32

This is a list of known spammers, spam domains, and IP addresses to which these domains point.

This list is derived from spam patterns observed on Super User as well as information from DNS and reverse DNS lookups from sources such as VirusTotal. It will be expanded as research progresses and as more spam is identified.

All IP address links go to the associated VirusTotal information page. Any subdomains of the listed domains are considered to be included.

  • 1
    Are these IP addresses purported to be the IPs of the servers which the spam points to, or the IPs of the servers from which the spammers are visiting? – nhinkle Mar 29 '15 at 6:53
  • These are the IPs to which the domains point. – bwDraco Mar 29 '15 at 6:53
  • 2
    Thanks for clarifying. What is the intended usage of the list as you envision it? Are you expecting others to add to it, and if so, should it be community-wiki? – nhinkle Mar 29 '15 at 6:55
  • 1
    My goal is a collaboratively edited list of known spam links which can be used as a reference for spam detection and flagging. CW is probably a good idea here. – bwDraco Mar 29 '15 at 6:56
  • 7
    The IPs are blocked automatically and blacklisted. The blatant ones get flag-killed within couple of hours at max. I don't understand the point of this post? – Sathyajith Bhat Mar 29 '15 at 9:12
  • 1
    Some spam is sneakier than you think. The key issue this intends to address is the fact that spammers keep using different domains which are missed by the system and users as a whole. – bwDraco Mar 29 '15 at 9:14
  • 3
    I don't think this is the best place to post spam lists. – oldmud0 Apr 1 '15 at 22:42
  • 1
    @oldmud0: why? Perhaps Meta Stack Exchange would be more appropriate? This list is based on the spam patterns we see on Super User, so it would be natural to post it here on the local Meta. – bwDraco Apr 2 '15 at 2:50
  • 1
    Add me to the chorus on why should this post exist. Is it to benefit admins who run other sites who want intel on what IPs/hosts might be SPAM sources? Why would anyone benefit in that way? Unless Stack Exchange has some banned IP/host API that someone can use this all seems a bit “mall cop”-ish. – JakeGould Apr 10 '15 at 5:47
  • Woodface started a "blacklist candidate" on meta some time ago, maybe you'd like to take some of the candidates for the The Master Spam List: chat.meta.stackexchange.com/… – bummi Apr 27 '15 at 10:26
25

Tenorshare and affiliates

Data recovery, password recovery, video conversion, and PDF conversion spam. Has various other names such as SmartKey. The scale of the spam and the fact that multiple malware programs have been found on these IP addresses suggest that the conduct originates from a criminal organization.

IP addresses:

Domains:

  • tenorshare.com
  • advancedpdfconverter.com
  • androiddatarecoverypro.com
  • any-data-recovery.com
  • card-data-recovery.com
  • excel-password-recovery.net
  • fix-computer.net
  • lost-password.net
  • lostwindowspassword.com
  • macvideoconverterpro.com
  • password-master.net
  • photorecovery-formac.com
  • powerpointpasswordrecovery.net
  • rarpasswordunlocker.net
  • recover-windows-password.net
  • recoverlostpassword.com
  • sqlpassword-recovery.com
  • windows7-password-reset.net
  • windowspasswordcracker.com
  • windowspasswordrecovery.net
  • windowspasswordreset.net
  • windowspasswordsrecovery.com
  • wordpassword-recovery.com
  • youtubedownloaderconverter.net

Smart PC Fixer/Wise Recovery

Fake system maintenance and tuning software; known adware and scam. Also associated with data recovery spam.

IP addresses:

Domains:

  • smartpcfixer.com
  • 1fix.org
  • cardrecoverypro.com
  • drivertuner.com
  • easyfix.org
  • errorsfixer.org
  • faq800.com
  • fix1.org
  • guru4pc.net
  • howto4pc.org
  • official-drivers.com
  • pceasynow.com
  • photorecoverypro.net
  • regeasypro.com
  • registryware.org
  • smartfixer.net
  • smartfixer.org
  • wisefixer.com
  • wisefixer.net
  • wiserecovery.com

Password Unlocker

Password recovery spam; also associated with PDF conversion (Nemo PDF) and data recovery (Hodo).

IP addresses:

Domains:

  • passwordunlocker.com
  • password-unlocker.com
  • passwordtech.com
  • goshareware.com
  • nemopdf.com

Apowersoft

Screenshot and video downloader spam.

IP addresses:

Domains:

  • apowersoft.com
  • downloadavideo.net
  • downloaddailymotion.com
  • free-download-youtube.com
  • free-music-downloader.com
  • screenshot.net
  • video-download-capture.com
  • videograbber.net

Wasel

VPN client spam. Uses seemingly legitimate blog links to deceive reviewers. Whois information indicates the operator is Michael Maher of iSpire.

IP addresses:

Domains:

  • wasel.com
  • i-spire.com (developer website)
  • internetwasel.com
  • waselpro.com
  • iwasl.com
  • vpnfaqs.com
  • vpnanswers.com
  • bestcheapvpnservice.com
  • unblockingtwitter.com
  • openingblockedsite.com
  • arabicdownloads.com
  • arabicsoftdownload.com

Repair Toolbox

Office document data recovery recovery spam. Uses a seemingly valid question to disguise activity, then posts an answer using a different account promoting the product. An example question follows:

How to repair Corrupt MS Excel file?

How to repair and recover corrupt MS excel file? I am unable to open corrupt MS Excel file due to virus infected, I have crucial Workbook sheet got lost, so how to get back corrupted MS Excel file. Please help me.

IP addresses:

Domains

This list is non-exhaustive due to the extremely large number of domains associated with the above IP address.

  • *.repairtoolbox.com
  • *.fixtoolbox.com
  • [document file extension].repair
  • [document type]repairtoolbox.com (any domain which ends with this string)
  • all-recovery-inc.com

Miscellaneous spammers

These domains and products are known to be spam but no further association with the above have presently been identified.

  • Long Path Tool
    • Usually does not post a link; just mentions the program by name.
  • Windows Password Breaker / Advanced Password Breaker
    • recoverwindowspassword.com
  • Windows Password Buster
    • password-buster.com
  • Remo Recover
    • remorecover.com
    • remosoftware.com
    • Note: Spam for this product often does not contain any links, which can make it harder to identify as such.
  • Brorsoft
  • Pavtube
    • Appears to be related to Brorsoft (see 1, 2; further investigation needed)
    • Includes DVDAid, BDMagic, and Handbraker (notice that the latter has an intentionally confusing name)
  • Preply (language learning spam)
    • preply.com
  • Open File Tool (solutions for the recovery of corrupted files for many different file types)
    • openfiletool.com (208.76.175.50)
  • Krojamsoft
    • Usually does not post a link; just mentions the program (Batch Rename) by name.

Blog Spammers

Spam has links to blogs containing affiliate links to paid products.

  • removeunwantedprograms.wordpress.com
    • Contains affiliate links to revouninstallerpro.com and mackeeperapp.mackeeper.com
  • A keyword search for "Remo Recover" at SU turned up this question which asks: Do file recovery systems like Remo Recover work? – karel Mar 31 '15 at 8:02
  • 2
    It is, to an extent, a legitimate product, but I've seen it spammed at least twice here on Super User. – bwDraco Mar 31 '15 at 8:03
  • 1
    No time for a thorough edit, but let me add: DBF repair, Krojamsoft, AquaSnap, XpressDox, BrorSoft, eScan, BackupChain, Debookee, Bionix. Then there's the hall of fame: Paragon and Acronis (the latter being particularly nasty… as if they needed advertising). – slhck Mar 31 '15 at 21:05
  • @slhck Are you saying that Acronis is malware? I'm asking because I've used their free WD backup application and I've never heard there's a problem with it. (Or did I misunderstand your comment?) – ispiro Apr 2 '15 at 7:41
  • 2
    @ispiro No, it's not malware. They were just setting up lots of fake accounts to spam us. – slhck Apr 2 '15 at 7:42
  • @slhck Oh. OK. Thanks for the super-speedy response! – ispiro Apr 2 '15 at 7:42
  • @slhck Ugh, Brorsoft. I have that one on my list: FFmpeg GPL license violators who try to spam the mailing lists and forum. Some of these same clowns have spammed here at SU too, but I can't recall which. I flagged them and they go away. – llogan Apr 3 '15 at 4:36
  • @slhck: Is it certain that the spam came from Acronis, and not one of their resellers, or possibly someone wanting to ruin their reputation? – Ben Voigt Apr 7 '15 at 22:56
  • @BenVoigt The latter is rather implausible. I don't know about the former, as there is no easy way to tell. – slhck Apr 8 '15 at 4:51
  • As if anyone needs to ruin Acronis' reputation. – Carey Gregory Apr 9 '15 at 18:35
  • Another one for your list: inetfusion is getting a lot of "recommendations". – fixer1234 May 11 '15 at 7:17
  • Another one is spam (which doesn't seem to contain any links - stupid spammers) for "long path tool". Example Source path too long - BUT IT NEVER USED TO BE and superuser.com/a/930344/337631 (already deleted) – DavidPostill Jun 22 '15 at 18:01
  • You may want to add msoutlooktools.com and friends. – Braiam Jul 4 '15 at 20:57
  • Another regular spammer here: vanskeys.com – fixer1234 Aug 17 '15 at 5:00
  • 1
    @DavidPostill: Bear in mind that this answer is community wiki, so feel free to edit it as needed. Just try to be consistent with the formatting. – bwDraco Oct 1 '15 at 17:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .