Tenorshare and affiliates
Data recovery, password recovery, video conversion, and PDF conversion spam. Has various other names such as SmartKey. The scale of the spam and the fact that multiple malware programs have been found on these IP addresses suggest that the conduct originates from a criminal organization.
IP addresses:
Domains:
- tenorshare.com
- advancedpdfconverter.com
- androiddatarecoverypro.com
- any-data-recovery.com
- card-data-recovery.com
- excel-password-recovery.net
- fix-computer.net
- lost-password.net
- lostwindowspassword.com
- macvideoconverterpro.com
- password-master.net
- photorecovery-formac.com
- powerpointpasswordrecovery.net
- rarpasswordunlocker.net
- recover-windows-password.net
- recoverlostpassword.com
- sqlpassword-recovery.com
- windows7-password-reset.net
- windowspasswordcracker.com
- windowspasswordrecovery.net
- windowspasswordreset.net
- windowspasswordsrecovery.com
- wordpassword-recovery.com
- youtubedownloaderconverter.net
Smart PC Fixer/Wise Recovery
Fake system maintenance and tuning software; known adware and scam. Also associated with data recovery spam.
IP addresses:
Domains:
- smartpcfixer.com
- 1fix.org
- cardrecoverypro.com
- drivertuner.com
- easyfix.org
- errorsfixer.org
- faq800.com
- fix1.org
- guru4pc.net
- howto4pc.org
- official-drivers.com
- pceasynow.com
- photorecoverypro.net
- regeasypro.com
- registryware.org
- smartfixer.net
- smartfixer.org
- wisefixer.com
- wisefixer.net
- wiserecovery.com
Password Unlocker
Password recovery spam; also associated with PDF conversion (Nemo PDF) and data recovery (Hodo).
IP addresses:
Domains:
- passwordunlocker.com
- password-unlocker.com
- passwordtech.com
- goshareware.com
- nemopdf.com
Apowersoft
Screenshot and video downloader spam.
IP addresses:
Domains:
- apowersoft.com
- downloadavideo.net
- downloaddailymotion.com
- free-download-youtube.com
- free-music-downloader.com
- screenshot.net
- video-download-capture.com
- videograbber.net
Wasel
VPN client spam. Uses seemingly legitimate blog links to deceive reviewers. Whois information indicates the operator is Michael Maher of iSpire.
IP addresses:
- 95.211.216.155
- 37.48.74.7
- 109.236.83.24
- 173.199.114.19
- 216.155.134.164
- 93.190.137.136
- 67.55.100.153
- 216.155.134.169
Domains:
- wasel.com
- i-spire.com (developer website)
- internetwasel.com
- waselpro.com
- iwasl.com
- vpnfaqs.com
- vpnanswers.com
- bestcheapvpnservice.com
- unblockingtwitter.com
- openingblockedsite.com
- arabicdownloads.com
- arabicsoftdownload.com
Repair Toolbox
Office document data recovery recovery spam. Uses a seemingly valid question to disguise activity, then posts an answer using a different account promoting the product. An example question follows:
How to repair Corrupt MS Excel file?
How to repair and recover corrupt MS excel file? I am unable to open corrupt MS Excel file due to virus infected, I have crucial Workbook sheet got lost, so how to get back corrupted MS Excel file. Please help me.
IP addresses:
Domains
This list is non-exhaustive due to the extremely large number of domains associated with the above IP address.
- *.repairtoolbox.com
- *.fixtoolbox.com
- [document file extension].repair
- [document type]repairtoolbox.com (any domain which ends with this string)
- all-recovery-inc.com
Miscellaneous spammers
These domains and products are known to be spam but no further association with the above have presently been identified.
- Long Path Tool
- Usually does not post a link; just mentions the program by name.
- Windows Password Breaker / Advanced Password Breaker
- recoverwindowspassword.com
- Windows Password Buster
- password-buster.com
- Remo Recover
- remorecover.com
- remosoftware.com
- Note: Spam for this product often does not contain any links, which can make it harder to identify as such.
- Brorsoft
- Pavtube
- Preply (language learning spam)
- preply.com
- Open File Tool (solutions for the recovery of corrupted files for many different file types)
- openfiletool.com (208.76.175.50)
