Piradius.net / Yohost.org - black hat hosting?

Piradius.net is a web host in Malaysia that has cropped up a few times as hosts for this long-running scam.

It seems that this isn't an isolated case. Looking just one server at gives us a number of other fraudulent domains:

• bestcrisisprices.com - fake ecommerce site registered to Michell.Gregory2009@yahoo.com that has been used for this fraud, this fraud and many others.
  
• blizzard-battle.net - fake "World of Warcraft" login page, presumably designed to harvest usernames and passwords.
  
• europemedicalnet.com - claims to be a German medical company, in reality it isn't. Purpose unclear, probably run by Manuel Fichter.
  
• everyhit.info - front-end for the registry-cleaner-comparisons.com fraudware site.
• evilcheats.org - registered to kingstonsmith@hushmail.com who is connected with many fraudulent and/or suspect sites.
• excelcapitals.com - smart looking but suspect "get rich quick" site, apparently based in Panama.
  
• flyappraisals.com - fake domain appraisals.
• flyrating.com - fake domain appraisals.
• germanymedicalnet.com - currently displaying text from the Pozde.com domain scam.
• gooogled.com - appears to sell knock-off designer goods.
• hellas-warez.com - "Warez" as in illegal software downloads.
• hygetropin-hgh.com - Claims to export prescription drugs from China.
• indigo-net.org - another "Kingston Smith" domain.
• jessicassoftware.com - suspiciously cheap software.
• maximizedlivingscam.com - another "Kingston Smith" domain.
• nameorange.com - fake domain appraisals.
• nextdayrelief.com - unconvincing "pharmacy" that claims to be in the US, but hosts in Malaysia
  
• pedma.com - fake domain appraisals.
• podzz.com - fake domain appraisals.
  
• poker-bonus-codes.de - Kingston Smith again.
• pozde.com - fake domain appraisals.
• r4ishop.com - with prices in pounds sterling, it appears to be passing itself off as a UK-based electronics retailer. In reality, everything is anonymised and it could be based anywhere.
• rc-chem.net - claims to be a Canadian supplier of steroids, a Google search on the domain is enlightening.
• replica-prestigious-watches.com - fake designer watches.
• tropicalnames.com - fake domain appraisals.
• yohost.org - anonymous hosting.

In fact, it's the last domain "yohost.org" which gives a clue as to what is really going on. Yohost.org looks like a reseller of Piradius.net's hosting and it advertises itself as "100% anonymous hosting and anonymous DNS and domain name services" which is "beyond the reach of virtually any government or law enforcement agency."

If you Google for "anonymous hosting" then Yohost.org comes up as #4. So you can see where their customers are coming from.

Yohost.org also rents other servers from Piradius.net, and they show a mix of sites that appear to be very dodgy indeed, through to sites that appear legitimate.

They appear to run the following IPs and probably others too:

124.217.231.173
124.217.231.209
124.217.250.102
124.217.250.106

Hosting rubbish like this does not enhanced Piradius.net's reputation, they would really be better off booting Yohost.org in order to clean up their IP range.