From April 21

Spring time
Posted April 21st, 2007 by veruccawatcher

Late spring/early summer in some parts of the world and the birds are singing.
However, the ones singing to us can't carry a tune.
Or maybe we are missing the sheet or maybe we don't have an ear for music.

One was singing about Boris Mizhen, we found the sheet for that one, but it was a bit old.
Still harmonic though.

A couple of melodies about Swank, but we could not check that against the sheet.
Sounded awfully out of tune. Maybe a little one only trying to socialize.

So we are humming along for ourselves and checking the sheets we actually have.
Mostly concentrating on bulkerforum, though it feels like wasting time.

But the forums sing, google and other sources sing nicely along with it.
And so does our archives.

Oldtimers like Michael Lindsay, Charles Fielding Childs, Max Sutter, James Botkin, Glen MCCausland and Tony Banks are definitely on board, all in ROKSO.
A few others have been fully identified, like mcproxy, Nick Danger (Marion) and iannewla (um, well ... Ian).
And some others pretty close (europe, corleonem, canadaguy99, adultguy1, general).

US and European servers seem to be popular. Lindsay is taking care of the US part, but we are wondering a bit about the Europeans.
There are some Germans on board, we are pretty close to identifying one or two of them too. Only missing one or two sheets.

We are convinced there are other guys participating on the forum that can be found in ROKSO, directly or indirectly. Time will tell.
Swank's identity is known, but Phantom is a slippery guy. We would like some info there. Some birds were humming something about Australia, or was it New Zealand? The last moderator is Crypto, already found. So that leaves the Admin, slippery guy that too.

And Crypto has made a new program, a Yahoo and Hotmail email verifier. Selling it via cryptosoft.biz apparently.
We hope he has gotten some help regarding copyrights on the program. He is not too bright there.
And only selling it to a few spammers? He need some financial advice too. Nice feedback on the program on bulkerforum.
So why only sell it to a few? We don't know the price, couple of thousands maybe? That should leave something left after the expenses for the lawyers work with copyrighting it.

Anyway, back to the forums, the birds and the sheets.
We could need a few more sheets though.
Time is running out, we don't think bulkerforum will stay up more than a few months longer, probably three to four months and it is gone.

With respect,
scribbler

bigjohnson / eliteboy

Updated May 29 2007
(Originally posted by TheScribblers)

We thought this one disappeared, but he did not.
Lots of nicks.
One key is equity488. Which we overlooked until now.
And there is more to come here, we don't have more time today.
We are noting that there are apparently some connection to Jose Rivera (aka Kingtriga, jrlove2001@yahoo.com).
We are also wondering a little about zenbulker (mmg.llc@gmail.com).
A bit slippery this one and the birds do not agree either.

Nicks:
bigjohnson, mbulks, eliteboy, bestleads, mrsoftee122, equity488, mbulker

aim: mbulks / mrsoftee122 (active)
icq: 247156389 [ 247-156-389 ] [ 247 156 389 ]

Socalled "aliases":
Manny Lively, Manny Rod

Hmm, could this be Kit? Or is Kit a partner?
We'll find out, sooner or later.

Whois for some domains:

Domain Name : wishyouwells.com

::Registrant::
      Name      : Manny Lively
      Email     : mbulks@gmail.com
      Address   : 827 Linden Street
      Zipcode   : 11211
      Nation    : US
      Tel       : 7182415544
      Fax       :

::Administrative Contact::
      Name      : Manny Lively
      Email     : equity488@aol.com
      Address   : 827 Linden Street
      Zipcode   : 11211
      Nation    : US
      Tel       : 7182415544
      Fax       :

::Technical Contact::
      Name      : Manny Lively
      Email     : equity488@aol.com
      Address   : 827 Linden Street
      Zipcode   : 11211
      Nation    : US
      Tel       : 7182415544
      Fax       :

::Name Servers::
      ns1.wishyouwells.com    61.158.31.26
      ns2.wishyouwells.com    222.179.142.50

Domain Name : rtheyloworwhat.net

::Registrant::
      Name      : Manny Lively
      Email     : mbulks@gmail.com
      Address   : 827 Linden Street
      Zipcode   : 11211
      Nation    : US
      Tel       : 7182415544
      Fax       :

::Administrative Contact::
      Name      : Manny Lively
      Email     : equity488@aol.com
      Address   : 827 Linden Street
      Zipcode   : 11211
      Nation    : US
      Tel       : 7182415544
      Fax       :

::Technical Contact::
      Name      : Manny Lively
      Email     : equity488@aol.com
      Address   : 827 Linden Street
      Zipcode   : 11211
      Nation    : US
      Tel       : 7182415544
      Fax       :

::Name Servers::
      ns1.wishyouwells.com
      ns2.wishyouwells.com

And some Magic Media Group:

Domain ID:D16314606-LRMS
Domain Name:WINSMART.INFO
Created On:31-Jan-2007 02:27:20 UTC
Last Updated On:01-Apr-2007 20:33:14 UTC
Expiration Date:31-Jan-2008 02:27:20 UTC
Sponsoring Registrar:Domain Discover (R183-LRMS)
Status:CLIENT TRANSFER PROHIBITED
Registrant ID:TNTN-0000378402
Registrant Name:MMGROUP
Registrant Organization:Magic Media Group
Registrant Street1:101 Convention Center Drive
Registrant Street2:
Registrant Street3:
Registrant City:Las Vegas
Registrant State/Province:NV
Registrant Postal Code:89109
Registrant Country:US
Registrant Phone:+1.7029391455
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:mbulks@gmail.com
Admin ID:TNTN-0000378402
Admin Name:MMGROUP
Admin Organization:Magic Media Group
Admin Street1:101 Convention Center Drive
Admin Street2:
Admin Street3:
Admin City:Las Vegas
Admin State/Province:NV
Admin Postal Code:89109
Admin Country:US
Admin Phone:+1.7029391455
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:mbulks@gmail.com
Billing ID:TNTN-0000378400
Billing Name:Jason Alexander
Billing Organization:
Billing Street1:101 Madison Ave
Billing Street2:
Billing Street3:
Billing City:Brooklyn
Billing State/Province:NY
Billing Postal Code:11211
Billing Country:US
Billing Phone:+1.8582481904
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:mbulks@gmail.com
Tech ID:TNTN-0000378402
Tech Name:MMGROUP
Tech Organization:Magic Media Group
Tech Street1:101 Convention Center Drive
Tech Street2:
Tech Street3:
Tech City:Las Vegas
Tech State/Province:NV
Tech Postal Code:89109
Tech Country:US
Tech Phone:+1.7029391455
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:mbulks@gmail.com
Name Server:NS2.12DNSSERV.NET
Name Server:NS1.12DNSSERV.NET

Domain ID:D15314588-LRMS
Domain Name:RAGTORICHES.INFO
Created On:13-Nov-2006 21:04:24 UTC
Last Updated On:22-Nov-2006 21:03:10 UTC
Expiration Date:13-Nov-2007 21:04:24 UTC
Sponsoring Registrar:RegisterFly.com, Inc. (R318-LRMS)
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:tujkL7KDDnfVaIxT
Registrant Name:Tammara Gonzales
Registrant Organization:Magic Marketing Group
Registrant Street1:9606 Carroll Canyon Rd
Registrant Street2:
Registrant Street3:
Registrant City:San Diego
Registrant State/Province:CA
Registrant Postal Code:92126
Registrant Country:US
Registrant Phone:+1.6192712365
Registrant Phone Ext.:
Registrant FAX:+1.6192712365
Registrant FAX Ext.:
Registrant Email:mbulks@gmail.com
Admin ID:tujkL7KDDnfVaIxT
Admin Name:Tammara Gonzales
Admin Organization:Magic Marketing Group
Admin Street1:9606 Carroll Canyon Rd
Admin Street2:
Admin Street3:
Admin City:San Diego
Admin State/Province:CA
Admin Postal Code:92126
Admin Country:US
Admin Phone:+1.6192712365
Admin Phone Ext.:
Admin FAX:+1.6192712365
Admin FAX Ext.:
Admin Email:mbulks@gmail.com
Billing ID:tujkL7KDDnfVaIxT
Billing Name:Tammara Gonzales
Billing Organization:Magic Marketing Group
Billing Street1:9606 Carroll Canyon Rd
Billing Street2:
Billing Street3:
Billing City:San Diego
Billing State/Province:CA
Billing Postal Code:92126
Billing Country:US
Billing Phone:+1.6192712365
Billing Phone Ext.:
Billing FAX:+1.6192712365
Billing FAX Ext.:
Billing Email:mbulks@gmail.com
Tech ID:tujkL7KDDnfVaIxT
Tech Name:Tammara Gonzales
Tech Organization:Magic Marketing Group
Tech Street1:9606 Carroll Canyon Rd
Tech Street2:
Tech Street3:
Tech City:San Diego
Tech State/Province:CA
Tech Postal Code:92126
Tech Country:US
Tech Phone:+1.6192712365
Tech Phone Ext.:
Tech FAX:+1.6192712365
Tech FAX Ext.:
Tech Email:mbulks@gmail.com
Name Server:NS1.BLK128DNS.COM
Name Server:NS2.BLK128DNS.NET
Name Server:

"Magic Media Group"? Right now (May 29 2007) bulkerforum.biz has magically disappeared.
Lots of magics going on. Huh, Phantom?

OhDearTisTheFantom

The publication of the name, address, phone number and pictures of one of the leading players in the bulker business was set in type and all ready to go, but there was an urgent request from a higher authority to stay the execution. Wapol wants first dibs.

Europe is in Germany

europe

Saturday, November 17, 2007

europe / guschman

History:
This one was posted on May 26, 2007 by DucksInTwoRows
And edited November 17, 2007 by veruccawatcher, after the last ddos on spam-court.com. Change: Full name



Just a short one. The intention was to write some more, but today we prefer to spend most of our time on other, important things in life than following the scum of the net around.

"europe" aka "guschman" is Martin Neumann from Germany.
Tried to be careful.
But you can never trust a spammer, even not the "trusted" ones.
Just like their own spam, their info floats around.
From one spammer to the next. And so on.
Now Martin, try to hit that delete button now.
Aber ach, zu spät. Vielleicht.

We make an exception this time and try to believe that spammers don't always lie:
Born in 1981, lives in Rostock.
Was also a member of the dead and buried specialham.com and spamforum.biz.

We have been told he works with something IT-related.
Well, of course he does, he offers hosting.
Man, those spammers think they are clever when telling us stuff.

Or did we just pull that up from a hat?

Why the hell does a host offer their services to criminals?
You know Martin, you could just get rid of that spamhosting/spamsupporting part?
Your choice.

Maybe more later, we have to double- and triplecheck some stuff.
Auf Wiedersehn.

Crypto from Moldova

Posted January 9th, 2007 by TheScribblers

Drug spammer, first posting on bulkerforum:
Posted: Sat Sep 16, 2006 8:11 pm Post subject: s-rx.biz pharma partner

Dear members, i have the honor to recomend you a pharma partner (sponsor)

Affiliate Share: 50% !

People are working very good, right now they write they own mailer, and gives sock's to mailer's wich needs them. Tech Support is alway's on.
You can add your own domain's, or use predifined ones.

More info and registration is here: www.s-rx.biz

I work with them, and I'm very satisfied with their service.

Greets
_________________
SDD

Second posting on bulkerforum:

I have a good database of anti's (including spamcop members email's and bluesecurity membres email's) message me to filter your invite email's

ICQ:294059880

Probably from Moldova. Possible name Victor Goncearencu.
Birth date is probably correct. April 1, 1984, they are some kind of fools all these guys and an april fool is not worse than others.
email(s): crypto@xaker.ru
He is an admin over at x-land.org. We'll have a look there later.

Some "interesting" hits in the logs from Jan. 8th. From Moldova apparently, the IP says so; 217.26.156.3.
Probably Crypto himself or his "friends at a hacker board". Could be his friends over at x-land.org (whois info changed lately btw). Maybe Dorin gave him a hand? They are both from Chisinau btw. Or maybe it was just Crypto himself.
You know someone is trying something when the errorlog is bigger than the log.

He has been "promoted" to moderator at bulkerforum too.
Hes englis sems as badd as the admin's though, didd it "promote" itself?
We stronggly sugest that the ufficiul langage at the forrum hereafter is referred to as "cryptenglis".
With a taste of Moldowhine. And l33tish.
Yeah, Crypto is a cool guy. Or a real April fool.

Burch and Brown

The first two inhabitants placed under the glare of the spotlight in this blog have quite a history.
Joshua Burch (ebulker) and Christopher J. Brown (dollar) rate a mention in many places, more often than not in relation to the DDoS attack that put Blue Security out of business.

Spotlighting News linked them together in that sorry episode in May 2006. They even make an appearance in the Wikipedia entry on Blue Frog and the duo scored a hit in Slashdot

Obviously these good ol' boys are not new to the DDoSing game.

Swank / Dollar / Brown

Swank (Christopher J. Brown) - intro
Posted December 8th, 2006 by veruccawatcher

For the non-spammers, Swank is probably best known from Spam Kings as "Richard Cunningham".
We think he actually is a minor player among the spammers.
He likes to give the impression of being a big player.
Most of his stuff has usually gone to pieces. Mainly a middle man.
ssoft.biz is apparently his now, earlier domains are down.
Seems he is running a forum for spammers there.
Most of his older domains are either dead or not renewed.
He likes to give the impression of being good at social engineering, investigating scammers and "antis". And of course he likes bragging about what a big guy he is, how long he has been in "the industry", what he has done earlier and so on.
Now that is a bit dangerous for him. We are coming very close, almost in his backyard by following all the trails he is giving. By following those, comparing various stories, doublechecking with other sources we are getting a picture of this guy.
He claims giving his attention more to his "legitimate" businesses now. Probably some VOIP, historically he has got a hang for opps involving that kind of stuff, e.g. Cognigen and other telecommunications/internet related. He is not doing too good though, not having too much money.
According to other sources he is running 6-7 PCs from home. Not all of them in good shape, he looses stuff regularly. A couple of them seems to be below the 1GHz mark too and he tries to upgrade them (messing it up of course, his uncle was apparently not a very good teacher, or Swank has difficulties learning).

To be continued/edited .....
See the Spamhaus entry on Christopher J. Brown

What Joshua Burch sells

MastaP

Posted: Tue Jun 26, 2007 1:24 pm
Post subject: Large Dom Full Optin Data Lists.


I have Full optin Data Here is the lists I have currently
data is from 06-07 up may of this year.

These are all FULL Data Name,address,email,ip,phone, time date,source etc

File Name: aol.txt
domain: aol.com
Unique Records: 4,092,039

File Name: yahoo.txt
domain: yahoo.com
Unique Records: 14,884,106

File Name: Hotmail.txt
domain: hotmail.com
Unique Records: 3,249,110

File Name: msn.txt
domain: msn.com
Unique Records: 749,080

File Name: earthlink.txt
domain: earthlink.net
Unique Records: 505,213

Interested in any of the lists contact ICQ: 277-819-069

Aren't there a lot of customers (23 million) on AOL, Yahoo, Hotmail, MSN and Earthlink who are sitting on the edge of their seats waiting for offers from Joshua's customers, the spamming community!

Joshua Burch

This summary is not available. Please click here to view the post.

Spam-Court hit by DDOS

During the month of June, 2007, spammers have mounted several Distributed Denial of Service attacks, designed to shut down any sites that have been gathering evidence about their antics.

They set their sites on Spamhaus but with little success, because they are well protected.
They mounted an attack on Castlecops - the premier Phish combat site, but to no avail.
Next they set their sites on URIBL and caused them two or three days of grief before the attack fizzled out.
Another fizzler was SURBL - again a two day wonder before they gave up, admitting defeat.

But the one that caught everyone's imagination was the sharpest thorn in their side. This was a little site that was hitting way above its lightweight status. Spam-Court was a sleeper. A little site but with great research. A small group (maybe two to four people) spent many hours researching the spammers who congregated at a "bulker" biz forum and started creating a dossier on some of its contributers.

Whenever anyone there posted any messages about illegal operations, the Spam-Court team noted it down, did a few Google searches, and found out more about them.

And that's where the story gets really interesting. Little by little, bit by bit, they started publishing their findings, all gleaned from looking around the Internet. When the bulker biz inhabitants discovered that their cover was being blown, thet got more than just a little hot under the collar, why, they blew their stacks. This could not be! Nobody should dare to unmask their true identities! Such mischievous behaviour might lead to all sorts of unpleasnt consequences, like their arrests.

So our spammy group at bulkers called for an all out attack on spam-court, to deal to them in much the same way as many of them had previously dealt to Blue Security a year ago.
You might be wondering what it was that got them so riled up?

Over the next few days, you will be able to read the contents of Spam-Court's postings right here. Of course, Spam-Court won't stay down for long. Every day the spammers use their zombie bot-nets for DDoS attacks is a day spent not using them for spamming. And they can't countenance that for long!