China: The Last Resort for Spammer Domain Registration

Take any domain you've been spammed with over the past week and do a simple lookup on it. Chances are extremely good that the registrar for said domain will be located in China.

The list of the most spammer-friendly domain registrars has included the following major players:

• Tucows.com


• godaddy.com


• registerfly.com


• CSL Computer Service Langenbach GmbH d/b/a joker.com [aka: Joker.com]


• Beijing Innovative Link Technology


• Moniker.com


• aceofdomains.com (a subsidiary of Moniker.com)


• Xin Net Technology Corporation (aka: Xin Net, New Net, paycentre.com)


• Todaynic.com


• Chinanet


• BizCN


• Dotster


• HKDNR

Of that list, four are located in China, with one in Hong Kong.

Over the past two year, following a relentless campaign of complaints and educating registrars on how to properly shut down and nullroute an illicit domain, that list shrank to:

• Beijing Innovative Link Technology


• Xin Net Technology Corporation (aka: Xin Net, New Net, paycentre.com)

And only within the past couple of days:

• Xiamen Chinasource Internet Service Co., Ltd.

That's largely because Xin Net finally heeded the literally millions of complaints we were sending to them, backed up with evidence of fake contact information and links to wikipedia entries which outline the illegal operations these sponsor organizations are a part of.

It's a pretty good sign that complaining to the right people, in the right way, can have a devastating effect on the spammer economy. XIN NET was home to literally millions of spammed domains representing illegal operations. It took months of consistent communication, often using translators and other elements to get the message across to them that they were essentially supporting illegal activity.

It should be mentioned that Beijing Innovative Link Technology (aka: "BILT" to our community) have in fact been responsive regarding illegally-registered domains. It's just that they never shut them all down. There are always a handful of them which are still actively in use in widespread, aggressive spam campaigns.

I and several colleagues of mine have been diligently reporting every domain and name server we get spammed with in the hopes of getting the domains shut down. This was initially a very daunting process, since many of not most registrars weren't entirely clear on how to perform a proper domain shut down. Fortunately most of them have been very receptive and now even the most stubborn registrars have undergone a change of heart, probably because their continued ignoring of complaints could have led to their ICANN accreditation being revoked.

This is the kind of work which spammers and their sponsors assume (rightly, until recently) that members of the general public didn't want to take on. On the surface it sounds extremely overwhelming. Sponsors routinely register literally hundreds of thousands of domains, including DNS domains. I won't go into the boring details of how domain names work, and how registration takes place, but suffice to say that in the case of spammer-friendly sponsors like SanCash and Spamit, the registration of millions of domain names is not uncommon, and it all happens automatically.

There are two key failing points regarding these domain registrations:

1) They always use fake contact information for all of the contacts. (Administrative, Technical, Billing, etc.)
2) In many cases, a stolen credit card is used to register the domain, or a hacked PayPal account. Several regular domain reporters have received feedback to this effect over the past several years of reporting the domains.

Registration of a domain using fake information is in violation of ICANN accreditation. Forget what the domain is even used for (for now at least): if the contact information is along the lines of the following:

Administrative Contact:
Joe Lastname
123 Fake St.
Fake, NY
10000
tel: 123 4567890
fax: 123 4567890
joelastname@fakefakefake.com

Then that puts the domain registrar in the position of having allowed an illicit domain registration to take place.

If I report that information as being verifiably fake, and the registrar continues to allow several thousand more new domains to be registered using the same information, that puts them in violation of ICANN regulations, which stipulate that valid contact information must be present in order for a registered domain to be considered "valid."

Notably, XIN NET was continually allowing that to happen, for many years. They appeared to be ignoring our multiple complaints, making note of identifiably fake contact information.

All of that changed approximately eight days ago, and XIN NET should be commended for finally taking swift and widespread action against several tens of thousands of active domains used for heavily spammed products such as VPXL, Canadian Pharmacy and Prestige Replicas (to name only a few.)

But add to that the fact that all of these sites are doing the following:

• Lying, everywhere, on every page, about every detail of their products, their location, their staff and their alleged online security.


