Wednesday, February 20, 2008

Who is Servman? (now that Bulkerforum is down)

Since Feb. 12th, bulkerforum.biz has been dormant. Domain does not resolve and it's not hosted on any of the previously known hijacked IP's. That's interesting in itself, in light of the slew of recent arrests involving illegal spammers.

But there's other interesting news regarding that site. Several members have suddenly been unceremoniously removed. I'll report back on a few of them in the coming weeks, but for now I thought I'd cover one particular member who seems to have actively wanted to cover his tracks: ServMan.

Back in November when Marion Lynn created his blog, spamgossip, he began exposing individual members of bulkerforum.biz, the go-to forum for illegal spammers.

Initially he listed handfuls of people per day, then removed a bunch, then removed a bunch more. Since then it's remained pretty dead, and numerous postings have been removed altogether. As one would expect, this caused people (like me) to dig a little deeper. I checked out some of the postings of the exposed users. At the time, none of it seemed particularly important.

I and many others had recently noticed (before the forum was shut down, if that's what's taken place) that some of those members have suddenly "gone dark" on that forum, notably Phantom (aka: Norman Keith Holmes.)

Then in mid-January I noticed that one of the members, ServMan, had either been systematically deleting any postings he had on the forum, or getting someone else to. (Or, alternatively, one of the admins of that forum may feel that having his particular info on that forum is a bad idea.)

Whenever I see this kind of thing happen, it definitely seems to indicate that there is truth to the exposed information. Why would somebody suddenly shut up unless the name was correct? Especially in light of how that group has acted whenever someone like myself has done this in the past (claiming libel, claiming my info is way off base, etc.) it is stunning just how silent some of the members have become.

Servman was listed as one Adam J. Minic. Searching for that turns up very few hits, but there is one interesting one from the NANAE newsgroup:

Newsgroups: news.admin.net-abuse.email
From: DarkFiber
Date: Sat, 24 Nov 2007 20:46:21 -0000
Local: Sat, Nov 24 2007 3:46 pm
Subject: Re: TURKEY STUFFING: ANOTHER SHITBAG!

On Thu, 22 Nov 2007 19:46:51 -0800, spamgossip wrote:
> SPAM AND EGGS! On Thu, 22 Nov 2007 19:46:51 -0800, spamgossip wrote:
> SPAM AND EGGS!

> The spam is in your mail and the egg is on the faces of these Bulker
> Forum members!

> servman - Adam J Minic - Boise, ID

Highly believable as there is evidence as recent as summer 2007 that Adam Minic associates with veteran spammer Todd Springer of the S & S Global LLC spam business that Todd and his brother, Scott used to run. Adam is perhaps a protege of theirs.

Kind of makes one wonder if Todd and Scott Springer didn't really retire from the spam business.

One also has to wonder if KEVIN JAMES MINIC #18299 who was discharged (as an inmate) from the Idaho Department Of Correction on 03/21/2005 is any relation.


On Dec. 27th, 2007 - the last time I bothered to check into it, Servman was responsible for 11 postings. Prior to that the number was much higher, around 30 or so.



I checked it on Jan. 28th, 2008, just out of curiosity. There were zero postings from Servman. None.



As it happens, I still have copies of some of his postings on the forum. In my opinion, while they are definitely damning evidence pointing to a string of the usual offences associated with illegal spamming, they aren't terribly different from those of numerous other members of the site. Nonetheless, either Servman or someone else must have assumed that this was too much exposure for him.

Here are the details I managed to glean from the postings I was able to archive from bulkerforum.biz last year following the exposition of Servman:


  • He expressed interest in Hotmail and Yahoo email list verifier software.

  • He was interested in purchasing lists from numerous members.

  • He offered a new RX program (ie: Pharmacy spam, like we needed more of this crap.) He paid a 45% commission per sale.

  • He used (or uses) DarkMailer (aka: DM) to perform his spam runs.

  • He was (or still is) an active member of Sancash, the now-renowned "herbal remedy" spammer affiliate program with ties to Genbucks and Tulip Lab. (yes, VPXL / Elite Herbal / Manster / Megadik, again: like any of us wants to hear about it.) He liked spamming for them and made okay commission apparently. His conversion ratio indicates that he's spamming lots of people who definitely do not want to hear about these products: "My conversions started at 1:80 and have been at 1:150-1:250 ever since." More on this below.

  • He was also a member of the bulker.biz affiliate program. (Canadian Pharmacy, I believe, is one of their properties.)

  • He has dealt with diploma spamming in the past. Whether he actually mailed it himself is unknown. This is very obviously illegal activity.

  • He was in need of new servers in Sept. 2007. He had very specific requests as to the specs of these servers, which were to be used for "proxy mailing", in other words: to use a botnet to send spam, which is illegal. It appears that he may have done a deal with RackSpace06 for those servers, and that he got ripped off by him (or nearly so.)

  • In March 2007 he stated "We have entered a new era in mailing. Botnet is your best canidate for re-entering this industry." He then outlined how to get started in the bot-spamming business. It's pretty clear he knows a lot about how to send spam using hijacked and infected computers, to lists of people who very likely don't want to hear from him.

