Update – 15th January 2016:
A year later and they are back with the scam scam messages (“A required driver is missing”). This time I’m seeing the advertisements on YouTube again.
I don’t understand how they can get away with such clearly inaccurate claims in their advertising. A required driver is most certainly not missing from my (and many other victims) system.
And yet other adverts are clearly written correctly and don’t lie:
Original post – 6th December 2014:
An update / Response from Corel has been added to the end of this post!
Earlier this week I started noticing misleading adverts on some web pages being served by Google Adwords.. (See the “Important Message” box on the screenshots below).
It was even served as an advert at the end of a youtube video I had made about this scam!
When a tricked user clicks the link they are taken to “www.winzipsystemtools.com” and a sub-page on that domain.
I called, as shown in the screenshot above.. 18008720241 (0018008720241 / 1-800-872-0241) to ask them about the missing driver they claimed I had.
Then their absolute lies start.
What worries me is the claim on the website and, multiple times, by the agent on the end of the phone that they are Winzip!
This is worryingly.. going by all the things I’ve checked – actually Winzip! running this scam.
The website is hosted on 22.214.171.124 (“static.126.96.36.199.clients.your-server.de”) at Hetzner in Germany:
inetnum: 188.8.131.52 – 184.108.40.206
descr: Hetzner Online AG
descr: Datacenter 14
The hostnames systemtools.winzip.com and mac.winzip.com also point to 220.127.116.11 and when “systemtools” is visited gives you a similar website to the “advert” one.. but with a different phone number 18557167029 (0018557167029 / 1-855-716-7029).
It is astonishing to me that supposedly reputable huge companies like Winzip (owned by Corel) are involved in this kind of scam.
I hope these people get slapped down like a recent similar scam.
Another hostname that points to the same website IP is wp.girnarsoft.com
The domain is under the name:
Domain Name: WINZIPSYSTEMTOOLS.COM
Registrant Name: ROB CHARLEBOIS
Registrant Organization: ROB CHARLEBOIS
Registrant Street: 35 WESTWOOD DR
Registrant Street: OTTAWA
Registrant City: ONTARIO
Registrant State/Province: ON
Registrant Postal Code: K2G2W9
Registrant Country: CA
Registrant Phone: +1.6134826735
Registrant Email: RCHARLEBOIS@GMAIL.COM
As an aside and not really part of my complaint related to WinZip and their affiliation:
The person on the end of the phone gave the suspicious domain lmi1.com (logmein 1) which doesn’t seem to be owned by LogMeIn. The domain whois information is protected using a privacy service and the website just forwards you to the code entry page on logmein rescue’s website.
The organisation www.cyberpcexperts.com is also somehow involved. Their logo and name appeared on the logmein rescue applet I was told to download.
Registrant Name: Abinesh Pratap Singh
Registrant Organization: Benovellient Technologies Pvt. Ltd.
Registrant Street: B-23/C1, Sec-62, Institutional Area,
Registrant City: Noida
Registrant State/Province: Uttar Pradesh
Registrant Postal Code: 201307
Registrant Country: IN
Registrant Phone: +91.9013165106
Registrant Email: firstname.lastname@example.org
Hosted on 18.104.22.168 with rdns cyberpc.server.firm.in
Net Range 22.214.171.124 – 126.96.36.199
Also involved and related to cyperpcexperts, publishing the same telephone number on their website, is www.benosupport.com hosted on 188.8.131.52 (“web21.hspheredns.com”)
Organization Cologlobal (CARTI-1)
Registrant Name: Abinesh pratap singh
Registrant Organization: Beno Support
Registrant Street: malvia nagar
Registrant City: delhi
Registrant State/Province: Delhi
Registrant Postal Code: 201307
Registrant Country: IN
Registrant Phone: +91.9310358904
Registrant Email: email@example.com
Quite entertainingly at the address listed on the cyberpcexperts website there is also a company called “Benovellient Technologies Pvt. Ltd“. Hah. Their domain is protected with a privacy service.
They also list the same telephone number as cyberpcexperts on their website and it is hosted on the same server as benosupport.com
The linkedin profile claims they have between 500 and 1,000 employees.. quite an operation.
They appear to be selling rebadged systweak software.
Update – 9th December 2014:
A response via the BBB from Corel Corporation states…
“What the customer appears to be experiencing is an individual or group falsely representing themselves as WinZip. WinZip does not sell products or services valued at $500. All individual products and services are valued at under $100. The user [..snip..] has been contacted by the WinZip product manager to discuss the details of the call to the claimed WinZip support so this can be addressed if necessary.”
It doesn’t explain how the “group falsely representing themselves as WinZip” is in control of a server that mac.winzip.com uses!
I’ve also not had an e-mail reply to the message I sent to the product manager.
Update – 10th December 2014:
The phone number has disappeared from the systemtools.winzip.com / www.winzipsystemtools.com website!
Spot the difference now (the second screen shot) compared to when I made the call and wrote this post:
I’ve also been contacted by “Rob Charlebois – VP of Ecommerce” at WinZip asking for more information…
The first e-mail notes that I could have managed to somehow get on the phone to a reseller or affiliate who re-package their software (ref: download.com and the ilk with their “downloaders” that also come with junkware).. however I’m absolutely certain that WinZip (at least until a few days ago) were quite clearly running the phone number in question going by Google… (note that the number has now been removed from the second result down!, it is still a the bottom of the first google result and top right on the third result.)
Update – 14th December 2014:
WinZip have done an incredible job of eradicating any evidence of the phone number from their websites! The above google search has changed since the 10th and now only lists one Winzip website. One page has disappeared from the google index and the final one has disappeared and 404 errors on Winzip.com… still no apology or acceptance of a problem with their call center from Winzip.