# Tenorshare and affiliates
*Data recovery, password recovery, video conversion, and PDF conversion spam. Has various other names such as SmartKey. The scale of the spam and the fact that multiple malware programs have been found on these IP addresses suggest that the conduct originates from a criminal organization.*
**IP addresses:**
- [54.201.153.20][1]
- [184.168.229.155][2]
- [54.69.177.37][3]
- [67.20.74.163][4]
- [50.87.141.154][5]
**Domains:**
- tenorshare.com
- advancedpdfconverter.com
- androiddatarecoverypro.com
- any-data-recovery.com
- card-data-recovery.com
- excel-password-recovery.net
- fix-computer.net
- lost-password.net
- lostwindowspassword.com
- macvideoconverterpro.com
- password-master.net
- photorecovery-formac.com
- powerpointpasswordrecovery.net
- rarpasswordunlocker.net
- recover-windows-password.net
- recoverlostpassword.com
- sqlpassword-recovery.com
- windows7-password-reset.net
- windowspasswordcracker.com
- windowspasswordrecovery.net
- windowspasswordreset.net
- windowspasswordsrecovery.com
- wordpassword-recovery.com
- youtubedownloaderconverter.net
# Smart PC Fixer/Wise Recovery
*Fake system maintenance and tuning software; known adware and scam. Also associated with data recovery spam.*
**IP addresses:**
- [173.192.57.82][6]
**Domains:**
- smartpcfixer.com
- 1fix.org
- cardrecoverypro.com
- drivertuner.com
- easyfix.org
- errorsfixer.org
- faq800.com
- fix1.org
- guru4pc.net
- howto4pc.org
- official-drivers.com
- pceasynow.com
- photorecoverypro.net
- regeasypro.com
- registryware.org
- smartfixer.net
- smartfixer.org
- wisefixer.com
- wisefixer.net
- wiserecovery.com
# Password Unlocker
*Password recovery spam; also associated with PDF conversion (**Nemo PDF**) and data recovery (**Hodo**).*
**IP addresses:**
- [162.144.77.13][7]
- [69.164.205.180][8]
- [162.144.79.192][9]
- [108.178.27.101][10]
**Domains:**
- passwordunlocker.com
- password-unlocker.com
- passwordtech.com
- goshareware.com
- nemopdf.com
# Apowersoft
*Screenshot and video downloader spam.*
**IP addresses:**
- [67.222.52.38][11]
- [67.20.89.96][12]
- [74.86.5.247][13]
- [192.163.229.63][14]
**Domains:**
- apowersoft.com
- downloadavideo.net
- downloaddailymotion.com
- free-download-youtube.com
- free-music-downloader.com
- screenshot.net
- video-download-capture.com
- videograbber.net
# Wasel
*VPN client spam. Uses seemingly legitimate blog links to deceive reviewers. Whois information indicates the operator is **Michael Maher** of **iSpire**.*
**IP addresses:**
- [95.211.216.155][15]
- [37.48.74.7][16]
- [109.236.83.24][17]
- [173.199.114.19][18]
- [216.155.134.164][19]
- [93.190.137.136][20]
- [67.55.100.153][21]
- [216.155.134.169][22]
**Domains:**
- wasel.com
- i-spire.com (*developer website*)
- internetwasel.com
- waselpro.com
- iwasl.com
- vpnfaqs.com
- vpnanswers.com
- bestcheapvpnservice.com
- unblockingtwitter.com
- openingblockedsite.com
- arabicdownloads.com
- arabicsoftdownload.com
---
# Repair Toolbox
*Office document data recovery recovery spam. Uses a seemingly valid question to disguise activity, then posts an answer using a different account promoting the product. An example question follows:*
> ## How to repair Corrupt MS Excel file?
>
> How to repair and recover corrupt MS excel file? I am unable to open corrupt MS Excel file due to virus infected, I have crucial Workbook sheet got lost, so how to get back corrupted MS Excel file. Please help me.
**IP addresses:**
- [192.185.37.236][23]
**Domains**
*This list is non-exhaustive due to the extremely large number of domains associated with the above IP address.*
- *.repairtoolbox.com
- *.fixtoolbox.com
- [*document file extension*].repair
- [*document type*]repairtoolbox.com (any domain which ends with this string)
- all-recovery-inc.com
---
# Miscellaneous spammers
*These domains and products are known to be spam but no further association with the above have presently been identified.*
- Long Path Tool
- Usually does not post a link; just mentions the program by name.
- Windows Password Breaker / Advanced Password Breaker
- recoverwindowspassword.com
- Windows Password Buster
- password-buster.com
- Remo Recover
- remorecover.com
- remosoftware.com
- *Note:* Spam for this product often does not contain any links, which can make it harder to identify as such.
- Brorsoft
- Pavtube
- Appears to be related to Brorsoft (see [1][24], [2][25]; further investigation needed)
- Includes DVDAid, BDMagic, and Handbraker (notice that the latter has an intentionally confusing name)
- Preply (language learning spam)
- preply.com
- Open File Tool (solutions for the recovery of corrupted files for many different file types)
- openfiletool.com (208.76.175.50)
- Krojamsoft
- Usually does not post a link; just mentions the program (Batch Rename) by name.
---
# Blog Spammers
Spam has links to blogs containing affiliate links to paid products.
- removeunwantedprograms.wordpress.com
- Contains affiliate links to revouninstallerpro.com and mackeeperapp.mackeeper.com
[1]: https://www.virustotal.com/en/ip-address/54.201.153.20/information/
[2]: https://www.virustotal.com/en/ip-address/184.168.229.155/information/
[3]: https://www.virustotal.com/en/ip-address/54.69.177.37/information/
[4]: https://www.virustotal.com/en/ip-address/67.20.74.163/information/
[5]: https://www.virustotal.com/en/ip-address/50.87.141.154/information/
[6]: https://www.virustotal.com/en/ip-address/173.192.57.82/information/
[7]: https://www.virustotal.com/en/ip-address/162.144.77.13/information/
[8]: https://www.virustotal.com/en/ip-address/69.164.205.180/information/
[9]: https://www.virustotal.com/en/ip-address/162.144.79.192/information/
[10]: https://www.virustotal.com/en/ip-address/108.178.27.101/information/
[11]: https://www.virustotal.com/en/ip-address/67.222.52.38/information/
[12]: https://www.virustotal.com/en/ip-address/67.20.89.96/information/
[13]: https://www.virustotal.com/en/ip-address/74.86.5.247/information/
[14]: https://www.virustotal.com/en/ip-address/192.163.229.63/information/
[15]: https://www.virustotal.com/en/ip-address/95.211.216.155/information/
[16]: https://www.virustotal.com/en/ip-address/37.48.74.7/information/
[17]: https://www.virustotal.com/en/ip-address/109.236.83.24/information/
[18]: https://www.virustotal.com/en/ip-address/173.199.114.19/information/
[19]: https://www.virustotal.com/en/ip-address/216.155.134.164/information/
[20]: https://www.virustotal.com/en/ip-address/93.190.137.136/information/
[21]: https://www.virustotal.com/en/ip-address/67.55.100.153/information/
[22]: https://www.virustotal.com/en/ip-address/216.155.134.169/information/
[23]: https://www.virustotal.com/en/ip-address/192.185.37.236/information/
[24]: https://www.virustotal.com/en/ip-address/173.193.175.141/information/
[25]: https://www.virustotal.com/en/ip-address/184.172.39.195/information/