Fraud Reports Wiki

Also known as Software Downloads


Downloadable Software is a software piracy site attributed to Leo Kuvayev. However, there are some indications that there are links to Alex Polyakov and My Canadian Pharmacy. Spamhaus has a record on Leo Kuvayev where he is listed with an alias of "OEM guy" and uses the alias Alex Rodrigez for registrations.

The new registrar for the name servers is Beijing Innovative, using a pair of nameservers -


Complaints about abetting a crime should be directed there.


Xmas 2007

Dec 06/Jan 07 logo Feb 07/Mar 07 logo
DownSoftLogo.jpg DownSoftLogo2.jpg


Developments (Feb/Mar 2007)[]


On February 27th, 2007, over 250 of the Downloadable Software sites and all known Toronto Pharmacy sites were redirected to a Pacnames holding page. The IP address page of this redirection is owned by the US IP Address Administration and the Global IP Address Administration.

Subsequent registrations were briefly on the .eu registry, then shifted back to .com (see below), and are loading the original pages. These registrations are using name servers registered with Beijing Innovative Linkage Technology. The registrant gives an email address of The domain is an Alex Polyakov illegal web site for My Canadian Pharmacy.

Registrations of these illegal piracy sites are often in the name of "Alex Rodrigez", as in

Domain name:

Registrant Contact:
  Alex Rodrigez
  +358-30-5563 fax:
  po box 445
  Laapentranta Laapentranta 12700

Note that "" is also registered by "Alex Rodrigez" using a Registration Service Provided By: ST Registry, Contact: - not listed by ICANN. Formerly he listed his address at Christchurch, New Zealand.

Domain name:

Administrative Contact:
  Owner:         Alex Rodrigez
  Contact:       Alex Rodrigez
  Address:       PO BOX 3229
  City:          CHCH
  Country:       NZ

Subsequently he changed it to Australia:

Domain name:

Administrative Contact:
  Owner:         Open Fusion
  Contact:       Gavin Carr
  Address:       PO Box 1222
  City:          Wahroonga
  Country:       AU is itself resolved by name servers and The domain is registered with eNom by

Alex Rodrigez (
Fax: +358.207818027
PO box 109 WP 1432
Lappeenranta,  53101

This Lappeenranta address seems credible, but is probably fake. Laapentranta above is misspelled and has a wrong postal code.

Previous history[]

This has been in operation since at least June 2006. Spam sites may be called Downloadable Software or Software Downloads. The list of pirated products has grown to over 250 line items stolen from such major software vendors as

  • Microsoft
  • IBM
  • Borland
  • Corel
  • Adobe
  • McAfee
  • Symantec

Historical - Spam reporting[]

Early reports of this spam to PacNames were unsuccessful. This being said, PacNames re-wrote its terms and conditions to include tougher anti-abuse clauses, which as a direct consequence led to the shutting down of the spamming domains with that registrar.

Legality of the operation[]

When asked if this and other sites (Soft Sales and OEM Soft Store) were definitely illegal, a spokesman from Adobe responded

Yep...totally illegal...thanks.

Chris Stickle
Enforcement Manager, Anti-Piracy
Adobe Systems, Inc.
601 Townsend St.
San Francisco, CA 94103
415.832.5140 fax

Microsoft posts some clear guidelines on how to recognize piracy. Here is an extract

Advertisers use terms like "Original Equipment Manufacturer" ("OEM") software in an attempt to explain
why the offered software is so inexpensive.
Purchasing from known and trusted sources and avoiding "too good to be true" deals are the best ways to
avoid wasting valuable time and money on counterfeit or infringing software.
Beware of Spam emails offering software prices that are too good to be true. There is a high risk that
these software titles are counterfeit or infringing.

Spam Examples[]

Image Spam:

An example of image spam for Downloadable Software (laga-soft), April 2007

This is nearly identical to several spams received for a variety of illegal pharmacy sites, including several associated with Yambo Financials, notably Canadian Pharmacy.

Sponsoring Registrars[]

Google Blogspot redirections, March 2008, are listed at Blogspot. Blogspot redirections are a move to try to evade filters and complaints against the target sites. Existing reporting tools focus on the spammed URL,so the spammer hopes that the actual site will be obscured from reporting tools.

Sample sites (April 2007) are

  • and registered with BIZCN.COM, INC in China.
  • registered with ONLINENIC, INC

Their name servers are on domain and registered with Beijing Innovative Linkage Technology, also in China.

Less recent sites (March 2007), since removed

Registrar technical contacts
Name Corp.
Organisation Corp.
Language 	English
Address 	98 Hampshire Street
N-4892 Nassau
Phone 	+1.2423275277
Fax 	+1.2423275277


More recent samples (March 2009) include 506 domains, registered with Onlinenic, from

Typical registrant:
   Valery Rigalo +7.4999384712
   Novomariinskaya str., 11/1, apt. 38
   Moscow N/A RU 193901

As of March 16, 2009, these sites use name servers [ = ChinaNet, China Telecom] and [ = Hananet, Korea]. The domain is registered with

Registrar: ONLINENIC, INC.
Status: clientHold
Updated Date: 12-feb-2009
Creation Date: 13-dec-2008
Expiration Date: 13-dec-2009

Registrant :
   Valery Rigalo +7.4999384712
   Novomariinskaya str., 11/1, #38
   Moscow Moskovskaya Oblast RU 193901

One of the first abuse complaints was made to Onlinenic in January 2009. Though it has been placed on status ClientHold, that does not suspend its operation as a name server. All competent registrars know this, and it is well documented on this site under "Registrar Advice".

Note: "Valery Rigalo" owns about 514 other domains and is associated with about 196 domains according to a recent query on Domaintools. Also, Name Server: NS1.GREENZMIY.COM (has 541 domains)

How to report this spam[]

Option 1 - Complainterator[]

Report the name servers to the registrar using Complainterator. No reputable company in the Republic of China supports software piracy.

Option 2 - BSA[]

But more importantly, remember that this is a flagrant software piracy operation. You can

  1. shut down the whole operation
  2. provide evidence leading to the arrest of the criminals

Follow these steps

  1. Open the pirate site, and note down a selection of software vendor names and software titles being pirated
  2. Visit the Business Software Alliance web site
  3. Select "Report Software Piracy"
  4. Fill in your contact details
  5. Fill in the matching software vendors and software titles in the reporting form
  6. Send it off and feel better

Option 3 - list of report sites[]

JavaWoman's list of email reporting addresses, by vendor, for software piracy is an excellent resource. Some examples are shown here ready to be copied into an email cc list:,,,,,

Related Spams[]

Names containing "oem" or "soft" are invariably for the Downloadable Software piracy site. Other names containing "tabs" or "rx" were invariably Toronto Pharmacy (hasn't been seen for a while). In July, a related site called Soft Eden appeared, and referred to itself as Downloadable Software].

Name servers were on domains

There were in excess of 250 sites running this scam. Ten of the most recently spammed sites (Jul 28) were:

Sites registered with BIZCN using name servers registered with Beijing Innovative Linkage Technology

Sites registered with OnlineNic (506)


Spamit (the underground sponsor affiliate program related to Glavmed) is the sponsor organization behind this type of site. They pay spammers to promote it, and they don't shut down illegal spammers.

See also: Category:Kuvayev family


For information on Capital Networks, please refer to that article.