Euro Software

(Also called "EuroSoft" or "All popular OEM software for PC and MAC. All EUROPEAN languages version" in web site source code.)

## Description

* dealing with anonymous criminals in unknown countries
* giving them your credit card number
* trusting that what you are purchasing actually is the software they claim it is
* assuming the validation codes will work
* allowing them to possibly install malicious software on your computer
* if you are a business owner, taking the risk that a disgruntled former employee will report you for using unauthorized copies of software and make you the target of legal action by software manufacturers

The software vendors have been asked to comment.  They have acknowledged that these sites offering software at such prices are illegal.
According to the Spamhaus ROKSO listing, Euro Softwares is hosted on IP address ranges associated with Leo Kuvayev/Bad Cow. The sites themselves have few distinctive features to associate them with a specific spam operation. IP addresses are shared with an occasional short-lived casino site. Although the domain registrations superficially resemble the identity-theft style of Yambo registrations, on investigation the registrants appear to be completely imaginary people.

## False Pretenses

### Better Business Bureau fake certificate

If you look closely at the seal, you will notice that instead of applying to euromarketsoft.com it states that

```
This BBB*OnLine* Reliability seal, and the commitments that
this seal signifies, pertain only to beyondbedding.com

```

But this site is euromarketsoft.com! The genuine seal for the genuine beyondbedding.com company is in the newer format, at
https://www.bbb.org/online/consumer/cks.aspx?id=106111312332497

### TRUSTe fake certificate

The directory of TRUSTe accredited sites at http://www.truste.com/trusted\_sites/index.html#E has no reference to Euro Software or any of the hundreds of sites we sampled.
A close look at the faked certificate will show that the name of the software piracy site is in the header, in this example EuroSoftMarkets.COM, but in the text we find

```
EuroSoftMarkets.COM is a certified licensee of the TRUSTe® Privacy Seal Program.
The privacy statement and practices of www.shop.com have been reviewed by TRUSTe
for compliance with our strict program requirements.

```

Notice that the second reference is not to EuroSoftMarkets.COM but to www.shop.com. The original certificate was stolen from another company, and can be seen at http://clicktoverify.truste.com/pvr.php?page=validate&url=www.shop.com&sealid=101
Just as with the Better Business Bureau claim, this is another example of the fraud that these criminals perpetrate.

### Trial version or no serial number

There is an admission in the **Support** section that you may be receiving non-genuine versions. Item 3 contains the incriminating evidence:

```
3. If you can not install your soft and have no serial or you have TRIAL version.
Extract archive with your software to some folder on your hard drive or on your
Desktop. Open extracted folder. Find the "README.TXT" file or "README" from this
folder and follow instructions.

```

## Sponsoring Registrars/Hosts

### 2008/2009/2010

**Microsoft**

The abuse of Microsoft's free hosting service spaces.live.com has been ongoing since late 2008. At peak there were over 2000 abuses caught in spam traps every day. In March 2010 the abuse rate was still as high as 200 per day. Despite being aware of this abuse, Microsoft has failed to take any effective action to prevent it. Since the EuroSoft sites pirate Microsoft's products, Microsoft puts itself in a difficult position when trying to defend its copyright in the light of its known support of piracy over such a long period. Worse still, Microsoft's support of software piracy places the company in a difficult legal position, since the piracy sites also provide Microsoft's competitors' products.

A partial list of redirection sites for EuroSoft to which Microsoft has provided access:

* sundowutortes.net
* hopenfaras.net
* probastondtes.net
* dorehatotes.net
* movercanotes.net
* zionetovates.net
* murgadobarotes.net

### January/February 2008

Visesh Infotechnics Ltd.

aesofta.com
asoftofe.com
asoftohe.com
asoftoje.com
asoftoke.com
azosofta.com
bartolosoft.com
britansofte.com
castsofte.com
dastsofte.com
fabsofte.com
fadsofte.com
fawsofte.com
fazsofte.com
festsofte.com
fistsofte.com
fostsofte.com
fystsofte.com
gastsofte.com
kasofte.com
pastsofte.com
soft-caq.com
softaced.com
softaded.com
softahed.com
softajed.com
softaned.com
softaseq.com
softaset.com
softasew.com
softaved.com
softawea.com
softawec.com
softawef.com
softaweh.com
softawej.com
softawes.com
softawet.com
softawew.com
softove.com
softroi.com
softrou.com
violesofte.com
xastsofte.com
zasofte.com
zastsofte.com
zawsofte.com

Dynadot, LLC

* eurosoftmarket.com

ItsYourDomain.com (recently acquired by Tucows)

* **tertorest.com** (Name Server)

Hosts:

* CNCGROUP Henan province network
* Shanghai B&T Network and Telecom Inc
* ZBYD Technology Co.,Ltd (also known for being a provider of bulletproof hosting for Herbal King penile enlargement sites)
* TOCC (currently also hosting Express Herbal penile enlargement sites, a successor to Herbal King)