• Sale of fake "herbal remedies" with no valid active ingredient (several reports confirm this, notably the BBC report from December 2007 regarding "Elite Herbal", now known as "VPXL")


• Sale of potentially harmful or extremely addictive pharmaceutical products without the advice or consent of any licensed pharmacist.


• Aggravated repeat spamming to a majority of recipients who do not wish to receive any emails regarding these products and for whom there is no mechanism to opt out.

And you have a lot more ammunition to supply to the domain registrar.

If I started a website called "coccacolla.com" and claimed it was an official website of the Coca Cola corporation, Coca Cola would definitely hear about it, and the site would be shut down. I would also be sued. That's because there are laws regarding what a company (and therefore: the company's website) can and cannot claim. I can't claim, for example, that Coca Cola will cure cancer. I also can't claim that my corporate address is somewhere in the middle of the Atlantic Ocean. Again: it's not just morally incorrect behavior, it's illegal in most countries to do so.

Yet we have sites representing this barrage of spamvertised products, all registered with fake contact information, promoting fake or (at best) counterfeit products, with claims that they are located in a variety of locations where they in fact do not occupy any offices or warehouses.

One example: Canadian Pharmacy.

A recently spammed domain:

http://scoreway.cn

Whois information:

%whois scoreway.cn
Domain Name: scoreway.cn
ROID: 20071204s10001s42304059-cn
Domain Status: ok
Registrant Organization: theNoun
Registrant Name: HimNil
Administrative Email: goto@åç¸ç½ç»æéån
¬å¸nsoring Registrar: å¦é¨å
Name Server:ns0.nameedns1.com
Name Server:ns0.renewwdns1.com
Registration Date: 2007-12-04 21:03
Expiration Date: 2008-12-04 21:03

Look at that. No identifiable contact information of any sort. The brevity of the record is not unnatural, but the lack of any genuine contact info is.

But scoreway.cn actually presents you an iframe which is loading a separate domain:

http://newrxwalk.com

WHOIS for newrxwalk.com:

Domain Name: NEWRXWALK.COM
Registrar: XIN NET TECHNOLOGY CORPORATION
Whois Server: whois.paycenter.com.cn
Referral URL: http://www.xinnet.com
Name Server: NS0.BILLBOARDTOPTENS.COM
Name Server: NS0.GREATTENS.COM
Name Server: NS0.ONTHETENS.COM
Name Server: NS0.ORSTENSGUIDE.COM
Status: ok
Updated Date: 06-jun-2008
Creation Date: 23-may-2008
Expiration Date: 23-may-2009

Registrant:
Wen Feng
NO.397,zhuquedadao street,xian City,shanxi Province
710061



Administrative Contact:
WenFeng
Wen Feng
NO.397,zhuquedadao street,xian City,shanxi Province
xi an Shanxi 710061
CN
tel: 298 5228188
fax: 298 5393585
cncliup@21xn.com

Technical Contact:
WenFeng
Wen Feng
NO.397,zhuquedadao street,xian City,shanxi Province
xi an Shanxi 710061
CN
tel: 5228188
fax: 5393585
cncliup@21xn.com

Billing Contact:
WenFeng
Wen Feng
NO.397,zhuquedadao street,xian City,shanxi Province
xi an Shanxi 710061
CN
tel: 5228188
fax: 5393585
cncliup@21xn.com

Registration Date: 2008-05-23
Update Date: 2008-06-06
Expiration Date: 2009-05-23

Primary DNS: ns0.orstensguide.com
Secondary DNS: ns0.onthetens.com

That old standby, XIN NET.

A complaint has already been sent of course. :)

As I mentioned in previous posts, it's pretty straightforward to pick apart the falseness of this contact information, even if you know nothing about Chinese postal addresses or phone numbers. There is no "5228188" phone number. Dialing it will get you nothing. Likewise the fax number. The regsitrant behind this scam of a domain knows this.

"Wen Feng" is similar to numerous other bogus registrant names we've seen in the past. The address is bogus. etc. etc. All verifiable if you do some legwork.

