Latest new rogue found by the guys at Bleeping Computer :
http://www.bleepingcomputer.com/securitybl...ue-antispyware/
QUOTE
Don’t let the name fool you, though, this is just the same old rogue anti-spyware wrapped into a new disguise. VirusBurst is also from the same makers of SpywareQuake, SpyFalcon, SpyAxe, SpywareStrike, etc, etc.
Another Rogue - By AndyAtHull:
http://www.securitycadets.com/2006/09/anot...gue-virusburst/
Also gets a mention from TeMerc:
http://temerc.blogspot.com/2006/08/smithfr...virusburst.html
Thanks to Nick for pointing this out in his latest blog..
http://securityticker.blogspot.com/2006/08...ke-spyware.html
QUOTE
VirusBurst, Another Fake Spyware Program
While I was posting about SiteAdvisor in my earlier posts today, Bleeping Computer announced they found yet another fake antispyware program, VirusBurst. While the name is different, it looks pretty much the same as SpywareQuake to me.
Looking at the registration info for VirusBurst.com, I can see the usual suspect is involved with this site as well. Estdomains is the registration provider. They seem to always be near questionable programs and websites.
Registration Service Provided By: ESTDOMAINS INC
Contact: +1.3027224217
Website: http://www.estdomains.com
Domain Name: VIRUSBURST.COM
Registrant:
Burst Technology GesmbH
Judi Stewart ()
Davidgasse 87
Vienna
null,A-1100
AT
Tel. +431.3365073
Creation Date: 10-Aug-2006
Expiration Date: 10-Aug-2007
I'm sure the above info contains fake information. Most of the time when these rogue programs are registered, the info is not real.
While I was posting about SiteAdvisor in my earlier posts today, Bleeping Computer announced they found yet another fake antispyware program, VirusBurst. While the name is different, it looks pretty much the same as SpywareQuake to me.
Looking at the registration info for VirusBurst.com, I can see the usual suspect is involved with this site as well. Estdomains is the registration provider. They seem to always be near questionable programs and websites.
Registration Service Provided By: ESTDOMAINS INC
Contact: +1.3027224217
Website: http://www.estdomains.com
Domain Name: VIRUSBURST.COM
Registrant:
Burst Technology GesmbH
Judi Stewart ()
Davidgasse 87
Vienna
null,A-1100
AT
Tel. +431.3365073
Creation Date: 10-Aug-2006
Expiration Date: 10-Aug-2007
I'm sure the above info contains fake information. Most of the time when these rogue programs are registered, the info is not real.
A closer look at the domain info reveals that SpywareBurst is directly related to another well known rogue spyware scam known as Spyaxe and various others.
The SpywareBurst domain server tokiodrift.biz is actually a download page for SpyAxe
VIRUSBURST.COM = [ 195.225.177.121 ]
Registration Service Provided By: ESTDOMAINS INC
Contact: 1.3027224217
Website: http://www.estdomains.com
Domain Name: VIRUSBURST.COM
Registrant:
Burst Technology GesmbH
Judi Stewart judi.stewart@gmail.com
Davidgasse 87
Vienna
null A-1100
AT
Tel. 431.3365073
Creation Date: 10-Aug-2006
Expiration Date: 10-Aug-2007
Domain servers in listed order:
ns4.tokiodrift.biz
ns3.tokiodrift.biz
ns2.tokiodrift.biz
ns1.tokiodrift.biz
--
Tokiodrift obviously borrowed from the recent Fast and the Furious movie of the same name , they probably thought it will be a big hit with the kids.. who would suspect spyware from such a cool sounding site like that ??
tokiodrift.biz
195.225.176.68 [no reverse DNS set]
195.225.176.68 (TOKIODRIFT.BIZ)
1. almanah.biz
2. spyaxe.biz
3. spyaxe.com
4. spyaxe.net
5. spywarestrike.com
6. tokiodrift.biz
ns1.tokiodrift.biz = [ 195.225.176.68 ]
Domain Name: TOKIODRIFT.BIZ
Domain ID: D14306663-BIZ
Sponsoring Registrar: ESTDOMAINS INC
Sponsoring Registrar IANA ID: 832
Domain Status: clientTransferProhibited
Registrant ID: DI_3727814
Registrant Name: Joshua Perez
Registrant Organization: Techpeace Ltd
Registrant Address1: Stubenbastei
Registrant City: Wien
Registrant Postal Code: 1010
Registrant Country: Austria
Registrant Country Code: AT
Registrant Phone Number: 431.5127913
Registrant Email: perezjoshu@gmail.com
Name Server: NS1.TOKIODRIFT.BIZ
Name Server: NS2.TOKIODRIFT.BIZ
Name Server: NS3.TOKIODRIFT.BIZ
Name Server: NS4.TOKIODRIFT.BIZ
Created by Registrar: ESTDOMAINS INC
Last Updated by Registrar: ESTDOMAINS INC
Domain Registration Date: Sat Aug 19 07: 59: 17 GMT 2006
Domain Expiration Date: Sat Aug 18 23: 59: 59 GMT 2007
Domain Last Updated Date: Sat Aug 19 09: 34: 52 GMT 2006
Following on from the previous report of new rogue spyware scams that are hosted through ESTdomains and Atrivohell / Intercage / Nlayer gangster network - http://www.bluetack.co.uk/forums/index.php?showtopic=15209
Lets hope the googlebot gets hungry for all these links soon
