Tuesday, July 30, 2019

Profiling "Innovative Marketing" - The Flagship Malvertising andf Scareware Distributor - Circa 2008 - An OSINT Analysis

Continuing the "FBI Most Wanted Cybercriminals" series I've decided to take a closer look at "Innovative Marketing" the primary malvertising and scareware distributor participating in several high-profile malvertising and scareware-serving campaigns circa 2008 including personally identifiable information on two of the main group operators - Shaileshkumar P. Jain and Bjorn Daniel Sundin with the idea to provide law enforcement and the U.S Intelligence community with the necessary information to track down and prosecute the gang behind these campaigns.

In this post I'll profile actionable intelligence on the infrastructure behind the "Innovative Marketing" malvertising and scareware distributor circa 2008 including personally identifiable information on two of the key members of the gang.

Known "Innovative Marketing" alternative brand names and related associates:
Billingnow
BillPlanet PTE Ltd.
Globedat
Innovative Marketing Ukraine
Revenue Response
Sunwell
Synergy Software BV
Winpayment
Consultancy SPC
Winsecure Solutions,
Winsolutions FZ-LLC
ByteHosting Internet Services, LLC
Setupahost.net

Known related campaigns and related brands launched by the same group:
BurnAds
UniqAds
Infyte
NetMediaGroup
ForceUp

Related malicious and fraudulent domains known to have participated in the campaign:
hxxp://ad2cash.net 
hxxp://adtraff.com 
hxxp://adzyclon.com 
hxxp://bestadmedia.com
hxxp://bestsearchnet.com 
hxxp://bucksbill.com 
hxxp://burnads.com 
hxxp://casinoaceking.com 
hxxp://cryptdrive.com 
hxxp://fileprotector.com 
hxxp://forceup.com 
hxxp://freetvnow.net 
hxxp://fulsearch.com 
hxxp://getfreecar.com 
hxxp://greyhathosting.com

Related malicious and fraudulent domains known to have participated in the campaign:
hxxp://installprovider.com 
hxxp://libresystm.com 
hxxp://magicsearcher.com 
hxxp://moneypalacecash.com 
hxxp://myhealth-life.org 
hxxp://myonlinefinance.com 
hxxp://netmediagroup.net 
hxxp://netturbopro.com 
hxxp://newbieadguide.com 
hxxp://pcsupercharger.com 
hxxp://popsmedia.com 
hxxp://popupnukerpro.com 
hxxp://prizesforyou.com 
hxxp://searchcolours.com 
hxxp://searchoperation.com 
hxxp://sellmoresoft.net 
hxxp://sellmysoft.net 
hxxp://sharpadverts.com 
hxxp://softwcs.com 
hxxp://tallgrass-seach.com 
hxxp://theringtonesource.com 
hxxp://traffalo.com 
hxxp://unicsearch.com 
hxxp://uniqads.com 
hxxp://vitecmedia.com 
hxxp://wewillfind.com 
hxxp://windefender.com 
hxxp://workhomecenter.com 
hxxp://yourseeker.com 
hxxp://yourteacheronline.com 
hxxp://zappinads.com

Related scareware products known to have been sold and distributed by "Innovative Marketing":
SpyGuarder
SpyKiller Pro
Spyware Sweeper
SpywareIsolator
SwiftCleaner
SystemDoctor
SystemErrorFixer
SystemSweeper
TotalAntivirus
Trasheraser
Trustedprotecion
UltimateCleaner