An aside here: note that registrant's email address: cncliup@21xn.com. For the past year or more, hundreds of thousands of domains have been registered using a similar address: cncliup@21cn.com. Do a google search on that and you'll find numerous complaints and reports regarding spammed domains for these sites. We focused on the use of that domain as an indicator that it was registered illegally. XIN NET and Todaynic took that information and used it in conjunction with our detailed reports to shut down thousands of domains at once, and may be using that information to block registration of any new domains. This would explain the shift to the 21xn.com domain. Note: 21cn.com and 21xn.com are both providers of free email addresses. Sort of like a Chinese Hotmail.

Anyway...

If we visit the site, and look at what they claim:

You may contact us at +1(210) 888-9089, please, keep your order I.D. every time you make a call.

That phone number is a VOIP phone number (or otherwise digital phone line) registered by Level 3 communications in San Antonio, Texas. The owner of the number could in theory be located anywhere in the world. Just like everything else regarding this operation, it's quite possible that the number was also registered using fake contact info, and / or using a stolen credit card number.

Calling the number initially results in a voicemail prompt:

Hello. You have reached united pharmacy support service. Unfortunately, our operators are currently unavailable, so please leave a message after the beep.

They also mention that you can email them at support@uphs.info, or visit the website: uphs.info

Subsequent phone calls however result in a woman answering the phone, and denying any connection whatsoever to the spammed website "scoreway.cn", or its subsequent redirected domain "newrxwalk.com". Unless you have a concern regarding an order you actually placed, they won't discuss anything with you.

If we visit the "contact us" link, we're presented with a form, and the email address: support@canadianmedicationsupport.com

That email address has of course changed several times over the past several years. No contact with that address or via the form has ever gotten any kind of response, and I've been trying for the past two years under a variety of identities.

No corporate address is listed anywhere, no physical location is given.

My (long winded) point: no legitimate company would run in so many circles to hide its location, nor would it need so many thousands of illegally-registered domains to operate. The reason Coca Cola doesn't hide it's corporate office addresses (in Atlanta, GA) is because it operates legally, and communicates with its customers and the public in appropriate and legal ways.

Of course, they also don't illegally abuse numerous systems while attempting to promote their products. Spamit sites, and Canadian Pharmacy in particular, are routinely hosted on botnets (assumedly Storm), use hacked public domains to perform redirections, abuse whitelisted email templates from well known corporate email campaigns, and abuse all manner of systems just to ensure that you recieve a message from them, promoting their products. No legitimate company would engage in these tactics.

This is only one example, obviously.

If you want to join the cause and begin making more of a dent in these illicitly-run spam operations, go over to complainterator.com and download the complainterator. Read the supplied instructions and enter any of the numerous domains you got spammed with. Send off the complaint. Join the cause. (Apologies in advance: at the moment this is a Windows-only application. And no, I didn't create it.)

You would be surprised at just how effective this can be. If a company like XIN NET can be turned around, so can any other registrar being hit with these fake domain registrations. XIN NET is more vigilant about this process. Now it's time to educate Xiamen Chinasource Internet Service Co., Ltd..

SiL / IKS / concerned citizen

SlickCams and SlickCash: Webcam Spammers and Lying Liars

This summary is not available. Please click here to view the post.

The Real Profit Centers of Spam: Sponsors

I recently wrote a new entry describing and dissecting the quagmire that is the "spammer economy" on the now-infamous spam-wiki. It's located here. I had spent many months (in fact the better part of a year and a half) researching and documenting everything that I found which described the separate entities and their distinct relationships. The writing and publishing of that wiki entry is the result of not only a lot of research, but a considerable change of viewpoint regarding who profits from spam, how we all refer to them, and what their distinct role is.

Unwanted email spam has been with us for so long now that I think we all, as recipients, tend to associate the incoming messages with one individual, or possibly one group or organization. For years now, even well-respected groups such as spamhaus have referred to these entities - individually or as a group - as "spam gangs" or "spam kings." They've often used teminology or nomenclature such as "Yambo Financial" or "Badcow" to refer to ghostly, unseen groups of criminals. My feeling is (and maybe it's just my feeling): This is no longer an accurate way to refer to the groups of individuals who spend their livelihoods crafting randomized emails promoting illegal fly-by-night urls.

