Euro Software

(Also called "EuroSoft" or "All popular OEM software for PC and MAC. All EUROPEAN languages version" in web site source code.)

Description[]

Euro Software or Euro Softwares or EuroSoft or World Software is a pirated "OEM" software site, intermittently spammed in heavy bursts for multiple similar domain names. As with all pirated software, purchasing on this site means

dealing with anonymous criminals in unknown countries
giving them your credit card number
trusting that what you are purchasing actually is the software they claim it is
assuming the validation codes will work
allowing them to possibly install malicious software on your computer
if you are a business owner, taking the risk that a disgruntled former employee will report you for using unauthorized copies of software and make you the target of legal action by software manufacturers

The software vendors have been asked to comment. They have acknowledged that these sites offering software at such prices are illegal.

According to the Spamhaus ROKSO listing, Euro Softwares is hosted on IP address ranges associated with Leo Kuvayev/Bad Cow. The sites themselves have few distinctive features to associate them with a specific spam operation. IP addresses are shared with an occasional short-lived casino site. Although the domain registrations superficially resemble the identity-theft style of Yambo registrations, on investigation the registrants appear to be completely imaginary people.

False Pretenses[]

Better Business Bureau fake certificate[]

In an attempt to appear legitimate. the site has the logo of the Better Business Bureau. When you click that logo, you expect to be taken to the Better Business Bureau site to display their certificate of authenticity. But these criminals can not get any such certification, so they fake it. They dummy up a fake certificate, and serve it up from their own site. The graphic shows one such example, taken from their euromarketsoft.com web site, seen on October 15, 2009.

If you look closely at the seal, you will notice that instead of applying to euromarketsoft.com it states that

This BBBOnLine Reliability seal, and the commitments that
this seal signifies, pertain only to beyondbedding.com

But this site is euromarketsoft.com! The genuine seal for the genuine beyondbedding.com company is in the newer format, at https://www.bbb.org/online/consumer/cks.aspx?id=106111312332497

Euro Software BBB — Fake BBB certificate, click to enlarge

TRUSTe fake certificate[]

In a similar display of fraud, Euro Software sites display the logo of TRUSTe but again serve it up from their own site.

The directory of TRUSTe accredited sites at http://www.truste.com/trusted_sites/index.html#E has no reference to Euro Software or any of the hundreds of sites we sampled.

A close look at the faked certificate will show that the name of the software piracy site is in the header, in this example EuroSoftMarkets.COM, but in the text we find

EuroSoftMarkets.COM is a certified licensee of the TRUSTe® Privacy Seal Program.
The privacy statement and practices of www.shop.com have been reviewed by TRUSTe
for compliance with our strict program requirements.

Notice that the second reference is not to EuroSoftMarkets.COM but to www.shop.com. The original certificate was stolen from another company, and can be seen at http://clicktoverify.truste.com/pvr.php?page=validate&url=www.shop.com&sealid=101

Just as with the Better Business Bureau claim, this is another example of the fraud that these criminals perpetrate.

Euro Software TRUSTe — Fake TRUSTe certificate, click to enlarge

Trial version or no serial number[]

There is an admission in the Support section that you may be receiving non-genuine versions. Item 3 contains the incriminating evidence:

3. If you can not install your soft and have no serial or you have TRIAL version.
Extract archive with your software to some folder on your hard drive or on your
Desktop. Open extracted folder. Find the "README.TXT" file or "README" from this
folder and follow instructions.

Sponsoring Registrars/Hosts[]

2008/2009/2010[]

Microsoft

The abuse of Microsoft's free hosting service spaces.live.com has been ongoing since late 2008. At peak there were over 2000 abuses caught in spam traps every day. In March 2010 the abuse rate was still as high as 200 per day. Despite being aware of this abuse, Microsoft has failed to take any effective action to prevent it. Since the EuroSoft sites pirate Microsoft's products, Microsoft puts itself in a difficult position when trying to defend its copyright in the light of its known support of piracy over such a long period. Worse still, Microsoft's support of software piracy places the company in a difficult legal position, since the piracy sites also provide Microsoft's competitors' products.

A partial list of redirection sites for EuroSoft to which Microsoft has provided access:

sundowutortes.net
hopenfaras.net
probastondtes.net
dorehatotes.net
movercanotes.net
zionetovates.net
murgadobarotes.net

January/February 2008[]

Visesh Infotechnics Ltd.

aesofta.com asoftofe.com asoftohe.com asoftoje.com asoftoke.com azosofta.com bartolosoft.com britansofte.com castsofte.com dastsofte.com fabsofte.com fadsofte.com fawsofte.com fazsofte.com festsofte.com fistsofte.com fostsofte.com fystsofte.com gastsofte.com kasofte.com pastsofte.com soft-caq.com softaced.com softaded.com softahed.com softajed.com softaned.com softaseq.com softaset.com softasew.com softaved.com softawea.com softawec.com softawef.com softaweh.com softawej.com softawes.com softawet.com softawew.com softove.com softroi.com softrou.com violesofte.com xastsofte.com zasofte.com zastsofte.com zawsofte.com

Dynadot, LLC

eurosoftmarket.com

ItsYourDomain.com (recently acquired by Tucows)

tertorest.com (Name Server)

Hosts:

CNCGROUP Henan province network
Shanghai B&T Network and Telecom Inc
ZBYD Technology Co.,Ltd (also known for being a provider of bulletproof hosting for Herbal King penile enlargement sites)
TOCC (currently also hosting Express Herbal penile enlargement sites, a successor to Herbal King)

May 2009[]

The free hosting service at gigazu.net was being abused by spammers using a redirection method. The spamming of the gigazu.net sites was detected in the URIBL.COM spam honeypot revealing these redirection sites

adamsgebe5584.gigazu.net adamshyhi6579.gigazu.net alexanderbidi4266.gigazu.net andersongamu7062.gigazu.net andersonqozy5537.gigazu.net bennettvone7014.gigazu.net brooksxidu5445.gigazu.net carterlidi520.gigazu.net carterlywu3162.gigazu.net clarkfeqa2232.gigazu.net clarkzyze160.gigazu.net collinsqavi1632.gigazu.net cookfyky5411.gigazu.net cooperkody1499.gigazu.net cooperwaxa7718.gigazu.net davispyqa5355.gigazu.net edwardskaqe3034.gigazu.net edwardskybu2872.gigazu.net floresjere1592.gigazu.net fosterniqe7533.gigazu.net gonzalesfelu6444.gigazu.net gonzalezzepu9555.gigazu.net grayseqi7382.gigazu.net griffinrywu6869.gigazu.net griffinsyqi7410.gigazu.net griffintaku4094.gigazu.net hayeswisi4898.gigazu.net hernandezquwa4801.gigazu.net hilljehy6171.gigazu.net hilllopy2886.gigazu.net howardrabi2661.gigazu.net hughesxefy3986.gigazu.net jamestyku8352.gigazu.net jenkinswefa9603.gigazu.net johnsonjoxu1035.gigazu.net leewego5225.gigazu.net lewiszabe7931.gigazu.net martinwepi1490.gigazu.net millerkeko4271.gigazu.net millerkify3069.gigazu.net millertyre5604.gigazu.net millerxupa9587.gigazu.net mitchellrewo3400.gigazu.net morgankowa1814.gigazu.net morgannuqu6862.gigazu.net morganroly7971.gigazu.net morristimu8492.gigazu.net morrisxibi8348.gigazu.net morriszeny1117.gigazu.net nelsonnuhi6531.gigazu.net parkerboxe2216.gigazu.net petersonpazu1299.gigazu.net phillipsbyxo2124.gigazu.net phillipskeby6274.gigazu.net phillipsnyhy2056.gigazu.net powellcono7191.gigazu.net pricedane6501.gigazu.net riveragaco1210.gigazu.net robertstace8181.gigazu.net rodriguezmexa6912.gigazu.net rogerswovu8886.gigazu.net rosswivi1517.gigazu.net russellsuto2625.gigazu.net sanchezbaby2952.gigazu.net scottdety9139.gigazu.net scottpuho1264.gigazu.net simmonszire4112.gigazu.net stewartzeze315.gigazu.net thomasrede4113.gigazu.net thomassizy8884.gigazu.net thompsonsacu7341.gigazu.net turnermemi3047.gigazu.net wardwogu8710.gigazu.net watsonhebo7164.gigazu.net watsonwomi8203.gigazu.net whitejaqi1086.gigazu.net williamsropi4044.gigazu.net wilsonsysu2078.gigazu.net wilsontune6188.gigazu.net wilsonxaku4528.gigazu.net woodgoco2189.gigazu.net wrightfaly8436.gigazu.net

At May 1, 2009 these redirected to just one Euro Software web host - viokermante.com

Registration Service Provider:
   DiscountDomainRegistry.com
   http://DiscountDomainRegistry.com

Registrar of Record: TUCOWS, INC.
Record last updated on 29-Apr-2009.
Record expires on 09-Apr-2010.
Record created on 09-Apr-2009.

Registrar Domain Name Help Center:
   http://domainhelp.tucows.com

August/September 2009[]

Redirection abuse from Yahoo Groups has targeted several sites

Target Domain Name	Crime Sponsoring Registrar
bravisskos.com	Registrar: PLANETDOMAIN PTY LTD.
gourdanses.com	Registrar: TUCOWS INC.
grastobins.com	Registrar: INTERNET.BS CORP.
kavientos.com	Registrar: TUCOWS INC.
krapobravs.com	Registrar: TUCOWS INC.
shacestours.com	Registrar: PLANETDOMAIN PTY LTD.
snedaemos.com	Registrar: PLANETDOMAIN PTY LTD.

Sample spammed redirection URLs targeting Euro Software

Sample spam

Eurosoftware Inc with the
European Association of the Manufacturer
present Special Summer Sale.
All sofware have 50 % discount.
And note - This is the full version, not trial or test. 

Add any programs you want to the 
shopping cart and then simply enter 
the MCRS-1234 code to instantly get 50% off the total price.

http://groups.yahoo.com/group/tafeqibuxifyzulej/message/1

November 2009[]

Redirection abuse from Microsoft spaces.live.com has targeted Eurosoft

http://cid-965def53a79acc8d.spaces.live.com redirects to dorgusentos.net which is reviewed in Site Advisor

It is extremely surprising to see Microsoft's free hosting service being allowed to suport software piracy

Examples of Spam[]

September 2009, Yahoo Groups redirection abuse

Euro Software Yahoo — Yahoo Groups piracy support via redirection

March 2009 -- Hosted on Microsoft's spaces.live.com in an abuse of the terms of service

Euro Software redirection — Example of Microsoft's piracy support on spaces.live.com

Piracy of Microsoft and other vendor software on http://wietoperaste.com http://sertifore.com http://gaburgose.com - were redirected from

January 2008 -- Subject: "Skaggs Software Markets - Deals"

We have literally thousands of programs available from some of the biggest software publishers. It does not matter
if it's Microsoft, OneNote or Adobe After Effects 7 applications you need to find we have them all in stock and
more, some at less than 80% of standard store cost.

If your interested please take a peek at our site. 
http://www.softawef.com/

bye for now

Edwin Hollingsworth
Skaggs's Software Markets

before. Chiun had Security, told him about them. During let's try to keep Vietnam veteran, trained in onto the
floor, either from the elevators it was close." "I was right at whatever cost. We have to office of Tower
security,  Zuniga Self-trained sniper. Subject to fits of depression

Need some software urgently? Purchase, download and install right now! Software in English, German, French,
Italian, and Spanish for IBM PC and Macintosh! Cheap prices give you the possibility to save or buy more
software than you can afford purchasing software on a CD!

Purchasing software you can be sure you get perfectly working software, in case you are not satisfied,
we offer money refund. Quick response and advice on how to install your software are guaranteed.

http://fustsofte.com

Original software only!

Microsoft's advice[]

The advertisers use terms like "Original Equipment Manufacturer" ("OEM") software, as an attempt to explain why the offered software is so inexpensive. Spammers also include random dictionary words and paragraphs of text throughout their email to avoid anti-spam filtering technology.

Microsoft is working to educate partners and consumers about the risks of getting software from suspicious sources. We are investigating the sources of these operations and are doing everything in our power to stop this kind of activity.

Purchasing from known and trusted sources and avoiding "too-good-to-be-true deals" are the best ways to avoid suspicious software offers.

Here are some suspect signs to look for:

Beware of spam emails offering software prices that are too good to be true. Beware of offers requesting the wiring of money to foreign banking institutions. Beware of software shipping into the United States from overseas.

For more information regarding spam offering suspicious software, please visit: http://www.microsoft.com/piracy/YourPC_Spam.mspx

You may also visit our Internet site on http://www.microsoft.com/piracy and http://www.howtotell.com to review additional information on recognizing genuine Microsoft product and Microsoft's licensing policies.

Related brands[]

See the entry at OEM Software

"Royal Software: Your Software Retailer"
Page title: "OEM Software//Home"
First seen September 2010
Examples: best-softwaredownloads.com download-oem-now.com
Sharing hosting with EuroSoft and WatchShop.

How to report this spam[]

Option 1 - Complainterator[]

Report the name servers to the registrar using Complainterator. No reputable company in the Republic of China supports software piracy.

Option 2 - BSA[]

But more importantly, remember that this is a flagrant software piracy operation. You can

shut down the whole operation
provide evidence leading to the arrest of the criminals

Follow these steps

Open the pirate site, and note down a selection of software vendor names and software titles being pirated
Visit the Business Software Alliance web site
Select "Report Software Piracy"
Fill in your contact details
Fill in the matching software vendors and software titles in the reporting form
Send it off and feel better

Option 3 - list of report sites[]

JavaWoman's list of email reporting addresses, by vendor, for software piracy is an excellent resource. Some examples are shown here ready to be copied into an email cc list:

piracy@apple.com, piracy@autodesk.com, reportpiracy@borland.com, nopiracy@corel.com, tip@macromedia.com, piracy@microsoft.com, piracy@symantec.com