Tenorshare and affiliates
Data recovery, password recovery, video conversion, and PDF conversion spam. Has various other names such as SmartKey. The scale of the spam and the fact that multiple malware programs have been found on these IP addresses suggest that the conduct originates from a criminal organization.
IP addresses:
Domains:
- tenorshare.com
- advancedpdfconverter.com
- androiddatarecoverypro.com
- any-data-recovery.com
- card-data-recovery.com
- excel-password-recovery.net
- fix-computer.net
- lost-password.net
- lostwindowspassword.com
- macvideoconverterpro.com
- password-master.net
- photorecovery-formac.com
- powerpointpasswordrecovery.net
- rarpasswordunlocker.net
- recover-windows-password.net
- recoverlostpassword.com
- sqlpassword-recovery.com
- windows7-password-reset.net
- windowspasswordcracker.com
- windowspasswordrecovery.net
- windowspasswordreset.net
- windowspasswordsrecovery.com
- wordpassword-recovery.com
- youtubedownloaderconverter.net
Smart PC Fixer/Wise Recovery
Fake system maintenance and tuning software; known adware and scam. Also associated with data recovery spam.
IP addresses:
Domains:
- smartpcfixer.com
- 1fix.org
- cardrecoverypro.com
- drivertuner.com
- easyfix.org
- errorsfixer.org
- faq800.com
- fix1.org
- guru4pc.net
- howto4pc.org
- official-drivers.com
- pceasynow.com
- photorecoverypro.net
- regeasypro.com
- registryware.org
- smartfixer.net
- smartfixer.org
- wisefixer.com
- wisefixer.net
- wiserecovery.com
Password Unlocker
Password recovery spam; also associated with PDF conversion (Nemo PDF) and data recovery (Hodo).
IP addresses:
Domains:
- passwordunlocker.com
- password-unlocker.com
- passwordtech.com
- goshareware.com
- nemopdf.com
Apowersoft
Screenshot and video downloader spam.
IP addresses:
Domains:
- apowersoft.com
- downloadavideo.net
- downloaddailymotion.com
- free-download-youtube.com
- free-music-downloader.com
- screenshot.net
- video-download-capture.com
- videograbber.net
Wasel
VPN client spam. Uses seemingly legitimate blog links to deceive reviewers. Whois information indicates the operator is Michael Maher of iSpire.
IP addresses:
- 95.211.216.155
- 37.48.74.7
- 109.236.83.24
- 173.199.114.19
- 216.155.134.164
- 93.190.137.136
- 67.55.100.153
- 216.155.134.169
Domains:
- wasel.com
- i-spire.com (developer website)
- internetwasel.com
- waselpro.com
- iwasl.com
- vpnfaqs.com
- vpnanswers.com
- bestcheapvpnservice.com
- unblockingtwitter.com
- openingblockedsite.com
- arabicdownloads.com
- arabicsoftdownload.com
Miscellaneous spammers
These domains and products are known to be spam but no further association with the above have presently been identified.
- Windows Password Breaker / Advanced Password Breaker
- recoverwindowspassword.com
- Windows Password Buster
- password-buster.com
- Remo Recover
- remorecover.com
- remosoftware.com
- Note: Spam for this product often does not contain any links, which can make it harder to identify as such.
- Brorsoft
- Preply (language learning spam)
- preply.com