veruccawatcher

There is some kind of life at spam-court.com

2021-12-18T04:35:00.003-11:00

But not much.

Briefly looking back, was it 12-13 years ago already? I have forgotten most, so memory need to be refreshed.

Wonder what the spammers, botnetters, stock pump-and-dumpers, carders, hackers and the rest of the scum are up to in 2021.

And perhaps taking a closer look at them some time next year. Perhaps a special one at the bulkerforum members. Especially the admins. Crypto, Swank, Phantom. And the russian. I wonder what they are up to these days. If they are still alive.

Ducks restarted this, we both will be back. So we have the Good and the Bad slowly back in business. We should add an Utgly one. But clever, we are struggling a bit with the database from the old days.

bulkman99 - the MontrealPimp

2008-11-24T11:50:00.003-11:00

http://news.justia.com/cases/featured/california/candce/5:2008cv03889/206207/

Default judgement if I read correctly, Facebook v. Adam Guerbuez.

Big mouth, that bulkman99/MontrealPimp.
And a bit stupid.
FTC showed some kind of interest in him back in February this year.
What kind of interest is unknown to me.
I dont know how strongly they want him either.

Someday someone else than Facebook will go after him.
He was easy to trace.

BulkEnt

2008-09-19T11:39:00.004-11:00

Yeah, I am breathing.
BulkEnt/~~Gary~~ Garrett is next.

About a year ago the following was posted on bulkerforum.biz:

Hey guys

We are looking for one or two responsible/can-spam compliant mailers to do a few mailings for us. We need to do a little more testing to tweak our system before launching 100%. I am willing to pay upfront if you have good references. The product is mobile phone text-message(SMS) based. I am looking for someone that can hit all the major ISPs and can send atleast a few million per day. Contact me ASAP for more details as we are looking to get started right away.

AIM: BulkEnterprise
ICQ: 221-281-113
Yahoo: BulkEnt1

If this ebizpro ever got his bluetooth and SMS-spamming up and going is an open question.

If someone else is more eager than me, go ahead.

spam-court.com taken offline

2008-04-16T05:35:00.004-11:00

For an unspecified time. Forever is definately a possibility.
Watch ducksintworows.blogspot.com or this one instead.
If you feel it is worth the time.

Nathan ("n")

2008-03-01T11:22:00.000-11:00

Briefly mentioned by Ducks in his "snippets":

Note to self: The nick "n" is probably also known as elitet0kr, EvilAnarchistGuy, nathanownzu, t0k3d, EliteRAHA. Remember the guy from a couple of years back: Nathan?

I don't know what he mean by the last sentence, I should have a chat with him about that. But the info about his other nicks are correct with one exeption, I doubt that he is "EvilAnarchistGuy". I also add another of his nicks which is very interesting: t0k3d. More about that one later.

Anyway, on bulkerforum.biz he was offering proxies for sale.
A post from Tue Feb 05, 2008, not so long ago:

Hello,

I am selling high quality IP restricted proxys that are HP scanned and have anti-honeypot code working at the bot-level to get rid of those tricky HPs. As of now there are 1.5-2.5k working, unlisted (spamcop, spamhaus) proxys online at any given time. The list is reset every 1.5 to 2 hours, depending on what the customer wants. The proxy supports socks4 and socks5, no HTTP as of yet, sorry.

The cost is $150/week for every IP authorized on the proxys. This includes scanning/proxy checker servers as well. Many people ask me why they have to pay for the scanning/proxy checker server. It is simply because every IP takes up space in the IP authorization bracket, and that is what I base the price on.

If you are interested, my Skype is savethedogs. PM me for AIM and MSN.

Legal proxies? Hardly.
He had another posting back in September 2007 with some nice screenshots.
There are also some other screenshots floating around which can be tied to his highly illegal activity. And a domain name legi0n.net (now expired) is highly interesting. That domain has been involved in some criminal activitity a few years back (nicked from http://www.f-secure.com/v-descs/ircbot_es.shtml):

The backdoor's file is a PE executable file about 8 kilobytes long, packed with MEW file compressor and patched with PE_Patch.

When the backdoor's file is activated on a computer, it copies its file to Windows System folder as MOUSEBM.EXE and then starts the copied file as a service named 'Mouse Button Monitor', described as follows:

Enables a computer to maintain synchronization with a PS/2 pointing device.
Stopping or disabling this service will result in system instability.

