germany Netdirekt E.k (finnzi.com)
NS7.ONLINEPROMOSTATS.COM - 213.133.100.58 - Germany Hetzner-rz-nbg-net
NS8.ONLINEPROMOSTATS.COM - 88.198.62.172 - Germany Hetzner-rz-nbg-net

IP: 84.243.252.86 - Berlin, Gfx-cust-worldstream

Registrant: namecheap.com

*****

admediastats.com (status: LOCKED)
ICANN Registrar: ENOM, INC
Created 4 January 2009

ns1.admediastats.com - 91.211.64.71 - Russian Federation Ural Industrial Limited Company
ns2.admediastats.com - 116.50.15.1 - Hong Kong Hostfresh
ns3.admediastats.com - 89.146.226.121 - Germany De-nic
ns4.admediastats.com - 212.117.162.90 - Luxembourg Root Esolutions

IP: 84.243.252.179 - Berlin, Gfx-cust-worldstream

Registrant: WhoisGuard Protected

Malvertizing at realtor.com?

I have received two independent reports, several days apart, of a possible malvertizement problem at realtor.com.  If anybody can grab evidence, using Fiddler or your network capture software of choice, we’ll be grateful to hear from you so that we can identify the malvert(s) and get it (them) shut down.

Posted by sandi with no comments
Filed under: