iLivid network

User avatar
evilfantasy
Posts: 2101
Joined: Thu Dec 25, 2008 4:08 am

iLivid network

Post by evilfantasy » Wed Sep 26, 2012 10:30 pm

This is a continuation from this topic: Please Check Out This Odd Couple TV Series Message Board

Part of the iLivid network of websites serving adware, malware and spam.

The iLivid network (Internet Live Video Player). They offer bundled downloads that include adware and malware. The iLivid WOT Scorecard has many negative remarks and ratings.

VirusTotal results for download.cdn.ilivid.com/cdn/r/164/iLividSetupV1.exe - Detection ratio: [red]6 / 30[/red]

[red][massrate]banners.ilivid.com
blog.ilivid.com
download.cdn.ilivid.com
download.ilivid.com
ilivid.com
ilivid.kayako.com
lp.ilivid.com
moviefind.net
program.ilivid.com
support.ilivid.com
[/massrate][/green]

User avatar
Myxt
Posts: 2083
Joined: Sat Mar 05, 2011 6:18 am

RE: iLivid network

Post by Myxt » Mon Oct 01, 2012 6:59 am

Search poisoning too. I thought I would try Googling> iLivid site:whois.domaintools.com
and every return "seemed" to include that term, yet it is not found on the page.
Then I tried searching Microsoft.com, and the SERPs look like Microsoft is all about iLivid.

There are some parked domains, named something else, with title tags = http(etc) ilivid.com.
One of those, wwwnavbharattimes.com, is on an IP with 235,300 other screwy-looking hosts - e.g. 0--4.com.

Here is (one of) the owner(s): http://www.blogger.com/profile/00192002049077642348

Another domain:
[red]keepvid.com[/red]

User avatar
Jazspeak
Posts: 3711
Joined: Fri Oct 17, 2008 4:20 pm

RE: iLivid network

Post by Jazspeak » Mon Oct 01, 2012 3:27 pm

The Virus Total report in the OP certainly raises some interesting observations about the malware and the inability of so many AV companies to identify the malware. With the ratio as strong as 6/30 it can be strongly suggested that there is malware. So why was Avira able to identify the presence of malware? Why were BitDefender and Sucuri unable to do so?

User avatar
Amobirius
Posts: 605
Joined: Sun May 13, 2012 1:09 pm

RE: Bandoo Media

Post by Amobirius » Mon Oct 01, 2012 5:00 pm

Ilivid is owned by "Bandoo Media" and " Musiclab, LLC" and "iMesh Inc". Which is meant to be just one company. -_-
Who owns:
[red]Ilivid
Bearshare
iMesh
Bandoo
jZip
And possibly more
[massrate]
cdn.ilivid.com
bandoo.com
bandooo.com
download.bandooo.com
download.bandoo.com
bandoo.kayako.com
mail.bandoo.com
banddo.com
bandooinvite.com
service.bandoo.com
bearflix.com
invite.bearflix.com
bando1.com
bandoo1.com
bandoo10.com
bandoo11.com
bandoo12.com
bandoo13.com
bandoo14.com
bandoo15.com
bandoo16.com
bandoo17.com
bandoo18.com
bandoo19.com
bandoo2.com
bandoo20.com
bandoo3.com
bandoo4.com
bandoo5.com
bandoo6.com
bandoo7.com
bandoo8.com
bandoo9.com
bandooinvite.com
bandooinvite1.com
bandooinvite10.com
bandooinvite14.com
bandooinvite2.com
bandooinvite21.com
bandooinvite23.com
bandooinvite25.com
bandooinvite3.com
bandooinvite4.com
bandooinvite5.com
bandooinvite6.com
bandooinvite7.com
bandooinvite8.com
bandooinvite9.com
banner.bearflix.com
matomymarket.com
support.imesh.com
imesh.com
adsmarket.com
download.imesh.com
search.imesh.com
en.imesh.com
es.imesh.com
fr.imesh.com
de.imesh.com
it.imesh.com
nl.imesh.com
pl.imesh.com
tr.imesh.com
pt.imesh.com
imesh.en.softonic.com
imesh.softonic.com
ilivid-download-manager.en.softonic.com
ilivid-download-manager.softonic.com
_p_nfwgs5tjmq.twitter.com
_p_mjswc4ttnbqxezi.twitter.com
_p_nfgwk43ijv2xg2ld.twitter.com
bearshare.com
download.bearshare.com
bearshare.en.softonic.com
bearshare.softonic.com
search.bearshare.com
en.bearshare.com
es.bearshare.com
fr.bearshare.com
pt.bearshare.com
it.bearshare.com
nl.bearshare.com
pl.bearshare.com
tr.bearshare.com
de.bearshare.com
bareshare.org
bearshare.org
bearshare1.com
bearshare2.com
support.bearshare.com
musiclab-llc.com
bearshrae.com
best-emoticons.com
jzip.com
download.jzip.com
jzip.kayako.com
[/massrate][/red]

