Exposing the Pay Per Install Underground Business Model – Historical OSINT - An Analysis - 2008

What are some of the primary scareware and adware distributors circa 2008? Which were the most profitable pay-pay-install and drive-by-download affiliate-network based revenue-sharing scheme malicious and fraudulent scareware and adware pushing providers circa 2008? Who was providing them with the necessary infrastructure to help them stay online and earn fraudulent profit in the processes of pushing fake security software also known as scareware including adware to hundreds of thousands of unsuspecting users online? Keep reading.

In this exclusive analysis I'll provide actionable intelligence on some of the major rogue and fraudulent pay-per-install and drive-by-download scareware and adware pushing affiliate-network based type of rogue providers circa 2008 and discuss in-depth the tactics techniques and procedures of the cybercriminals behind these affiliate-networks including actionable intelligence on the infrastructure behind these campaigns.

Sample Key Pay-Per-Install and Drive-by-Download Affiliate-Networks that I'll expose in this analysis circa 2008 include:

• LuxeCash
• LoudMo
• Adware Dollars
• GoldenCashWorld
• CodecMoney
• Earnings4you
• EXE Revenue
• Go-Go-Cash
• InstallConverter
• InstallerCash
• Junior VIP
• Oxocash
• Snap Installs
• Spicy Codec
• The Installs
• Traf Cash
• Vomba Cash
• Wave Revenue
• Ya Bucks
• Yazzle
• Zango Cash
• 3XL Parnership
• Cash Boom
• Cash Codec
• Cash Wrestler
• Buckware
• Bakasoftware
• Cash Panic
• Dogma Software
• K2Cash
• Traffic Converter
• VipSoft Cash
• Dailybucks
• EU Pays
• Golden Cash
• Profit Cash
• Ruler Cash
• Sex Profit
• VIP Convert
• Stimul Cash

Sample Screenshots of some of the key pay per install affiliate programs circa 2008:

Sample Screenshot of Adware Dollars:

Sample Screenshot of Bakasoftware:

Sample Screenshot of Bakasoftware's Admin Interface:

Sample rogue and fraudulent domains known to have been involved in Bakasoftware-related campaigns:
hxxp://av-xp-08.com
hxxp://av-xp-2008.com
hxxp://antivirusxp08.net
hxxp://antivirusxp2008.net
hxxp://antivirusxp-2008.net
hxxp://antivirusxp-08.net
hxxp://antivirus-xp-08.net
hxxp://antivirus-xp-08.com
hxxp://antivirusxp-08.com
hxxp://antivirusxp-2008.com
hxxp://antivirxp08.com
hxxp://avxp08.net
hxxp://avxp-08.com
hxxp://avxp-2008.com
hxxp://avxp08.com
hxxp://avxp2008.com
hxxp://avxp-2008.net
hxxp://antivirusxp08.com
hxxp://antivirusxp2008.com
hxxp://antivirusxp-2009.com

Including the following photos obtained from a private safari where the top performing participants in the rogue affiliate-network based programs participated:

Stay tuned!