VirusRemover 2008
WinAntiSpyware
WinAntiVirusPro
WinBugFixer
WinDefender2008
WinFixer
Winsecureav
WinSpyware Protect
WinxDefender
XLifeGuarder
XP AntiSpyware 2009
XP AntiVirus

Related domains known to have participated in the campaign:
hxxp://acchiappavirus.com
hxxp://adiosvirus.com
hxxp://ahorrememoria.com
hxxp://altalimpeza.com
hxxp://anonimutente.com
hxxp://ad2cash.net
hxxp://ad2profit.com
hxxp://adcomatoz.com
hxxp://adgurman.com
hxxp://adhokuspokus.com
hxxp://adnetserver.com
hxxp://ad2profit.com
hxxp://adcomatoz.com
hxxp://adgurman.com
hxxp://adhokuspokus.com
hxxp://adnetserver.com
hxxp://adredired.com
hxxp://adsolutio.com
hxxp://adtraff.com
hxxp://adverdaemon.com
hxxp://adverlounge.com
hxxp://adzyclon.com
hxxp://adredired.com
hxxp://adsolutio.com
hxxp://adtraff.com
hxxp://adverdaemon.com
hxxp://adverlounge.com
hxxp://adzyclon.com
hxxp://alg-search.com
hxxp://alhoster.com
hxxp://aligarx.biz
hxxp://all-search-it.com
hxxp://alphatown.us
hxxp://anmira.info
hxxp://anonymbrowser.com
hxxp://antivirussecuritypro.com
hxxp://aptprog.com
hxxp://art-earn.biz
hxxp://astalaprofit.com
hxxp://antiamenazas.com
hxxp://antiespiamaestro.com
hxxp://antievidence.com
hxxp://antispionimaestro.com
hxxp://antispywareconductor.com
hxxp://antispywarecontrol.com
hxxp://antispywaremaster.com
hxxp://antispywaremeister.com
hxxp://antivirusfiable.com
hxxp://antivirusforall.com
hxxp://antivirusforalla.com
hxxp://antivirusforalle.com
hxxp://antivirusfueralle.com
hxxp://antivirusgenial.com
hxxp://antivirusmagique.com
hxxp://antivirusparatodos.com
hxxp://anzentsuru.com
hxxp://apagahistorico.com
hxxp://apolloantivirus.com
hxxp://antivirussecuritypro.com
hxxp://astalaprofit.com
hxxp://b2adz.com
hxxp://bestadmedia.com
hxxp://bestpharmacydeals.com
hxxp://archivosenestado.com
hxxp://atemaiserro.com
hxxp://atrapavirus.com
hxxp://aucunchoixpourvirus.com
hxxp://aucunefaute.com
hxxp://aucuninfection.com
hxxp://aucunmenace.com
hxxp://aucunserreurs.com
hxxp://avcompleto.com
hxxp://autodealer-search.com
hxxp://b2adz.com
hxxp://bazaard.com
hxxp://belkran.com
hxxp://belshar.com
hxxp://bestadmedia.com
hxxp://avsecurityplus.com
hxxp://avseguro.com
hxxp://bandoaivirus.com
hxxp://bandoalleinfezioni.com
hxxp://barreraintegral.com
hxxp://bastioneantivirus.com
hxxp://beskyttelseonline.com
hxxp://beskyttendevaerktoj.com
hxxp://bestsellerantivirus.com
hxxp://best-biznes.info
hxxp://best-cools.info
hxxp://bestdatafinder.com
hxxp://besteversearch.com
hxxp://bestpharmacydeals.com
hxxp://best-screensavers.biz
hxxp://bestsearchnet.com
hxxp://bestshopz.com
hxxp://bestsearchnet.com
hxxp://bestshopz.com
hxxp://bestwnvmovies.com
hxxp://bizadverts.com
hxxp://bizmarketads.com
hxxp://bestwm.info
hxxp://bestwnvmovies.com
hxxp://bezzz.info
hxxp://bi-bi-search.com
hxxp://bizadverts.com
hxxp://bizmarketads.com
hxxp://blessedads.com
hxxp://bm-redy.com
hxxp://bovavi.com
hxxp://brandmarketads.com
hxxp://blanchdisc.com
hxxp://borresuspasos.com
