Spyware Sucks
“There is no magic fairy dust protecting Macs" – Dai Zovi, author of “The Mac Hacker’s Handbook"

ALERT: Watch out for Bellas Interactive….

August 3rd 2010 in Uncategorized

Bellas Interactive have been highlighted as attempting to sell malvertizing to Casala Media in two of the most well written articles I have seen about malvertizing in a long time.

Suspected Malvertiser Posting As Legitimate Ad Agency

Anatomy Of An Attempted Malware Scam

 

bellasinteractive.com has not appeared on this blog before, but all of the other domains mentioned in the article and comments, as well as the “trade references” have been mentioned here.

 

bellasinteractive.com
ICANN Registrar: TODAYNIC.COM, INC
Created 6 April 2010

IP: 89.248.162.179 – Ecatel Ltd

Registrant: Jonathan J Kerr (jonathanjkerr@gmail.com)

Shares IP with implantschool.com

*****

implantschool.com
ICANN Registrar: TODAYNIC.COM, INC
Created 29 May 208

Registrant: J.W. Vaartjes (vaartjes@tandarts.nl)

*****

Domains seen in the comments:

ad-amazing.com
ICANN Registrar: BIZCN.COM, INC
Created 3 June 2010

IP: 93.174.92.188

Registrant: Sparkle Coleman (dns@ad-amazing.com)

Reverse DNS for 93.174.92.188 = mail.ptsupport.info

*****

innovyxinc.com
ICANN Registrar: TODAYNIC.COM, INC
Created 13 July 2010

IP: 94.102.55.100 – Ecatel Ltd

Registrant: Mary J Ferree (maryjferree@gmail.com)

*****

Domains of the "Trade References" supplied for bellasinteractive.com:

flamingonetwork.com
ICANN Registrar: BIZCN.COM
Created 12 July 2010

IP: 94.102.55.105 – Ecatel Ltd

Registrant: Registar Services, Harold Pinner (registar@flamingonetwork.com)

*****

mindadsint.com
ICANN Registrar: BIZCN.COM
Created 11 July 2010

IP: 94.102.55.107

Registrant: Registar Services, Sarah Avallone (registar@mindadsint.com)

*****

4revenuegroup.com
ICANN Registrar: BIZCN.COM, INC
Created 11 July 2010

IP: 94.102.55.102

Registrant: 4revenuegroup Contractors, Gerardo Young (it@4revenuegroup.com)

*****

To repeat my earlier advice, please treat domains in the 93.174.92.* and 94.102.55.* IP ranges with extreme caution (especially if they are used to sell advertising).  We should now include domains in the range 89.248.162.* range as well.  Domains in that IP range include the following:

