What is IE Snare?
IE snare is a web tool use by many of the online bookmakers for ‘reputation management’ in order to counter ‘fraud and abuse’. It tracks information about your computer and browsing habits including:
- Websites visited
- Time on websites
- Unique information about your computer
All of this allows the bookmakers to track where you’ve been and and idea of what you’ve been doing there.
Why does this matter?
Online bookmakers are keen to identify anyone they might consider as a ‘sharp punter’ Ie: Anyone who is going to cost them money. Matched Betting is a great example of how some people are able to make money for themselves at the expense of the bookmaker’s profit and so they’re keen to catch us!
By tracking your internet history, bookmakers are able to spot people who constantly bounce between many different online betting sites and the big online betting exchanges (Betfair, Smarkets etc). If they suspect you of being a matched bettor or sharp punter who’s shopping round for the very highest odds on a bet; they’re likely to ban you.
How can I tell if I’ve been infected?
The easiest way to check is to run a search on your computer for “mpsnare”
If IE Snare has been installed on your machine then it will find one or more of the following folders:
- #mpsnare.iesnare.com
- #ci-mpsnare-iovation.com
- mpsnare.iesnare.com
- ci-mpsnare.iovation.com
Another way is to run a command prompt (Go to Start – Run – “CMD”):
Then in the black box type: dir mp*.com /s
How to remove IE Snare
Removing IE Snare is as simple as deleting the folders found from the above searches. This will remove all history that IE Snare has stored and so you be safe until it gets installed onto your machine again.
Given that many online betting sites are using IE Snare, there is a good chance your machine will become infected again and so you should block IE Snare before you get infected.
How to block IE Snare
Blocking IE Snare doesn’t stop it from being installed onto your computer, but it does stop it from reporting back any ‘findings’ to the betting site, thus making it useless at tracking your matched betting activities. In order to stop is from reporting back you need to amend your computer’s “host file”.
– Go to: Start – Run – Notepad – Right click on “notepad” and select “Run as Administrator”
Within Notepad go to: File – Open
Then in the drop-down box select “All Files”:
In the File Name box type: C:\Windows\System32\Drivers\Etc and then press ‘Open’
Right click on “hosts” and select “Properties” from the bottom of the list
Make sure that the box next to “Read-Only” is unticked
Click “Apply” then “OK”. Now double click on “hosts”. It will open up and look like this:
Copy and paste all of the below into the Notepad below the line “127.0.0.1 localhost”:
127.0.0.1 iesnare.com
127.0.0.1 iesnare.co.uk
127.0.0.1 www.iesnare.co.uk
127.0.0.1 mpsnare.iesnare.com
127.0.0.1 mpsnare.iesnare.co.uk
127.0.0.1 www.mpsnare.iesnare.com
127.0.0.1 www.mpsnare.iesnare.co.uk
127.0.0.1 ci-mpsnare.iesnare.com
127.0.0.1 ci-mpsnare.iesnare.co.uk
127.0.0.1 www.ci-mpsnare.iesnare.com
127.0.0.1 www.ci-mpsnare.iesnare.co.uk
127.0.0.1 admin.iesnare.co.uk
127.0.0.1 www.admin.iesnare.com
127.0.0.1 www.admin.iesnare.co.uk
127.0.0.1 iovation.com
127.0.0.1 iovation.co.uk
127.0.0.1 www.iovation.com
127.0.0.1 www.iovation.co.uk
127.0.0.1 www.iesnare.com
127.0.0.1 admin.iesnare.com
127.0.0.1 dra.iesnare.com
127.0.0.1 impsnare.iesnare.com
127.0.0.1 mpsnare.iesnare.com
127.0.0.1 mx.iesnare.com
127.0.0.1 snare.iesnare.com
127.0.0.1 iovation.com
127.0.0.1 accountlock-demo.iovation.com
127.0.0.1 admin.iovation.com
127.0.0.1 bam-pilot.iovation.com
127.0.0.1 batch.iovation.com
127.0.0.1 ci-accountlock.iovation.com
127.0.0.1 ci-admin.iovation.com
127.0.0.1 ci-mpsnare.iovation.com
127.0.0.1 ci-snare.iovation.com
127.0.0.1 dv-fw-a-nat.iovation.com
127.0.0.1 ioit.iovation.com
127.0.0.1 mx.iovation.com
127.0.0.1 p.iovation.com
127.0.0.1 rm-admin-demo.iovation.com
127.0.0.1 soap.iovation.com
127.0.0.1 test.iovation.com
127.0.0.1 testgw.iovation.com
So it now looks like:
Go to File and click “Save”
Now close notepad, restart your machine and you’re done!
How to check it’s worked
You can check the block has worked by going to:
Start – Run – CMD
Then in the black box type:
ping mpsnare.iesnare.com
The reply should come back from 127.0.0.1 and look like:
Pinging mpsnare.iesnare.com [127.0.0.1] with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128