hxxp://bossedeserreurs.com
hxxp://brossedesfautes.com
hxxp://bugseraser.com
hxxp://blessedads.com
hxxp://brandmarketads.com
hxxp://bucksinsoft.com
hxxp://burnads.com
hxxp://cancerno.com
hxxp://bucksinsoft.com
hxxp://burnads.com
hxxp://cancerno.com
hxxp://candid-search.com
hxxp://carpropane.com
hxxp://caiforavirus.com
hxxp://ceroamenazas.com
hxxp://cerovirus.com
hxxp://chasseurdeserreures.com
hxxp://cleanerpotente.com
hxxp://cashloanprofit.com
hxxp://casinoaceking.com
hxxp://casinodealsgalore.com
hxxp://cheap-auto-deals.com
hxxp://cashloanprofit.com
hxxp://casinoaceking.com
hxxp://casinoby.com
hxxp://casinodealsgalore.com
hxxp://cleanpctool.com
hxxp://cleanuptool.com
hxxp://confidentsurf.com
hxxp://confidentuser.com
hxxp://contenidoseguros.com
hxxp://clubheat.info
hxxp://come-from-stars.com
hxxp://co-search.com
hxxp://creamme.net
hxxp://cryptdrive.com
hxxp://contenteraser.com
hxxp://controledemenaces.com
hxxp://controlloreprivacy.com
hxxp://curerrores.com
hxxp://cyndyk.info
hxxp://deuscleanerpay.com
hxxp://didosearch.com
hxxp://diphelp.biz
hxxp://dmitry-v.info
hxxp://doma2000.com
hxxp://dataconfidentiality.com
hxxp://defensaantivirus.com
hxxp://defensecelebre.com
hxxp://defensededriver.com
hxxp://defensedinformation.com
hxxp://defensedudisque.com
hxxp://defensenetsurfage.com
hxxp://defensivesystem.com
hxxp://dejitarufukugen.com
hxxp://dejitarukyoikira.com
hxxp://dejitaruwakuchin.com
hxxp://detapurotekuta.com
hxxp://detaripea.com
hxxp://detectaerrores.com
hxxp://discoseguro.com
hxxp://diskassistent.com
hxxp://diskretter.com
hxxp://disksaeuberung.com
hxxp://disksizesaver.com
hxxp://disksparare.com
hxxp://disukushuri.com
hxxp://doubledefender.com
hxxp://driversecurise.com
hxxp://einwandfreierpc.com
hxxp://eliminadordeamenazas.com
hxxp://elmejorantivirus.com
hxxp://durtsev.com
hxxp://easybestdeals.com
hxxp://energostroj.com
hxxp://enothost.com
hxxp://eroticabsolute.com
hxxp://emperahogo.com
hxxp://enmiendaerrores.com
hxxp://equipoantiespia.com
hxxp://eracheisa.com
hxxp://erasutoppu.com
hxxp://erreurchasseur.com
hxxp://errorfighter.com
hxxp://essentialeraser.com
hxxp://expertdantispyware.com
hxxp://errordigger.com
hxxp://errorinspector.com
hxxp://evrogame.info
hxxp://fandasearch.com
hxxp://fantazybill.com
hxxp://exterminadordevirus.com
hxxp://extremuclean.com
hxxp://fairukyua.com
hxxp://feilvakt.com
hxxp://fejlfripc.com
hxxp://fantazybill.com
hxxp://favouriteshop.com
hxxp://fileprotector.com
hxxp://forceup.com
hxxp://freepcsecure.com
hxxp://fastwm.info
hxxp://fastzetup.info
hxxp://fati-gati-search.com
hxxp://favourable-search.com
hxxp://favouriteshop.com
hxxp://feel-search.com
hxxp://f-host.net
hxxp://fifaallchamp.com
hxxp://fight-arts.com
hxxp://fejlreparering.com
hxxp://felfixare.com
hxxp://ferramentadesolucao.com
hxxp://ferramentasegura.com
hxxp://festplattencleaner.com
hxxp://festplattentool.com
hxxp://fiksdinpc.com
hxxp://filtredetraces.com
hxxp://filtrototal.com
hxxp://fileprotector.com
hxxp://findbyall.com
hxxp://firstbestsearch.com
hxxp://firstlastsearch.com
hxxp://first-ts.com
hxxp://fixthemnow.com
hxxp://fjernervirus.com
hxxp://foutenwacht.com
hxxp://geheugenredder.com
hxxp://foamplastic.net
hxxp://fokus-search.com
hxxp://force-search.com
hxxp://forceup.com
hxxp://forex-instruments.info
hxxp://forceup.com
hxxp://forvatormail.com
hxxp://freepcsecure.com
hxxp://freerepair.org
hxxp://freetvnow.net
hxxp://friedads.com
hxxp://freetvnow.net
hxxp://friedads.com
hxxp://getfreecar.com
hxxp://glorymarkets.com
hxxp://great4mac.com
hxxp://greyhathosting.com
hxxp://fulsearch.com
hxxp://getfreecar.com
hxxp://gibdd.us
hxxp://glass-search.com
hxxp://glorymarkets.com
hxxp://gosthost.net
hxxp://great4mac.com
hxxp://greyhathosting.com
hxxp://gt-search.com
hxxp://hackerpro.us
hxxp://hardlinecenter.com
hxxp://guardiandelaprivacidad.com
hxxp://guardianodelpc.com
hxxp://gubbishremover.com
hxxp://hackerstaisaku.com
hxxp://hadodoraibugado.com
hxxp://harddriveguard.com
hxxp://herramientasegura.com
hxxp://historialout.com
hxxp://hebooks-service.com
hxxp://iddqdmarketing.com
hxxp://infyte.com
hxxp://installprovider.com
hxxp://hebooks-service.com
hxxp://hintway-international.com
hxxp://homeofsite.com
hxxp://hromeos.com
hxxp://hyip2all.org
hxxp://hotbevakning.com
hxxp://ingavirus.com
hxxp://ingenmulighetforvirus.com
hxxp://inhaltsaeuberung.com
hxxp://icq-lot.org
hxxp://iddqdmarketing.com
hxxp://ideal-search.com
hxxp://idea-rem.com
hxxp://i-forexbank.biz
hxxp://infyte.com
hxxp://inhaltspeicher.com
hxxp://inmunepc.com
hxxp://kakujitsutsuru.com
hxxp://keinespurenlassen.com
hxxp://keineviren.com
hxxp://initial-search.com
hxxp://insochi2014.com
hxxp://installprovider.com
hxxp://internetadaultfriend.com
hxxp://internetadaultfriend.com
hxxp://internetanonymizer.com
hxxp://intervarioclick.com
hxxp://invulnerableads.com
hxxp://internetanonymizer.com
hxxp://internetsupernanny.com
hxxp://intervarioclick.com
hxxp://investmentsgroup.org
hxxp://invulnerableads.com
hxxp://it-translation.biz
hxxp://izol-tech.com
hxxp://kamerton-tests.com
hxxp://kazilkasearch.com
hxxp://keytooday.com
hxxp://keywordcpv.com
hxxp://kiridi.net
hxxp://kpoba.net
hxxp://kurgan45.info
hxxp://keywordcpv.com
hxxp://libresystm.com
hxxp://luckyadcoin.com
hxxp://luckyadsols.com
hxxp://magicsearcher.com
hxxp://knowhowprotection.com
hxxp://konsekiauto.com
hxxp://kontentsufiruta.com
hxxp://kurinkonseki.com
hxxp://kyoiireza.com
hxxp://kyoikanshi.com
hxxp://kyoryokucleaner.com
hxxp://largavidapc.com
hxxp://laufwerkcleaner.com
hxxp://limpiapc.com
hxxp://ladadc.com
hxxp://lanastyle.com
hxxp://ldizain.info
hxxp://libresystm.com
hxxp://liders.biz
hxxp://linii.net
hxxp://prevedmarketing
hxxp://malware-scan.com
hxxp://limpietodo.com
hxxp://lomejorenantivirus.com
hxxp://longlifepc.com
hxxp://lungavitapc.com
hxxp://maechtigerreiniger.com
hxxp://liveclix.net
hxxp://loffersearch.com
hxxp://londasearch.com
hxxp://lovecraft-forum.net
hxxp://loveopen.info
hxxp://lseom.biz
hxxp://luckyadcoin.com
hxxp://luckyadsols.com
hxxp://mad-search.com
hxxp://magicsearcher.com
hxxp://mailcap.info
hxxp://manage-search.com
hxxp://marketingdungeon.com
hxxp://mass-send.com
hxxp://max-expo.net
hxxp://malwareschutz.com
hxxp://manutencaopc.com
hxxp://memorisebu.com
hxxp://menacecontrole.com
hxxp://menacefighter.com
hxxp://maxyanoff.com
hxxp://mediatornado.com
hxxp://mega-project.biz
hxxp://megashopcity.com
hxxp://mightyfaq.com
hxxp://menacemonitor.com
hxxp://menacescrubber.com
hxxp://menacesprotection.com
hxxp://miavcompleto.com
hxxp://mightycleaner.com
hxxp://minnesparere.com
hxxp://monitordeamenazas.com
hxxp://moteurpcpro.com
hxxp://moneypalacecash.com
hxxp://mounthost.net
hxxp://myfavouritesearch.com
hxxp://myhealth-life.org
hxxp://mycontentassistant.com
hxxp://netsurfageassure.com
hxxp://nettoyeurdepc.com
hxxp://nettoyeurdeserreures.com
hxxp://myfavouritesearch.com
hxxp://myhealth-life.org
hxxp://myonlinefinance.com
hxxp://mysurvey4u.com
hxxp://myonlinefinance.com
hxxp://mysurvey4u.com
hxxp://mythmarketing.com
hxxp://mytravelgeek.com
hxxp://mythmarketing.com
hxxp://mytravelgeek.com
hxxp://netmediagroup.net
hxxp://netturbopro.com
hxxp://onestopshopz.com
hxxp://myusefulsearch.com
hxxp://napol.net
hxxp://navygante.com
hxxp://netmediagroup.net
hxxp://netturbopro.com
hxxp://netmediagroup.net
hxxp://nettoyeurdevirus.com
hxxp://nettoyeurpuissant.com
hxxp://neuerantivirus.com
hxxp://neuerschild.com
hxxp://newbieadguide.com
hxxp://nryb.com
hxxp://of-by.info
hxxp://olgalml.com
hxxp://ol-search.com
hxxp://onedaysoft.com
hxxp://nientetracce.com
hxxp://nouvelantivirus.com
hxxp://nurdeinpc.com
hxxp://ohnespurensurfen.com
hxxp://omelhorantivirus.com
hxxp://onlinehelpmate.com
hxxp://onlineverktyg.com
hxxp://onrainpurotekuta.com
hxxp://onestopshopz.com
hxxp://onwey.com
hxxp://opensols.com
hxxp://original-search.com
hxxp://osetua.com
hxxp://osminog.org
hxxp://opensols.com
hxxp://pcsoftw.com
hxxp://pcsupercharger.com
hxxp://popadprovider.com
hxxp://popsmedia.com
hxxp://ordureffaceur.com
hxxp://oruripea.com
hxxp://pasderreurs.com
hxxp://pasdesfautes.com
hxxp://pasdesmenaces.com
hxxp://parischat.org
hxxp://passwordinspector.com
hxxp://pcsoftw.com
hxxp://pcsupercharger.com
hxxp://pasendommagement.com
hxxp://pasplusdespertes.com
hxxp://pasplusdevirus.com
hxxp://pcantiviruspro.com
hxxp://pcassertor.com
hxxp://pcbewaker.com
hxxp://pcboosterpro.com
hxxp://pcbunan.com
hxxp://pceternel.com
hxxp://pcforfender.com
hxxp://pchealthkeeper.com
hxxp://pchjaelper.com
hxxp://pcinforedder.com
hxxp://pclibredevirus.com
hxxp://pcohnespuren.com
hxxp://pcredskab.com
hxxp://pcsansbug.com
hxxp://pcsecuresystem.com
hxxp://pcsecurise.com
hxxp://pcsentineru.com
hxxp://pcsiemprenueva.com
hxxp://pctoolpro.com
hxxp://pcultralimpia.com
hxxp://pcveiligheidstool.com
hxxp://pcvirussweeper.com
hxxp://perfektantivirus.com
hxxp://personalityprotector.com
hxxp://poseidonantivirus.com
hxxp://poupememoria.com
hxxp://performanceoptimizer.com
hxxp://piramidki.com
hxxp://podelkin.info
hxxp://popadprovider.com
hxxp://popsmedia.com
hxxp://popupnukerpro.com
hxxp://prenetsearch.com
hxxp://prevedmarketing.com
hxxp://prizesforyou.com
hxxp://r2d2adverising.com
hxxp://popupnukerpro.com
hxxp://postcity.info,
hxxp://prenetsearch.com,
hxxp://prevedmarketing.com,
hxxp://prizesforyou.com,
hxxp://preservingtool.com
hxxp://privacidadconductor.com
hxxp://privacidadgarantizada.com
hxxp://privacidadyseguridad.com
hxxp://privacyredder.com
hxxp://privacywaker.com
hxxp://privacywarrior.com
hxxp://privatsicherer.com
hxxp://protecaoconfiavel.com
hxxp://proteccionasegurada.com
hxxp://proteccioncompleta.com
hxxp://pro-dom.info
hxxp://propotolok.info
hxxp://pro-svet.info
hxxp://r2d2adverising.com
hxxp://radiosfera.net
hxxp://proteccionimperial.com
hxxp://protecteurdinfo.com
hxxp://protectionassuree.com
hxxp://protectionconue.com
hxxp://protectiondedriver.com
hxxp://protectiondenetsurfage.com
hxxp://proteggidati.com
hxxp://protezioneesperta.com
hxxp://protezionefidata.com
hxxp://pulituraestrema.com
hxxp://puraibashihosho.com
hxxp://puraibashimaneja.com
hxxp://puraibashitoshinrai.com
hxxp://rendimientototal.com
hxxp://rensanu.com
hxxp://reparaerrores.com
hxxp://reparateurdesysteme.com
hxxp://repareja.com
hxxp://reparemenaces.com
hxxp://repareya.com
hxxp://rimuoviciarpame.com
hxxp://riparaminacce.com
hxxp://riparasubito.com
hxxp://riservatezzanet.com
hxxp://safeharddrive.com
hxxp://safepctool.com
hxxp://rocktheads.com
hxxp://roller-search.com
hxxp://rombic-search.com
hxxp://searchcolours.com
hxxp://sellmoresoft.com
hxxp://rocktheads.com
hxxp://roller-search.com
hxxp://rombic-search.com
hxxp://rus-invest.net
hxxp://rusnets.info
hxxp://russia-post.com
hxxp://sajruen.info
hxxp://samson-pro.com
hxxp://sauni.net
hxxp://se7ensearch.com
hxxp://safudaijoubu.com
hxxp://salvaspaziosudisco.com
hxxp://sansendommagement.com
hxxp://sansinfections.com
hxxp://sayonarabaggu.com
hxxp://schijfbewaker.com
hxxp://schijfcontroleur.com
hxxp://schijfredder.com
hxxp://schijfruimteredder.com
hxxp://schutzderdaten.com
hxxp://schutzfuerpc.com
hxxp://secretissimosoft.com
hxxp://secretopertutti.com
hxxp://secretosasalvo.com
hxxp://secretoseguro.com
hxxp://securepccleaner.com
hxxp://sefunahimitsu.com
hxxp://sekretessforsvarare.com
hxxp://senzadoppioni.com
hxxp://shingaidome.com
hxxp://shinraihogo.com
hxxp://selvascreensaver.com
hxxp://sharpadverts.com
hxxp://shivanetworking.com
hxxp://shopshot.com
hxxp://softwcs.com
hxxp://shinraipafomansu.com
hxxp://shisutemudifensu.com
hxxp://sichererantivirus.com
hxxp://sichererschutz.com
hxxp://sicherheitstool.com
hxxp://sikkerbrukere.com
hxxp://sikkerpcredskap.com
hxxp://sikkersystem.com
hxxp://sinataques.com
hxxp://sinrrastros.com
hxxp://sinsenales.com
hxxp://sistemaprotegido.com
hxxp://sistemupyua.com
hxxp://sisutemuantei.com
hxxp://sisutemuorugurin.com
hxxp://skyddsprogram.com
hxxp://smittfri.com
hxxp://solelunaantivirus.com
hxxp://speichertool.com
hxxp://spyguardpro.com
hxxp://spywaretaisakumaster.com
hxxp://stopbedreiging.com
hxxp://stopminacce.com
hxxp://spywareisolator
hxxp://storageprotector.com
hxxp://succesantivirus.com
hxxp://superanonimo.com
hxxp://surfforsure.com
hxxp://surfremover.com
hxxp://stratosearch.com
hxxp://swiftcleaner.com
hxxp://tallgrass-seach.com
hxxp://traffalo.com
hxxp://traveltray.com
hxxp://sutoppuwirusu.com
hxxp://syssauvegarde.com
hxxp://systemerrorfixer.com
hxxp://systemesansfaute.com
hxxp://systemesansvirus.com
hxxp://systemhoover.com
hxxp://systemschild.com
hxxp://tackanejvirus.com
hxxp://tilforlatelig.com
hxxp://toolsicuro.com
hxxp://topsalgantivirus.com
hxxp://trasheraser.com
hxxp://trusselovervagning.com
hxxp://trustedantivirus.com
hxxp://trustedprotection.com
hxxp://tryggpcverktyg.com
hxxp://trygpcbruger.com
hxxp://turnkeyantivirus.com
hxxp://unidadessanas.com
hxxp://usuarioprotegido.com
hxxp://utiledereparation.com
hxxp://vitecmedia.com
hxxp://waytotheprofit.com
hxxp://windefender.com
hxxp://wontu-search.com
hxxp://utilisateursur.com
hxxp://vaktmotvirus.com
hxxp://veiligheidsagent.com
hxxp://virenvernichter.com
hxxp://virusbekaemper.com
hxxp://viruskrakker.com
hxxp://virussperr.com
hxxp://virusurimuva.com
hxxp://virusvanger.com
hxxp://virusvijand.com
hxxp://volumformatredskap.com
hxxp://wirusufinisshu.com
hxxp://wirusuk.com
hxxp://wirusukyua.com
hxxp://aboutstat.net
hxxp://freeorangestats.com
hxxp://newstat.net
hxxp://aboutstat.net
hxxp://freeorangestats.com
hxxp://getmosales.com
hxxp://newstat.net
hxxp://sexprofit.com
hxxp://ad2cash.net
hxxp://admiragroup.com
hxxp://antispyexpert.com
hxxp://antispyexpertpro.com
hxxp://getmosales.com
hxxp://malwarecrash.com
hxxp://adtraff.com
hxxp://bucksbill.com
hxxp://burnads.com
hxxp://forceup.com
hxxp://freetvnow.com
hxxp://getfreecar.com
hxxp://adtraff.com
hxxp://adzyclon.com
hxxp://checkm8.com
hxxp://adtraff.com
hxxp://blessedads.com
hxxp://prevedmarketing.com
hxxp://checkm8.com
hxxp://newbieadguide.com
hxxp://blessedads.com
hxxp://prevedmarketing.com
hxxp://malwarecrashpro.com
hxxp://bestadmedia.com
hxxp://bestsearchnet.com
hxxp://blessedads.com
hxxp://bucksbill.com
hxxp://burnads.com
hxxp://burnads.com
hxxp://casinoaceking.com
hxxp://cryptdrive.com
hxxp://newbieadguide.com
hxxp://blessedads.com
hxxp://prevedmarketing.com
hxxp://fileprotector.com
hxxp://forceup.com
hxxp://forceup.com
hxxp://freetvnow.net
hxxp://fulsearch.com
hxxp://games.biz
hxxp://Imamis.net
hxxp://Individ-search.com
hxxp://Information-advertising.info
hxxp://Infyte.com
hxxp://getfreecar.com
hxxp://greyhathosting.com
hxxp://netmediagroup.net
hxxp://netturbopro.com
hxxp://newbieadguide.com
hxxp://getfreecar.com
hxxp://greyhathosting.com
hxxp://netmediagroup.net
hxxp://netturbopro.com
hxxp://newbieadguide.com
hxxp://greyhathosting.com
hxxp://installprovider.com
hxxp://libresystm.com
hxxp://loffersearch.com
hxxp://magicsearcher.com
