This post on the Sunbelt blog about apparently bogus anti-virus software rang a bell.. there was something eerily familiar about this whole operation that I'd seen before. A close examination of these so-called anti-virus sites shows a link to
marketbay.com - so these look like some autogenerated affiliate sites or other.
MarketBay are pretty well known for shady practices, for example
here and
here. Before they were called
marketbay.com, they were known as
yourclick.com and run by a firm apparently called
Three W Networks Ltd (
Google it). Everything is hidden behind a shell company in the Bahamas, with a name of David Da Silva connected to it, although this is a fairly common name and it may well be assumed. The company recently changed name to
Media Entertainment Guide, still quoting the Da Silva name and a Bahamas address as seen in the
WHOIS for
marketbay.org which is not privacy protected (unlike marketbay.com).
[As a side note, the historical WHOIS records for
marketbay.com identify a previous owner who confirmed that the domain was sold to another party]
The software punted by MarketBay looks to be of questionable use, but that's an accusation that can be made against any one of a number of businesses..
caveat emptor and all that. But at the very least you can say that affiliates are marketing this software deceptively.
Now, the IP address of 67.212.90.64/28 is rather more fruitful to examine. It's a very small block of IP addresses, listed as belonging to
Mango Ideas in Canada (
note: these sites are no longer hosted there as of March 2011)
There is certainly nothing worth visiting in 67.212.90.64/28 and blocking the whole lot would probably save you some headaches, The block seems to be clean, but for research interest, the sites that WERE hosted are listed in this
this CSV file with MyWOT ratings attached.
Update 23/3/11: It appears that most of the sites are no longer hosted here (they appear to have moved to other Canadian hosts), there are a few remaining sites that I can't vouch for one way or another.. as it is, I would suggest that this block is now clean and no longer evil.
Mr Kennedy says that he assumes that the bad sites were probably put on there by a reseller or perhaps a compromised account, and they have a very strict anti-abuse policy.