User avatar
evilfantasy
Posts: 2101
Joined: Thu Dec 25, 2008 4:08 am

RE: iLivid network

Post by evilfantasy » Mon Oct 01, 2012 7:13 pm

[red][massrate]lp.bearshare.com
search.bearshare.net[/massrate][/red]




User avatar
Jazspeak
Posts: 3711
Joined: Fri Oct 17, 2008 4:20 pm

RE: Bandoo Media

Post by Jazspeak » Tue Oct 02, 2012 12:47 am

<quote user="amobirius">
"[red]Bearshare[/red]"
[/quote]

Yes, I have come across these characters before, some time ago, and I recall getting an AV alert from malware on one of their sites.

User avatar
evilfantasy
Posts: 2101
Joined: Thu Dec 25, 2008 4:08 am

RE: iLivid network

Post by evilfantasy » Tue Oct 02, 2012 3:42 am

<quote user="jazspeak">Yes, I have come across these characters before, some time ago, and I recall getting an AV alert from malware on one of their sites.[/quote]

Bearshare and iMesh have been around for many, many years (Bearshare December 2000). I'm surprised they are still "flying the same flag" and getting away with it. Limewire had also been around forever (May 2000) but they have had to shut down development when the online copyright laws caught up to the software. Just check out the Limewire Homepage. Frostwire (September 2004), a clone of Limewire, is still up and thriving though. Why just Limewire had to comply is beyond me. There is a new version of Limewire available under different programmers, on another website, but I will not mention the name here.

Back to Bandoo Media, Inc...

>>In my digging I found Koyote-Lab, Inc. Another website hosted on the same IP owned by Bandoo Media Inc. including adware and/or spyware in the software installer. <<

hxxp://download.cdn.koyotesoft.com/r/cdn/114/Setup_FreeFlvConverter.exe

VirusTotal results [red]1[/red] / 30 (Antiy-AVL - Malware site) - The registration for Koyote-Lab, Inc. is private and uses the same name servers as does iLivid, jZip and the others and hosted in the same country.

Part of the iLivid network.

Screenshots of [yellow]Free Flv Converter[/yellow] install and pre-checked [yellow]adware and/or spyware[/yellow].
  • http://i.imgur.com/UxRrs.jpg
  • http://i.imgur.com/rYlsL.jpg
By default the installation of Free Flv Converter includes:
  • Searchnu.com homepage
  • Search-Results.com as default search
  • Torch Browser
  • Torch as default browser
[red][massrate]download.cdn.koyotesoft.com
koyotesoft.com
koyotesoft.kayako.com
koyotstar.free.fr
lp.koyotesoft.com[/massrate][/red]


A few of these may be duplicates and others ARE mentioned in other WOT topics so if using the MRT place a check mark next to "Don't replace my earlier comments to avoid parsing your previous comments.

Some of the websites are listed in another topic.

[red][massrate]acewinks.com
amusingcool.com
avatarsgreat.com
cartoonslord.com
emoticonsfaces.com
emoticonsfeature.com
emoticonwizards.com
emotikons-pc.com
excellentwink.com
extensions.ftalk.com
extensions.ftalkconnect.com
extensions.ftalking.com
facez-direct.com
facez-house.com
facez-topia.com
fantastigames.com
featurecool.com
featuresuper.com
finesweet.com
fixbee.com
goodnesswinks.com
images.ilivid.com
lp.bearshare.com
lp.fixbee.com
lp.imesh.com
lphant.com
minicatalog.bandoo.com
search.jzip.com
shareaza.com
stats.jzip.com
update.jzip.com
winkscomical.com
winkslaughable.com
winksweet.com
winkuniverse.com
winkwow.com
wizardemoticons.com
worthemoticon.com
worthwink.com[/massrate][/red]


Note: Kayako.com is listed in some of the links in this topic (jzip.kayako.com, ilivid.kayako.com) but is not owned or hosted by Bandoo Media Inc. It's the help desk and live chat software that Bandoo Media Inc. uses and I have not found anything indicating the company is doing anything wrong or unethical.

User avatar
c۞g
Posts: 10927
Joined: Mon Jan 05, 2009 4:02 am

RE: iLivid network

Post by c۞g » Tue Oct 02, 2012 4:07 am

From 2009: pantheraproject.net / Discordia Limited
might be worth check those old domains to see which are still active and associated to Discordia Limited.

Here are the domains which are hosted on IP: [red]207.232.22.55[/red]

