Results tagged “Zango” from SpywareGuide Greynets Blog

Zango's New Moon

|
Twilight.

Now that I've induced headaches and nosebleeds, let me walk you through a scam related to the upcoming New Moon movie, the second in a series of...oh, I don't know....let's roll with twelve. Twelve movies guaranteed to make you pull your hair out.

Anyway.

Youtube is filling up with lots of clips that look like this...

zangmoon2.jpg
Click to Enlarge

...and like the one below. There are some rude words, but it's important to note many of these scam vids are relying on the audience desire to see the two leads of the Twilight films bumping uglies.

zangmoon1.jpg
Click to Enlarge

...um.

So anyway, the viewer goes running off to the sites mentioned - one of which is a dubious looking Forex trading site, and I don't need to tell you that FOREX SCAMS ARE BAD - and the "install link", which is a redirect URL:

tiny.cc/kristenanal

....charming...and you arrive on a Zango install splash page, located at

boxoffice.powered-by.zango.com

which shows you lots of pictures of Iron Man, The Joker and some other random movie people in the background with Ye Olde Zango Installer in the middle of the screen. At this point, I should mention Zango have altered their "Cancel Install" button, which famously made no sense whatsoever:

bc1.jpg


"Click OK to Cancel or Click "Cancel" to continue the installation".

Well, here's the new version. It also makes no sense whatsoever, though it isn't quite as brain melting as the first.

zangmoon4.jpg

"To quit and not install, click OK. To continue installing Zango and cancel this notice, click Cancel".

Awesome.

Should you install Zango, you won't get any free movie. You won't see the red hot boinky-boinky action you were promised.

What you will see, is this website promising to "burn your boredom":

zangmoon6.png
Click to Enlarge

Amazingly - or not - New Moon is nowhere to be seen, and all of the "movies to watch" resolve to a URL that looks like this:

http:///#

As you might have guessed, you won't be watching any free movies anytime soon. The site above is Blemax.com, feel free to add it to your blocklists.

Oh, and don't be writing angry Twilight fan letters shouting at me because I said there'd be twelve films and how I'm slamming it without knowing the subject matter at hand. As everybody knows, there are four books, there will be four films, and they will all be terrible.

....I'm doing it again, aren't I?
Here's the latest site to avoid due to it being completely worthless:

streaminghddivx.com

Like so many others of its ilk, it promises tons of "free movies" in return for you installing Zango.

strhddivx1.jpg
Click to Enlarge

Shall I show you a screenshot of the funky installer before it all goes horribly wrong? Okay then. I know you love pictures of installers; who am I to argue?

strhddivx2.jpg
Click to Enlarge

Wow, "100% free unlimited access to 10000+ videos"! I guess this is the point where I say "Imagine your dismay, then, as you fire up the prompt, click Start, install Zango and click on the "Play" button for Transformers 2, only to find...."

strhddivx3.jpg 

....that you're clicking a link taking you to movies.yahoo.com instead.

What, you didn't actually think one of these pot boilers was ever going to turn out to be the real deal, did you? Oh, you didn't? Why am I not surprised...
Despite going boom, there are still plenty of Zango installs out there. I've no idea if they're still actually paying affiliates or what, but let's take a look at a recent site that's come to light anyway.

The site in question here is a typical "make money from ripped videos" effort, called

Watchjonas.info

I've never heard of the program in question, but it looks like a hideous 80s restyling of Saved By the Bell or something. Seriously, my eyes:

wtcjns0.jpg
Click to Enlarge

Eurgh...

You Get What You Pay For

|
Yet another cookie cutter movie site that gives you little or nothing in return for installing Adware? Yes please!

Much as I'd love to show you the part where it all goes horribly wrong, let's set the scene.

First, you need to throw together a website about an upcoming movie. How about.....



dragonballevolution.info

Yeah, that'll do it.

Obviously, you need to put the site up for sale as quick as you can.

dbzmvz2.jpg
Click to Enlarge

Let's make it perfectly obvious that the only reason the site exists is to trade off Adware in exchange for ripped movies:

"It also does have a streaming site (watch.dragonballevolution.info) which have the full movie streaming online (movie hosted on others video sharing host).

Most of the site income came from its streaming site which I have installed zango. It does pretty well with zango( look at the pageview per install ration on attachment).

