32

This is a list of known spammers, spam domains, and IP addresses to which these domains point.

This list is derived from spam patterns observed on Super User as well as information from DNS and reverse DNS lookups from sources such as VirusTotal. It will be expanded as research progresses and as more spam is identified.

All IP address links go to the associated VirusTotal information page. Any subdomains of the listed domains are considered to be included.

9
  • 1
    Are these IP addresses purported to be the IPs of the servers which the spam points to, or the IPs of the servers from which the spammers are visiting?
    – nhinkle Mod
    Commented Mar 29, 2015 at 6:53
  • These are the IPs to which the domains point.
    – bwDraco
    Commented Mar 29, 2015 at 6:53
  • 2
    Thanks for clarifying. What is the intended usage of the list as you envision it? Are you expecting others to add to it, and if so, should it be community-wiki?
    – nhinkle Mod
    Commented Mar 29, 2015 at 6:55
  • 1
    My goal is a collaboratively edited list of known spam links which can be used as a reference for spam detection and flagging. CW is probably a good idea here.
    – bwDraco
    Commented Mar 29, 2015 at 6:56
  • 7
    The IPs are blocked automatically and blacklisted. The blatant ones get flag-killed within couple of hours at max. I don't understand the point of this post?
    – Sathyajith Bhat Mod
    Commented Mar 29, 2015 at 9:12
  • 1
    Some spam is sneakier than you think. The key issue this intends to address is the fact that spammers keep using different domains which are missed by the system and users as a whole.
    – bwDraco
    Commented Mar 29, 2015 at 9:14
  • 3
    I don't think this is the best place to post spam lists.
    – oldmud0
    Commented Apr 1, 2015 at 22:42
  • 1
    @oldmud0: why? Perhaps Meta Stack Exchange would be more appropriate? This list is based on the spam patterns we see on Super User, so it would be natural to post it here on the local Meta.
    – bwDraco
    Commented Apr 2, 2015 at 2:50
  • Woodface started a "blacklist candidate" on meta some time ago, maybe you'd like to take some of the candidates for the The Master Spam List: chat.meta.stackexchange.com/…
    – bummi
    Commented Apr 27, 2015 at 10:26

1 Answer 1

Reset to default
25

Tenorshare and affiliates

Data recovery, password recovery, video conversion, and PDF conversion spam. Has various other names such as SmartKey. The scale of the spam and the fact that multiple malware programs have been found on these IP addresses suggest that the conduct originates from a criminal organization.

IP addresses:

Domains:

  • tenorshare.com
  • advancedpdfconverter.com
  • androiddatarecoverypro.com
  • any-data-recovery.com
  • card-data-recovery.com
  • excel-password-recovery.net
  • fix-computer.net
  • lost-password.net
  • lostwindowspassword.com
  • macvideoconverterpro.com
  • password-master.net
  • photorecovery-formac.com
  • powerpointpasswordrecovery.net
  • rarpasswordunlocker.net
  • recover-windows-password.net
  • recoverlostpassword.com
  • sqlpassword-recovery.com
  • windows7-password-reset.net
  • windowspasswordcracker.com
  • windowspasswordrecovery.net
  • windowspasswordreset.net
  • windowspasswordsrecovery.com
  • wordpassword-recovery.com
  • youtubedownloaderconverter.net

Smart PC Fixer/Wise Recovery

Fake system maintenance and tuning software; known adware and scam. Also associated with data recovery spam.

IP addresses:

Domains:

  • smartpcfixer.com
  • 1fix.org
  • cardrecoverypro.com
  • drivertuner.com
  • easyfix.org
  • errorsfixer.org
  • faq800.com
  • fix1.org
  • guru4pc.net
  • howto4pc.org
  • official-drivers.com
  • pceasynow.com
  • photorecoverypro.net
  • regeasypro.com
  • registryware.org
  • smartfixer.net
  • smartfixer.org
  • wisefixer.com
  • wisefixer.net
  • wiserecovery.com

Password Unlocker

Password recovery spam; also associated with PDF conversion (Nemo PDF) and data recovery (Hodo).

IP addresses:

Domains:

  • passwordunlocker.com
  • password-unlocker.com
  • passwordtech.com
  • goshareware.com
  • nemopdf.com

Apowersoft

Screenshot and video downloader spam.

IP addresses:

Domains:

  • apowersoft.com
  • downloadavideo.net
  • downloaddailymotion.com
  • free-download-youtube.com
  • free-music-downloader.com
  • screenshot.net
  • video-download-capture.com
  • videograbber.net

Wasel

VPN client spam. Uses seemingly legitimate blog links to deceive reviewers. Whois information indicates the operator is Michael Maher of iSpire.

IP addresses:

Domains:

  • wasel.com
  • i-spire.com (developer website)
  • internetwasel.com
  • waselpro.com
  • iwasl.com
  • vpnfaqs.com
  • vpnanswers.com
  • bestcheapvpnservice.com
  • unblockingtwitter.com
  • openingblockedsite.com
  • arabicdownloads.com
  • arabicsoftdownload.com

Repair Toolbox

Office document data recovery recovery spam. Uses a seemingly valid question to disguise activity, then posts an answer using a different account promoting the product. An example question follows:

How to repair Corrupt MS Excel file?

How to repair and recover corrupt MS excel file? I am unable to open corrupt MS Excel file due to virus infected, I have crucial Workbook sheet got lost, so how to get back corrupted MS Excel file. Please help me.

IP addresses:

Domains

This list is non-exhaustive due to the extremely large number of domains associated with the above IP address.

  • *.repairtoolbox.com
  • *.fixtoolbox.com
  • [document file extension].repair
  • [document type]repairtoolbox.com (any domain which ends with this string)
  • all-recovery-inc.com

Miscellaneous spammers

These domains and products are known to be spam but no further association with the above have presently been identified.

  • Long Path Tool
    • Usually does not post a link; just mentions the program by name.
  • Windows Password Breaker / Advanced Password Breaker
    • recoverwindowspassword.com
  • Windows Password Buster
    • password-buster.com
  • Remo Recover
    • remorecover.com
    • remosoftware.com
    • Note: Spam for this product often does not contain any links, which can make it harder to identify as such.
  • Brorsoft
  • Pavtube
    • Appears to be related to Brorsoft (see 1, 2; further investigation needed)
    • Includes DVDAid, BDMagic, and Handbraker (notice that the latter has an intentionally confusing name)
  • Preply (language learning spam)
    • preply.com
  • Open File Tool (solutions for the recovery of corrupted files for many different file types)
    • openfiletool.com (208.76.175.50)
  • Krojamsoft
    • Usually does not post a link; just mentions the program (Batch Rename) by name.

Blog Spammers

Spam has links to blogs containing affiliate links to paid products.

  • removeunwantedprograms.wordpress.com
    • Contains affiliate links to revouninstallerpro.com and mackeeperapp.mackeeper.com
17
  • A keyword search for "Remo Recover" at SU turned up this question which asks: Do file recovery systems like Remo Recover work?
    – karel
    Commented Mar 31, 2015 at 8:02
  • 2
    It is, to an extent, a legitimate product, but I've seen it spammed at least twice here on Super User.
    – bwDraco
    Commented Mar 31, 2015 at 8:03
  • 1
    No time for a thorough edit, but let me add: DBF repair, Krojamsoft, AquaSnap, XpressDox, BrorSoft, eScan, BackupChain, Debookee, Bionix. Then there's the hall of fame: Paragon and Acronis (the latter being particularly nasty… as if they needed advertising).
    – slhck Mod
    Commented Mar 31, 2015 at 21:05
  • @slhck Are you saying that Acronis is malware? I'm asking because I've used their free WD backup application and I've never heard there's a problem with it. (Or did I misunderstand your comment?)
    – ispiro
    Commented Apr 2, 2015 at 7:41
  • 2
    @ispiro No, it's not malware. They were just setting up lots of fake accounts to spam us.
    – slhck Mod
    Commented Apr 2, 2015 at 7:42
  • @slhck Oh. OK. Thanks for the super-speedy response!
    – ispiro
    Commented Apr 2, 2015 at 7:42
  • @slhck Ugh, Brorsoft. I have that one on my list: FFmpeg GPL license violators who try to spam the mailing lists and forum. Some of these same clowns have spammed here at SU too, but I can't recall which. I flagged them and they go away.
    – llogan
    Commented Apr 3, 2015 at 4:36
  • @slhck: Is it certain that the spam came from Acronis, and not one of their resellers, or possibly someone wanting to ruin their reputation?
    – Ben Voigt
    Commented Apr 7, 2015 at 22:56
  • @BenVoigt The latter is rather implausible. I don't know about the former, as there is no easy way to tell.
    – slhck Mod
    Commented Apr 8, 2015 at 4:51
  • As if anyone needs to ruin Acronis' reputation.
    – Carey Gregory
    Commented Apr 9, 2015 at 18:35
  • Another one for your list: inetfusion is getting a lot of "recommendations".
    – fixer1234
    Commented May 11, 2015 at 7:17
  • Another one is spam (which doesn't seem to contain any links - stupid spammers) for "long path tool". Example Source path too long - BUT IT NEVER USED TO BE and superuser.com/a/930344/337631 (already deleted)
    – DavidPostill Mod
    Commented Jun 22, 2015 at 18:01
  • You may want to add msoutlooktools.com and friends.
    – Braiam
    Commented Jul 4, 2015 at 20:57
  • Another regular spammer here: vanskeys.com
    – fixer1234
    Commented Aug 17, 2015 at 5:00
  • 1
    @DavidPostill: Bear in mind that this answer is community wiki, so feel free to edit it as needed. Just try to be consistent with the formatting.
    – bwDraco
    Commented Oct 1, 2015 at 17:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .