New Rogue: SpySlay?

[TeMerc]

I just had a user join up with a link to spyslayDOTcom/anti-spyware.

As soon as you click the page, you get re-directed to a System Doctor download!! A well known rogue.

BAD news!

For those with SiteAdvisor reviewr status, please add your comments or mimic mine:
http://www.siteadvisor.com/sites/spyslay.com/

Google search for 'spyslay' brings up most of the forums this guy is spamming:
http://www.google.com/search?q=spysl...e7&rlz=1I7ADBS

From one:

Posted by: genry-morgan Sep 20 2007, 03:23 AM
hello there!
i have got a online journal. i have recieved a lot of spam in my blog recently. could anyone tell me how to get antispam filter or something else to protect my blog? spamers send there much links. spamers are bothering me !
but i should say that once i got a advantage from them. they have sent me some links to someanti virus programme. so i decided to visit this site because my PC started to work slowly. i found there a proposition to download anti virus programme. after installing it, the program deleted all spyware from my computer!!! even such progams as Kaspersky and Nod32 could not find it!!!! i could not even think that there are so many spyware in my computer!!! you could click by one of this links. searching spyware on your PC is free!!! here are the link.
hxxp://www.spyslay.com/anti-spyware/
So that guys are not so useless, i think)))


hasta la vista

This one needs to go into the rogues gallery pronto.

Admins need to add spyslayDOTcom to ban filters

I've not done any research beyond a quick Google search, just spreading the word right now.

[TeMerc]

Whois Info:

Contact: +49.3094413291

Domain Name: SPYSLAY.COM

Registrant:
TROYHORSE
Michel Dubua ()
Dionos 109
Buenos Aires
null,54652
AR
Tel. +526.54556254

Creation Date: 08-Jun-2007
Expiration Date: 08-Jun-2008

Domain servers in listed order:
ns2.spyslay.com
ns.spyslay.com

Administrative Contact:
TROYHORSE
Michel Dubua ()
Dionos 109
Buenos Aires
null,54652
AR
Tel. +526.54556254

Technical Contact:
TROYHORSE
Michel Dubua ()
Dionos 109
Buenos Aires
null,54652
AR
Tel. +526.54556254

Billing Contact:
TROYHORSE
Michel Dubua ()
Dionos 109
Buenos Aires
null,54652
AR
Tel. +526.54556254

Status:ACTIVE

Website Title: None given.
AboutUs: Wiki article on Spyslay.com
SEO Score: 61%
Terms: 62 (Unique: 47, Linked: 9)
Images: 3 (Alt tags missing: 3)
Links: 11 (Internal: 7, Outbound: 4)

Server Type: Apache/2.0.54 (Fedora)
IP Address: 87.118.103.24
IP Location - Berlin - Berlin - Keyweb Ag Ip Network
Response Code: 200
Blacklist Status: Clear
Domain Status: Registered And Active Website

ICANN Registrar: DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Created: 2007-06-08
Expires: 2008-06-08
Registrar Status: ok
Name Server: NS.SPYSLAY.COM
Name Server: NS2.SPYSLAY.COM
Whois Server: whois.publicdomainregistry.com

From here:
http://www.bluetack.co.uk/forums/ind...=0&#entry83425

I caught this guy on two of my forums and blocked him already.

"genry-morgan" (gooffy@spyslay.com) is coming from:

61.60.74.118 - GSN, Taiwan Government Service Network.:61.60.32.0-61.60.127.255
and
210.42.140.5 - Hubei Provincial Education Commission :210.42.140.0-210.42.141.255

Both ranges look like they belong in a couple of our lists, if not there already. ;]

My forums are now blocking:
61.60.74.*
210.42.140.*
210.42.141.*

[EASTER]

Just great. Even more ROGUE garbage to muddy the waters with past offerings of this type. Don't they ever stop? Deceptions like these positioned on ANY websites should be immediately frozen.

Thank goodness the watchers keep close tabs on these farces.