If the backdoor fails to start its service, it tries to inject its code into Explorer.exe process. When active, the backdoor connects to one of the following servers on port 18067:

esxt.is-a-fag.net
esxt.legi0n.net

Then backdoor joins an IRC channel called '#p2' using the hardcoded password and creates a bot there. A remote hacker can control a backdoor via a bot that it creates in the '#p2' channel. A hacker can do any of the following:
scan for vulnerable computers and spread to them using PnP exploit
download and run files on an infected computer
find files on local hard disks
perform DDoS (Distributed Denial of Service) attack
perform SYN and UDP flood
The backdoor has the ability to spread to remote computers using the PnP exploit on port 445. Please see the following page for detailed information on the vulnerability:

http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx

Detection

Detection for this malware was published on August 15th, 2005 in the following F-Secure Anti-Virus updates:

[FSAV_Database_Version]

Version=2005-08-15_05

You asked for screenshots?
Here is a couple, note his nicks and his website. I split this one in two:

More screenshots will be added if needed.

Someone should kick his Butt.

Ron Paul spam tied to bulkerforum.biz

2007-12-07T06:14:00.001-11:00

This story on slashdot made a couple of bells start ringing.

... someone calling themselves nenastnyj was behind it and their botnet control server has been shut down

nenastnyj is a member of bulkerforum.biz. You will probably know him as "nena" over there.
Drug spammer apparently in charge of PharmaBucks. Here is his first posting on bulkerforum in January 2007:

Posted: Tue Jan 09, 2007 7:36 am
Post subject: New big money with PharmaBucks
Dear colleagues (we hope that we will be able to call you partners of our partnership program in future),

The partnership program "PharmaBucks" is more than happy to encourage you to cooperate with us.

For the time being, there is one shop and four medical preparations, that are the most needed, available in our partnership program.

We offer you sales with commissions from 30 to 50%. According to the promotion of our program everybody who registers before February 1st, 2007 will be registered in partnership plan " Silver " that offers you 40%.

Our conditions and benefits:

- Detailed and very honest statistics! You will feel it from the very first minute of our cooperation;
- Commissions up to 55%;
- Referral system of 5%
- Our own steady bulk-servers;
- Support is always ready to answer your questions comprehensively and correctly;
- Daily change of domains, personal domains for the big adverts;
- Regular professional text refreshments;
- Salaries webmoney, fethard, wire;
- Hold – 14 days;
- % commissions according to the following tariff description:

0-10 sales per day - 30% commission
11-20 sales per day - 40% commission
20-50 sales per day - 45% commission
50+ sales per day - 55% commission

Our cooperation and your time is of a great value for us, that’s why we made all the conditions of successful and lucrative cooperation with you so much easier.

Everybody, from the beginners to the professionals, is more than welcome to join our partnership program. Respectful and sophisticated Support is always ready to help you with any kind of problem.

Our working team consists of exceptional professionals that have invested all their experience acquired throughout many years into this program.
We are always looking with a perspective concentrating our attention and experience only on reaching the highest peaks, comprehensively analyzing and improving our accomplishments.

We hope that you will value our advantages starting from today.

To register and start working you can by connecting to this ICQ number: 303-435-751.
Back to top
View user's profile Send private message
ICQ Number <------- 304927900 304-927-900

A bit later he answers neuman's question:
what are the products?

now only 4, and 1 shop, soon ill be 4more products
now only Viagra Soft tabs Cialis soft tabs, cialis, and viagra pro

A small image from pharmabucks.biz when the page was still up:

We have not been following nena/PharmaBucks around, so we don't know the story after January.

Back to the Ron Paul spam:
More details in a report from Secureworks.
A bit shorter version on ars technica

And there is something else that is a bit interesting in that report.
The Ron Paul spam has been tied to "Reactor botnet". "spamit" on bulkerforum is being mentioned, but SecureWorks doubt he is the author. It is more likely that he is a customer of the author of the bot controlling software.
Interesting points anyway.

Now, I highly doubt that the Russians are especially interested in US politics.
Which leaves the question: Which american spammers (and probably with connections to bulkerforum.biz) are behind the spam for Ron Paul?

We know that the Digital Gangstas Matt Leppala, Pete Snoufax and ytcracker are close to an orgasm if Ron Paul is being mentioned. But we have no idea if they were behind the spam. n0fx on bulkerforum is an old buddy of them.

DucksInTwoRows blog is back

2007-12-06T07:50:00.000-11:00

Has been up back again for a few days now.
Not any new content now.
Writing a small draft on kref/spamit.
And another small one on toxicdog and his alias.

Snippets

2007-11-27T12:01:00.002-11:00

A collection where small snippets are saved temporarily and gradually expanded towards an independent blogpost.
More like memos to myself. Read them if you like, but don't expect much.
Mainly regarding members of bulkerforum.biz who are offering services that are illegal in most countries.

AbdAllah

[Nov 16, 2007]
His second post on bulkerforum.biz:

BP servers & hosting for mailing, trojan's, exploit's, etc. in Turkey, Malaysia, HongKong, USA, Thailand, China.
Fast setup, cheap price.
Please contact ICQ: 483-384-343 (Mr.Abdulla)
or write to PM.
Thank you !

One example of the typical hard working, honest members of bulkerforum.biz.

And the moderator Crypto greets him:

He is a well known russian BP provider.
Dobro pajalovati na bulkerforum AbdAllah.

We know that hosting mule scams is one of those included in his term "etc.", but what else is possible?
Child porn, carder sites? Not unlikely.

Honored with an SBL-listing in Spamhaus in November 2007, SBL59691.

To be continued ........

ProfDDoS

Nick says it all.
His post #5 on bulkerforum.biz:

Greeting!!!!

Let me to bring to your attention professional DDoS service!
Quality is guaranteed by uniqueness of the updated and supported software. Huge, constantly growing quantity of bots worldwide online.
Destroy a site of the competitor!!!
The prices depend on duration and complexity of the project.
For information welcome in the icq.
For all questions: ICQ support 448845. skype ss_support1

Moderators Dollar and Crypto are not totally happy about that post.
A bit strange regarding Crypto when reading his greetings to AbdAllah, but who knows what's inside these guys brains.
Crypto has not been showing too much intelligence in his posts, so it is perhaps not so strange after all.

Phantom rushes to his defense:

I have to disagree here guys LOL this person has been of great service to us all without you even knowing about it ..Thanks guy

ProfDDoS is the same guy as, or in bed with .....damn I lost that part.

Maybe continued.

Sanjay / sancash

A quick note to self:
This guy is involved with Elite Herbal.
How high up he is in the food chain cannot be established accurately.
If not on top, he is very high up.

Definately to be continued.
[Ducks new posting here: sanjay aka sancash.]

Phantom

One of the moderators.
Been hanging around for some years now.
Always been very slippery, but now the smelly ex-wannabee-spammer "Nick Danger" (Marion Sidney Lynn) claims to have his identity and has "outed" him.

We have seen that info earlier, but we are not totally convinced about how real this is.
Two long and wild shots: This "outed" identity is either a middleman or a deliberate smoke screen.

Both Veru and myself are going more in the direction of "back to the roots" like WarriorForum and Bulkbarn, like Phantom himself indirectly suggests in his various postings on different forums during the last years. And like magic, some info fits. Pure magic it is.
This indicates another identity, but this does not seem very likely either.
The fact that both of us, originally independent of each other, went in that direction is a sign that there may be something here. And so is the fact that some of our findings were identical. That's magical.
It still seems unlikely though, so we are open for suggestions and speculations combined with hard facts.
Especially hard facts about the identity "outed" by the smelly chicken of an ex-wannabee-spammer.

escape

Usman Ahzaz

Snippets:

olatesuite

exploits

Ucraine

drug spammer

.

From a posting about a month ago on bulkerforum, someone asked for this:

subject: Need a persistent exe application
One that will take an exe I already have and make it 'persistent' - hidden from the filesystem, hard to remove, etc

skype: myst231 or pm me here (i dont know if the pm situation has been resolved)

And the OlateSuitemaster of exploits answers:

escape
Joined: 15 Sep 2006
Posts: 55

votes: 2 Posted: Wed Oct 17, 2007 3:30 pm Post subject: y0
i can help you out
_________________
OlateSuite - HiSpeed Mirrored BP Shared Hosting & Dedicated Servers...
Exclusive Ip Restricted Socks4

The Christmas season is approaching, so watch out for OlateSuits exploits this year too:
Happy Holiday Season, TrendLabs article from 2006 about OlateSuit exploit
Watch out for any Holiday Season Blowout Sales this year.

Yet another hard working, honest businessman on the bulkerforum.

kref/spamit (glavmed)

Probably two guys, belonging to the same gang.
Crypto hugs kref:

kref, is known in the BlackSEO biz. He is a good guy and pay on time.
Have his own design/coders team(for his rx websites), and the affilate system for mailers looks very nice
He have a lot of references, just pm him, and find out more,
I think you gonna like it.

With such good references, we don't hesitate to label those guys as criminal spammers.
Snippets:

despmedia.com

glavmed.com

glavmed.org

hzmedia.info

spamit.com

thecanadianmeds.com

saintd / saintdmitry

Michael_sun2k

Their "designers": dadaev.com

To come

David (from Houston, TX.)

perka (from Romania - ZedCash)

rxnic

TLCmail / Stolder / leadz / empharmpartners (this is probably Impulse Marketing Group, or at least connected to them)

toxicdog (alex0ra, alexora, goomenuk, Prague, spamilka.com, Black Network, 69.50.177.122)

The last post on spam-court.com

2007-11-24T05:42:00.000-11:00

Below is the last post on spam-court.com.
The day after the posting, the criminals started yet another DDoS attack on the site and it went down.
For good (at least with Dreamhost as the host).

A few days later http://ducksintworows.blogspot.com/ was attacked. And is still down.

Short note ....
Posted November 16th, 2007 by DucksInTwoRows

We will leave spam-court.com as it is now for some time.
http://ducksintworows.blogspot.com/ will probably be the main area for new posts and small notes.

Maybe some posts will show up on http://veruccawatcher.blogspot.com/

Perhaps something interesting shows up at http://veruccawatcher.wordpress.com/, but that's less likely.

lhl

2007-11-24T05:38:00.001-11:00

A Smart Condor. Known at least since the specialham days. Probably Chinese. Aka "lhyfrank".
lhl1922@yahoo.com
At first glance he specializes in adult, MySpace and yahoo bots.
Has at least one listing in Spamhaus.
Some indications that this one also is or was involved in hosting.
Latest domain is thxkilo.com. Whatever that is.
Easy to spot and trace. I will leave that to others and maybe fill in some more later.

Bioshah

2007-11-24T05:29:00.002-11:00

Let's just give this one the status of "under construction" now.

A "dropshipper".
Content from the private part of bulkerforum has been "outed" by the smelly ex-wannabe-spammer.

The most interesting part is who he really is.
We don't know. Yet.
Only a couple of clues.

Small keywords to be checked and sorted out:

Hitesh

biologicalmiracle

shacro

hitmanshah

London

Hmm, London.
A few years back a letter went out from the FDA to:
Biologicalmiracle.com
PO Box 726
London, England EC1 V 7QQ
United Kingdom

Time will show if this is the same guy.
Biologicalmiracle is still up, same snake oil.

Quoting from one of his posts on the former private part of bulkerforum (smelly ex-wannabe-spammers can sometimes come in handy):

Pharma Sponsor & Drop Shipping
Im posting this here as I dont want Anti Fuckers to contact me in main Forum.
We still have pharma sponsor with controlled meds. So if any of you are interested PM.
I also provide Drop Ship faciities, so you big boys who already have their own sponsors PM if your interested

Maybe FDA, FBI or others would like to contact him too?

July 2008
When doing one of our very infrequent searches for info on members of bulkerforum.biz, we came across some info that may be interesting.
A couple of forum threads:
http://gofuckbiz.com/showthread.php?t=3454
http://www.crutop.com/Vbulletin/showthread.php?t=76615

Now something called istbill/istpay shows up in connection with bioshah.
Together with a lot of names, both individuals and companies.

The main question is still open:
Whois Bioshah? Sergey, Jani, Mike, Raj, Rajesh? Or someone else?
Our bets today are for Jani, Mike or Raj.
Time is an excellent tool. We'll wait and see what shows up.

seedcash / cluster

2007-11-24T05:24:00.000-11:00

Daniel Lessing
An oldtimer, listed in ROKSO (Spamhaus' Register of Known Spam Operations).
Nicks on bulkerforum.biz are seedcash and cluster.
He used "cluster" on the spammer forum specialham too, in addition to dl1227.
On other he used dl69hunt.

Into porn, mortgage spamming, hosting and trying to sell some harvested lists on bulkerforum.

Hmm, selling harvested lists? Is that legal?

tiket.cc - AbdAllahs support site?

2007-11-22T08:48:00.000-11:00

AbdAllah, the proud member of bulkerforum.biz with connections to the Russian Business Network has a site that avoids attention:
Some info:


Domain: tiket.cc
Status: Protected

DNS:
        ns1.dnsmanager.org
        ns2.dnsmanager.org

Created: 2007-11-04 03:15:56
Expires: 2008-11-04
Last Modified: 2007-11-03 15:15:53

Registrant Contact:
        Private person
        Ahmad Gashmi Ahmad Gashmi (mailbox@abdulla.cc)
        Rublevskoe Shosse 7
        Moskow, Moskow, RU 542009
        P: +7.4952038129         F: +7.4952038129

Hosted at leaseweb in the Netherlands, 85.17.184.21.

Compare with this one:


Domain Name: ABDULLA.CC

Registrant:
    AbdAllah net inc.
    AbdAllah El Ahmad Gashmi        (abdulla@abdulla.cc)
    Kreshatik street 32/16
    Kreshatik street 32/16
    Kyiv
    Kyïv,45434
    UA
    Tel. +38.0632687263

The last one is listed on spamhaus.org, SBL49890.

AbdAllah

2007-11-22T08:06:00.002-11:00

One "snippet" from ducksintworows.blogspot.com, which is still under DDoS.
This guy has connection to the Russian Business Network, one of the worst criminal networks in history.
And he is a proud member of bulkerforum.biz, offering his services there.
The moderator Crypto gives him a nice welcome hug:

[Nov 16, 2007]
His second post on bulkerforum.biz:

BP servers & hosting for mailing, trojan's, exploit's, etc. in Turkey, Malaysia, HongKong, USA, Thailand, China.
Fast setup, cheap price.
Please contact ICQ: 483-384-343 (Mr.Abdulla)
or write to PM.
Thank you !

One example of the typical hard working, honest members of bulkerforum.biz.

And the moderator Crypto greets him:

He is a well known russian BP provider.
Dobro pajalovati na bulkerforum AbdAllah.

And then they went for DDosing blogspot

2007-11-21T07:55:00.000-11:00

First they silence spam-court.com.
Now http://ducksintworows.blogspot.com/ is DDosed.

The criminals at bulkerforum.biz do not like that their criminal activites are questioned. And pointing out who the persons behind the activities are:

---------- Forwarded message ----------

Hi there,

As you may have noticed, your blog has recently become the target of a
DDOS attack, and we've therefore had to make it temporarily unavailable.
However, we wanted to let you know that we're actively addressing this
problem, and we hope to make your blog available again as soon as possible
while still defending against such attacks. Thanks for your patience, and
we apologize for the inconvenience.

Sincerely,
The Blogger Team

Showing their real faces (or asses if you prefer).
Criminals, nothing else, but pure criminals.

Ducks will continue to write (infrequently) here.

Well, DDos again on spam-court.com

2007-11-17T11:59:00.001-11:00

And Dreamhost support pulls the plug:

I'm going to have to permanently disable this site and
ask that you move it's hosting elsewhere

Can't blame Dreamhost, they have done more than expected during the earlier attacks.
And I thank them for that.

But it finally came to an end.

DDoS may pay off.
But not in the long run.

Now it's very close to a personal attack.

I was planning to take it easy for some time and leave the writings to Ducks.
But now I am pissed.
There are tons of stuff on those bastards who are doing their "business" (read criminal activity) on bulkerforum.
Some of them have a history several years old.

I will contribute the best I can in exposing them.
Gloves are off and I am going to publish the full names and/or whatever info I have on those criminals. Including the participants on the criminal forum.
As promised on spam-court.com, if the DDOs-ing continued.
First out was Martin Neumann, europe aka guschman.
Next out, in no particular order or timeframe, are:

hairdev (full name)

canadaguy99 (full name - will be interesting, even for the criminals themselves)

tylerdurden (full name - a small appetizer: ginster)

jpcserv (full name)

perka (full name)

xpepro (full name - one keyword in the meantime: "TRNi Inc" )

General / bizorigins (full name)

paradiseslim (full name)

bulkman99 (the pimp from Montreal)

corleonem (an innovative consultant)

deatos (a young blackhat from Michigan)

leego (pill pusher)

kref/spamit (glavmed / despmedia / spamit.com)

One "snippet", as Ducks calls them, from yesterday was about a member of bulkerforum.biz, "ProfDdos". And the day after he posts that, spam-court is DDosed. Coincidence?
I repeat Ducks snippet here:

[start of Ducks' posting]

ProfDDoS

Nick says it all.
His post #5 on bulkerforum.biz:

Greeting!!!!

Let me to bring to your attention professional DDoS service!
Quality is guaranteed by uniqueness of the updated and supported software. Huge, constantly growing quantity of bots worldwide online.
Destroy a site of the competitor!!!
The prices depend on duration and complexity of the project.
For information welcome in the icq.
For all questions: ICQ support 448845. skype ss_support1

I have to disagree here guys LOL this person has been of great service to us all without you even knowing about it ..Thanks guy

ProfDDoS is the same guy as, or in bed with .....damn I lost that part.

[end of Ducks' posting]

Note: ProfDDoS is the same guy as, or in bed with "Caesar" on bulkerforum.

europe / guschman

2007-11-17T09:41:00.000-11:00

History:
This one was posted on May 26, 2007 by DucksInTwoRows
And edited November 17, 2007 by veruccawatcher, after the last dddos on spam-court.com. Change: Full name

Just a short one. The intention was to write some more, but today we prefer to spend most of our time on other, important things in life than following the scum of the net around.

"europe" aka "guschman" is Martin Neumann from Germany.
Tried to be careful.
But you can never trust a spammer, even not the "trusted" ones.
Just like their own spam, their info floats around.
From one spammer to the next. And so on.
Now Martin, try to hit that delete button now.
Aber ach, zu spät. Vielleicht.

We make an exception this time and try to believe that spammers don't always lie:
Born in 1981, lives in Rostock.
Was also a member of the dead and buried specialham.com and spamforum.biz.

We have been told he works with something IT-related.
Well, of course he does, he offers hosting.
Man, those spammers think they are clever when telling us stuff.

Or did we just pull that up from a hat?

Why the hell does a host offer their services to criminals?
You know Martin, you could just get rid of that spamhosting/spamsupporting part?
Your choice.

Maybe more later, we have to double- and triplecheck some stuff.
Auf Wiedersehn.

onlinecasino - Jeroen Puttemans

2007-10-28T09:45:00.000-11:00

And old acquaintance from the specialham days.
I am not visiting the bulkeforum board so often these days.
It is good to have other spammers draw your attention to stuff you overlook.

Good old Jeroen (well, he is not that old, soon 24) is now selling stolen lists.
Our spammer suspected it when he saw this post from him:

1.7 million opt-in gamblers data from pureplay.com for sale
exclusive leads taken by our team straight downloaded from database
i'm selling them cheap
price 2 k

And the best part of it is that Puttemans confirmed the list was stolen when he was accused of selling a fake list:

it's not fake you fag!
our hacker stole it, the data is real

Another criminal on bulkerforum.biz.

Puttemans will mess it up for himself sooner or later, he tends to do that.
Here is a sad story from him (godmailer) back in 2004:

godmailer: damn my sagonet servers all got shutdown
godmailer: im going to charge back

godmailer: i have no proxies, no server damn im out of business
godmailer: i was too greedy
godmailer: should i apologize to god maybe thats best lol

godmailer: i need to complete 80 gamblers in 2 weeks and i have nothing'
godmailer: especially no proxys
godmailer: thats a 10 K pre paid order
bisz: sucks to be u
godmailer: yes it is
godmailer: i already received the 10 k pre paid order

Nice little row of IP-adresses he had back then:


Sago Networks SAGO-20030401 (NET-65-110-32-0-1)
                                  65.110.32.0 - 65.110.63.255
Jeroen Puttemans SAGO-65-110-63-100 (NET-65-110-63-100-1)
                                  65.110.63.100 - 65.110.63.109

But he messed up.

There are some other stories about him too.
I will be filling in more stuff. Maybe a picture, if I can find it. The fatcat.

Phantom - trustworthy or a snitch?

2007-09-15T05:46:00.000-11:00

A little bit of drama at bulkerforum.biz.
Marion Lynn ("Nick Danger") has finally been kicked out and is huffing and puffing as usual when things don't go his way. Threatening to "out bulkerforum", contacting us and posting on the newsgroup news.admin.net-abuse.email.
He contacted us some days back with info about "Lizza". Most of the info was already known to us and we didn't bother to verify some of the other info. Verifying info from one disgusting guy about other disgusting guys is actually not our favourite way of spending our valuable time. We always feel the need for a long shower after that kind of work.

One little part he did not include when he contacted us caught our attention in his newsgroup posting:

Phantom leaks private user info including signup info to Lizza, proof
here:
[9/6/2007 1:29:22 PM] Ladders10 says: Did you use proxy possibly? yeah
from the information I had on file. I do not lie. I'm very up front
you can ask around about that. I was told by mod phantom that this is
the information on file I think both names are proxied up no?"

You can't trust anybody these days, can you?

I don't blame him if it was info about Marion Lynn though.
And now Marion Lynn tries to bite back. But the miserable old man has no teeth back, so I doubt he will succeed in harming anyone. He probably lost some money on his wannabe spammer career and has put his info for sale. Tragic. It must be a joke.

But the main point is: When the moderators of bulkerforum.biz are snitches, who can you trust?
Do we finally see the end of bulkerforum and Phantom?

Updating

2007-08-08T13:17:00.000-11:00

Or actually not updating, only pasting some old stuff from spam-court.com. Some new stuff has been lying around more or less half-baked the last couple of months.

But some of this old stuff need updating too. Regarding some of the members, the info is there. For others, I cannot draw final conclusions.

If we could get a bit coordinated, we could have something going again. I think middle of or late September could be a nice time to start. Must have a talk with Ducks and Scribblers about that.

Yuki

2007-08-08T11:01:00.000-11:00

History:
This one was posted on September 16th, 2006 by TheScribblers

Chinese hoster.
AKA encrinite
ICQ: 190966690 (190-966-690 )
Known emailaddresses: syllphia@hotmail.com
Domains: webserverchina.com (possibly, but gone)

moneyminters

2007-08-08T10:49:00.000-11:00

History:
This one was posted on December 17th, 2006 by veruccawatcher

Hoster.
AKA qualitypaintings (not using it anymore?).
Calling itself Devid Felix.

Skype: moneyminters
icq: 271749180
aim: moneyminters, dedicatedsols (old?)
yahoo: dedicatedsolutions4u (old?)
Emailaddresses, a nice mix of old and new:
moneyminters@gmail.com, bulletproofsolutions@hotmail.com, urfriend911@indiatimes.com, moneyminter@ureach.com,

Nice list of what it is offering:

Hosting

Direct Mailing

Domains

Botnet

Yahoo Accounts

GeoRedirects

BlueBottle

Custom PHP Works

Web Designing

Drop Shipping

Botnet, hmmm. And "dropshipping"? Illegal drugs into US?
And he shouts like hell over not be able to call out with Skype.
The error message he gets should tell him, it must be kind of slow:

Message
Call Failed – Internal Error

Meaning
Calling from a known fraudulent node

ucraineanu

2007-08-08T10:31:00.000-11:00

History:
This one was posted on September 16th, 2006 by TheScribblers

Presenting himself as replica spammer. Formerly selling proxies and "GI" emails. Probably still is. From Romania.
Nice AIM icon.

Possible name: Iulian Varzaru
aim: ucraineanu
skype: iulianv
icq: 246999133 ( 246 999 133 / 246-999-133 ) / 175420059 (175 420 059 / 175-420-059)
Yahoo: cergat, cergatus
AKA spamking
emailaddresses: ukraineanu@yahoo.com
Domains: shoppgateway.com (dead), evirtualshop.com (probably him, or his "sponser")

One posting on bulkerforum starts out like this:

hey there - this is fairlogic from BC - most might know me as ucraineanu - here to present you my watch sponser - been around for a whyle - doin very good -

Swank - moderator

2007-08-08T10:27:00.000-11:00

History:
This one was posted on December 8th, 2006 by veruccawatcher

For the non-spammers, Swank is probably best known from Spam Kings (http://spamkings.oreilly.com/), "Richard Cunningham".
We think he actually is a minor player among the spammers.
He likes to give the impression of being a big player.
Most of his stuff has usually gone to pieces. Mainly a middle man.
ssoft.biz is apparently his now, earlier domains are down.
Seems he is running a forum for spammers there.
Most of his older domains are either dead or not renewed.
He likes to give the impression of being good at social engineering, investigating scammers and "antis". And of course he likes bragging about what a big guy he is, how long he has been in "the industry", what he has done earlier and so on.
Now that is a bit dangerous for him. We are coming very close, almost in his backyard by following all the trails he is giving. By following those, comparing various stories, doublechecking with other sources we are getting a picture of this guy.
He claims giving his attention more to his "legitimate" businesses now. Probably some VOIP, historically he has got a hang for opps involving that kind of stuff, e.g. Cognigen and other telecommunications/internet related. He is not doing too good though, not having too much money.
According to other sources he is running 6-7 PCs from home. Not all of them in good shape, he looses stuff regularly. A couple of them seems to be below the 1GHz mark too and he tries to upgrade them (messing it up of course, his uncle was apparently not a very good teacher, or Swank has difficulties learning).

To be continued/edited .....

Hellhoster

2007-08-08T10:08:00.000-11:00

History:
This one was posted on December 29th, 2006 by veruccawatcher

This creature is apparently a "she".
Asian (Chinese?) hoster.
Got her first post on bulkerforum.biz slightly edited.
Parts of the original posting from December 6th, some edits:

We are Glad to launch Our Hosting Solutions officially ,
We have Auto Changing IPs Hosting Solution which can take GOOD , GAURENTEED Care of the following problems -
1) DDOS
2) Downtime due to tracking by SpamHaus
3) BlackListing of the DNS , IPS which again give problem in keeping the server up
4) Any Situation we give you the solution
.
.
.
What we can Host -
1)Adult (any , legal or illegeal) ( Gaurenteed UP time on Them)
2)Pharma ( Gaurenteed UP time on Them)
3)Replicas ( Gaurenteed UP time on Them)
4)Oems ( Gaurenteed UP time on Them)
5)Enlargment Pills ( Gaurenteed UP time on Them)
6)Phising Pages ( Gaurenteed UP time on Them)

We can also Host Bank Scams and Shits , but only for known and trusted members (no intention to hurt the rules of the board just telling about the services)

BP SERVERS IN CHINA , HK , KOREA

We can give you SOLID MACHINES which mean REAL BULLET PROOF
We can take care of Persons who get listed in a WEEK's Time , But then the prices are accordingly Smile
I know many of friends here may think we are overnigth players here but please let me make it clear we have hosted MANY BIGGIES here without Mentioning their names Smile

If you feel we are scammers / rippers / snitch please before posting commets or asking about ref TEST OUR SERVICES - FREE

We have Good BIGGES here who can vouch for our Services .

Peace,
-Hell Host-
_________________
BP Servers - HK , Korea , China
Botnet Hosting Solutions
BP Domains

icq- 289-566-222

Now that led to some more posts.
"Crazy" and "mcproxy" were not too happy about some of the content.
"adultguy1" responded:

I can say we have been doing business with vinci for 6 months now and have been very pleased with the speed of her servers and the service she provides

She is also very HOTTT!!!!

We are wondering a bit what services he is using. Illegal adult maybe?
We just have to check him out later. Maybe we will try to find out who the "biggies" are. Testing her services for free would be a good start.

The "ethical" Swank, usually so concerned about the reputation of "the industry" because spammers so often get mixed together with the carders, phishers etc. was not to concerned this time. According to his first response which of course was a question about pics of the hot creature, not a comment at all about her services. A permafried brain, money or sex is difficult to combine with ethics for the spammers. Too much to handle.

Anyway, the hoster from Hell's post has been slightly edited to fit the impression of "ethicul" standards. But kick her from the forum? No way, she is still there. And they all know what she is offering. "Gaurenteed".