Dragonball evolution the movie will be released in the United States this April 10, 2009. So make this the deal fast before someone else does!"


...but let's throw up a ludicrous "disclaimer" anyway:

dbzmvz3.jpg


Of course, you need to install Zango to watch the film:

dbzmvz4.jpg

Click to Enlarge

Setting aside the age problem - you need to be 18+ to install Zango, and how many people over 18 are seriously going to go looking for the Dragonball Evolution movie? - there's also the problem of it going horribly wrong.

Did I say horribly wrong?

dbzmvz5.jpg


...whoops, I guess I did.

Enjoy your "film", kids.
Remember those sites that want you to install Zango in return for ripped movies?

Sure you do.

Well, I've just seen the inevitable happen - it was only a matter of time before Zango affiliates latched onto Twitter as a means of promoting their installers. Here's a sample shot of a Twitter profile that's been firing out Zango related links since March 17th:

ztwts1.jpg
Click to Enlarge

Depending on which link you click (and there's quite a lot of them), you'll end up seeing something like this:

ztwts2.jpg
Click to Enlarge

Of course, you'll only see any content on the site if you agree to the Zango install.

The site in question here is

newtvstream.com

I'd imagine there are plenty more Zango affiliates firing out links on Twitter, so if you see people advertising "free movies" or TV shows, there's a good bet you'll be taken to a Zango installer prompt...

Installer Fail?

|
I'm not quite sure what's going on with

avatarchapters.org

But if you want to watch their poor quality, illegally ripped episodes of Avatar: The Last Airbender (quite possibly the stupidest name for anything, ever) then this happens:

avchpr2.jpg
Click to Enlarge

Isn't the popup supposed to prevent me from tasting forbidden fruit until I install Zango?

Oh well. As a side note, just when I was about to leave the website, this appeared:

avchpr3.jpg

Do you really want me to answer that, kid?
Runescape. I've never played it, but thanks to the handy Wikipedia article I can tell you that:

"RuneScape is a Java-based Massively Multiplayer Online Role-Playing Game operated by Jagex Ltd. Recognised by Guiness World Records as the world's most popular free MMORPG, RuneScape has approximately fifteen million active free accounts and is a graphical browser-based game with a large degree of 3D rendering."

The Runescape creators don't like Bots very much. In fact, a thriving underworld of botting, cheating and leet haxing exists with a wealth of program sharing and information sharing taking place. Along with Habbo Hotel, it's where a lot of wannabe Phishers cut their teeth. With that in mind, I thought we should take a look at the following website

rzhx0.jpg

Here's a sample screenshot. Funky advert for powerlevelling aside, check out the text beneath it:

nexz1.jpg
Click to Enlarge

"iBot Lite is the BEST Free RuneScape Bot around. We offer it for free, or you can suscribe to the paid version(which has more features). However, if you just would like to automine, autofight, etc. on RuneScape, then you can try out the FREE iBot Lite Version. If you want more features, and want to run more bots, and make MORE money, then please consider purchasing iBot Pro. This is the BEST RuneScape Bot EVER released for FREE! As well as the best PAID RuneScape Bot EVER!"


That sounds like all sorts of wrongness. Sure enough, visit the forum and you're presented with a wide array of downloads. One in particular, for a program called iBot / neXus, caught my eye.

nexz2.jpg

Note that they claim more than eighteen thousand downloads - this will be important in a few moments.

What happened next is a bit of a first for me - a Zango installer prompt, launched from a forum instead of a regular website. Even better (or worse), check out the text on the Zango popup:

nexz3.jpg
Click to Enlarge

I'm pretty sure it can't be a good thing to have "Click start to download your Runescape hack" and "& see our new glitch to get past 3k limit" on one of your installers.

The site has been around since 2006, but because Internet Archive hasn't save any of the installer pages there's no way to know how many of those 18,000+ downloaders installed Zango to get their hands on the missing Bot program, though we do know they've been on there since at least February of this year.

Wait, did I just say "missing"? Yep, because in a humorous twist, it seems the site owners want you to download Zango and then give you a missing download.

nexz4.jpg


Really guys, how are these sites getting through quality control?

When I think of all the great (and not so great) moments in history, I sometimes wish there was a place where I could see all these different events.

The good news is, there is. The bad news is, it's not very good.