A key turning point came when I was exposed to several discussion groups used by spammers, many of which I will not refer to directly due to the clandestine nature of how I came across them. In these discussions, many of the mailers or sponsors were essentially mocking any references to "spam gangs." In a nutshell: there is no "gang." There likely is no "Yambo financials". While "Alex Polyakov" or "Leo Kuvayev" may indeed be real people, with possible verifiable connections to one or more of the criminal entities who support and thrive upon illegal spam email, my feeling is: that's likely a red herring, put there to divert attention away from the real responsible parties.

Another turning point came during the investigation and raids upon properties directly related to Sancash or Genbucks. (By the BBC and New Zealand law enforcement, respectively.) This really raised the point of who stands to profit the most in these million-message spam runs: sponsors.

Sponsors is not a sexy term when discussing spamming, generally. Usually the press and individual recipients tend to focus on two things: mailers (spammers) and botnets. They make the press most often because it's probably too complicated to go into the depth of detail required to expose precisely who is behind that "p3n1s-p|ll" message you just received. People don't have the time. Referring to a "sponsor" will only confuse them.

The truth is: sponsors, or sponsor organizations (as I commonly refer to them) are the big fish in the spammer economy. They take the most risk, provide the most resources to mailers, and profit the most from spamming. They control everything from the design and functionality of their sites, to their affiliate front-ends, statistics, domain registration, fast-flux hosting and in some cases even the design or copy of the messages being sent.

Who are these sponsors? There are a handful of them in the upper ranks of the spam messages we receive every day. The top three (based on my own research) are as follows:

• SanCash


• Spamit


• Bulker.biz

Pretty much everybody in the world is receiving spam on behalf of these three organizations. They are well-established, have ties to numerous individuals (remember: no gangs. Everyone is an island) who provide them everything from "bulletproof hosting" to botnet infections. They are the ones most responsible for the 90+ percent of crap we all receive every single day.

So let's examine each of them briefly.

SanCash

SanCash is responsible for that old standby: VPXL (also known throughout the past three years as a variety of names including "Manster", "ManXL" and "Elite Herbal." It's all the exact same useless crap. Despite their claims of it elongating your "member", it does nothing. There is tons of evidence out there to support this.)

SanCash was investigated first by an individual blogger [spaminmyinbox], and subsequently by the BBC [see their article here or download the podcast of the investigation here.], only the BBC weren't aware that that's who they were actually investigating. That's because they focused on the entity they could find out in the wild: GenBucks. Genbucks is a publicly available marketing affiliate group. You won't find any mention anywhere on their sites related to "VPXL" (et al.) You will find mention of a variety of other products for which practically nobody has ever received email spam. Their forums discuss banner advertising or "SEO" (search engine optimization) marketing. This is so that it appears that they have absolutely no connection to the rather obviously rampant amounts of spam being sent worldwide.

The first connection comes from how and where certain domains are registered, and how certain sites operate. During much of last year, domains used for the processing of orders on behalf of ManXL and Elite Herbal sites (domains like "mysecurepaysite.net", now long since out of use) featured a registrant's email address of "pilldude@gmail.com". Do a search for "pilldude" and you'll inevitably find the Genbucks forum (http://genbucks.com/forum/search.php?searchid=720) and his own genbucks blog (http://pilldude.genblogger.com/).

It is no coincidence that all posting on behalf of "pilldude" stopped abruptly at precisely the same moment that members of New Zealand law enforcement executed a raid on 20 properties in Christchurch, New Zealand as a direct result of the information uncovered by the BBC and spaminmyinbox. (See story here.)

But look around and you'll see people openly discussing SanCash, making no mention of Genbucks. Clearly the connection is there. They just want people to (wrongly) focus on GenBucks, when in reality it's SanCash that's profiting from VPXL spam.

