### Tenorshare and affiliates

*Data recovery, password recovery, video conversion, and PDF conversion spam. Has various other names such as SmartKey. Considering the scale of the spam and the fact that multiple malware programs have been found on these IP addresses, it is probable that this is a criminal organization.*

**IP addresses:** 

- [54.201.153.20][1]
- [184.168.229.155][2]
- [54.69.177.37][3]
- [67.20.74.163][4]
- [50.87.141.154][5]

**Domains:**

- tenorshare.com
- advancedpdfconverter.com
- androiddatarecoverypro.com
- any-data-recovery.com
- card-data-recovery.com
- excel-password-recovery.net
- fix-computer.net
- lost-password.net
- lostwindowspassword.com
- macvideoconverterpro.com
- password-master.net
- photorecovery-formac.com
- powerpointpasswordrecovery.net
- rarpasswordunlocker.net
- recover-windows-password.net
- recoverlostpassword.com
- sqlpassword-recovery.com
- windows7-password-reset.net
- windowspasswordcracker.com
- windowspasswordrecovery.net
- windowspasswordreset.net
- windowspasswordsrecovery.com
- wordpassword-recovery.com
- youtubedownloaderconverter.net

### Smart PC Fixer/Wise Recovery

*Fake system maintenance and tuning software; known adware and scam. Also associated with data recovery spam.*

**IP addresses:**

- [173.192.57.82][6]

**Domains:**

- smartpcfixer.com
- 1fix.org
- cardrecoverypro.com
- drivertuner.com
- easyfix.org
- errorsfixer.org
- faq800.com
- fix1.org
- guru4pc.net
- howto4pc.org
- official-drivers.com
- pceasynow.com
- photorecoverypro.net
- regeasypro.com
- registryware.org
- smartfixer.net
- smartfixer.org
- wisefixer.com
- wisefixer.net
- wiserecovery.com

### Password Unlocker

*Password recovery spam; also associated with PDF conversion (**Nemo PDF**) and data recovery (**Hodo**).*

**IP addresses:**

- [162.144.77.13][7]
- [69.164.205.180][8]
- [162.144.79.192][9]
- [108.178.27.101][10]

**Domains:**

- passwordunlocker.com
- password-unlocker.com
- passwordtech.com
- goshareware.com
- nemopdf.com


  [1]: https://www.virustotal.com/en/ip-address/54.201.153.20/information/
  [2]: https://www.virustotal.com/en/ip-address/184.168.229.155/information/
  [3]: https://www.virustotal.com/en/ip-address/54.69.177.37/information/
  [4]: https://www.virustotal.com/en/ip-address/67.20.74.163/information/
  [5]: https://www.virustotal.com/en/ip-address/50.87.141.154/information/
  [6]: https://www.virustotal.com/en/ip-address/173.192.57.82/information/
  [7]: https://www.virustotal.com/en/ip-address/162.144.77.13/information/
  [8]: https://www.virustotal.com/en/ip-address/69.164.205.180/information/
  [9]: https://www.virustotal.com/en/ip-address/162.144.79.192/information/
  [10]: https://www.virustotal.com/en/ip-address/108.178.27.101/information/