### May 2009

The free hosting service at gigazu.net was being abused by spammers using a redirection method. The spamming of the gigazu.net sites was detected in the URIBL.COM spam honeypot revealing these redirection sites

adamsgebe5584.gigazu.net
adamshyhi6579.gigazu.net
alexanderbidi4266.gigazu.net
andersongamu7062.gigazu.net
andersonqozy5537.gigazu.net
bennettvone7014.gigazu.net
brooksxidu5445.gigazu.net
carterlidi520.gigazu.net
carterlywu3162.gigazu.net
clarkfeqa2232.gigazu.net
clarkzyze160.gigazu.net
collinsqavi1632.gigazu.net
cookfyky5411.gigazu.net
cooperkody1499.gigazu.net
cooperwaxa7718.gigazu.net
davispyqa5355.gigazu.net
edwardskaqe3034.gigazu.net
edwardskybu2872.gigazu.net
floresjere1592.gigazu.net
fosterniqe7533.gigazu.net
gonzalesfelu6444.gigazu.net
gonzalezzepu9555.gigazu.net
grayseqi7382.gigazu.net
griffinrywu6869.gigazu.net
griffinsyqi7410.gigazu.net
griffintaku4094.gigazu.net
hayeswisi4898.gigazu.net
hernandezquwa4801.gigazu.net
hilljehy6171.gigazu.net
hilllopy2886.gigazu.net
howardrabi2661.gigazu.net
hughesxefy3986.gigazu.net
jamestyku8352.gigazu.net
jenkinswefa9603.gigazu.net
johnsonjoxu1035.gigazu.net
leewego5225.gigazu.net
lewiszabe7931.gigazu.net
martinwepi1490.gigazu.net
millerkeko4271.gigazu.net
millerkify3069.gigazu.net
millertyre5604.gigazu.net
millerxupa9587.gigazu.net
mitchellrewo3400.gigazu.net
morgankowa1814.gigazu.net
morgannuqu6862.gigazu.net
morganroly7971.gigazu.net
morristimu8492.gigazu.net
morrisxibi8348.gigazu.net
morriszeny1117.gigazu.net
nelsonnuhi6531.gigazu.net
parkerboxe2216.gigazu.net
petersonpazu1299.gigazu.net
phillipsbyxo2124.gigazu.net
phillipskeby6274.gigazu.net
phillipsnyhy2056.gigazu.net
powellcono7191.gigazu.net
pricedane6501.gigazu.net
riveragaco1210.gigazu.net
robertstace8181.gigazu.net
rodriguezmexa6912.gigazu.net
rogerswovu8886.gigazu.net
rosswivi1517.gigazu.net
russellsuto2625.gigazu.net
sanchezbaby2952.gigazu.net
scottdety9139.gigazu.net
scottpuho1264.gigazu.net
simmonszire4112.gigazu.net
stewartzeze315.gigazu.net
thomasrede4113.gigazu.net
thomassizy8884.gigazu.net
thompsonsacu7341.gigazu.net
turnermemi3047.gigazu.net
wardwogu8710.gigazu.net
watsonhebo7164.gigazu.net
watsonwomi8203.gigazu.net
whitejaqi1086.gigazu.net
williamsropi4044.gigazu.net
wilsonsysu2078.gigazu.net
wilsontune6188.gigazu.net
wilsonxaku4528.gigazu.net
woodgoco2189.gigazu.net
wrightfaly8436.gigazu.net

At May 1, 2009 these redirected to just one Euro Software web host - viokermante.com

```
Registration Service Provider:
   **DiscountDomainRegistry.com**
   http://DiscountDomainRegistry.com

```

```
Registrar of Record: **TUCOWS, INC.**
Record last updated on 29-Apr-2009.
Record expires on 09-Apr-2010.
Record created on 09-Apr-2009.

Registrar Domain Name Help Center:
   http://domainhelp.tucows.com

```

### August/September 2009

Redirection abuse from Yahoo Groups has targeted several sites

 snedaemos.com | Registrar: PLANETDOMAIN PTY LTD.

Sample spammed redirection URLs targeting Euro Software

* http://groups.yahoo.com/group/xipadytitiwedehox
* http://groups.yahoo.com/group/tafeqibuxifyzulej
* http://groups.yahoo.com/group/bacixudemedehevaq
* http://groups.yahoo.com/group/cypytupalojubymod
* http://groups.yahoo.com/group/cukunysyxywyfoweg
* http://groups.yahoo.com/group/fyxufyvemidokegi
* http://groups.yahoo.com/group/fykyjymavydohi
* http://groups.yahoo.com/group/bagekugygofyko

Sample spam

```
Eurosoftware Inc with the
European Association of the Manufacturer
present Special Summer Sale.
All sofware have 50 % discount.
And note - This is the full version, not trial or test.

Add any programs you want to the
shopping cart and then simply enter
the MCRS-1234 code to instantly get 50% off the total price.

http://groups.yahoo.com/group/tafeqibuxifyzulej/message/1

