This domain was registered on 16-Jan-2006 by David Taylor under the guise of SunShine Ltd. It uses the "ANTISPYDNS.BIZ" domain for its DNS traffic. The domain is hosted by NetcatHosting who owns its IP: 195.225.176.79. What is interesting even more about the netblock is this...
This hosting company has a wmf file available for download listed (do not download this!):
traff4ppc.biz/parthner3/xpl.wmf
Guess what, yes you got it... this is the Win32/Exploit.WMF trojan. This webhosting company is hosting some nefarious stuff and should be shut down immediately. Responsible upstream providers ought to shut off the juice for them.
If you haven't heard about the WMF Exploit, or want to see a full FAQ about it, then read this article.
Other sites are hosted at NetcatHosting which I didn't research for this article (although by association I'd be very wary):
looking-for.cc
aboutme.4click.biz
195.225.176.77
www.nospywaresoft.com
Courtesy of Sunbelt-Software, this is what the Spyfalcon program looks like:
The site concerning the title of this article looks like this:
SpyFalcon's content looks awfully familiar to SpywareStrike just on looks alone eh?
Stay clear of this tool and others like it!