Following the New Zealand raids, several people posted on Bulkerforum.biz regarding the raids and the investigation, making it extremely clear that the investigation was definitely on the right track:

ubuntu

Joined: 06 Feb 2007
Posts: 12

Posted: Thu Dec 20, 2007 10:26 am
Post subject:

not sure if this is sancash

this is related to this audition.. and hmm.. looks like GB...

http://www.bbc.co.uk/radio4/theinvestigation/pip/uvboh/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

jhood

Joined: 23 Oct 2006
Posts: 151

Posted: Thu Dec 20, 2007 11:51 am
Post subject:

thanks for link ubuntu..

eliteherbal/manster IS SanCash

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

icanspam

Joined: 10 Aug 2007
Posts: 52

Posted: Thu Dec 20, 2007 2:22 pm
Post subject:

SA?

Shane Atkinson, bro.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

mail4spart

Joined: 15 Sep 2006
Posts: 33

Posted: Thu Dec 20, 2007 5:18 pm
Post subject:

I know Shane is a straight up guy and doesnt deserve all this heat. I hope he can survive this like he did last time he came under a lot of heat before him and his brother. He has been running a smart business for a long time and looks after his people and if he has to shut down the biz there will be many affiliates effected and unpaid.

"jhood" puts a very fine point on it: "eliteherbal/manster IS SanCash". So it's clear: they knew this operation was in trouble due to the investigation.

It didn't stop the spam at all, of course. And in the meantime "spaminmyinbox" has been sued and placed under a restraining order by Genbucks' offices in India, meaning he can't post more detail about his indepth investigation.

Following the raids, sancash.com as a domain completely shut down and I and other individuals noticed that new names began floating around, among them "etranzmu." As we speak, the new location of SanCash is unknown and their representatives (on bulkerforum.biz: azzy and sanjay) have taken all discussion regarding SanCash "off-forum". This is a clear sign of two things:

1) They must be feeling some heat.
2) They know they're operating in violation of the law.

You can read much, much more about this operation by reading the SanCash entry on the spam wiki.

Products they are known to spam (based on domain registrations and the use of the "Infinity Secure" order processing page):

• VPXL (Also known as Express Herbal)


• King Replica


• Diamond Replicas


• Prestige Replicas


• ED Pill Store / ED Pill Shop

And previously-spammed products going back at least two years or so:

• Manster


• ManXL


• Elite Herbal


• Extra-Time


• More-Size


• Wondercum


• Spur-M


• Personal Pussy


• Penis Enlargement Pills


• Penis Enlargement PatchRX


• Vigramax


• FatBlaster


• Hoodia

Spamit

As we've seen with SanCash, Spamit also has a shell, publicly available front-end company which is easy to find but which (again) doesn't discuss email spamming in any form whatsoever. That "company"'s name is Glavmed.

Spamit, unlike SanCash, still has a publicly available affiliate portal, but not much else is known regarding their operations. Their representatives on bulkerforum.biz were named kref and spamit. I say "were" because with absolutely no fanfare at all, their bulkerforum accounts and all postings were completely deleted on or about Feb. 11th, 2008.

Spamit is behind several very malicious forms of spam. They're probably best known as the sponsors of "Canadian Pharmacy" or "US Pharmacy", both very prolifically spammed, and notable for their focus on the sale of controlled pharmaceuticals such as Hydrocodone and Ambien. Mailers who send on behalf of this group have abused so many systems and so many trademarks and email templates that at some point I should think that a variety of large corporations should be able to serve a class-action corporate lawsuit against them. Here's only a few examples of the abuse that they are known to perpetrate in the name of landing even a single message into an individuals email inbox:

• Hijacking or hacking of publicly owned web servers to be used as redirectors or image hosts.


• Use of whitelisted corporate email templates to bypass spam filters, predominantly used only in Hotmail mailings.


• Use of the same domain to redirect to a Canadian Pharmacy website, present a dynamic / randomized stock spam gif image, or download an infection exe for Storm worm.


• Hijacking / hacking of a publicly owned web server to perform either a redirect to a Canadian Pharmacy website, or to download a new infection exe for Storm worm.


• Automated creation of several hundreds of thousands of redirection pages on free web services such as Geocities, Google Pages, Lycos Tripod and Blogspot.


