Friday, December 14, 2007

Elite Herbal Exposed by BBC4, Blogger

Another quick one. Another intrepid investigator of illegal spammers, Spam In My Inbox, has joined the BBC in investigating the cretins behind the endless flood of unwanted "Elite Herbal" spam, drawing direct links between the Elite Herbal spam type, the GenBucks affiliate program, Tulip Labs in Mumbai, India (who create and ship the bogus "herbal remedies") and the actual spammer who hit the send button: Shane Atkinson of New Zealand.

It's a fascinating story and has apparently led to several new investigations.

You can listen to the show, BBC4's "The Investigation", here.

I have created a temporary download of an mp3 podcast of the show here, and I also created a complete transcript of the show here.

You can read SpamInMyInBox's response to the show here.

This is great news regarding this widely reviled group.

SiL / IKS

Saturday, December 8, 2007

Is Phantom Really Norman Holmes?

Just a quick one since I noticed that spamgossip has vastly modified its content.

All posts referencing anything but LIZZA have been taken down!.


Indeed. When did that happen, Marion? And for what reason? Someone bringing more heat than you expected?

Looks like his identification of Phantom as one Norman Holmes of Perth, Australia was probably correct, and this appears to be reflected in Phantom's complete silence on bulkerforum and most other places we'd expect to find him.

That may also mean that he's been correct about the identification of many others. How did he get this information? Who would trust an idiot like Marion Lynn with their personal data? He certainly wasn't welcome on bulkerforum for most of the time he was there, and in a relatively short span of time he managed to completely piss off most of that forum's members. I can't fathom who would openly share this kind of data with him, but clearly whoever they were: they were successful in providing a ton of evidence to the completely wrong guy. (It's apparent that a lot of the info came from Lizza aka Steve Joseph, as evidenced in the remaining AIM chat transcripts, but there must have been others, as this info paints a far from complete picture on its own.)

This whole thing looks fishy, and in the grand scheme of things proves that no real heavy hitters were actively posting on bulkerforum anyway.

Phantom's last posting in the public areas of bulkerforum back on Nov. 15th was mostly a whiny rant about Nick Danger and his original posting on the NANAE newsgroup. He further alleges that Marion Lynn is now guilty of computer hacking. That's a pretty ridiculous conclusion to come to, Norm. :) We all know that Marion's computer expertise does not extend beyond the most basic workings of frikkin' AOL for christ's sake.

Anyway it's interesting, and I'm certain that I'm not the only one who has noticed this stunned silence from the bulk (get it?) of bulkerforum members.

You may have heard about the scads of recent arrests of individuals involved in botnet ownership and operation, theft of personal data and credit card fraud just in the past two weeks. This has been a banner year for cracking down on the scum that continue to send everyone illegally propogated spam messages to people who don't want them, promoting products which are not only unwanted by 99.99999% of its recipients but are also fraudulent, counterfeit, and in some cases fatal. I fully expect to see more arrests in the coming months, and who knows: maybe we'll see a Mr. Norman Holmes behind bars for enabling so many mailers to illegally use services which are not theirs for the propogation of illegal spam using his infamous WarpSpeedMailer software.

The old adage is true that whenever you shine a light on a bunch of cockroaches, they scatter and hide in record time. Spammers, apparently, are absolutely no different.

SiL / IKS / concerned citizen

P.S. Of course I and many others have complete sequential backups of spamgossip including all of the personal data which was posted regarding Norm Holmes and others. I won't repost all of it here just yet, but it's definitely still out there. Also: that original NANAE posting and several others still contain this same information including all of the images of his household, the location of his house, and his god-awful taste in furniture and upholstery. None of that is going away anytime soon.

