(Also called "EuroSoft" or "All popular OEM software for PC and MAC. All EUROPEAN languages version" in web site source code.)
Description[]
Euro Software or Euro Softwares or EuroSoft or World Software is a pirated "OEM" software site, intermittently spammed in heavy bursts for multiple similar domain names. As with all pirated software, purchasing on this site means
The software vendors have been asked to comment. They have acknowledged that these sites offering software at such prices are illegal. According to the Spamhaus ROKSO listing, Euro Softwares is hosted on IP address ranges associated with Leo Kuvayev/Bad Cow. The sites themselves have few distinctive features to associate them with a specific spam operation. IP addresses are shared with an occasional short-lived casino site. Although the domain registrations superficially resemble the identity-theft style of Yambo registrations, on investigation the registrants appear to be completely imaginary people. |
False Pretenses[]
Better Business Bureau fake certificate[]
In an attempt to appear legitimate. the site has the logo of the Better Business Bureau. When you click that logo, you expect to be taken to the Better Business Bureau site to display their certificate of authenticity. But these criminals can not get any such certification, so they fake it. They dummy up a fake certificate, and serve it up from their own site. The graphic shows one such example, taken from their euromarketsoft.com web site, seen on October 15, 2009.
If you look closely at the seal, you will notice that instead of applying to euromarketsoft.com it states that This BBBOnLine Reliability seal, and the commitments that this seal signifies, pertain only to beyondbedding.com
But this site is euromarketsoft.com! The genuine seal for the genuine beyondbedding.com company is in the newer format, at https://www.bbb.org/online/consumer/cks.aspx?id=106111312332497 |
TRUSTe fake certificate[]
In a similar display of fraud, Euro Software sites display the logo of TRUSTe but again serve it up from their own site.
The directory of TRUSTe accredited sites at http://www.truste.com/trusted_sites/index.html#E has no reference to Euro Software or any of the hundreds of sites we sampled. A close look at the faked certificate will show that the name of the software piracy site is in the header, in this example EuroSoftMarkets.COM, but in the text we find EuroSoftMarkets.COM is a certified licensee of the TRUSTe® Privacy Seal Program. The privacy statement and practices of www.shop.com have been reviewed by TRUSTe for compliance with our strict program requirements.
Just as with the Better Business Bureau claim, this is another example of the fraud that these criminals perpetrate. |
Trial version or no serial number[]
There is an admission in the Support section that you may be receiving non-genuine versions. Item 3 contains the incriminating evidence:
3. If you can not install your soft and have no serial or you have TRIAL version. Extract archive with your software to some folder on your hard drive or on your Desktop. Open extracted folder. Find the "README.TXT" file or "README" from this folder and follow instructions.
Sponsoring Registrars/Hosts[]
2008/2009/2010[]
Microsoft
The abuse of Microsoft's free hosting service spaces.live.com has been ongoing since late 2008. At peak there were over 2000 abuses caught in spam traps every day. In March 2010 the abuse rate was still as high as 200 per day. Despite being aware of this abuse, Microsoft has failed to take any effective action to prevent it. Since the EuroSoft sites pirate Microsoft's products, Microsoft puts itself in a difficult position when trying to defend its copyright in the light of its known support of piracy over such a long period. Worse still, Microsoft's support of software piracy places the company in a difficult legal position, since the piracy sites also provide Microsoft's competitors' products.
A partial list of redirection sites for EuroSoft to which Microsoft has provided access:
- sundowutortes.net
- hopenfaras.net
- probastondtes.net
- dorehatotes.net
- movercanotes.net
- zionetovates.net
- murgadobarotes.net
January/February 2008[]
Visesh Infotechnics Ltd.