• Persistent spamming to newly-created gmail accounts, even ones which have never been used at all, within days of creation.


• Persistent spamming to any and all "catchall" addresses, to any domain in the world, several dozen times per day. (Often several times per hour.)


• Completely false claims throughout all spamvertised properties. Everything: their claims of security and safety of offered products, who is on their staff, where they are located, who supports them -- all claims are 100% false.

What a bunch of charmers.

They are known to register several hundreds of thousands of throwaway domains using completely fictitious or nonsensical contact information, and they have been known to register domains using either stolen credit cards or stolen paypal accounts.

Spam sent on behalf of SanCash and Spamit represent some 97% of all the spam messages I receive to any account I control. I know this to also be true of many friends and colleagues.


Products they are known to spam (based on domain registrations and the use of the "Infinity Secure" order processing page):

• Canadian Pharmacy


• US Pharmacy


• Downloadable Software

Note also that "Canadian Pharmacy" will revert to "European Pharmacy" upon auto-sensing of your IP address's geographic location. It's the same site, though.

There are probably many more, but these are the top three for this sponsor.

An additional note regarding Spamit and the Storm worm.

Spamit have been directly tied to infection attempts for the Storm botnet as listed above. We can still see evidence of this even now. Here's two urls I was spammed today [omitting their use of Google ads click linking].

http://westphoto.org/video.exe [do not visit this link on an unprotected computer]
http://scramignon.com/redir.html

As mentioned above, both of these domains are publicly owned, legitimate websites whose servers have been hacked and had these files (video.exe, redir.html) placed on them.

video.exe claims to be the "storm codec", and spam for it usually contains some kind of social engineering copy to fool you into thinking you're downloading a naughty or voyeuristic video. It is of course an infection file for Storm worm.

The redirect in this case points to "sugaronly.com", a Canadian Pharmacy domain.

But let's switch the two around:

http://scramignon.com/video.exe [Again: do not visit this link on an unprotected computer]
http://westphoto.org/redir.html

They both still work. This means that these domains (and several thousand other such hijacked domains) can be re-used in parallel spam runs.

This indicated that Spamit as a company, and Canadian Pharmacy as a brand, rely heavily on high numbers of infections of the Storm worm.

Spamit also has a spam wiki entry, but it is currently missing a lot of this detail.

Bulker.biz

Bulker.biz is possibly one of the older sponsors of illegal spam in existence today. Thanks to the above-mentioned illegal activity of Spamit in relation to Canadian Pharmacy, Bulker.biz is no longer the most malicious spam sponsor organization around.

It's only recently that I noticed that representatives of bulker.biz publicly stated that bulkerforum.biz is mainly in existence because of their sponsorship. It makes sense (and was so obvious that I'm surprised nobody picked up on it earlier.)

Bulker.biz is perhaps best known for that old standby, "My Canadian Pharmacy," which I'll refer to as "MCP". At one point, MCP was the most prolifically-spammed property in existence, accounting for several million spam messages per day, and even peaking at an estimated 20 billion messages sent in a 24 hour period. (Based on research by the i-Law group in May, 2006. [Summary available here.] At that time it was unknown that bulker.biz was responsible for the MCP "brand".

MCP was the first criminal spam operation I researched, which culminated in a report which I provided to law enforcement in seven countries, and a revised summary entry in the spam wiki. You can see from this entry that just like spamit, bulker.biz is responsible for quite a bit of abuse to this day. A sampling of their illegal activity:

• Hijacking of publicly owned Unix servers for everything from DNS hosting, to website hosting, redirections, and image hosting. [This continues to this day.]


• Completely false claims throughout all spamvertised properties.


• Automated creation of several hundreds of thousands of redirection pages on free web services such as Geocities, Google Pages, Lycos Tripod and Blogspot.

Again: charming.

The unique targetting of Unix servers is of particular note, since it's the same method of hosting used by bulkerforum.biz, further tightening the link between the two. You can obviously read much more about them in the spam wiki entry.

