Bad guys go nuts on SiteAdvisor

Presumably in an effort to undo the work done by us good guys, it seems the bad guys are now going absolutely nuts on SiteAdvisor, deliberately mis-rating good sites as bad, and bad sites as good.

This user for example, who rated a slew of malicious sites as bad, and a few good sites (hosts-file.net, mywot.com and err - this blog?) as bad;

http://user.siteadvisor.com/forums/search.php?searchid=27722

How do we know who these guys are? Well lets take one random site they rated as good, mcafee-malware.com;


Who is this site? Well, Google had quite a bit to say, that kinda contradicts this user;

http://www.google.com/safebrowsing/diagnostic?site=http://mcafee-malware.com/&hl=en

Namely:

What happened when Google visited this site?

Of the 349 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-08-02, and the last time suspicious content was found on this site was on 2009-08-02.
Malicious software includes 219 scripting exploit(s).

This site was hosted on 1 network(s) including AS49314 (NEVAL).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, mcafee-malware.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

Yes, this site has hosted malicious software over the past 90 days. It infected 147 domain(s), including waltainfo.com/, celebritysweating.com/, deafindieelephants.com/.

For additional kicks n giggles: Google Diagnostic page for AS49314

mcafee-malware is hosted at 91.212.198.53 (NEVAL - Individual retailer Nevedomskiy A A). Not surprising of course, the CNET, shows it hosts a slew of exploit and other malicious domains, and 91.212. hosts over 800 malicious domains (the history shows over 1000!!), including;

091809.ru
0day33hours.com
1000league.com
1year2months.com
4-open-davinci.com
4pok.cn
57yq57.davtraff.com
7mzkrq.davtraff.com
acollision.com
acousticnail.cn
addedantiviruslive.com
addedantivirusonline.com
addedantiviruspro.com
addedantivirusstore.com
adscene.ir
advancedspl.com
advanced-virusremover2009.com
alltwiyh.org
anchorroofs.com
anti-fish.ir
anti-spyware.ir
antispyware-scannerv3.com
antivirus-2009-ppro.com
ap.clubmillionswow.cn
apprecearlyrock.com
arakhnity.com
arch1day.com
ascertaindiseasepro.cn
atioqe.cn
badrobbots.com
banasmortgageltd.com
bankinggolf.cn
baseupdatecenter.com
best-adultnet.com
bestcountedantivirus.com
bestcover2u.cn
bestcover4u.cn
bestcover4you.cn
bestcoverforyou.cn
bestdefenselive.cn
bestexaminedisease.cn
bestfriskviruslive.cn
bestprotectiononline.cn
best-xxxnet.com
bigcoverlive.cn
bigdefense2u.cn
big-pornnet.com
bigprotectionlive.cn
biztraff.eu
blendlot.cn
blogtransaction.cn
bmt.tw
bookproud.cn
bottleoneexpress.com
bro.tw
buidnote.com
bwgm.schoolh.cn
bxv.peopleopera.cn
cacbuhub.cn
calvinzfunz.com
cameronzfunz.com
camillezfunz.com
candicezfunz.com
cargoex.info
cheapbestgeneric.com
cleverkit.com
clubmillionswow.cn
codoromon.com
cokiran.com
colliders.org
consultingalliance24.com
coqhecup.cn
countedantiviruspro.com
crazysp0rt.cc
crd.tw
currentlywork.com
davtraff.com
delawaregambling.com
designroots.cn
dmr.tw
dollaradmin.ru
dollarpoint.ru
drawingstyle.cn
dreamlitediamond.cn
easyaddedantivirus.com
easybestprotection.cn
easycheckpoisonpro.cn
easyfriskdisease.cn
easyincomeprotection.cn
easypersonalprotection.cn
easyserviceprotection.cn
edcomparison.com
erogayxxx.com
eurosport.com
examineillnesslive.cn
examineillnessstore.cn
examinepoisonstore.cn
exodih.cn
exousyt.cn
fast-scan-your-pcv3.com
feptuaq.cn
fer5woi.ru
fifiyfiyfvio.com
filaaonw1mer.net
financeimprove.cn
fossmossposs.com
freak-vkontakte.net
freak-vkontakte.us
free-antivirus-engine.com
free-antiviruses.com
freeantivirusplus09.com
freecoveronline.cn
freecoverstore.cn
freedefense2u.cn
freedefenseforyou.cn
free-porn-xmovies.com
free-tube-video-central.net
fremoperka.com
friskdiseaselive.cn
fuadrenal.com
furiade.com
fzfaw6.davtraff.com
gamblingalabama.com
gamblingalaska.com
gamblingarizona.com
gamblingarkansas.com
gamblingcalifornia.com
gamblingcolorado.com
gamblingconnecticut.com
gamblingdelaware.com
gamblinggeorgia.com
gamblingidaho.com
gamblingillinois.com
gamblingindiana.com
gamblingiowa.com
gamblingkansas.com
gamblingkentucky.com
gamblinglouisiana.com
gamblingmaine.com
gamblingmaryland.com
gamblingmassachusetts.com
gamblingminnesota.com
gamblingmississippi.com
gamblingmissouri.com
gamblingmontana.com
gamblingnebraska.com
gamblingnewhampshire.com
gamblingnewjersey.com
gamblingnewmexico.com
gamblingnorthcarolina.com
gamblingnorthdakota.com
gamblingohio.com
gamblingoklahoma.com
gamblingpennsylvania.com
gamblingrhodeisland.com
gamblingsouthcarolina.com
gamblingsouthdakota.com
gamblingtennessee.com
gamblingutah.com
gamblingvermont.com
gamblingvirginia.com
gamblingwashington.com
gamblingwestvirginia.com
gamblingwisconsin.com
gamblingwyoming.com
gamingalabama.com
gamingalaska.com
gamingarizona.com
gamingarkansas.com
gamingcalifornia.com
gamingcolorado.com
gamingconnecticut.com
gamingdelaware.com
gamingflorida.com
gaminggeorgia.com
gamingidaho.com
gamingillinois.com
gamingindiana.com
gamingiowa.com
gamingkansas.com
gamingkentucky.com
gamingmaryland.com
gamingminnesota.com
gamingmississippi.com
gamingmissouri.com
gamingmontana.com
gamingnebraska.com
gamingnewhampshire.com
gamingnewjersey.com
gamingnorthcarolina.com
gamingnorthdakota.com
gamingohio.com
gamingoklahoma.com
gamingpennsylvania.com
gamingrhodeisland.com
gamingsouthcarolina.com
gamingsouthdakota.com
gamingtennessee.com
gamingtexas.com
gamingutah.com
gamingvermont.com
gamingvirginia.com
gamingwashington.com
gamingwestvirginia.com
gamingwisconsin.com
gamingwyoming.com
getantivirusplus09.com
getantivirusplusnow.com
getcheapgeneric.com
goniont.com
goodknight.info
google-analyze.cn
google-analyze.org
gotbotnet.ru
greatsolforbuz.com
greatsolforbuz1.com
happycoinbox.com
heartdomainer.cn
hikimounttrail.com
homnitell.cn
hondaavto.com
hotxasib.cn
housedomainname.cn
iapaymentpro.com
ia-payment-pro.com
ia-scannerpro.com
ia-scanner-pro.com
idahogambling.com
illegaltopcounters.ru
inguaro.com
islandtravet.cn
italiavideoclip.com
jaymarkets.cn
k1l3r.ru
kaktotak.net
kauitour.com
kembe2.davtraff.com
kiskecaq.cn
kovsutap.cn
kvk.housevisual.cn
larurinsa.com
legrifal.info
lemmydislikes.com
lifenaming.cn
lisexin.com
liteauction.cn
litefront.cn
loshadinet.com
makefred.cn
mal-waredoc.com
m-analytics.net
maragoga.net
mcafee-malware.com
melodynew.cn
merielied.cn
molo.tw
montanagambling.com
moskva.fm
mougoalivee.com
movie-loader.net
munobatuno.com
musicdomainer.cn
mx.moskva.fm
mxout.moskva.fm
myascertainpoison.cn
mybig-porn.com
mybig-portal.com
mybig-xxx.com
mycheckdiseasepro.cn
mycheckdiseasestore.cn
mydefense4u.cn
mydefense4you.cn
myexaminevirusstore.cn
myguardforyou.cn
mymytube.com
myplusantiviruspro.com
my-porn-archive.com
myrurrly.com
nakadshima.com
nakedfriday888.com
nameguards.cn
namespacecates.com
ncux.asia
ncux.biz
ncux.tv
ncuxlist.com
nebraskagambling.com
neteck.com
newguard2u.cn
newguard4u.cn
newguard4you.cn
newguardforyou.cn
newhampshiregambling.com
newhappymay.com
newtransfer.cn
nextfreedollar.com
nicescores.cn
nissanlife.com
northcarolinagambling.com
northdakotagambling.com
ns1.cjhfgtewuy.com
ns1.dmdnssrv.info
ns1.dnsmytruedns.com
ns1.eurohost.biz.ua
ns1.megahostname.biz
ns2.cjhfgtewuy.com
ns2.datinglab.net
ns2.megahostname.biz
oceandealer.cn
odile-marco.com
odmarco.com
online2163.com
online2168.com
onlinedetect.com
onlinescanxppro.com
ontest112233311.ru
panmap.in
pcantimalware.com
pc-privacydefender.com
pennsylvaniagambling.com
peopleopera.cn
pfgcorp.eu
powerantivirusscannerv3.com
protection-centre.com
protectionsystemlab.com
pub.oceandealer.cn
pubilcnameserver7.com
qwehost.com
rainfinish.cn
realantivirusplus09.com
refugepro.cn
resourcebahbah.com
reycross.cn
reycross.com
reycross.net
rhodeislandgambling.com
rmi.tw
roomsme.cn
roselambda.cn
rot77.biz
rx-promotion.com
rxstorepro.com
rx-white.com
salireal.com
sandiiegoexpo.ru
seamodern.cn
securedvirusproscanner.com
share-paint.com
smartantivirusplus09.com
smilecasino.cn
softwaresense-search.com
soldiersoftware.net
southcarolinagambling.com
spfighter.com
splo2day.com
spyware-fight.com
stakeshouse.cn
startagplants.com
stopbadwareorg.com
super-porn-hub.com
sutra2day.com
suxpymi.cn
swwfight.net
symphonygold.cn
tedixyt.cn
tennesseegambling.com
tinnily.info
top-downloadnet.com
topmedschoice.com
top-xxxnet.com
totalbuckler.com
total-buckler.com
toyotafoall.com
tracker.likedevil.com
trafficshop.tw
travetbeach.cn
travets.cn
tsunabataki.com
tubez-boobez.com
tubezzz-boobezzz.net
updatedate.cn
use-sena.cn
us-machinery.com
va.litefront.cn
veremur.com
vermontgambling.com
video-info.info
vilasse.cn
vilihood.cn
virus-analysis.com
vitamingood.cn
vkanlakte.cn
vkontakte.tc
washingtongambling.com
webtopsearch.com
welovemovie.com
wexwefoh.cn
workfuse.cn
worksean.cn
worldofwarcry.cn
www.0day33hours.com
www.1000league.com
www.1year2months.com
www.4-open-davinci.com
www.4pok.cn
www.acollision.com
www.acousticnail.cn
www.adayby.cn
www.addedantiviruslive.com
www.addedantivirusonline.com
www.addedantiviruspro.com
www.addedantivirusstore.com
www.adscene.ir
www.advancedspl.com
www.advanced-virusremover2009.com
www.alert-pay.biz
www.alltwiyh.org
www.anchorroofs.com
www.anti-fish.ir
www.anti-spyware.ir
www.antivirus-2009-ppro.com
www.apprecearlyrock.com
www.arakhnity.com
www.arch1day.com
www.atioqe.cn
www.avplus247.com
www.av-plus-pay-online.com
www.badrobbots.com
www.banasmortgageltd.com
www.bankinggolf.cn
www.best-adultnet.com
www.bestcountedantivirus.com
www.bestcover2u.cn
www.bestcover4u.cn
www.bestcover4you.cn
www.bestcoverforyou.cn
www.bestdefenselive.cn
www.bestexaminedisease.cn
www.bestfriskviruslive.cn
www.bestprotectiononline.cn
www.best-xxxnet.com
www.bigcoverlive.cn
www.bigdefense2u.cn
www.big-pornnet.com
www.bigprotectionlive.cn
www.biztraff.eu
www.blendlot.cn
www.blogtransaction.cn
www.bookproud.cn
www.bottleoneexpress.com
www.bro.tw
www.buidnote.com
www.cacbuhub.cn
www.calvinzfunz.com
www.cameronzfunz.com
www.camillezfunz.com
www.candicezfunz.com
www.cargoex.info
www.che2s32.com
www.cheapbestgeneric.com
www.clubmillionswow.cn
www.codoromon.com
www.cokiran.com
www.consultingalliance24.com
www.conylti.com
www.coqhecup.cn
www.countbiz.com
www.countedantiviruspro.com
www.crazysp0rt.cc
www.currentlywork.com
www.davtraff.com
www.delawaregambling.com
www.dollaradmin.ru
www.dollarpoint.ru
www.drawingstyle.cn
www.dreamlitediamond.cn
www.easyaddedantivirus.com
www.easybestprotection.cn
www.easyfriskdisease.cn
www.easyincomeprotection.cn
www.easypersonalprotection.cn
www.easyserviceprotection.cn
www.edcomparison.com
www.erogayxxx.com
www.esli.tw
www.examineillnesslive.cn
www.examineillnessstore.cn
www.examinepoisonstore.cn
www.exodih.cn
www.exousyt.cn
www.feptuaq.cn
www.fifiyfiyfvio.com
www.filaaonw1mer.net
www.financeimprove.cn
www.fossmossposs.com
www.freak-vkontakte.biz
www.freak-vkontakte.com
www.freak-vkontakte.net
www.freak-vkontakte.us
www.freeantivirusplus09.com
www.freecoveronline.cn
www.freecoverstore.cn
www.freedefense2u.cn
www.freedefenseforyou.cn
www.free-porn-xmovies.com
www.free-tube-video-central.net
www.fremoperka.com
www.friskdiseaselive.cn
www.fuadrenal.com
www.furiade.com
www.fusionheart.cn
www.gamblingalabama.com
www.gamblingalaska.com
www.gamblingarizona.com
www.gamblingarkansas.com
www.gamblingcalifornia.com
www.gamblingcolorado.com
www.gamblingconnecticut.com
www.gamblingdelaware.com
www.gamblinggeorgia.com
www.gamblingidaho.com
www.gamblingillinois.com
www.gamblingindiana.com
www.gamblingiowa.com
www.gamblingkansas.com
www.gamblingkentucky.com
www.gamblinglouisiana.com
www.gamblingmaine.com
www.gamblingmaryland.com
www.gamblingmassachusetts.com
www.gamblingminnesota.com
www.gamblingmississippi.com
www.gamblingmissouri.com
www.gamblingmontana.com
www.gamblingnebraska.com
www.gamblingnewhampshire.com
www.gamblingnewjersey.com
www.gamblingnewmexico.com
www.gamblingnorthcarolina.com
www.gamblingnorthdakota.com
www.gamblingohio.com
www.gamblingoklahoma.com
www.gamblingpennsylvania.com
www.gamblingrhodeisland.com
www.gamblingsouthcarolina.com
www.gamblingsouthdakota.com
www.gamblingtennessee.com
www.gamblingutah.com
www.gamblingvermont.com
www.gamblingvirginia.com
www.gamblingwashington.com
www.gamblingwestvirginia.com
www.gamblingwisconsin.com
www.gamblingwyoming.com
www.gamingalabama.com
www.gamingalaska.com
www.gamingarizona.com
www.gamingarkansas.com
www.gamingcalifornia.com
www.gamingcolorado.com
www.gamingconnecticut.com
www.gamingdelaware.com
www.gamingflorida.com
www.gaminggeorgia.com
www.gamingidaho.com
www.gamingillinois.com
www.gamingindiana.com
www.gamingiowa.com
www.gamingkansas.com
www.gamingkentucky.com
www.gamingmaryland.com
www.gamingminnesota.com
www.gamingmississippi.com
www.gamingmissouri.com
www.gamingmontana.com
www.gamingnebraska.com
www.gamingnewhampshire.com
www.gamingnewjersey.com
www.gamingnorthcarolina.com
www.gamingnorthdakota.com
www.gamingohio.com
www.gamingoklahoma.com
www.gamingpennsylvania.com
www.gamingrhodeisland.com
www.gamingsouthcarolina.com
www.gamingsouthdakota.com
www.gamingtennessee.com
www.gamingtexas.com
www.gamingutah.com
www.gamingvermont.com
www.gamingvirginia.com
www.gamingwashington.com
www.gamingwestvirginia.com
www.gamingwisconsin.com
www.gamingwyoming.com
www.getantivirusplus09.com
www.getantivirusplusnow.com
www.getcheapgeneric.com
www.goniont.com
www.goodknight.info
www.google-analyze.org
www.gotbotnet.ru
www.greatgo.cn
www.greatsolforbuz.com
www.greatsolforbuz1.com
www.haos-in.ru
www.happycoinbox.com
www.heartdomainer.cn
www.hikimounttrail.com
www.homnitell.cn
www.hondaavto.com
www.hotxasib.cn
www.housedomainname.cn
www.iapaymentpro.com
www.ia-payment-pro.com
www.ia-scannerpro.com
www.idahogambling.com
www.illegaltopcounters.ru
www.inguaro.com
www.islandtravet.cn
www.jaymarkets.cn
www.k1l3r.ru
www.kaktotak.net
www.kiskecaq.cn
www.kovsutap.cn
www.larurinsa.com
www.lemmydislikes.com
www.lifenaming.cn
www.lisexin.com
www.litefront.cn
www.loshadinet.com
www.makefred.cn
www.mal-waredoc.com
www.m-analytics.net
www.maragoga.net
www.mcafee-malware.com
www.merielied.cn
www.molo.tw
www.montanagambling.com
www.moskva.fm
www.mougoalivee.com
www.moulitehat.cn
www.movie-loader.net
www.munobatuno.com
www.myascertainpoison.cn
www.mybig-porn.com
www.mybig-portal.com
www.mybig-xxx.com
www.mycheckdiseasepro.cn
www.mycheckdiseasestore.cn
www.mydefense4u.cn
www.mydefense4you.cn
www.myexaminevirusstore.cn
www.mymytube.com
www.myplusantiviruslive.com
www.myplusantiviruspro.com
www.myrurrly.com
www.nakadshima.com
www.nakedfriday888.com
www.nameguards.cn
www.namespacecates.com
www.ncux.asia
www.ncux.biz
www.ncux.tv
www.ncuxlist.com
www.nebraskagambling.com
www.neteck.com
www.newguard2u.cn
www.newguard4u.cn
www.newguard4you.cn
www.newguardforyou.cn
www.newhampshiregambling.com
www.newhappymay.com
www.newtransfer.cn
www.nicescores.cn
www.nissanlife.com
www.northcarolinagambling.com
www.northdakotagambling.com
www.oceandealer.cn
www.odile-marco.com
www.odmarco.com
www.online2163.com
www.online2168.com
www.onlinedetect.com
www.ontest112233311.ru
www.palaceyou.cn
www.pcantimalware.com
www.pc-privacydefender.com
www.pennsylvaniagambling.com
www.peopleopera.cn
www.pfgcorp.eu
www.protection-centre.com
www.protectionsystemlab.com
www.pubilcnameserver7.com
www.quroser.com
www.qwehost.com
www.rainfinish.cn
www.rainjukebox.cn
www.realantivirusplus09.com
www.refugepro.cn
www.resorttravet.cn
www.resourcebahbah.com
www.reycross.cn
www.reycross.com
www.reycross.net
www.rhodeislandgambling.com
www.roomsme.cn
www.roselambda.cn
www.rx-promotion.com
www.rxstorepro.com
www.rx-white.com
www.salireal.com
www.seamodern.cn
www.share-paint.com
www.shotgol.com
www.smartantivirusplus09.com
www.smilecasino.cn
www.softwaresense-search.com
www.soulmosp.cn
www.southcarolinagambling.com
www.spfighter.com
www.splo2day.com
www.spyware-fight.com
www.stakeshouse.cn
www.startagplants.com
www.startgetaways.cn
www.stopbadwareorg.com
www.suptullog.com
www.sutra2day.com
www.suxpymi.cn
www.swwfight.net
www.symphonygold.cn
www.teamwows.cn
www.tedixyt.cn
www.tennesseegambling.com
www.top-downloadnet.com
www.topmedschoice.com
www.top-xxxnet.com
www.totalbuckler.com
www.total-buckler.com
www.toyotafoall.com
www.trafficshop.tw
www.travetbeach.cn
www.trucount3005.com
www.tsunabataki.com
www.tubez-boobez.com
www.tubezzz-boobezzz.net
www.use-sena.cn
www.us-machinery.com
www.veremur.com
www.vermontgambling.com
www.video-info.info
www.vilasse.cn
www.vilihood.cn
www.virus-analysis.com
www.vkanlakte.cn
www.vkontakte.tc
www.volyh32s.com
www.vs-codec-pro.com
www.washingtongambling.com
www.webo.tw
www.websiteflower.cn
www.webtopsearch.com
www.weekendtravet.cn
www.welovemovie.com
www.wexwefoh.cn
www.workfuse.cn
www.worksean.cn
www.wowregister.cn
www.wyominggambling.com
www.xomeros.com
www.xpdeluxeprotector.com
www.xuyxuyxuy.cn
www.yahoo-analytics.net
www.ycompguard.com
www.yourcheckpoisonpro.cn
www.yourcountedantivirus.com
www.yourfriskdisease.cn
www.yourfriskinfection.cn
www.yourfriskviruspro.cn
www.yourguard4you.cn
www.yourguardforyou.cn
www.yourguardonline.cn
www.yourguardpro.cn
www.yourguardstore.cn
www.zaupdate.com
www.zaupdt.com
www.zyne4ka.com
wyominggambling.com
xbpy5s.odmarco.com
xfln.housevisual.cn
xmovies-downloads.com
xomeros.com
xpdeluxeprotector.com
xuyxuyxuy.cn
xz.dnspalace.org
yahoo-analytics.net
ycompguard.com
youbonusnew.cn
yourcheckpoisonpro.cn
yourcountedantivirus.com
yourfriskdisease.cn
yourguard4you.cn
yourguardforyou.cn
yourguardonline.cn
yourguardpro.cn
yourguardstore.cn
zaupdate.com
zaupdt.com
zx.dnspalace.org
zxchost.com

Ref:
http://hosts-file.net/?s=91.212.&view=history
http://hosts-file.net/?s=91.212.&view=matches

You'll no doubt not be surprised to learn, the 91.212.* ranges, are all Russian/Ukranian owned and controlled.

So how do you find the malicious reviewers then? That's an easy one - just look at the good guys pages on SiteAdvisor, for example;

http://www.siteadvisor.com/sites/winpatrol.com

Where you'll find PhantasimLies2001, or;

http://www.siteadvisor.com/sites/hosts-file.net

Or ... well, you get the idea. Just some of the fake reviewers we've identified thus far include;

http://user.siteadvisor.com/forums/member.php?u=306155 coloradoChris-is-a-Liar
http://user.siteadvisor.com/forums/member.php?u=306159 Mc-Afee-Allows-Lies
http://user.siteadvisor.com/forums/member.php?u=306160 Mc-Afee-Allows-Lies2
http://user.siteadvisor.com/forums/member.php?u=306163 Mc-Afee-sucks
http://user.siteadvisor.com/forums/member.php?u=306164 Mc-Afee-charged-w-fraud
http://user.siteadvisor.com/forums/member.php?u=306261 stop-bashers2001
http://user.siteadvisor.com/forums/member.php?u=306267 sharons-lies
http://user.siteadvisor.com/forums/member.php?u=306275 Phantasim-lies
http://user.siteadvisor.com/forums/member.php?u=306276 Phantasim__lies
http://user.siteadvisor.com/forums/member.php?u=306279 PhantasimLies2001
http://user.siteadvisor.com/forums/member.php?u=306284 Phantasim-Lies2001y
http://user.siteadvisor.com/forums/member.php?u=306339 stop-bashers2003
http://user.siteadvisor.com/forums/member.php?u=306340 stop-bashers2004

Special thanks to the ladies and gents that gave me a heads up!.

Sadly, this is one of the downsides to sites such as SiteAdvisor, MyWot, OpenDNS etc etc etc, that allow user based ratings - they're ripe for abuse.