aesofta.com asoftofe.com asoftohe.com asoftoje.com asoftoke.com azosofta.com bartolosoft.com britansofte.com castsofte.com dastsofte.com fabsofte.com fadsofte.com fawsofte.com fazsofte.com festsofte.com fistsofte.com fostsofte.com fystsofte.com gastsofte.com kasofte.com pastsofte.com soft-caq.com softaced.com softaded.com softahed.com softajed.com softaned.com softaseq.com softaset.com softasew.com softaved.com softawea.com softawec.com softawef.com softaweh.com softawej.com softawes.com softawet.com softawew.com softove.com softroi.com softrou.com violesofte.com xastsofte.com zasofte.com zastsofte.com zawsofte.com
Dynadot, LLC
- eurosoftmarket.com
ItsYourDomain.com (recently acquired by Tucows)
- tertorest.com (Name Server)
Hosts:
- CNCGROUP Henan province network
- Shanghai B&T Network and Telecom Inc
- ZBYD Technology Co.,Ltd (also known for being a provider of bulletproof hosting for Herbal King penile enlargement sites)
- TOCC (currently also hosting Express Herbal penile enlargement sites, a successor to Herbal King)
May 2009[]
The free hosting service at gigazu.net was being abused by spammers using a redirection method. The spamming of the gigazu.net sites was detected in the URIBL.COM spam honeypot revealing these redirection sites
adamsgebe5584.gigazu.net adamshyhi6579.gigazu.net alexanderbidi4266.gigazu.net andersongamu7062.gigazu.net andersonqozy5537.gigazu.net bennettvone7014.gigazu.net brooksxidu5445.gigazu.net carterlidi520.gigazu.net carterlywu3162.gigazu.net clarkfeqa2232.gigazu.net clarkzyze160.gigazu.net collinsqavi1632.gigazu.net cookfyky5411.gigazu.net cooperkody1499.gigazu.net cooperwaxa7718.gigazu.net davispyqa5355.gigazu.net edwardskaqe3034.gigazu.net edwardskybu2872.gigazu.net floresjere1592.gigazu.net fosterniqe7533.gigazu.net gonzalesfelu6444.gigazu.net gonzalezzepu9555.gigazu.net grayseqi7382.gigazu.net griffinrywu6869.gigazu.net griffinsyqi7410.gigazu.net griffintaku4094.gigazu.net hayeswisi4898.gigazu.net hernandezquwa4801.gigazu.net hilljehy6171.gigazu.net hilllopy2886.gigazu.net howardrabi2661.gigazu.net hughesxefy3986.gigazu.net jamestyku8352.gigazu.net jenkinswefa9603.gigazu.net johnsonjoxu1035.gigazu.net leewego5225.gigazu.net lewiszabe7931.gigazu.net martinwepi1490.gigazu.net millerkeko4271.gigazu.net millerkify3069.gigazu.net millertyre5604.gigazu.net millerxupa9587.gigazu.net mitchellrewo3400.gigazu.net morgankowa1814.gigazu.net morgannuqu6862.gigazu.net morganroly7971.gigazu.net morristimu8492.gigazu.net morrisxibi8348.gigazu.net morriszeny1117.gigazu.net nelsonnuhi6531.gigazu.net parkerboxe2216.gigazu.net petersonpazu1299.gigazu.net phillipsbyxo2124.gigazu.net phillipskeby6274.gigazu.net phillipsnyhy2056.gigazu.net powellcono7191.gigazu.net pricedane6501.gigazu.net riveragaco1210.gigazu.net robertstace8181.gigazu.net rodriguezmexa6912.gigazu.net rogerswovu8886.gigazu.net rosswivi1517.gigazu.net russellsuto2625.gigazu.net sanchezbaby2952.gigazu.net scottdety9139.gigazu.net scottpuho1264.gigazu.net simmonszire4112.gigazu.net stewartzeze315.gigazu.net thomasrede4113.gigazu.net thomassizy8884.gigazu.net thompsonsacu7341.gigazu.net turnermemi3047.gigazu.net wardwogu8710.gigazu.net watsonhebo7164.gigazu.net watsonwomi8203.gigazu.net whitejaqi1086.gigazu.net williamsropi4044.gigazu.net wilsonsysu2078.gigazu.net wilsontune6188.gigazu.net wilsonxaku4528.gigazu.net woodgoco2189.gigazu.net wrightfaly8436.gigazu.net
At May 1, 2009 these redirected to just one Euro Software web host - viokermante.com
Registration Service Provider: DiscountDomainRegistry.com http://DiscountDomainRegistry.com
Registrar of Record: TUCOWS, INC. Record last updated on 29-Apr-2009. Record expires on 09-Apr-2010. Record created on 09-Apr-2009. Registrar Domain Name Help Center: http://domainhelp.tucows.com
August/September 2009[]
Redirection abuse from Yahoo Groups has targeted several sites
Target Domain Name | Crime Sponsoring Registrar |
---|---|
bravisskos.com | Registrar: PLANETDOMAIN PTY LTD. |
gourdanses.com | Registrar: TUCOWS INC. |
grastobins.com | Registrar: INTERNET.BS CORP. |
kavientos.com | Registrar: TUCOWS INC. |
krapobravs.com | Registrar: TUCOWS INC. |
shacestours.com | Registrar: PLANETDOMAIN PTY LTD. |
snedaemos.com | Registrar: PLANETDOMAIN PTY LTD. |
Sample spammed redirection URLs targeting Euro Software
- http://groups.yahoo.com/group/xipadytitiwedehox
- http://groups.yahoo.com/group/tafeqibuxifyzulej
- http://groups.yahoo.com/group/bacixudemedehevaq
- http://groups.yahoo.com/group/cypytupalojubymod
- http://groups.yahoo.com/group/cukunysyxywyfoweg
- http://groups.yahoo.com/group/fyxufyvemidokegi
- http://groups.yahoo.com/group/fykyjymavydohi
- http://groups.yahoo.com/group/bagekugygofyko
Sample spam
Eurosoftware Inc with the European Association of the Manufacturer present Special Summer Sale. All sofware have 50 % discount. And note - This is the full version, not trial or test. Add any programs you want to the shopping cart and then simply enter the MCRS-1234 code to instantly get 50% off the total price. http://groups.yahoo.com/group/tafeqibuxifyzulej/message/1