Presenting the wonderfully named

encyclomedia.com

My eye was initially drawn to the main splash on the site, nothing less than the "I Have a Dream" speech by Martin Luther King:

mlk1.jpg
Click to Enlarge

Aside from the fact the above clip is extremely short, the really interesting part is the Zango branded banner adorning every videopage.

At this point, the randomness of the website comes into play. As with many sites offering Zango adware, what's offered doesn't match up to what's on offer. Case in point, click the Zango banner and instead of being handed what you're looking for - in this case, history videos - you're given...

mlk2.jpg
Click to Enlarge

...Jessica Simpson and Mischa Barton. I don't know about you, but I don't recall seeing Pam Anderson on the steps of the Lincoln Memorial. Okay, I hear you say - that's just some goofy marketing gone awry. It happens.

Sure it does. But as you wade through the site and see increasingly heavy duty material such as the Holocaust offered up as an incentive to install Zango:

mlk3.jpg

...is it too much to ask that when you click through to see more historical videos, the first thing you see isn't Pamela Anderson in a see through top?

mlk4.jpg


Stay classy, guys.

Maybe it's just me, but I think the owner of the site in question should perhaps put a little thought, care and respect into what they're promoting versus what they're actually sending people to. As it stands, it's just another cookie cutter website designed to send as many people as possible to the Zango website for some $$$ in the most tasteless, thoughtless way possible.

As a closing note, here's the full "I Have a Dream" speech, with no condensed videos, Zango or breasts in sight. I also have a dream, which involves tasteful advertising.

It's quite a long way off...
zangani1.jpg

For a long time now, I've wondered exactly why so many people are creating identikit websites, all asking you to install Zango in return for "free" movies and TV shows, almost always illegally ripped and streamed without the permission of the rights holder.

These sites have become something of a plague over the last year or so, and sometimes they seem to tie into other areas such as cookie cutter sites offering games. Who can forget the wonderful Batman game from a few months ago that followed the same template as the movie sites?

At any rate, I've spent quite some time trying to find out who could have come up with the idea of telling everyone to run out and make these movie / TV sites. It stands to reason that the idea of creating these things en masse and rolling them out to the public at large must have had a good, solid nudge from somewhere, right?

Well, step right up, interesting and faintly outrageous PDF Document.

For your eyes only, Ladies and Gentlemen:

"Annihilating Zango For Skyrocket Profit".

No really, that's the title.

zangani2.jpg
Click to Enlarge

What we have here, is nothing less than an instruction manual encouraging people to go out and create as many of these movie streaming cookie cutter sites as possible to make a tidy profit from installing Zango. I should add, right at the outset, that this has NOT been created by Zango - rather, an enterprising person (or persons) that decided to hop on the gravy train.

Indeed, check out the comical "disclaimer":

zangani3.jpg

This entire document promotes illegal streaming to make a profit and unethical activity (it even has section on how to get an account approved with Zango if you've been previously rejected), yet the creator says "I'm not responsible".

Well, there's a surprise
.

Even better, he says "You have NO rights to distribute this document", yet he stomps upon the copyright of the TV show creators he's making money from without permission. Once again, I'm shocked. On the bright side, I'm definitely not "dumb" where obtaining a copy of this document is concerned, because I woke up to find it tucked under my pillow.

Moving on, the rest of the introduction gives you a general rundown on Zango, payout rates and a screenshot of his earnings. Then we come to this:

zangani5.jpg
Click to Enlarge

I'd take issue with this being the "only unethical thing" in the PDF, considering the whole thing is based on generating profit from pirated movies but anyway. Some choice extracts:

"Now, when you signup with Zango, use some fake details" is a nice start. I've blanked out his actual method for attempting to scam Zango, but honestly? I'm a little surprised that he claims such a stupid technique actually works.

As for this:

"...I've never been verified by phone, because I registered under a famous Zango user and he simply told them to accept me anyway"
.

If that's true, I'm dazzled - especially given that this guy is the King of promoting installs via pirated material in PDFs you have to pay 10 to 15$ to obtain.

