Spyware Warrior

SpywareQuake scum on the run?

When I first wrote about SpywareQuake at SpywareConfidential and here, the domains spywarequake.com, spywarequake.net and spywarequake.info were hosted at a California ISP known to host spyware (CWS) and malware, and other Super Rogue anti-spyware apps such as SpySheriff (whois).

That ISP is InterCage (whois), formerly known as Atrivo (whois) or Atrivotechnologies, located in the San Francisco Bay area (corporation lookup) of California. More on InterCage/Atrivo later.

I just checked the whois information for the 3 Spyware Quake domains and it looks like the sites are now hosted at a different location, different ISP, (maybe different—there is or was a relationship between InterCage and the current hosting company but I’m not clear what.)

The current IP address for spywarequake.com, according to Dnsstuff.com is this:

Pinging spywarequake.com [85.255.117.202]:

Ping #1: Got reply from 85.255.117.202 in 82ms [TTL=57]
Ping #2: Got reply from 85.255.117.202 in 82ms [TTL=57]
Ping #3: Got reply from 85.255.117.202 in 82ms [TTL=57]
Ping #4: Got reply from 85.255.117.202 in 82ms [TTL=57]

Done pinging spywarequake.com!

85.255.117.202

Blacklist Status: Listed – Cached Today (details)
Cached Whois: Cached today
Record Type: IP Address
IP Location: Ukraine – Inhoster Hosting Company
Reverse IP: Web server hosts 1 websites (reverse ip tool requires free login)
Reverse DNS: not set

inetnum: 85.255.112.0 – 85.255.127.255
netname: inhoster
descr: Inhoster hosting company
descr: OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine

More in Inhoster in a bit, too.

Spywarequake.info shows the same IP as spywarequake.com.

Pinging spywarequake.info [85.255.117.202]:

Ping #1: Got reply from 85.255.117.202 in 82ms [TTL=57]

Spywarequake.net seems to be in a different location.

Pinging spywarequake.net [66.116.200.239]:

Ping #1: * [No response]

66.116.200.239 is located in Hopkinsville, Kentucky according to whois.sc and dnsstuff.com. The page at spywarequake.net says “web server is ok ”.
Odd.

So who is behind InterCage/Atrivo? And who is behind Inhoster, formerly Esthost? Are the two related or are they actually one and the same?

The name shown in the whois information for most of the InterCage/Atrivo domains is Emil Kacpersky, (not to be confused with Eugene Kaspersky of the antivirus company Kaspersky.) Inhoster.com (whois) is registered to:

Registration Service Provided By: ESTDOMAINS
Contact: +1.3027224217
Website: http://www.estdomains.com

Domain Name: INHOSTER.COM

Registrant:

Inhoster Inc. Andrei Kislizin () Lenina str. 23/95 Odessa ,54302 UA Tel. +38.0664637362 Fax. +38.0664637362

Creation Date: 01-Jun-2005
Expiration Date: 01-Jun-2006

Note the registrar, ESTDOMAINS, at estdomains.com (whois).

Estdomains.com is hosted at InterCage, at IP address 69.50.183.26 (whois)

The IP addresses now shown at Inhoster were fomerly shown as belonging to Esthost. Esthost.com is still alive and hosted at InterCage also. Esthost.com shares the IP address 69.50.176.228 with Estcertificates.com (whois).

SpamHuntress has blogged about Esthost and Atrivo/InterCage as well, and links to a thread on Google Groups where the relationship between Esthost and Atrivo is discussed.

This blog post is getting long and I’m going to break here for now, but I have more information about Emil Kacpersky, Atrivo/InterCage and Esthost/Inhoster to post in the next episode.

Super Rogues

This made my blood boil. As Sunbeltblog says, this site a Windows Security Center faux clone.

My IP address is edited out of the screenshot, but look at the outrageous scare tactics. I haven’t seen anything this bad since the Spy Wiper Spy Deleter days. There are 4 anti-spyware apps shown and 3 of them are already on the Rogue/Suspect Anti-Spyware Programs and Sites page, and I expect the 4th will earn a place shortly. PSGuard is known for hijacking desktops in forced installs through security exploits and RazeSpyware is no better. WorldAntiSpy follows suit.

The whois information on the domain security2k.net. shows it is hosted on Atrivo, a known host for many CWS hijackers, sites running exploits and spammers.

Update: SpyTrooper has also been added to the Rogue/Suspect Anti-Spyware page.

Note—if you need help removing this spyware, click on the comments or the “read more” link and scroll to the bottom for instructions.