HMA! VPN = FRAUD/CONTAMINATED

HMA! = frauds

here a copy of a mail i sent after i downloaded their program that pointed to reseller page

after logging in with 63 char pass they put infected file on page pointing to reseller page

at first a file called ForceInterface.DLL will try to contact malicious websites, after which you might want to download anew, and then this happens.. note the links and know why you should never EVER get Hide My Ass VPN

upon asking explanation about this none was given, only the link as it should have been.


    ******notice how the windows version is NOT https*********


http://hidemyass.cachefly.net/download/HMA-Pro-VPN-2.6.9-install.exe

https://vpn.hidemyass.com/HMA-Pro-VPN-1.1.7-install.pkg.zip


https://vpn.hidemyass.com/HMA-Pro-VPN-1.1.7-install-tiger.pkg.zip


https://vpn.hidemyass.com/linux.zip   linux


I also got a different registrant on the domainsearch

About a week ago my AV alerted me on a malicious website, and pointed the file ForceInterfaceLSP.dll in hma/bin as being the compromised file trying to connect to this IP.

also a file forceInterfaceCOM.dll was in there


I have since reinstalled my OS and have lost the IP it was trying to connect to.


Earlier i reinstalled the service and noticed that despite it being a new reinstall, several of the files were showing dates that weren't today.


Noticing this, deleted the program and all files going with that and then saw the difference in download links


Below the Whois. and the website tucows.com is a reseller service.. and i thought i read somewhere that a download for a trustworthy VPN should never come of a reseller page..


Address lookup
canonical name hidemyass.cachefly.net.
aliases
addresses 205.234.175.175


Domain Whois record
Queried whois.internic.net with "dom cachefly.net"...

   Domain Name: CACHEFLY.NET
   Registrar: TUCOWS.COM CO.
   Whois Server: whois.tucows.com
   Referral URL: http://domainhelp.opensrs.net
   Name Server: NS1.ADNS.CACHEFLY.NET
   Name Server: NS2.ADNS.CACHEFLY.NET
   Status: clientTransferProhibited
   Status: clientUpdateProhibited
   Updated Date: 10-dec-2008
   Creation Date: 24-feb-2005
   Expiration Date: 24-feb-2015

>>> Last update of whois database: Wed, 31 Aug 2011 23:03:34 UTC <<<

Queried whois.tucows.com with "cachefly.net"...

Registrant:
 CacheNetworks, LLC
 2002 W Chicago Ave
 Chicago, IL 60622
 US

 Domain name: CACHEFLY.NET


 Administrative Contact:
    Admin, DNS  dnsadmin@cachenetworks.com
    2002 W Chicago Ave
    Chicago, IL 60622
    US
    +1.1111111111
 Technical Contact:
    Admin, DNS  dnsadmin@cachenetworks.com
    2002 W Chicago Ave
    Chicago, IL 60622
    US
    +1.1111111111


 Registration Service Provider:
    Hover, help@hover.com
    416.538.5498
    http://help.hover.com


 Registrar of Record: TUCOWS, INC.
 Record last updated on 17-Dec-2008.
 Record expires on 24-Feb-2015.
 Record created on 24-Feb-2005.

 Registrar Domain Name Help Center:
    http://tucowsdomains.com

 Domain servers in listed order:
    NS1.ADNS.CACHEFLY.NET   205.234.175.2
    NS2.ADNS.CACHEFLY.NET   205.234.175.3


 Domain status: clientTransferProhibited
                clientUpdateProhibited

Network Whois record
Queried whois.arin.net with "n ! NET-205-234-175-0-1"...

NetRange:       205.234.175.0 - 205.234.175.255
CIDR:           205.234.175.0/24
OriginAS:
NetName:        CACHENETWORKS-ANYCAST-2
NetHandle:      NET-205-234-175-0-1
Parent:         NET-205-234-128-0-1
NetType:        Reallocated
RegDate:        2004-06-07
Updated:        2004-06-07
Ref:            http://whois.arin.net/rest/net/NET-205-234-175-0-1

OrgName:        CacheNetworks, Inc.
OrgId:          CACHE
Address:        209 W Jackson Blvd
Address:        Suite 700
City:           Chicago
StateProv:      IL
PostalCode:     60606
Country:        US
RegDate:        2003-03-04
Updated:        2011-02-09
Ref:            http://whois.arin.net/rest/org/CACHE

OrgTechHandle: DNSSE-ARIN
OrgTechName:   DNS Services
OrgTechPhone:  +1-877-442-2243
OrgTechEmail:  dnsadmin@cachenetworks.com
OrgTechRef:    http://whois.arin.net/rest/poc/DNSSE-ARIN

RTechHandle: DNSSE-ARIN
RTechName:   DNS Services
RTechPhone:  +1-877-442-2243
RTechEmail:  dnsadmin@cachenetworks.com
RTechRef:    http://whois.arin.net/rest/poc/DNSSE-ARIN

DNS records
name class type data time to live
hidemyass.cachefly.net IN A 205.234.175.175 3600s (01:00:00)
cachefly.net IN SOA server: ns1.adns.cachefly.net
email: hostmaster.cachefly.net
serial: 1314831603
refresh: 16384
retry: 2048
expire: 1048576
minimum ttl: 2560
 2560s (00:42:40)
cachefly.net IN NS ns1.adns.cachefly.net 86400s (1.00:00:00)
cachefly.net IN NS ns2.adns.cachefly.net 86400s (1.00:00:00)
175.175.234.205.in-addr.arpa IN PTR vip1.g-anycast1.cachefly.net 46437s (12:53:57)

Traceroute
Tracing route to hidemyass.cachefly.net [205.234.175.175]...

hop rtt rtt rtt   ip address fully qualified domain name
1 1 1 1   70.84.211.97 61.d3.5446.static.theplanet.com
2 0 0 0   70.87.254.5 po101.dsr02.dllstx5.networklayer.com
3 1 0 0   70.85.127.109 po52.dsr02.dllstx3.networklayer.com
4 0 0 0   70.87.253.29 e5-2.ibr04.dllstx3.networklayer.com
5 0 0 0   64.208.170.197 gigabitethernet7-3.ar2.dal2.gblx.net
6 0 0 0   205.234.175.175 vip1.g-anycast1.cachefly.net

Trace complete

Service scan
FTP - 21 Error: ConnectionRefused
SMTP - 25 Error: ConnectionRefused
HTTP - 80 HTTP/1.1 404 Not Found
Server: CFServ v0530
Date: Wed, 31 Aug 2011 23:04:37 GMT
Content-Type: text/html
Content-Length: 167
Connection: close
X-CF1: fH.ord1:nom:cacheH.ord1-01
POP3 - 110 Error: ConnectionRefused
IMAP - 143 Error: ConnectionRefused


these faggots deserve to be nuked