November 2009[]
Redirection abuse from Microsoft spaces.live.com has targeted Eurosoft
http://cid-965def53a79acc8d.spaces.live.com redirects to dorgusentos.net which is reviewed in Site Advisor
It is extremely surprising to see Microsoft's free hosting service being allowed to suport software piracy
Examples of Spam[]
September 2009, Yahoo Groups redirection abuse
March 2009 -- Hosted on Microsoft's spaces.live.com in an abuse of the terms of service
Piracy of Microsoft and other vendor software on http://wietoperaste.com http://sertifore.com http://gaburgose.com - were redirected from
- http://cid-01e92afdfc6bddea.spaces.live.com
- http://cid-5ff5d501f9e93035.spaces.live.com
- http://cid-1b830b0e14cf4d69.spaces.live.com
- http://cid-2a79a6b2859b3a13.spaces.live.com
- http://cid-024792033551f4af.spaces.live.com
- http://cid-b8e3e2c2dcf581b4.spaces.live.com
January 2008 -- Subject: "Skaggs Software Markets - Deals"
We have literally thousands of programs available from some of the biggest software publishers. It does not matter if it's Microsoft, OneNote or Adobe After Effects 7 applications you need to find we have them all in stock and more, some at less than 80% of standard store cost. If your interested please take a peek at our site. http://www.softawef.com/ bye for now Edwin Hollingsworth Skaggs's Software Markets before. Chiun had Security, told him about them. During let's try to keep Vietnam veteran, trained in onto the floor, either from the elevators it was close." "I was right at whatever cost. We have to office of Tower security, Zuniga Self-trained sniper. Subject to fits of depression
Need some software urgently? Purchase, download and install right now! Software in English, German, French, Italian, and Spanish for IBM PC and Macintosh! Cheap prices give you the possibility to save or buy more software than you can afford purchasing software on a CD! Purchasing software you can be sure you get perfectly working software, in case you are not satisfied, we offer money refund. Quick response and advice on how to install your software are guaranteed. http://fustsofte.com Original software only!
Microsoft's advice[]
The advertisers use terms like "Original Equipment Manufacturer" ("OEM") software, as an attempt to explain why the offered software is so inexpensive. Spammers also include random dictionary words and paragraphs of text throughout their email to avoid anti-spam filtering technology.
Microsoft is working to educate partners and consumers about the risks of getting software from suspicious sources. We are investigating the sources of these operations and are doing everything in our power to stop this kind of activity.
Purchasing from known and trusted sources and avoiding "too-good-to-be-true deals" are the best ways to avoid suspicious software offers.
Here are some suspect signs to look for:
Beware of spam emails offering software prices that are too good to be true. Beware of offers requesting the wiring of money to foreign banking institutions. Beware of software shipping into the United States from overseas.
For more information regarding spam offering suspicious software, please visit: http://www.microsoft.com/piracy/YourPC_Spam.mspx
You may also visit our Internet site on http://www.microsoft.com/piracy and http://www.howtotell.com to review additional information on recognizing genuine Microsoft product and Microsoft's licensing policies.
Related brands[]
See the entry at OEM Software "Royal Software: Your Software Retailer" |
How to report this spam[]
Option 1 - Complainterator[]
Report the name servers to the registrar using Complainterator. No reputable company in the Republic of China supports software piracy.
Option 2 - BSA[]
But more importantly, remember that this is a flagrant software piracy operation. You can
- shut down the whole operation
- provide evidence leading to the arrest of the criminals
Follow these steps
- Open the pirate site, and note down a selection of software vendor names and software titles being pirated
- Visit the Business Software Alliance web site
- Select "Report Software Piracy"
- Fill in your contact details
- Fill in the matching software vendors and software titles in the reporting form
- Send it off and feel better
Option 3 - list of report sites[]
JavaWoman's list of email reporting addresses, by vendor, for software piracy is an excellent resource. Some examples are shown here ready to be copied into an email cc list:
piracy@apple.com, piracy@autodesk.com, reportpiracy@borland.com, nopiracy@corel.com, tip@macromedia.com, piracy@microsoft.com, piracy@symantec.com
Further reading[]
- http://www.siteadvisor.com/sites/cid-a25e193d1778a941.spaces.live.com/postid?p=1515409
- http://web.tebweb.com:8080/cgi-bin/spm_forum/Blah.pl?,b=spam_latest_offenders,v=display,m=latest
- http://cid-5ff5d501f9e93035.spaces.live.com/
- http://www.spamtrackers.org/mar09.htm#spaces
- http://spamtrackers.eu/wiki/index.php?title=Euro_Softwares
- http://www.siteadvisor.com/sites/cid-6cc0f3f507f91632.spaces.live.com/
, ,