The next section shows you how to build a site quickly, targeting the TV shows most likely to make you a lot of money. Oh, I forgot - the package comes with phpvideoscript, which enables you to build an endless stream of identikit websites.

zangani6.jpg

Handy, eh?

zangani7.jpg

Good job Lost is keeping him rolling in the money. It goes a bit wrong on the next page though, because he leaves what is apparently his Zangocash username in the screenshot.

zangani8.jpg
Click to Enlarge

Say hello to xMastex! If Zango are reading this, you might want to go slamdunk his account in a ditch (if you haven't already), seeing as he's

1) Making money from PDFs ready rolling websites designed to profit from illegally ripped TV shows and movies via installs of your Adware and
2) Giving out "unethical" advice with regards joining your program with fake details.

zangani9.jpg
Click to Enlarge

As you can see above, he then goes on to list the best places to grab ripped streams, ready to be placed on your freshly created army of websites. Because of the system used to manage the sites you've created, you can add a stupid amount of videos to the pages with little to no fuss:

zangani10.jpg
Click to Enlarge

The rest of the document covers sites to submit your movie links to, traffic boosting and tricks involving places such as Sidereel.com. Oh, and this:

zangani11.jpg

...I thought the only unethical part of this PDF was the bit where they signed up to Zango with fake information? Oh well.

Who is Doing This?

Well, there's a bit of a tangled web where that's concerned. A number of different names are used in Whois for many of the sites referenced by "Mastex" on various places, the document signs off as "Stefano" and there's apparently an updated version of this document floating around on the net too.

To make things more complicated, it seems there are quite a few people now making their own versions of these PDFs.

There's usually a trail though, and sure enough I happened to find a review of one of these PDFs where someone is asking for "review copies". It's screenshot time:

zangani12.jpg

It's pretty likely "Marko" and Mastex aren't the same people,  because Stefano appears here as Mastex on Digg - but he's certainly promoting one of his own PDFs. The reviewer blanked out the URLs, but it's not too difficult to Google Marko + Gossipgirl websites ...

zangani13.jpg
Click to Enlarge

Look at that - someone called Marko spamming links to viewgossipgirl.info, via a number of streaming sites. However, the really interesting bit is the Digg link.

zangani14.jpg
Click to Enlarge

Well, I'm surprised by all the "watch free episodes online" links. Honestly.

Do a Whois search on Sick-Videos.net, and...

zangani15.jpg

Man, someone forgot their anonymous Whois Guard, didn't they?

The document Marko is pushing seems to be different from the original Mastex version, so it's entirely possible there's a whole industry out there involving people creating (then selling) their very own "make money in a dubious fashion" PDFs. All of the Marko sites that offered up Zango (here's one) seem to have had the Zango popup removed so perhaps they killed his account - but that doesn't mean he has to stop selling his PDFs. And so the industry continues to grow.

The question is, when is someone going to do something about it?
Jonathan Ross, the well known TV presenter has found himself the subject of a website promoting his television show. Unfortunately, it's nothing to do with him and only exists to install Zango Adware onto PCs.

The site in question is

ross-show.info

and looks like this:

jross1.jpg
Click to Enlarge

Pretty, isn't it? Anyway, click into any of the episodes and you'll see a Zango installer.

jross2.jpg
Click to Enlarge

He doesn't look too happy about having his head pasted onto an adware prompt, but oh well.

What really made me laugh about this website was the usual boilerplate disclaimer at the bottom of the page:

"Disclaimer: We are not responsible for any content which is streamed through this website. If any damage occurs by the use of information presented here, only shall the content provider be held liable.The streaming videos that has been found here are hosted by third party. Any copyrighted videos, pictures or music is a property of the original copyright holder and it was found on third party sites. Therefore for any copyright violations, the owner of this blog is not liable."

Oh really? Is the owner of the blog "not liable" when we find the person uploading at least some of the content is what appears to be....

jross5.jpg
Click to Enlarge

....the owner of the blog?

This person is seemingly ripping, then uploading BBC material to promos on Youtube to make a quick profit from Zango. Some of the other sites out there doing this can try and squirm out of copyright related shenanigans by linking to videos hosted in China - nothing to do with us, someone else uploaded it - but here we apparently have the site owner himself uploading the copyrighted content.

Funnier still, once you've actually installed Zango, all of the pages look like this:

jross10.jpg
Click to Enlarge

There's a complete lack of videos. Whether you browse the site in IE or Firefox, there's nothing there. If you go back and check out what any of the supposed episode pages look like before you install Zango, you can see one of the "movie" windows behind the installer prompt. Note the length of the clip:

jross11.jpg
Click to Enlarge

Every single video has a running time of 8:10.

Could it be - and I don't want to appear overly cynical here - that the supposed Youtube videos "featured" on site are nothing more than jpegs of a Youtube video window? The alternative is the site is coded extremely poorly and there's some sort of glitch preventing you from watching a ream of episodes that all last exactly 8:10.

Either way, it's not the greatest deal going, especially when the people promoting the site on Youtube place messages such as these in their videos to bait people in:

jross12.jpg

Maybe Jonathan Ross should do a show about it...

Mygamesfile, Revisited

|
Not so long ago, I wrote about

Mygamesfile.com

a site that promised "games", but insisted you download and install Zango before being taken to a series of extremely failure-filled demo versions. Well, I've been back to the site lately and things seem to have changed a little bit.

If you hit the "Download" button now:

downloadhl2.jpg

 ...pretty, isn't it?.....you'll see this appear in the bottom left hand corner of your browser:

downloadhl3.jpg

However, instead of being taken to the Zango gateway like you were previously, the screen flashes briefly and you're taken directly to the demo download.

In other words, no more Zango.

If I had to guess, I'd say Zango have either cancelled the site owners account, or it's still live but they're blocking him. Either way, the site is no longer making people install something before presenting them with a major letdown in the form of lame demo versions. So hey, if someone from Zango is reading this and you did indeed whack the account - thanks.
Let's take a look at

Mygamesfile.com

....a website that promises much, and delivers little.

You may have seen these adverts in circulation on ad networks recently:

hl2.jpg


fall3.jpg

Snap5.jpg

In each case, the advert promotes a popular videogame - most notably Half Life 2 and Fallout 3 in the above examples. The adverts are pretty clear - a picture of said game, and "Free, Legal". It seems reasonable to expect a deal has been made to allow you to obtain the advertised titles for free, legally.

Of course, it's all about to go horribly wrong.

Visit the site, and you quickly notice a few things - many 404 errors, pages that loop back on themselves and a lot of this:

lorem.jpg
Click to Enlarge

...hmmm. Moving swiftly on, we can see elements of the site are starting to slip from "reasonable" to "slimy". Namely, this:

Snap1.jpg
Click to Enlarge

"Download Half Life 2" sits proudly at the top of the page - at this point, you'd expect the full game, wouldn't you? Especially as beneath the Download button sits a number of green bars with "Server Load" written on them - each showing a different percentage. You would think this is further evidence of the site pushing out large sized downloads of the full game - imagine your dismay, then, when you shortly discover the "Server Load" graphics are entirely fake and don't represent anything at all.

Hit the Download button, and you'll see this:

Snap22.jpg
Click to Enlarge

An install prompt for Zango, pre-ticked (of course) and also giving you the option to have "free ShopperReports", whatever that is. Without installing this, you have no way to access the wonderful free game download waiting for you on the other side.

So you accept the prompt, and install Zango & company on your PC in return for the promise of a "free game".

What do you get?

Snap4.jpg
Click to Enlarge

A CNET download page offering up the Half Life 2 demo of ONE LEVEL, is what you get.You can't even play it unless you install Steam and create an account.

Yes, you've just been taken for a ride.

Even better than that, the site owner (who registered the URL anonymously, of course) can't even be bothered to offer up the correct downloads. The second advert in this article clearly shows Fallout 3, and the Fallout 3 "download page" says this:

Fallout 3 is the third game in the great Fallout Series. It is a single player RPG action game that takes place in Washington DC, following a nuclear war. 200 years after the war, survivors live safely in a fallout shelter named Vault 101. When you find that your father has inexplicably left Vault 101, you follow him to the outside world. A world filled with Super Mutants, Giant Insects, Raiders, and Slavers.

Fallout 3 allows you to explore the entire former city of Washington with near limitless freedom. The game can be played from either 1st person, or 3rd person perspective, and the course you take throughout is entirely up to you.

On top of all this, Fallout 3 renders its environment in eye popping graphics. Every explosion, every character, and every piece of scenery is displayed in full HD, creating a really powerfull experience. This is definitely a game that must be played.

Download Fallout 3 now! Just click start on the next page.


Sounds awesome, doesn't it? Imagine the look on your face, then, when you've installed Zango, been taken to the download page and....

fall4.jpg

...you're offered a PROTOTYPE from 2003 that doesn't even resemble the game eventually released last year. It's so far removed from the promised game it's not even funny:

"While playable, Van Buren is a pre-alpha tech demo, never intended for public consumption. Many features, including combat, aren't fully implemented, the graphics are very basic, and it is extremely buggy. It is also has no connection whatsoever to the Fallout 3 project currently being developed by Bethesda."

What's particularly humorous here is that their adverts say "MyGamesFile does not host or link to illegal software". However, if you read how this "not for public consumption" demo was made available in the first place....

"Oddly enough, one day after putting a tooth I lost during a biking accident under my pillow, I woke up and found a CD under my pillow. Putting it in my computer, I found out it contained something called "demo.rar". Unzipping it, guess what I found. So thank you, tooth fairy"

Whoops. The demo seems to be "on general release" nowadays, but its origins seem somewhat "under the counter", to say the least. In case you were in any doubt just how different these two are, this is Van Buren:

vb1.jpg
Click to Enlarge

...and this is Fallout 3:

fo3.jpg
Click to Enlarge

The prosecution rests, your Honour.

Just when you think it can't get any stinkier, you scroll right down to the bottom of the page.

Do my eyes see something there? Why yes, they do.....sort of.

fakeout.jpg

Oh my, dark grey text on a slightly lighter grey background. I wonder why they did that? Well, probably because it says this:

"MyGamesFile does not host or link to illegal software. All links are to legal, demonstration versions."

After all, nobody would install Zango (making the site owner money) if they were fully aware going into this "deal" that they could get these same demos elsewhere with no need to install anything, am I right? And if they furtively admit to doing nothing more than linking to demos elsewhere, what's with all the fake "server load" graphics all over the place?

This site fails.

It reminds me a little of the fake Batman MMORPG website from a few months ago - more importantly, it highlights how Zango continue to let bottom of the pile, cookie cutter sites like this through their Q&A process.

I'm willing to bet there's more of these out there. For now, the easiest way to ensure you don't get fooled by "offers" such as this is to switch off Javascript, then hit the "Download" button. If you're taken to something like Fileplanet or a Download.com Demo page, you know to back out slowly, not making any sudden movements...
According to this article in Globes Online:

Sources inform ''Globes'' that online media company Zango Inc. has closed its R&D center in Tel Aviv and fired all 50 employees. In June, the company laid off 75 employees, including 20 in Israel because of a drastic slide in the number of users and revenue, which forced the company to revamp its business plan.


There's a little more information here at the Zango blog.
There's been a recent surge in interest with regards the fake Batman MMORPG game from a few weeks ago - meanwhile, the digging has continued and some interesting bits and pieces have come to light.

If you examine the Whois details for some of the sites on the server related to this lot, you quickly find something strange. Despite all of the domains looking and acting the same, some of them are registered anonymously, while the majority have full contact details. As an example, let's take

adventure-quest-hacks.info

Here are the Whois details for this site - as you can see, this webpage (like a good portion on the server) are registered to a named individual in Canada (as opposed an anonymous registrant like the original Batman MMORPG website). There is a Google Ad at the bottom - however, the publisher ID is different to the ID that was used to roll out the fake Batman game advert so that doesn't help lead us to the potential identity of the site owner.

The only real thing of note with regards this person in Google is this post, where he's looking for someone to work with him on a "Browser Based RPG Game" so that's not much use either.

Of course, there's no way to know for sure who the fake Batman game website was / is registered to. However, I am curious why there appear to be a number of near-identical sites (in terms of content, the way they've been put together and general all-round execution) on the same server registered to this individual. Almost every site on that server has been made in the same way, with a single intention - convince the end-user to install Zango in return for everything ranging from empty lies to near-worthless content that could have been obtained elsewhere.

Is that name there as a placeholder for someone else? Does he own the server but not the sites (and if so, shouldn't the site owners actually be listed in the Whois details)? Could there be a group of individuals all running a couple of sites each and taking their own split of the profits (which would explain why some sites are tied to names and others are anonymous)?

More importantly, shouldn't Zango be taking a closer look at the sites listed here and here and (perhaps) canceling those affiliate accounts too?