[massrate]
[red]acesmilies.com
acewinks.com
amusingcool.com
amusingfunny.com
amusingwink.com
amusingwow.com
animation-3k.com
animation-base.com
animation-chat.com
animation-chats.com
animation-free.com
animation-gate.com
animation-hip.com
animation-jet.com
animation-top.com
animationbest.com
animationfaces.com
animationfine.com
animationfresh.com
animationhip.com
animations-chats.com
animations-hip.com
animationsbest.com
animationsfaces.com
animationsfresh.com
animationsgoodness.com
animationssmile.com
animationsworth.com
animationtop.com
avatarscool.com
avatarsfun.com
avatarsgreat.com
avatarsopen.com
avatarsplay.com
avatarsunreal.com
awesemoticons.com
awesome-emoticons.com
band00.com
band000.com
banddo.com
bandoo.com
bandoo11.com
bandoo12.com
bandoo13.com
bandoo14.com
bandoo15.com
bandoo16.com
bandoo17.com
bandoo18.com
bandoo19.com
bandoo2.com
bandoo20.com
bandoo3.com
bandoo8.com
bandooinvite.com
bandooinvite1.com
bandooinvite10.com
bandooinvite11.com
bandooinvite12.com
bandooinvite13.com
bandooinvite14.com
bandooinvite15.com
bandooinvite16.com
bandooinvite17.com
bandooinvite18.com
bandooinvite19.com
bandooinvite20.com
bandooinvite21.com
bandooinvite22.com
bandooinvite23.com
bandooinvite24.com
bandooinvite25.com
bandooinvite3.com
bandooinvite4.com
bandooinvite5.com
bandooinvite7.com
bandooo.com
bandoooo.com
bandoowinks.com
bareshare.org
bearflix.com
bearshare.com
bearshare.net
bearshare.org
bearshare1.com
bearshare2.com
bearsharedownload.com
bearsharefm.com
bearsharefree.com
bearsharepro.com
bearsharesucks.com
bearshrae.com
bearwire.com
being-chat.com
best-emoticons.com
bestamusing.com
bestcomical.com
bestwinks.com
boostanimations.com
bullvid.com
captainemoticons.com
captainwink.com
captainwinks.com
cartoonboss.com
cartoonbosses.com
cartooncaptains.com
cartoonchief.com
cartoonlord.com
cartoonpalaces.com
cartoonsboss.com
cartoonscaptain.com
cartoonschief.com
cartoonsfactory.com
cartoonslord.com
cartoonspalace.com
cartoonsplace.com
cartoonspots.com
cartoonswizard.com
centralcartoons.com
centralemoticons.com
chat-animation.com
chatanimation.com
chiefsmilies.com
chiefwinks.com
comicalbest.com
comicalemoticon.com
comicalfaces.com
comicalfeature.com
comicalfine.com
comicaltop.com
comicalwink.com
coolamusing.com
coolemoticon.com
coolworth.com
cute-emoticons.com
delicatecool.com
depot-emoticons.com
e-emoticons.com
emoticon-depot.com
emoticon-masters.com
emoticon-masterz.com
emoticon-message.com
emoticon-pc.com
emoticon-pcs.com
emoticonbest.com
emoticonboss.com
emoticoncaptain.com
emoticoncentral.com
emoticonchief.com
emoticonchiefs.com
emoticoncool.com
emoticonfunny.com
emoticongreat.com
emoticonlords.com
emoticonmaster.com
emoticonmasters.com
emoticonopen.com
emoticonpalace.com
emoticonpc.com
emoticonpcs.com
emoticonplaces.com
emoticonpoint.com
emoticons-amazing.com
emoticons-awesome.com
emoticons-burn.com
emoticons-extra.com
emoticons-extras.com
emoticons-info.com
emoticons-maestro.com
emoticons-market.com
emoticons-master.com
emoticons-pad.com
emoticons-pc.com
emoticons-pcs.com
emoticons-player.com
emoticons-safe.com
emoticons-station.com
emoticons-terminal.com
emoticonsace.com
emoticonsafe.com
emoticonsbest.com
emoticonscan.com
emoticonscool.com
emoticonsdepot.com
emoticonsfaces.com
emoticonsfeature.com
emoticonsfine.com
emoticonsgreat.com
emoticonsmessage.com
emoticonsopen.com
emoticonspace.com
emoticonsplay.com
emoticonspot.com
emoticonssafe.com
emoticonssmile.com
emoticonstop.com
emoticonsuniverse.com
emoticonsunreal.com
emoticonsweet.com
emoticonswizard.com
emoticonsworth.com
emoticontop.com
emoticonwizard.com
emoticonwizards.com
emoticonwow.com
emotikons-blast.com
emotikons-magic.com
emotikons-pc.com
emotikons-town.com
emotikonster.com
emotikonz.com
excellentanimation.com
excellentemoticons.com
excellentfaces.com
excellentsmileys.com
excellentwink.com
excellentwinks.com
excellentwow.com
explorium.net
extremesmiley.com
extremewink.com
face-virtual.com
facesanimations.com
facesbest.com
facesfresh.com
facessmile.com
facessweet.com
faceswink.com
facesworth.com
facewinks.com
facez-direct.com
facez-house.com
facez-log.com
facez-pc.com
facez-rocket.com
facez-site.com
facez-topia.com
facez-toyou.com
facez-volt.com
facezunique.com
fantasticavatars.com
fantasticemoticon.com
fantasticemoticons.com
fantasticsmiley.com
fantasticsmileys.com
fantasticwink.com
fantasticwinks.com
fantastigames.com
featurebest.com
featurecool.com
featureemoticon.com
featureemoticons.com
featurefunny.com
featuregreat.com
featuresmileys.com
featuresuper.com
featuresweet.com
featurewink.com
featurewinks.com
featurewow.com
fineanimations.com
fineemoticon.com
fineemoticons.com
finesmileys.com
finesweet.com
finewink.com
finewinks.com
fixbee.com
flashgreat.com
flashunreal.com
freshamusing.com
freshanimations.com
freshcomical.com