Friday, December 7, 2007

Fake Diplomas Are Illegal

Many people wonder what the deal is with ridiculous spam messages such as these:

F A S T T R A C K D E G R E E P R O G R A M Obtain the degree you=
deserve, based on your present knowledge and life experience. A prospero=
us future, money earning power, and the Admiration of all. Degrees from a=
n Established, Prestigious, Leading Institution. Your Degree will show ex=
actly what you really can do. Get the Job, Promotion, Business Opportunit=
y and Social Advancement you Desire! Eliminates classrooms and traveling.=
Achieve your Bachelors, Masters, MBA, or PhDin the field of your experti=
se Professional and affordable Call now - your Graduation is a phone call=
away. Please call:1-206-888-2083


This is what's referred to as "Diploma Mill" spam. If it sounds shady, that's because it is. In fact it's 100% illegal to sell fake diplomas, and more importantly it's a crime to represent yourself as having earned such a degree when applying for work.

The spam operation works like this:

- A sponsor handles the printing and shipping of the fake diplomas.
- Sponsor contacts spammers / mailers in the hopes of drumming up leads
- Spammer sends a message to millions of recipients (who probably, like me, don't want them)
- Inevitably one or two of them call the number, which is a voicemail prompt which reads as follows (for the number above, anyway - it varies):

Thank you for calling the university degree program. After the tone, please leave your name and two telephone numbers. One where you can be reached during the daytime hours and one for evenings.

Please do speak clearly after the tone. One of the registrars will be in touch with you shortly. Thank you and have a nice day.


From there, the spammer provides your voicemail response to the diploma sponsor. Lately that process has become a bit more labor intensive for the spammer, since (of course) so many people DON'T want to be contacted regarding this so-called "offer." As a result, several angry recipients of these emails have left voicemails in the hopes of tracking down who is behind them. This leads to issues for the spammer, who previously used to just hand over the voicemails only to be told by a pissed-off diploma sponsor that 4 out of 5 of the calls were angry complaints, or legitimate sounding responses that led to an angry person at the other end of the phone when it came time to reel them in.

So now the spammers have to filter out the complainers from the legitimate people who want to illegally purchase their fake diplomas.

An example of a fake diplomaYou'll notice that they word the voicemail in such a way as to indicate that you're undergoing some University-style admissions process. In reality this is, as one might expect, a purely commercial process. You want the piece of paper. They want your money. No background check takes place. No school transcripts of any sort are required. All you need is a credit card and an address to ship the phony diploma to. And you're done.

The hazards involved with this flatly illegal practice should be obvious to anyone. Would you trust any new doctor with a diploma on their wall if you were aware that any percentage of real people actively spend their money on these documents? Would you trust a new hire in any field if they presented you with this document as evidence of their expertise? Would you trust a contractor to make any repairs or modifications to your property if they claimed to have a degree or diploma claiming their excellence at what they do?

This kind of fraudulent representation has already happened, and led to some horrifying consequences. In 2003 one Laurence Perry was convicted of manslaughter. He took an 8 year old girl off her insulin and she died. Later, it was discovered that he represented himself with fake medical degrees. That's an old story, so in all likelihood he's out of jail by now.

A similar story unfolded as recently as a week ago, when "Doctor" John Curran was convicted of wire fraud and money laundering, after he "treated" 18 year old Taylor Alves in 2002 for terminal ovarian cancer. He basically ruined her life, which was already in jeopardy after such a crushing diagnosis. He's behind bars for 12 years.

Certainly it's not only medical degrees or MBA's which are on offer from these operations.

The sponsors behind these illegal documents treat it as though it's any other product. One member of bulkerforum.biz (among numerous others) who goes by the name of "Princess" is clearly very experienced in this field. She posted the following back in October of 2007, and apparently generated quite a bit of interest:

Topic: Mailers needed

princess

Joined: 15 Sep 2006
Posts: 25

PostPosted: Thu Oct 04, 2007 2:24 pm
Post subject: Mailers needed

Hi all.
for those who do not already know :)
I Sponsor a University program.
I am looking for more mailers to join our mailing group because my program is expanding.
A leads related program.
Pay starts at $18 to $20 depending on volume, for a good lead.

Q: What is a good lead?
A: A person who responds to your non URL adds who calls the phone number and leaves his contact information with a working phone number. It's so simple just too good to be true.

I use a non URL add that works through an email voice mail system, there is a phone number in our adds.
Only USA or Canada leads needed.
A qualified Mailer should be able to generate at least 10-20 good leads per day.
12 leads *$20 = 240$ USD a day
The conversion our good mailers have, is 70% good leads and about 30% bad. They make from $500 to $1500 weekly.
Payments, sent weekly via Bank Wire or WU.

I have a very good relationship with all our mailers and treat them well because I recognize that they are the fuel that helps run my business.
Please look me up and we can discuss this further.
You can contact me on ICQ # 338-284-118

Thanks Dianna


Cute. "Princess" Dianna wants to sell us fake degrees.

She continued to push this promotion several more times right through November 2007.

Note the specificity of what constitutes a "good lead". No websites, period. This is probably due to the arrest, prosecution and conviction of sponsors such as Craig and Alton Poe, back in December 2004. You can read a brief description of their conviction here. The story itself is quite entertaining not only because it involves lowlife criminal spammers going to jail, but also because of how it came to the attention of the Pennsylvania Deputy Attorney General:

Colby Nolan (pictured, left) is probably the first animal to hold this distinction -- an executive MBA from a university.

Pennsylvania Attorney General Jerry Pappert isn't amused, since Colby is a pet cat and a Texas-based online college allegedly gave the feline a degree for $399.

...

Pappert's office used the pet cat to investigate an alleged scheme designed to promote and sell bogus online academic degrees.


The main reason it was so easy to prosecute them and send them to jail is because they gathered their so-called "diploma leads" via easy to identify websites. Diploma sponsors couldn't ignore this and so they adopted a variety of alternate methods of generating the leads, most notably via throwaway voicemail phone numbers.

None of this makes the practice any more legal, or any more legitimate. If you attempt to use a fake document to gain employment, that's a crime. in the United States: It's a federal offence. Several states have begun cracking down on these illicit operations, and more than half of the states in the US have specific laws on the books regarding the sale of these documents, or the use of them as personal documentation.

As with most other types of spam-related crime, this is generally considered a variety of fraud.

In the case of the Poe brothers, they also generated fake grades transcripts, which is a further federal offence.

As with most other products promoted via illegal spammers: you should avoid these at all costs. Princess said it herself: "It's so simple just too good to be true."

There is a fantastic blog which tracks illegal diploma mills called (appropriately) diplomamillnews.blogspot.com. Definitely worth a read.

One can only hope that spammers convicted of this type of fraud end up being represented by lawyers with similar "credentials."

SiL / IKS / concerned citizen

Wednesday, November 28, 2007

One More Dangerzone Transcript

I forgot one last one from yesterday, so here it is:

AOL IM Session between Steve Joseph and Marion Lynn, Wednesday August 22nd, 2007
StaySpamming1 = Steve Joseph (bulkerforum username: Lizza and flores9xx)
SpringLilCobra = Marion Lynn (bulkerforum username Nick Danger)
Screen capture image of this chat session as posted by Marion Lynn on Nov. 24, 2007 on spamgossip.blogspot.com:
http://img441.imageshack.us/img441/2536/lizzamonhn8.jpg

SpringLilCobra [11:57 A.M.]: Let's go down and get dollar drunk so that we can have a talk
StaySpamming1 [11:57 A.M.]: yeah
StaySpamming1 [11:57 A.M.]: id hit him in head wammer
StaySpamming1 [11:57 A.M.]: won't be peaceful w/me an him
StaySpamming1 [11:58 A.M.]: I got anger built in for him
SpringLilCobra [11:58 A.M.]: Yeah, DDOS HIS ASS!
StaySpamming1 [11:58 A.M.]: an his fake god ass!
StaySpamming1 [11:58 A.M.]: oh yeah w/my fist
StaySpamming1 [11:58 A.M.]: He hasn't been out the house in 30 years
SpringLilCobra [11:58 A.M.]: :)
StaySpamming1 [11:58 A.M.]: gonna walk him around the block like my puppy
StaySpamming1 [11:58 A.M.]: hands an feet, dont obey I kick thatk id in the ass!!!!
StaySpamming1 [11:58 A.M.]: boy do I hate dollar
StaySpamming1 [11:58 A.M.]: hes so fake, and people worship this shit. he was once a Blood/Crip
StaySpamming1 [11:58 A.M.]: gang member
StaySpamming1 [11:58 A.M.]: drug addict
StaySpamming1 [11:58 A.M.]: now hes a god spammer? lol
SpringLilCobra [11:59 A.M.]: Yeah that is a bit funny. Is he black?
StaySpamming1 [11:59 A.M.]: white as snow
StaySpamming1 [11:59 A.M.]: chubby child
StaySpamming1 [11:59 A.M.]: Real nerdy, lots of acne
SpringLilCobra [11:59 A.M.]: that's what I thought. How he be a crip?
StaySpamming1 [11:59 A.M.]: he just acts the part on line
StaySpamming1 [11:59 A.M.]: lol
StaySpamming1 [11:59 A.M.]: He always used to come on aol talking about
SpringLilCobra [11:59 A.M.]: I thought only niggaz was Crips
StaySpamming1 [11:59 A.M.]: 'Yo nigga Ill ice you couzz'
StaySpamming1 [12:00 P.M.]: 'Yo son Ill ice you up nigga fo real mayn'
SpringLilCobra [12:00 P.M.]: I'll shove ice up his ass!
StaySpamming1 [12:00 P.M.]: god I remember him
StaySpamming1 [12:00 P.M.]: then two weeks later he came in
StaySpamming1 [12:00 P.M.]: wannabe
StaySpamming1 [12:00 P.M.]: cKilla
StaySpamming1 [12:00 P.M.]: blood gang!
StaySpamming1 [12:00 P.M.]: ii said ahh shit
StaySpamming1 [12:00 P.M.]: mental DISORDER!
StaySpamming1 [12:00 P.M.]: x-socs on line but cant answer his own posts
StaySpamming1 [12:00 P.M.]: i love it
StaySpamming1 [12:00 P.M.]: LOL
StaySpamming1 [12:00 P.M.]: X-COCKS
SpringLilCobra [12:00 P.M.]: Yeah, he is most likely a very unhappy person
SpringLilCobra [12:01 P.M.]: I notice that everyone but mega is leaving me alone pretty much
StaySpamming1 [12:01 P.M.]: lol
StaySpamming1 [12:01 P.M.]: id love him to post
SpringLilCobra [12:01 P.M.]: mega is really pissed
SpringLilCobra [12:01 P.M.]: scared actually
StaySpamming1 [12:02 P.M.]: id say Uh, Don't you got enough issues from scamming your clients? Then sending a confirmed no good guy like email4marketer money? which you never sent? You had ronn send it? then you go bitch a storm after the guy when he clearly scammed you? Why not get a job or spam for your services and earn money, instead of borrowing money for your services
StaySpamming1 [12:02 P.M.]: Stop trusting people and do your own damn work, Lastly, Mind your dman Business and answer your own threads!
StaySpamming1 [12:02 P.M.]: ya bitch!
StaySpamming1 [12:02 P.M.]: :D
StaySpamming1 [12:02 P.M.]: god id love these kids in my room
StaySpamming1 [12:02 P.M.]: ;[


Again: mostly so that it becomes searchable text as opposed to just a jpg, which is all that Marion Lynn posted.

Not terribly much insight in this one other than to further underscore what a ridiculous soap opera Bulkerforum has become. I think we all thought they were pretty small fry before, but these kinds of discussions only further that impression.

SiL

Tuesday, November 27, 2007

Monday, November 19, 2007

[anherbal.com] XtraSize / Elite Herbal Supplements Will Kill You!

I keep getting spam which abuses Google's "I'm Feeling Lucky" button. Usually a url just like this:

http://www.google.com/search?hl=en&q=inurl:anherbal&btnI=I=Im+Feeling+Lucky

The goal is to rank the domain up high enough that it is automatically the first choice for Google, a domain which is whitelisted and very commonly accepted by most email domains.

It is of course yet another feeble, desperate attempt to "hit inbox" (as the spammers call it) of as many people as possible, especially those who never wanted it in the first place.

If you remove the segment at the end which wants to include the "I'm Feeling Lucky" button, you can see that they even tried monitoring its page rank for a few days, and those results are part of the urls which are referenced by that search.

Fortunately in this case it is redirecting to a domain (anherbal.com) which has already stopped being hosted. And possibly is automatically redirecting you here. :) (It's happened before.)

The sad truth is: some people out there get suckered into this scam and assume that they will be able to enlarge their penises. Not only do they NOT end up with the desired results, there is significant evidence that these "herbal supplements", spammed en masse on behalf of "Elite Herbal" and "ManXL", can lead to death, particularly for members of their target audience (males aged 40 and up who experience erectile dysfunction.) Many men at that age experience blood pressure issues, making the taking of these so-called "supplements" an extremely dangerous proposition.

This is nothing new, of course. Spammers have been promoting lethal fake pharmacies for years now. It's just surprising the lengths that they will go to to reach people who rather obviously have absolutely no interest in their "products."

They can all go to hell as far as I'm concerned.

SiL / IKS / concerned citizen

Thursday, November 15, 2007

Bulkerforum Exposition (Again)

I guess that saying really is true: when it rains, it pours.

Our old wackjob - I meannnn - pal, Marion S. Lynn, aka Nick Danger, continues to blow a gasket and has created a fabulous blog of his own at spamgossip.livejournal.com, and went and told everyone about it at the revered newsgroup: NANAE. Trust me when I say that for once it makes for some interesting reading, but that is not thanks to any pearls of wisdom from Mr. Lynn. Instead it's from the hidden sections he's chosen to post. Bulkerforum created a hidden / private forum where I'm sure the privileged members who are able to see and contribute have all been either happily patting each other on their backs about how devilishly clever they all are, or more likely lamenting what a ghost town bulkerforum has become over the past several months. None of use ever thought they would all become so untrustworthy that nobody would ever want to do business at that forum, but wow: they've really outdone themselves.

Well it turns out that the private forum is really just "more of the same" from what I see posted on spamgossip (all of which I am of course saving, mostly for posterity. Law enforcement probably already had most of the info Mr. Lynn carefully selected for posting on his fabulous blog.

Well it certainly has raised the ire of a few of the members. The only realy drawback to all of this is that it came from Nick Danger in the first place. The man is an imbecile who probably couldn't figure out how to hit "send" on his very first spam run. Why couldn't it be someone like mcproxy, or perhaps dollar (long missing from that forum) who dropped the dime? Or rackspace?

Anyway for your further reading enjoyment, here are a few of the catty responses posted to bulkerforum in the wake of today's expository blog creation (some of the urls will wrap, unfortunately. Blogger's layouts are pretty rigid.) I notice they use a lot of my very own research in exposing Nick Danger / Marion Lynn all over again. I'm sure Lynn will again claim how all of this is just dandy for his business.

Enjoy (?)

SiL

Topic: NICK DANGER REALLY MARION LYNN (a girl's name) ANTI INFORMER

phantom

Joined: 15 Sep 2006
Posts: 286

Posted: Thu Nov 15, 2007 4:09 am
Post subject: NICK DANGER REALLY MARION LYNN (a girl's name) ANTI INFORMER

MODERATOR NOTE:

It was Nick Danger real name Marion Lynn that stole Rackspace's login/password and stole info from the forum and posted it on an anti informant site and has now just bragged to NANAE how fucking smart he is
http://groups.google.com/group/news.admin.net-abuse.email/
browse_thread/thread/d423031889b55b1b#090a50eb3d7e2074

DO NOT GO TO THE URL IN THIS NANAE POST WITHOUT USING PROXY!!

Anyway back to the story .. Nick was not smart at all he was fucking dumb he
showed his real IP in the message : CPE-72-129-227-13.kc.res.rr.com (72.129.227.13) that's Kansas City where Nick Lives ..

Here is complete details we have so far and his family feel free to call this
piece of shit or go visit him :

Marionslyn@aol.com.

913-766-5168 his phone number where he lives with his aged mother.

1021 1/4 Mass.Lawrence, KS 66073

pretentiouscow@aol.com
201 West Bridge
PO Box 23
Lawrence, KS 66073
US
785-856-6200 fax: 785-856-6200

Rivercitytalk@aol.com www.rivercitytalk - nick danger

ex wife = SHERI RAYE LYNN (Age: 55)

Ben Campbell-Bradley is his bum boy
in photo.

MARION J LYNN (Age: 75) Daddy
Braeden J Lynn
Shirley J Lynn
Smith Shirley Lynn
Kenneth G Lynn
Sheri Lynn
Shirley J Lynn
Smith Shirley Lynn
Braeden J Lynn
Kenneth G Lynn
Marion S Lynn
KANSAS CITY, KS
GARDEN CITY, KS RESIDENTIAL Home

Holdings, RJ webmaster@softwaresolution.org
6324 N Chatham Ave Suite #300
Kansas City, MO 64151-2473
US
Investigative Reporter Marion Sydney Lynn

http://a90.ac-images.myspacecdn.com/images01/100/
m_84704d3a1141ca924d6336927c5b50f1.jpg
http://www2.ljworld.com/photos/2005/jun/01/58665/ (with bum boy Ben)

It has been suggested from prominent member who knows police procedures that we should drop dime on nick danger from several places in the country we need folks to call his local CRIMESTOPPERS (ANONYMOUS) and tell them hes running a hacking operation from his home.
All calls to local crime stoppers are anonymous.

4 or 5 complaints and they should be able to get a warrant to search his home and take his systems and they find all the hacking EVIDENCE.. stealing identities, etc probably kiddy porn, bye bye for 15 years Smile

This wierdo is a total psycho and a dedicated anti informant he got amonst us earlier and we befriended him although we were a bit suspicious of him from the start, and he turns on us and informs and brags about it how smart he is.

Hope karma gets him big time.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

dollar

Joined: 15 Sep 2006
Posts: 433

Posted: Thu Nov 15, 2007 6:45 am
Post subject:

Hmmm... could it be this is the same k00k with the alias "TheUnknown" who made the post about me on hxxp://forums.somethingawful.com? The same guy who tried so hard to gain my trust on specialham and on IRC a few years back? The same guy who also tried so hard to pose as a bulkmailer on both SH and on IRC asking everyone for info? The same guy I exposed and humiliated on IRC and specialham? The one who someone had the aim convo with which within it he claimed he was in college and his mommy wouldnt let him leave at... 9pm CST US time to meet someone off... wasnt it 74th .. or 55th and paseo in KC? aahahahaa... Huh Marion/Bradley? Come on, come ride the PASEO some night in the red suburban with those fine chaps off 55th then hit 29th N to the bridge.. Really. I think theyd hit it off with you great. ;-)

I think there is a good chance this KC MO punk and his young buddy he lives with are possibly the former alias "TheUnknown" as well. Question is whho does what, who posts and who poses as the elite h4x0r? Who is the retarded nut who comes up with the posts? wait... theyre probably both mentally challenged.

I hear Kansas is lovely around this time of year.
_________________
*Marketing Advice* Need something? Don't want to get ripped off? I can send you the right direction.

I don't like intellectual midgets having any sway over how successful I am, with some silly insult or false accusation on the boards.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

r3v3nu

Joined: 10 Nov 2006
Posts: 12

Posted: Thu Nov 15, 2007 10:08 am
Post subject:

Thanks phantom. nice work


P.S. I wish someone would do this for the Russian forums out there. Everyone knows that's where the real meat is.