  • He hates "antis" (such a stupid term.) Yet he continues to mail to people he knows would prefer not to hear from him. Their complaints make him angry.



What other dealings does Mr. Minic feel would be threatened by exposing him as a spammer? A google search for "Adam Minic" (with quotes) and "boise idaho" (without quotes) turns up a posting dated Jan. 23rd, 2008 on the forum "averyoutdoors.com" from a user named Camo Coatings discussing goose hunting. He is also located in Boise Idaho. I had previously suspended this posting because someone claiming to be Mr. Minic complained that someone was threatening his life based solely on my posting on this blog, ignoring completely that this information was already widely publicized last year by Marion Lynn on his spamgossip blog.

Since he has not shown me any proof of these alleged threats, this posting has been reactivated, with his comments intact. I have excised the contact info, which as mentioned before is already available elsewhere.

I mentioned his "conversion ratio." Conversions are the meat and potatoes of the spam industry if you spam on behalf of an affiliate program. A ratio of 1:80 is not good, by legitimate marketing standards. That means that for every 80 people who end up clicking through to your site, only one of them bought something. Legitimate companies, companies like (let's say) Amazon.com, or Lavalife.com, or any other above-board business which relies on third parties for some of their marketing needs would be hoping to see conversions more along the lines of 1:4, or 1:10. Even 1:10 is not considered a good ratio by legitimate companies. This goes quite a way to explaining the spammer mentality. They don't care how many people (like me) don't want to hear from them, they want money. They want the money for as little effort as possible. They want to follow only two steps:

1. Hit "send"
2. Get paid

Your complaints mean nothing to a guy like Adam Minic / Servman. He can't be bothered to clean his lists because that involves more steps than the two outlined above. Steps like: cleaning your list. Or possibly: choosing NOT to promote fake herbal remedies or illegally supplied fake pharmaceuticals which have no proven medicinal value.

A posting from January 2007 is probably the biggest indicator as to why he doesn't want his personal data out there. It's in response to a posting by mcproxy regarding exposing the personal data of someone who scams you in the spam industry:

The thing is, maybe not posting personal info. but enough to get the point across. Ie: icq, alias, etc.. In a perticular section of the forum. I was just expressing my idea in hopes that we could build something workable. I vote for a scammer section for misconduct and wrong-dooing un-becoming of a valid contact in this biz type of section.. hehe.

Currently if any of us get scammed, I can speak for myself anyways, I will post their alias info at least. I have never posted anyone's personal info. and I am sure never will. But many of us know each other past our alias. So therfor thats the assumed risk we take in business through gui interface..

Maybe my "quick reference section to scammers" is not a great or even good idea, but just wanted to convey my thoughts about this issue.

Any-thoughts guys???


Maybe he's worried about being perceived as a scammer. Or maybe he does business in other areas which would be impacted by having his real name associated with activities like spamming or using a botnet. Aside from the purely legal ramifications, I guess that would definitely impact his bottom line. But then why continue to spam? Why knowingly participate in these activities if you weren't already well aware of the risks?

I'm intrigued to see if he appears anywhere else out there in terms of forum postings. Having said that: I have a life. I'm not going to knock myself out about it. Digging this bit of info didn't take long at all. I like to keep it that way.

It appears that Lynn was correct in identifying Servman. (Surprise!) I'm still not sold that he's effectively identified anyone else, or that doing so has had the desired effect.

SiL / IKS / concerned citizen

5 comments:

Adam Minic said...

Hello IKS, if it is you who are sending me threatning letters about spamming, please stop. I don't know you and I have never sent you or anyone spam.

Sincerely,
Adam Minic
Boise Idaho

IKillSpammerz said...

No, of course it is not me sending you or anyone else threatening letters.

By the way: no spammer knows me. That hasn't stopped them from sending me literally millions of messages that I do not want on a consistent basis.

I never threaten anyone. I merely research and present what I came up with, usually to law enforcement.

If someone is sending you threatening letters, you should take them to the police. I would expect that everyone knows that.

SiL / IKS / concerned citizen

Adam Minic said...

Hello IKS, Your name is I Kill Spammers. I checked my name on google and see you posting this crap using my name. The next obvious thought was to think you sent me the nasty emails telling me to stop spamming or else. I don't spam. I don't have anything to do with your email problems.

Sincerely,
Adam Minic

IKillSpammerz said...

> I don't spam. I don't have anything to do with your email problems.

So there may indeed be more than one Adam J. Minic in Boise Idaho. It's possible.

That identity was confirmed by a few sources including law enforcement.

I still am not the one sending anything threatening to anyone.

I have to correct you on this: my BLOG is called "i kill spammers", because I think everyone wants to (figuratively) kill spammers. I have no actual wish to kill anyone, or to threaten anyone.

I'm more than happy to retract or amend this post, but I'm also contacting you regarding the threats, because I can possibly help you find out who is sending them.

SiL

IKillSpammerz said...

I have reactivated this posting because it is of interest to the spam-fighting community. I have never received any valid proof of these so-called threats. Nonetheless I have excised the contact information which previously existed here.

Mr. Minic's comments link to his own blog regarding his fishing and hunting business. It is possible that there are indeed two Adam J. Minic's living in Boise.

SiL / IKS / concerned citizen