hs.2-137.zlkon.lv (94.247.2.137)

[sowhat-x]

The fake AV sites of "MS Antispyware 2009"...
(note: links to the malware executables not active at the moment)

addantivirus.com
antispylinks.com
antispylist.com
antispywareup.com
antiviruscheckout.com
antivirusup.com
goldpcguard.com
etc etc...

[SysAdMini]

Interesting. Those urls have been already reported to me as Zlkon urls.
But they resolve to 64.191.12.38 for me, not to zlkon.

[sowhat-x]

Yeap,you're totally about this...same ip resolves from here,and it seems that most of the online reverse ip services,haven't yet updated their data.
Plus several domains that were more than active during middle-March,appear to be temporarily semi-defunct currently,
they're probably in need of decentralizing some of their "merchantize"...

[SysAdMini]

Should we delete this topic until we get a real 137 address ?

[sowhat-x]

...to be 100% precise,I quickly parsed almost of the 94.247.2.x - 94.247.3.x ips during last night,
and they've certainly killed/moved lots of stuff that had been spotted in public during the 3 last months...
From the 500 about ips,for at least the 400 complaints/details could be found just via merely googling...
So yeah,remove it,makes no difference after a certain point...after all,it's not that difficult to find dns records' history if needed

So the shame now goes to...AS21788 - BurstNet Technologies Inc.,if they don't get these down before they re-activate:
http://www.robtex.com/ip/64.191.12.38.html

PS:That's kinda of funny,in a twisted sense of humour of course:
http://www.webhostdir.com/news/showNews.aspx?ID=10346

[MysteryFCM]

Still resolves to .137

msantispyware2009.com