freshemoticon.com
freshfeature.com
freshfine.com
freshsmileys.com
ftalk.info
ftalk.org
ftalk4u.com
ftalkchat.com
ftalkchatting.com
ftalkconnect.com
ftalkfb.com
ftalkim.com
ftalking.com
ftalkmessenger.com
ftalkvideo.com
ftalkvideochat.com
fularo.com
fun-emoticons.com
fun4im.com
funaces.com
funemoticon.com
funnyfeature.com
funnyfine.com
funnysweet.com
funpalaces.com
getanimations.com
gimesh.com
goodnessemoticons.com
goodnessfeature.com
goodnesstop.com
goodnesswink.com
goodnesswinks.com
great-emoticons.com
greatcomical.com
greatemoticon.com
greatemoticons.com
greatwink.com
hipanimation.com
i-facez.com
i-icons-blast.com
i-icons-expert.com
i-icons.com
i-iconsteel.com
i-iconz.com
icon-special.com
icons-special.com
iconsspecial.com
iconz-touch.com
iconz-u.com
iconz-zone.com
icospecial.com
ikons-century.com
ikons-specials.com
imesh.com
imesh.net
imesh5.com
imeshfm.com
imeshgold.com
imeshlite.com
imeshnews.com
imeshplatinum.com
imeshplay.com
imeshplayer.com
imeshpremium.com
inmind.com
jzip.com
koyotesoft.com
life-chats.com
lphant.com
lphant.net
lphant.org
magneviser.com
magnevizer.com
magnivaizer.com
magniviser.com
magnivizer.net
mastemoticons.com
master-emoticons.com
masteremoticons.com
mastersmilies.com
masterwinks.com
mega-emoticons.com
messagemoticons.com
ms-iconz.com
musiclab-llc.com
my-emotikons.com
mybandoo.com
niceamusing.com
niceanimations.com
niceemoticon.com
nicesmileys.com
nicewinks.com
niceworth.com
openavatars.com
openemoticon.com
openemoticons.com
opensmileys.com
openwink.com
pc-emoticons.com
pcemoticons.com
playavatars.com
playemoticon.com
playemoticons.com
playsmiley.com
playsmileys.com
playwinks.com
plentyofavatars.com
plentyofemoticons.com
plentyofsmileys.com
pointemoticon.com
pointemoticons.com
primesmilies.com
primewinks.com
quick-animation.com
quick-ikons.com
quick-winks.com
quickwinks.com
realemoticons.com
safe-emoticons.com
safeemoticons.com
safemoticons.com
shareaza.com
shareazaweb.com
smileanimations.com
smilecomical.com
smilewinks.com
smiley-depot.com
smiley-extras.com
smiley-maestro.com
smiley-master.com
smiley-masterz.com
smiley-message.com
smiley-pcs.com
smileyaces.com
smileyartist.com
smileygreat.com
smileyopen.com
smileypalace.com
smileyplay.com
smileysbest.com
smileyscool.com
smileysfeature.com
smileysfine.com
smileysfresh.com
smileysgreat.com
smileysopen.com
smileysplay.com
smileyssweet.com
smileystop.com
smileysunreal.com
smileyswink.com
smileysworth.com
smileyunreal.com
smileywizard.com
smileywizards.com
smiliesace.com
smiliesfactory.com
smilieshome.com
smiliesmaster.com
smiliespoint.com
smiliesspot.com
smiliesuniverse.com
smilieswizard.com
special-icons.com
spicyemoticons.com
spicywinks.com
supercomical.com
superemoticon.com
superlaughable.com
superwinks.com
sweetcomical.com
sweetemoticon.com
sweetexcellent.com
sweetfeature.com
sweetfunny.com
sweetsuper.com
symbol-special.com
thebandoo.com
tinyfaces-depot.com
tinyfaces-site.com
tinyfacesite.com
tinyfacesity.com
tinyfacestar.com
tinyphaces.com
top-emoticons.com
topamusing.com
topcomical.com
topemoticon.com
topwinks.com
torch-media.com
totalanimations.com
ultimateemoticon.com
ultimatefeature.com
ultimatesweet.com
ultimatewink.com
unique-facez.com
unrealavatars.com
unrealemoticon.com
unrealemoticons.com
unrealsmiley.com
unrealwink.com
unrealwinks.com
videolab-llc.com
wink-cosmos.com
wink-quick.com
wink-worlds.com
winkaces.com
winkbest.com
winkboss.com
winkchief.com
winkcomical.com
winkcool.com
winkextreme.com
winkfeature.com
winkfine.com
winkfree.com
winkfresh.com
winkfunny.com
winkgreat.com
winklords.com
winkopen.com
winkpalace.com
winkpalaces.com
winkplaces.com
winkpoint.com
winks-cosmos.com
winks-creation.com
winks-duet.com
winks-quick.com
winks-top.com
winks-universe.com
winks-world.com
winks-worlds.com
winksace.com
winksamusing.com
winksbest.com
winksboss.com
winkscaptain.com
winkscetral.com
winkscomical.com
winkscool.com
winksextreme.com
winksfaces.com
winksfeature.com
winksfine.com
winksfresh.com
winksfun.com
winksfunviet.com
winksgreat.com
winkslaughable.com
winkslord.com
winksmaster.com
winksopen.com
winkspalace.com
winksplay.com
winksquick.com
winkssmile.com
winksspace.com
winksspot.com
winkssweet.com
winkstop.com
winksuniverse.com
winksunreal.com
winksweet.com
winkswizard.com
winktop.com
winkultimate.com
winkuniverse.com
winkunreal.com
winkwizards.com
winkwow.com
wizardemoticons.com
wizardsmilies.com
wizardwinks.com
world-winks.com
worthanimation.com
worthanimations.com
worthbest.com
worthcool.com
worthemoticon.com
worthemoticons.com
worthfaces.com
worthfeature.com
worthfresh.com
worthgreat.com
worthsmile.com
worthsmileys.com
worthsweet.com
worthwink.com
worthwinks.com
wowamusing.com
wowanimations.com
wowemoticon.com
wowemoticons.com
wowgoodness.com
wowsmileys.com
wowwinks.com[/red]
[/massrate]

