Wednesday, January 16, 2008

Marion Lynn Is Wrong (Again)

It was brought to my attention recently that Marion Lynn (yes, him again. Bear with me, I'll try to be brief) is under the erroneous assumption that I am posting all over the place about him, and essentially harassing him in forums unrelated to spam using the nickname "snap_pop_no_crackle".

An example can be found here, in which Marion responds to the user named snap_pop_no_crackle regarding a story about Auschwitz (warning: not a lot of sensible discussion going on over there.)

14 January 2008 at 8:15 p.m.

snap_pop_no_crackle (Anonymous) says...

snap writes:

















14 January 2008 at 8:34 p.m.

Marion Lynn

Marion (Marion Lynn) says...

Well, Sil, A**hole or "Snap"; whatver is appropriate, I intend to make my recollections and research available as a free downloadable E-book because I believe that it contains infomation which cannot be found elsewhere and that the information is important to our understanding of history.

Just to set the record straight: I am not that user. Nor do I post on ljworld. Nor would I ever.

I also am not the same username (snap_pop_no_crackle) who is posting on Marion's own rather ridiculous forum, rivercitytalk. (I'm not linking to it. You can find it pretty easily yourself.) I personally believe that snap_pop_no_crackle is a user who originally commented on my blog anonymously back in June 2007:


Anonymous said...

for a mass spanking of Marion.

6/07/2007 06:32:00 PM

I could be wrong. It could be someone else. I hadn't even seen that posting, and you can see numerous comments by that user. This was the first I'd ever heard of it, or the username snap_pop_no_crackle. It's still a pretty good read, but that is not me.

Just to further clarify: The only monikers I have ever used to identify myself in all things spam-related are:

• SiL (short for SpamIsLame)
• IKS (short for IKillSpammers)
• concerned citizen

Marion can believe what he wants, but he's (as usual) mistaken.

Which calls into question the quality of the information he's been using to out several members of Bulkerforum. I notice all posting has come to a complete halt at since last November. Much of what he posted didn't amount to actual "evidence" in the first place. Just a litany of names. Clearly he was on the right track with a few of them, notably Phantom. But where's the beef?

I've got one for him to try and dig up: the admin of What's his name? Where does he live? What else does he run besides

I would bet dollars to donuts that Marion hasn't got a clue. Not that it really matters anyway; that forum has essentially cannibalized itself.

Anyway. Now that that's off my chest, back I go to fight more VPXL spam.


Monday, January 14, 2008

US Pharmacy (Very American) -> Total Lies

We are seeing a great deal of new spam for this family of illegal websites. I thought it was time to raise the curtain on how these illegal websites operate.

Note that on the front page, the site is selling numerous controlled substances:

A closer look:

Note that they misspell "Hydrocodone". Sounds like a real professional operation they got goin' on there...

Hydrocodone is defined by the US Food and Drug Administration (FDA) as a banned Schedule II narcotic, and further defined by the FDA as a Schedule III controlled substance.

Vicodin ES is a derived product containing Hydrocodone and is similarly classified by the US FDA.

Phentermine, Ambien and Xanax are all defined by the FDA as Schedule IV controlled substances.

Ultram (also known as Tramadol) is not classified as a controlled substance but it is highly addictive.

Controlled substances are considered by the FDA and the international medical community to have a very high risk of addiction.

Further reading:

Schedule III (US)
Schedule IV (US)

For Vicodin ES, the usual dose is 1 tablet, up to a maximum of 5 tablets per day. It is only recommended to take this drug (as well as Hydrocodone) under the strict recommendations and instructions of a doctor or pharmacist. Overdoses can kill people. Addiction is a very strong possibility.

The sale of these substances is considered a federal offence, particularly if one does so with no medical background whatsoever. As we shall see, not only do the operators of these sites have no medical background, they seem to be pretty open about indicating that this is the case, even though they might not recognize that they have done so.

They claim to accept Visa, American Express, Diners Club International and JCB Gold, as well as the online check service ECheck. They even present a special animated banner for the front page, and several large-size icons making this claim:

In reality, when one makes it through to their shopping cart page, it turns out that they only accept Visa and American Express. They also definitely do not accept ECheck, and no such option is present on any of these websites:

The quantity of tablets available for Hydrocodone on all US Pharmacy sites far exceeds any recommended dosage guidelines for this drug:

Clearly these websites do not care what happens to the patients who purchase these products from them. That last entry (180 pills!) is enough to cause serious harm or even death to somebody who is not under the care or supervision of a doctor or pharmacist.

At no point, anywhere on these sites, is there any mention as to who is the registered pharmacist or medical professional who will be providing these drugs to consumers. The sole purpose seems to be to profit as much as possible, even if it means killing the consumers who purchase these dangerous substances.

Throughout the site, a javascript function causes a momentary pop-up graphic to appear which claims: "Please Wait, Secure site loading":

This is of course a lie. There is no secure socket layer encryption technology present anywhere, on any of these websites. They also feature, to the left side of their menu, an image which claims "100% Secure Site":

This is, of course, also a lie.

A typical spam is received in only text format (no html) and featuring very stripped down content with no subject line. A typical message body will read "Get the pian meds you need" (sic) and then feature a link to the target website.

In early January, 2008, the links in the spam messages was almost always a Blogger website whose sole purpose was to redirect the user to the actual target website. For example: The spam received on Jan. 14th, 2008 contained the url:

That url in turn redirected us to:

Which was a mistake in this case, the morons who set up the Blogger site failed to use appropriate url redirection techniques. (Maybe they were high on Vicodin at the time...) It was attempting to redirect us to:

Several users have received dozens of these messages throughout the month of January. In all cases, the abuse of Blogger urls was reported directly to using their abuse reporting form:

Their "About Us" page makes no mention as to the quality of their products or their legal ability to sell any of them, but they do make a point of saying that they are a popular destination for the purchase of these controlled substances, legal or not:

US Pharmacy is your online pharmacy for FDA approved drugs, specializing in the EXTREMELY POPULAR, yet hard to find High Level Muscle Relaxers, Pain Relief, and prescription Sleeping Aid Meds and MORE!

Join tens of thousands of customers who safely, conveniently, and discreetly order prescription medication including men's health, weight loss, pain relief, diabetes, stop smoking, cholesterol and anti depressant medications and more. Check out our FAQ for more information.

Their FAQ page makes a series of claims which could only be perceived as further lies in light of the fact that they falsely claim to be offering us a secure server.

Q. Is it safe to use my credit card with US Pharmacy ?

A. Absolutely. We have taken every precaution to make sure your transaction is secure. All account information submitted to us is safely isolated from unauthorized access. When you place an order online or with US Pharmacy, your personal information and credit card information are encrypted using SSL encryption technology before being sent over the Internet, making it virtually impossible for your information to be stolen or intercepted while being transferred.

Q. Is my personal information kept confidential?

A. Absolutely the personal information you give us will only be viewed by authorized employees of our company for the purpose of completing your order. We do not sell, trade, or rent your personal information to others.

Q. Are the drugs that you sell safe?

A. Our products are made by overseas pharmaceutical manufacturers. These are the very companies that manufacture (and export in bulk) the drug that goes in to the making of the world's best-selling brands. In the new global economy, manufacturing is increasingly being outsourced to overseas facilities of parent companies or third-party suppliers. Naturally any new advances in manufacturing technology are invested in to these overseas facilities, rather than in to the company's little-used factories. Our drugs are manufactured in state-of-the-art facilities that fully comply with the Good Manufacturing Practices (GMP).

That statement regarding the "GMP" shows the potential for just how dangerous these websites are. The US FDA's Good Manufacturing Practice (GMP) regulation does indeed exist, however it was put in place to regulate the manufacturing of medical devices (think: stethoscopes, scalpels), not pharmaceuticals. The GMP has absolutely no bearing whatsoever on pharmaceutical products. The operators of these sites are clearly not any sort of medical professional, and are only in this to profit at whatever cost. As such all of these websites should be seen as extremely dangerous.

And later in the same FAQ:

Q. Is this legal?

A. There are different laws in different countries for import the drugs for personal use. US FDA regulations allow for the importation of personal medication required for a 3 month period. US residents are already importing medication from Canada, India and South America and US citizens travel to Mexico and Canada to purchase the drugs all the time. Americans are fed up with huge prices at local pharmacies, and Congress is allowing them to buy drugs from other countries to combat this injustice. World-class drugs are now within reach of everybody who is being squeezed by the high cost of prescription drugs.

What this statement conveniently fails to mention is the following:

The United States Federal Food, Drug, and Cosmetic Act (Act) (21 U.S.C. section 331) prohibits the interstate shipment (which includes importation) of unapproved new drugs.


"when 1) the intended use [of the drug] is unapproved and for a serious condition for which effective treatment may not be available domestically either through commercial or clinical means; 2) there is no known commercialization or promotion to persons residing in the U.S. by those involved in the distribution of the product at issue; 3) the product is considered not to represent an unreasonable risk; and 4) the individual seeking to import the product affirms in writing that it is for the patient's own use (generally not more than 3 month supply) and provides the name and address of the doctor licensed in the U.S. responsible for his or her treatment with the product or provides evidence that the product is for the continuation of a treatment begun in a foreign country."


to ensure that the importation is for personal use only (and not for resale), and to ensure that the use of the unapproved new drug sought to be imported into the U.S. is supervised and does not represent an unreasonable risk, the guidance provides that the individual affirm in writing that the drug is for his or her personal use, and provide either the name and address of the U.S. licensed physician who will supervise its use or some evidence that the treatment was begun in a foreign country and that the drugs are being imported to continue/conclude the already begun treatment. Thus, while not the only documentation, either a U.S. or foreign prescription, along with an affirmation of personal use, could be supplied as evidence that this factor exists.