Dealcomltd.com, Idealogisticservices.com, Todaylogisticservices.com, Eu-realestate.com, Kunglconsulting.eu, Clubpenguincoincodes.com, Clubpenguintoolbar.com, Dreggle.com, Iatw.info, Icpwiki.com, Pengcred.com, Alexasn.com, Beline.me, Candykitties.com, Candyloli.com, Clit9.com, Flawless18.com, Yng.me, Travel-key.de, Findperfectdate.com, Findlatinlove.com, Stffrs.com, Usamail4warding.com, 1001freedownloads.eu, 112lesidee.nl, Alex-domein.nl, Badgasten.net, Blackwolfart.eu, Blueprinz.nl, Bluesox.nl, Bottesteyn.nl, Browserupdate.nl, Browserupgrade.nl, Bshosting.eu, Bshosting.nl, Bslroadshow.nl, Budokai-tilburg.nl, Calabro.nl, Chintzhomedesign.com, Colorflame.eu, Compufaq.nl, Comserve.eu, Comserve.nl, Dabbs.nl, Defeber.nl, Designair.nl, Dikkemannen.nl, Disney-world.nl, Download-kazaa.nl, Downloadpunt.nl, Dsrm.info, Dutchflakforce.nl, Evaly.be, Examenstunt.com, Faithfactor.nl, Fijnlijf.com, Fijnlijf.nl, Flevofonds.nl, Flevoplace.com, Frankvanalphen.nl, Fruitmood.com, Frutopedia.com, Gelukslampion.nl, Getfreemusic.nl, Getlivesets.nl, Goedkoopste-epa.nl, Gomeztrading.eu, Goud-inkoop.nl, Grotemannen.nl, Hackersforum.nl, Hosting4every1.nl, Houseofsizes.com, Ilnido.nl, Itassetmanagement.nl, Langemannen.nl, Leer-spaans.nl, Leningstunter.com, Levee.nl, Linewash.com, Luigibruins.nl, M2create.nl, Mad-com.nl, Marenko.com, Marenko.nl, Mikeo.eu, Mobilering.nl, Moendia.nl, Msnweirdmaker.nl, Museumbrouwerij.nl, Muziekschoolheeten.nl, Muziekschoolurk.nl, Ncblog.nl, Nicorp.nl, Nicorpweb.com, Nicorpweb.nl, Onlinestart.be, Pc-xs.nl, Pcflex.nl, Pinglin.nl, Plopke.nl, Porteos.com, Prevanovi.nl, Protwin.nl, Pvmultimedia.nl, Receptenstad.nl, Remember-me.nl, Renltechniek.nl, Rickvm.net, Rings4u.nl, Rings4you.nl, Ronnyvee.nl, Rsg-ivy.nl, Rsgbetafestival.nl, Rsglevant-ivy.nl, Rubenlubben.nl, Sambeekadvies.nl, Sandocms.com, Sandocms.nl, Serverdeals.nl, Shoarmastar.nl, Snetch.net, Sticky-notes.nl, Taalcursusinfo.nl, Tallpersons.nl, Torremandiaz.com, Totaalsupport.com, Twanscare4cars.nl, Vaim.nl, Vakantie-koopje.nl, Verkouwconsultancy.nl, Verschiet.be, Volsmaak.nl, Wanneerhebikvakantie.nl, Webcambabez.eu, Zwollyhud.nl, Ltdcc.com, Oilhost.eu, Oilhost.net, Ugg-outlets.com, Abrahamjohnsex.biz, Cg-models.net, Dreamcaster.info, Elitennsets.com, Fashion-club.net, Finelady.biz, Freennpic.com, Girls-nn.net, Ice-pie.net, Lawrencevillesexchat.info, Little-agency.info, Littlenncuties.com, Lodraw.ru, Magazine-fashion.biz, Mirroroom.info, Natashachatvideo.biz, Nn-artmodels.com, Nn-pics.info, Nn-sites.com, Nndesire.com, Nndream.com, Nnelis.com, Nnjuniormodels.com, No-nude.us, Nonude-models.com, Nonude-pictures.com, Nonude-tgp.com, Nsleep.net, Nudeb.net, Paradise-4u.info, Placenudes.cn, Placesnude.cn, Portaladultchat.biz, Preteenposing.com, Ptl-models.com, Purenudismdata.cn, Purenudismdata.com, School-models.net, Schoolgirl-princess.biz, Schow-star.biz, Sexroomabdelking.info, Supernnpic.com, Terrrosenberg.cn, Tiny-angels.info, Tiny-jewels.com, Web-nymphs.com, Webegirls.biz, Yamodamo.me, Yamodamo.ws, Yomodelsfresh.com, Your-models.net, Your-nn.com, Yourmodel.net, Yournnpic.com, Martinandwilliams.com, Erelias.nl, Bellasinteractive.com, Implantschool.com, Bestdrugsonline.net, Lintasinteractive.com, Doborow.net, Megoko.com, Miacomp.com, Rmf23.org, Vebtrener.net, Vektop.com, Teenochka.com, Fietstracks.nl, Pulsefm.nl, Aquakoktebel.com.ua, Bscmayak.com, Burnlegion.com, Comixplaza.com, Kumuki.com, Magiasna.ru, Maximpolsky.com, Megacomix.ru, Mircomixoff.com, Napaneli.com, Napaneli.com.ua, Rojo.ru, Uamodel.nl, Uamodels.nl, Vn7.ru, Xdosug.com.ua, Xdosug.nl, Xmodel.com.ua, Xmodel.me, Xmodel.mobi, Xmodels.com.ua, Mejac.com, Mesurveyteam.com, Bigeasymovies.com, Ichtrinkepisse.com, Idrinkpiss.com, 3mlive.com, Bathindacity.com, Cybercricket.net, Cyberviewmovies.com, Cyberviewtv.com, Cyberviewtv.org, Hindi-movies.tv, Hotdnsplus.com, Liquidwebhost.net, Livetvbox.tv, Moviesntv.com, Addienstverlening.nl, Adq-design.nl, Adreslabel.nl, Alicesommer.nl, Arnoudvenema.nl, Arriva-noordoostbrabant.nl, Assetsandinvestments.nl, Besthost.nl, Bmdb.nl, Bramvanmensvoort.nl, Byjvo.nl, Cb-ict.nl, Clairo.nl, Cormelis.nl, Country-club.nl, Danspassie.nl, Daros.nl, Debianforum.nl, Degoudenui.nl, Designingmiracles.nl, Dietshop.nl, Diniz.nl, Diptv.nl, Djjumbo.nl, Dreamelements.nl, Edwinjansen.net, Edwinyuen.nl, Fanfare-tog.nl, Flyingstevie.nl, Fraggersforfun.nl, Garagebedrijfrutten.nl, H-1.nl, Hasweb.nl, Jozef-rozenburg.nl, K-group.nl, Kareleneunice.nl, Kljsml.be, Lapergola.nl, Mariakerk-hoogvliet.nl, Mickvandewiel.nl, Mind-x.nl, Modellenbureau-modee.nl, Motortoerclubvlijmen.nl, Nachtjagd.nl, Naturesheaven.nl, Nder.org, Nogzogekniet.nl, Oranjebud.nl, Parochiebredanoord.nl, Pasal.nl, Pinspot.nl, Powerdedi.nl, Rvduivenbode.nl, Schafttijd.nl, Smashradio.nl, Snekjies.nl, Soulfriends.nl, Spacecho.nl, Spartak.nl, Sportreal.nl, Suicide-bunnies.nl, Sursumcorda-aalsmeer.nl, Techno-planet.nl, Theodeveer.nl, Trevorbell.nl, Urbangfx.nl, Vvdekwakkert-heytse.nl, Vvdweststellingwerf.nl, Willibrordus-rhoon.nl, Xbox360team.nl, Yoga-lakshmi.nl, Yotv.nl, Yvettemoshage.nl, Zombio.nl, Zon-it.nl, Zor.in, Zyex.nl


Comments are closed.

Details here: http://www.microsoft.com/technet/security/bulletin/ms10-aug.mspx “This is an advance notification of one out-of-band security bulletin that Microsoft is intending to release on August 2, 2010. The bulletin addresses a security vulnerability in all supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, that […]

Previous Entry

  The source of the “Curves” Creative pictured is Tepuro Advertising.  Their domain, tepuro.com has only been registered since 26 July 2010, and was registered via BIZCN.COM. tepuro.com ICANN Registrar: BIZCN.COM Created 26 July 2010 IP: 63.247.93.29 – Global Net […]

Next Entry

Archives