```

### November 2009

Redirection abuse from Microsoft spaces.live.com has targeted Eurosoft

http://cid-965def53a79acc8d.spaces.live.com redirects to dorgusentos.net which is reviewed in Site Advisor

It is extremely surprising to see Microsoft's free hosting service being allowed to suport software piracy

## Examples of Spam

September 2009, Yahoo Groups redirection abuse

March 2009 -- Hosted on Microsoft's spaces.live.com in an abuse of the terms of service

Piracy of Microsoft and other vendor software on http://wietoperaste.com http://sertifore.com http://gaburgose.com - were redirected from

* http://cid-01e92afdfc6bddea.spaces.live.com
* http://cid-5ff5d501f9e93035.spaces.live.com
* http://cid-1b830b0e14cf4d69.spaces.live.com
* http://cid-2a79a6b2859b3a13.spaces.live.com
* http://cid-024792033551f4af.spaces.live.com
* http://cid-b8e3e2c2dcf581b4.spaces.live.com

January 2008 -- Subject: "Skaggs Software Markets - Deals"

```
We have literally thousands of programs available from some of the biggest software publishers. It does not matter
if it's Microsoft, OneNote or Adobe After Effects 7 applications you need to find we have them all in stock and
more, some at less than 80% of standard store cost.

If your interested please take a peek at our site.
http://www.softawef.com/

bye for now

Edwin Hollingsworth
Skaggs's Software Markets

before. Chiun had Security, told him about them. During let's try to keep Vietnam veteran, trained in onto the
floor, either from the elevators it was close." "I was right at whatever cost. We have to office of Tower
security,  Zuniga Self-trained sniper. Subject to fits of depression

```

```
Need some software urgently? Purchase, download and install right now! Software in English, German, French,
Italian, and Spanish for IBM PC and Macintosh! Cheap prices give you the possibility to save or buy more
software than you can afford purchasing software on a CD!

Purchasing software you can be sure you get perfectly working software, in case you are not satisfied,
we offer money refund. Quick response and advice on how to install your software are guaranteed.

http://fustsofte.com

Original software only!

```

## Microsoft's advice

The advertisers use terms like "Original Equipment Manufacturer" ("OEM") software, as an attempt to explain why the offered software is so inexpensive. Spammers also include random dictionary words and paragraphs of text throughout their email to avoid anti-spam filtering technology.

Microsoft is working to educate partners and consumers about the risks of getting software from suspicious sources. We are investigating the sources of these operations and are doing everything in our power to stop this kind of activity.

Purchasing from known and trusted sources and avoiding "too-good-to-be-true deals" are the best ways to avoid suspicious software offers.

Here are some suspect signs to look for:

Beware of spam emails offering software prices that are too good to be true.
Beware of offers requesting the wiring of money to foreign banking institutions.
Beware of software shipping into the United States from overseas.

For more information regarding spam offering suspicious software, please visit:
http://www.microsoft.com/piracy/YourPC\_Spam.mspx

You may also visit our Internet site on http://www.microsoft.com/piracy and http://www.howtotell.com to review additional information on recognizing genuine Microsoft product and Microsoft's licensing policies.

## Related brands

"Royal Software: Your Software Retailer"
Page title: "OEM Software//Home"
First seen September 2010
Examples: best-softwaredownloads.com download-oem-now.com
Sharing hosting with EuroSoft and WatchShop.

## How to report this spam

### Option 1 - Complainterator

Report the name servers to the registrar using Complainterator. No reputable company in the Republic of China supports software piracy.

### Option 2 - BSA

But more importantly, remember that this is a flagrant software piracy operation. You can

1. shut down the whole operation
2. provide evidence leading to the arrest of the criminals

Follow these steps

1. Open the pirate site, and note down a selection of software vendor names and software titles being pirated
2. Visit the Business Software Alliance web site
3. Select "Report Software Piracy"
4. Fill in your contact details
5. Fill in the matching software vendors and software titles in the reporting form
6. Send it off and feel better

### Option 3 - list of report sites

JavaWoman's list of email reporting addresses, by vendor, for software piracy is an excellent resource. Some examples are shown here ready to be copied into an email cc list:

piracy@apple.com, piracy@autodesk.com, reportpiracy@borland.com, nopiracy@corel.com, tip@macromedia.com, piracy@microsoft.com, piracy@symantec.com

## Further reading

* http://www.siteadvisor.com/sites/cid-a25e193d1778a941.spaces.live.com/postid?p=1515409
* http://web.tebweb.com:8080/cgi-bin/spm\_forum/Blah.pl?,b=spam\_latest\_offenders,v=display,m=latest
* http://cid-5ff5d501f9e93035.spaces.live.com/
* http://www.spamtrackers.org/mar09.htm#spaces
* http://spamtrackers.eu/wiki/index.php?title=Euro\_Softwares
* http://www.siteadvisor.com/sites/cid-6cc0f3f507f91632.spaces.live.com/

, ,