hxxp://malware-scan.com
hxxp://manage-search.com
hxxp://megashopcity.com
hxxp://mightyfaq.com
hxxp://misc-search.com
hxxp://moneycometrue.com
hxxp://moneypalacecash.com
hxxp://myhealth-life.org
hxxp://myonlinefinance.com
hxxp://mysurvey4u.com
hxxp://netmediagroup.net
hxxp://netturbopro.com
hxxp://newbieadguide.com
hxxp://newstat.net
hxxp://newbieadguide.com
hxxp://blessedads.com
hxxp://prevedmarketing.com
hxxp://pcsupercharger.com
hxxp://performanceoptimizer.com
hxxp://popupnukerpro.com
hxxp://prizesforyou.com
hxxp://traffalo.com
hxxp://uniqads.com
hxxp://popadprovider.com
hxxp://popsmedia.com
hxxp://popupnukerpro.com
hxxp://prevedmarketing.com
hxxp://prevedmarketing.com
hxxp://prizesforyou.com
hxxp://proximogroup.com
hxxp://adtraff.com
hxxp://bucksbill.com
hxxp://burnads.com
hxxp://forceup.com
hxxp://freetvnow.com
hxxp://proximogroup.com
hxxp://rocktheads.com
hxxp://roller-search.com
hxxp://rombic-search.com
hxxp://se7ensearch.com
hxxp://search-expand.com
hxxp://search-the-prey.com
hxxp://Cryptdrive.com
hxxp://Deuscleanerpay.com
hxxp://Easybestdeals.com
hxxp://Eroticabsolute.com
hxxp://Marketingdungeon.com
hxxp://Mediatornado.com
hxxp://Megashopcity.com
hxxp://Mightyfaq.com
hxxp://Mobilesoftmarketing.com
hxxp://Moneycometrue.com
hxxp://Moneypalacecash.com
hxxp://Cheap-auto-deals.com
hxxp://Checkstocklist.com
hxxp://Chushok.com
hxxp://Clever-at-search.com
hxxp://Mobilesoftmarketing.com
hxxp://Mobiletops.com
hxxp://Mobilorg.org
hxxp://Moneycometrue.com
hxxp://searchcolours.com
hxxp://searchmandrake.com
hxxp://searchonline-ease.com
hxxp://searchoperation.com
hxxp://searchvirtuoso.com
hxxp://sellmoresoft.net
hxxp://sellmysoft.net
hxxp://malware-scan.com
hxxp://sharpadverts.com
hxxp://shivanetworking.com
hxxp://shivanetworking.com,
hxxp://deuscleaneronline.com
hxxp://shivanetworking.com
hxxp://simplesamplesearch.com
hxxp://soccernet
hxxp://burnads.com,
hxxp://adtech.de
hxxp://blessedads.com,
hxxp://performanceoptimizer.com
hxxp://softwareprofit.com
hxxp://softwcs.com
hxxp://stratosearch.com
hxxp://tallgrass-seach.com
hxxp://theringtonesource.com
hxxp://traffalo.com
hxxp://traveltray.com
hxxp://treekindsearch.com
hxxp://unicsearch.com
hxxp://uniqads.com
hxxp://upg-soft.net
hxxp://vitecmedia.com
hxxp://wewillfind.com
hxxp://win.com
hxxp://windefender.com
hxxp://workhomecentre.com
hxxp://zappinads.com
hxxp://windefender.com
hxxp://wontu-search.com
hxxp://workhomecenter.com
hxxp://yourseeker.com
hxxp://yourshopz.com
hxxp://yourteacheronline.com
hxxp://zappinads.com
hxxp://zooworld-search.com

Related domains known to have participated in the campaign:
hxxp://adtraff.com – 190.15.73.254
hxxp://forceup.com – 190.15.73.254
hxxp://burnads.com – 190.15.73.254
hxxp://blessedads.com – 190.15.73.254
hxxp://prevedmarketing.com – 190.15.73.254
hxxp://r2d2adverising.com – 190.15.73.254
hxxp://shivanetworking.com – 190.15.73.254

We'll post updates as soon as new developments take place.