So no: what these sites are doing IS NOT LEGAL. Purchasing these substances from these sites IS NOT LEGAL. In fact, purchasing from these sites can lead to some serious charges for the consumers under FDA regulations, but this is assuming that the customer survives their likely overdose, given that the quantities which these sites have chosen to sell of these substances is much higher than anyone should ever take of these drugs.

Nobody requires a "three month supply" of Vicodin. That is a sure sign of addiction, and likely a sign that the user is at risk of overdose.

Placement of several control orders resulted in no secure page being accessed at any time, and no real-time validation of credit card information took place. We were immediately forwarded (via javascript) to a thank you page which passed a series of parameters which were easily able to be modified with no adverse effect.

Example url we were forwarded to:

We could easily modify this to say:

It has no problem with our value for the PTxnID paramater, and passes it through to the thank you paragraph:

This further indicates that there is no security whatsoever on these websites.

Placing an order results in a "thank you" page which claims that your order has been placed, and provides a 10-digit numerical tracking id. [eg.: 1291602685] They claim: "average time taken to fulfill an order is somewhere between 2 to 3 weeks."

They state that consumers can send emails regarding their order to the email address:

The website that they claim users can track their orders at is, however no such domain existed at the time we placed our sample orders.

Finally: even the brand for these illegal websites is a lie. Calling themselves "US Pharmacy" with the tagline "Very American" within their main banner indicates how badly they want to be taken seriously as a US-approved online pharmacy:

In reality the website we were spammed with () was hosted at an IP address located in China:


inetnum: -
netname: ZBYD
descr: ZBYD Technology Co.,Ltd
descr: 15A build , xiyongle road ,shijingshan district ,Beijing
country: CN
admin-c: LA100-AP
tech-c: LA100-AP
mnt-lower: MAINT-CNNIC-AP
mnt-routes: MAINT-CNNIC-AP
changed: 20071106
source: APNIC

person: Lei An
nic-hdl: LA100-AP
address: No. 20, Fuxing Road, Beijing
phone: +86-10-68650064
fax-no: +86-10-66813424
country: CN
changed: 20071106
source: APNIC

inetnum: -
netname: ZBYD
descr: ZBYD Technology Co.,Ltd
descr: 15A build , xiyongle road ,shijingshan district ,Beijing
country: CN
admin-c: LA1-CN
tech-c: LA1-CN
mnt-lower: MAINT-CN-ZBYD
changed: 20071106
source: CNNIC

person: Lei An
address: 15A build , xixiaoqu road ,shijingshan district ,Beijing
country: cn
phone: +86-10-68610494
fax-no: +86-10-68610495
nic-hdl: LA1-CN
changed: 20071106
source: CNNIC

The domain itself outputs absolutely no WHOIS information which is in violation of the ICANN accreditation rules. The domain was registered with XIN NET TECHNOLOGY CORPORATION on Jan. 9th, 2008, and the operators of this domain refer WHOIS requests to their own special whois domain ( which is unreachable.

A bit of a rant regarding XIN NET Technology Corporation: They appear to be the domain registrar of choice for all illegal spammers around the world today. Out of thouosands of complaints which have been lodged with them regarding a variety of patently illegally used domain names, not a single one has been responded to or acted upon. We're talking months of complaints here. ICANN apparently doesn't care. I and many others have complained to them regarding this rogue domain registrar with absolutely no response or action taken. You could probably create your own style of snuff porn site, and have it registered via XIN NET, and nobody will do anything about it. ICANN: When are you going to do something about this?

Anyway: Clearly, there is nothing American whatsoever about these websites.

Spammer lie. Criminals also lie. These sites are created and operated by criminals, and promoted via spammers.

Needless to say: Do not purchase from these websites. Among other things, it's "un-American".

SiL / IKS / concerned citizen

Friday, January 4, 2008

Another Day, Another Spammer Indictment: Alan Ralsky

It was only last May when we heard that Robert Alan Soloway was finally arrested for a variety of fraud charges stemming from his rampant illegal spamming. Now comes news that another long-time spammer, Alan Ralsky, has been indicted on very similar charges, this time relating to your typical "pump and dump" stock scamming. He's not alone either: he's only one of ten (10) individuals facing US federal charges including conspiracy, wire fraud, mail fraud, money laundering and computer fraud.

There are distinct similarities between Soloway and Ralsky, not least of which is their continual boasting about how untouchable they were, how they'd never allow themselves to face charges relating to their spamming practices, and that they'd never serve a single day in jail. For Soloway: that last one is already out the window, as he's been in custody since May in a federal penitentiary, and will remain there until his trial begins sometime this year (no date has yet been confirmed.)

Another similarity: These two individuals have been responsible for an overwhelming amount of junk email since approximately 1995.

If you look at Ralsky's Wikipedia entry, you can see a familiar pattern of fraud perpetrated over a very long period of time which actually predates his attraction to the Internet as a method for perpetrating these crimes.

I'm not entirely sure why an FBI raid on Ralsky's property in September of 2005 failed to result in any charges against him. The most often-quoted statement Ralsky made about it at the time sums it up: "They didn't shut us down. They took all our equipment, which had the effect of shutting us down." That definitely impacted his ability to profit quickly, but why weren't there any charges laid then? Whatever it was that has taken from 2005 until early 2008 to culminate in this litany of serious charges must have some serious evidence to back it up, and some lengthy investigations by a large number of law enforcement departments. Obviously that takes time.

Unlike Soloway, Ralsky seems to have made his fraud career into a family affair, involving his son in law Scott K. Bradley. This is not the first time he's involved relatives either: Bradley's home was also raided in September 2005. In stark contrast, Soloway appears to have been a bit of a loner, and virtually barricaded himself inside his posh Seattle apartment to continue his scamming activity.

In both the Soloway and the Ralsky indictments, one thing is clear: anti-spam laws are definitely the weakest link in the entire chain in terms of bringing charges that will stick, and in particular the CAN-SPAM law has absolutely no teeth whatsoever for this purpose. In both cases, the focus is much more distinctly on the material crimes of fraud and money laundering, much less so on the rampant abuse of computer systems (renting / leasing and using botnets, probably using hijacked public servers, etc.) and mass emailing millions of recipients who never wanted any of their crap in the first place, using fake headers the whole way. These crimes unfortunately don't appear to be seen as the serious problems that they are based on previous attempts to charge criminals under CAN-SPAM. Spammers abuse systems around the world and know that the law will never make any charges stick regarding these abuses. It's frustrating to me and many others that this crime is still not taken seriously in the courts.

Having said that: removing such a large scale fraud operation, by whatevere means, is most definitely something to be happy about. I don't care how they chose to promote it: fraud is fraud. Ripping people off is a crime. Ripping people off repeatedly is a crime. Each of their counts carry massive fines (up to $250,000 for each count, and there are several counts each) and lengthy jail terms (up to 20 years in federal prison for each count of many of the charges.) Since Ralsky has been so boastful about how much he loves spamming people, I'm sure that he'll remain in custody for many months leading up to his trial, whenever that takes place.

And it's not even a full week into the New Year. :)

Happy New Year, everyone. Let's hope we see a lot more arrests like these in the coming months.

SiL / IKS / concerned citizen

P.S. All of the stories related to these charges only mention that "Chinese companies" were affected by his stock spamming. I'm going to predict right here that two of those companies were CYTV (China YouTV) and CWTD (China World Trade Corp.). All of us saw rampant spam runs for these two stocks for well over two full years. They both appeared to be totally fictitious "companies" which existed only on paper, and apparently solely for the purposes of stock market fraud and manipulation. (I wrote about CWTD previously.)

If I'm right, you owe me a beer. :)

Wednesday, January 2, 2008

Crazyremedy (VPXL) Spammers Want To Kill You

I keep seeing tons of spam whcih abuses the Google "I'm feeling lucky" feature in the hopes of redirecting you to websites for the idiotic fake "herbal remedy" product currently known as "VPXL." It was previously known as Elite Herbal, Manster, Megadik and ManXL. I'm sure they'll change their product name yet again. It all amounts to the same thing. It's fake. It doesn't work. It can cause serious health defects to purchase these pills, which of course they don't want you to know. The current domain being spammed in this way is The barrage of spam for this completely bogus product to two of my accounts using this method is up to 42 per day. These idiots are clearly targeting anyone at all, not caring at all who gets their crap messages or whether they ever care to purchase this bogus "remedy."

Don't support these morons. For each attempt that they make, I will create a posting on this blog to subvert their "I'm feeling lucky" abuse of Google. And of course I'm reporting the "" domain.

Spammers, as usual, are complete idiots. I hope every last one of the spammers behind this Genbucks / Tulip Lab promotion get arrested and raided, just like Shane Atkinson did.

Stop clicking on spam for VPXL and other such products, and stop supporting them by purchasing from their totally insecure fly-by-night websites.

SiL / IKS / concerned citizen.