Random example:

Code: Select all

http://avatarscool.com/
Download link points to: hXXp://download.bandooo.com/o/2/r/0/BandooV8.exe
VT URL scan
BandooV8.exe - VT file scan

No Spyware / No Adware / No Trojans / No Popups
Web pages are rewritten as opposed to using pop-ups, pop-unders, etc.
No Adware?
- controlled advertisements are incorporated into the rewritten HTML as announced in the Terms of Use

hXXp://www.bandoo.com/terms_of_use.php
[cite]You hereby acknowledge that the Applications use various tools to enhance Your view of Web pages which You browse by adding Bandoo features to them, such as, for example, emoticons, winks and ads. In order to provide such enhancements, the Applications automatically apply certain JavaScript code and/or other elements provided by Bandoo to the Web pages you view. By using this Site and/or the Applications, You agree and consent to having the Applications automatically apply such modifications to Web pages which you view for the purpose of adding (in Bandoo's sole discretion) any and all features and functionality currently provided by Bandoo and/or provided by Bandoo in the future. [/cite]

I'm surprised hpHosts does not have this group of domains listed adware/spyware

Exploitation defined

User avatar
evilfantasy
Posts: 2101
Joined: Thu Dec 25, 2008 4:08 am

RE: iLivid network

Post by evilfantasy » Tue Oct 02, 2012 4:58 am

Extra note:

I just noticed that Free Flv Converter placed a shortcut on my desktop for "Get The Best Facebook Chat Messenger" from [red]hxxp://www.ftalk.com/?r=135[/red]. Kind of funny as the shortcut does not work...

VirusTotal results [red]3[/red] / 30
hxxp://download.cdn.ftalk.com/cdn/o/1/r/135/fTalkV4.exe

The website is owned by Koyote-Lab Inc., part of the iLivid network.

[red][massrate]
download.cdn.ftalk.com
download.ftalk.com
ftalk.com
[/massrate][/red]

User avatar
MysteryFCM
Posts: 2486
Joined: Mon Jul 14, 2008 4:47 pm

RE: iLivid network

Post by MysteryFCM » Tue Oct 02, 2012 5:23 am

I've sent an email to the contacts I've got for iMesh/iLivid, as these issues were supposed to have been resolved.

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests