BDDY is a part of the Matrix ransomware family. It encrypts files and renames them using this pattern: "[Buddy@criptext.com].[random_string]-[random_string].BDDY". For example, "1.jpg" might become "[Buddy@criptext.com].xQ4uk8Vz-KAFJcwKX.BDDY", and so on. BDDY stores the "#BDDY_README#.rtf" ranso
nvux.xyz is the address of a fake search engine. Typically, these bogus sites are promoted by browser hijackers - Potentially Unwanted Applications (PUAs) that change certain browser settings. This fake search engine is promoted by a PUA called CERX, which is related to the QIP rogue app. Note th
theultimatesafevideoplayer[.]info is one of many deceptive websites that attempts to trick visitors into installing adware or other potentially unwanted applications (PUAs). This is achieved via an installer, which supposedly installs updates for Adobe Flash Player. These sites are usually open
Spelevo is the name of an exploit kit that abuses software vulnerabilities to infect systems with various malware. In this case, it triggers vulnerabilities in Internet Explorer browser and Adobe Flash Player, and redirects users to the lookatmyvideo[.]com (LookAtMyVideo) website, which is disguis
Online Safety is a browser hijacker developed by Safely. It is endorsed as a multi-purpose tool, which is supposedly designed to enhance the browsing experience. The advertised capabilities include real time alerts about visits to harmful websites, management of user data collected by sites and de
Very similar to searchmedia.online, feed.ebooks-club.com, feed.searchfrit.com, and many other sites, speedtestace.co is a fake search engine. Its developers claim that this search engine provides an enhanced browsing experience (fast and accurate searches, improved results, and so on), however, t
wwserch42[.]biz is a rogue website, which is usually opened by potentially unwanted applications (PUAs) installed on browsers or operating systems. Therefore, people do not generally visit this site intentionally. Once opened, wwserch42[.]biz redirects people to other untrustworthy websites or loa
The s3.amazonaws[.]com website has been identified as proliferating a variety of unwanted and malicious content. It is hosted by Amazon AWS (Amazon Web Services), a legitimate service intended to provide various IT-related resources/functionalities, however, it is commonly misused by cyber crimi
"LAB Bot" email is a scam message. Its misleading subject/title suggests that the email is from Amazon Delivery Support, however, it has nothing to do with this company. The message is not from Amazon or associates, and the content has no connection with them. The body of the message claims to be
The Power Search app is categorized as a browser hijacker. There are two main reasons for this classification: it promotes a fake search engine by changing browser settings and gathers browsing data. Browser hijackers are termed 'potentially unwanted applications' (PUAs), since people often downlo