Bulker.biz is responsible for a very large amount of spam for the following properties:

• My Canadian Pharmacy


• International Legal RX


• US Drugs


• VIP Pharmacy ("Viagra + Cialis")


• Canadian Health&Care Mall


• Men Health (Men+ Health)

And other sites they were directly responsible for, but for which less spam was seen:

• Exclusive Caviar Online


• Double Your Dating

Bulker.biz is represented on bulkerforum.biz by member "ebulker".

You'll notice that I make specific mention of their mailing practices. That may or may not be directly attributable to the sponsors directly, but especially in the case of Spamit, they clearly have people in their ranks who insist upon spamming every email address in existence in the off chance that two of them might actually receive it and link all the way through to a purchase. It can't be a coincidence that virtually everybody in the world is receiving spam for their websites. If it were an individual mailer, we would see the same volume of spam for a variety of other sponsors. It's for this reason that I specifically include any mention of mailing practices or frequency.

An additional point specifically regarding Spamit's Canadian Pharmacy and all pharmacy properties promoted on behalf of Bulker.biz: I mentioned above that they lie. It's important to note precisely to what extent they lie. In the case of MCP, they lie with literally every single word on that site. They have a completely laughable "about us" page which features mini-bios of completely fictitious "doctors", whose faces are actually gleaned from stock images of surgeons and medical personnel. There is no "Jack Poppins" or "Carl Rose". The same is true of Canadian Pharmacy, which also features stock images (probably used without permission as well) and makes completely false claims regarding their "pharmacists" and licensing thereof. You can see a great deal more detail of these falsehoods in the MCP spam wiki entry.

As I mentioned above: sponsors are the big fish. They are the ones who register and provide hosting for the thousands of spamvertised URLs we see every day. They often also provide pre-made blogspot or geocities redirects (which they hire an individual to create.) They pay out the commissions to the mailers who spam on their behalf. They take care of the credit card processing (using high risk merchants who they pay to provide stable credit card processing on their behalf.) They take care iof any botnet-supported web hosting or DNS rotation. They're the source of all of this. They know they operate illegally, and they get away with it on a daily basis.

It is my hope that someone in law enforcement, or better yet someone from the legal teams of Pfizer, Microsoft or any other companies whose reputations these sponsors are tarnishing will step up and take action to get them completely shut down. The only reason an individual mailer is able to profit from illegally spamming in the first place is directly because these sponsors, and others like them, fully support their illegal activities, and engage in several more of their own. Shut these three down, and you will have removed three of the biggest criminal operations in existence today.

SiL / IKS / concerned citizen

P.S. Recently the PBS featured a documentary entitled "Illicit: The Dark Trade." (Broadcast on PBS, produced by National Geographic.) I strongly recommend viewing this documentary for its indepth exposition of the wider fake drug / fake watch / fake fashion item trade. It opened my eyes to the deeper profit structure of these networks of individuals, spam-related or otherwise.

"Hello! I am bored this evening."

One of the more persistent types of spam out there lately is for a type of "Russian dating" sites by the name of "UALadys."

Their pitch nearly always looks like this:

Subject lines seen in numerous spam messages:

Hello!
pics
Why aren't you replying to me?
Can we talk?
Long time, no talk
I find you interesting
Where have you been?
We talked on the web.

Hello! I am bored this evening. I am nice girl that would like to chat with you.
Email me at Elizabeth@jolasite.com only, because I am using my friend's email to
write this. Wanna see some pictures of me?

As far back as July 2007, the messages looked like this:

Do not ignore me please,
I found your email somewhere and now decided to write you.
Let me know if you do not mind. If you want I can send you some pictures of me.
I am a nice pretty girl. Don't reply to this email.
Email me direclty at Elena@supervisioncare.info

They've also infiltrated several blogs and comment forms. You can see some examples here and here. As you'd expect, there are thousands of them.

I know this is from UALadys because I infiltrated their affiliate program. It's also very easy to track this down in terms of recruiting of illegal spammers by using that old standby: bulkerforum.biz.

Bulkerforum member "bulker" hits people up on the open forum to mail for his dating program

bulker

Joined: 08 Jun 2007
Posts: 23

Posted: Wed Jun 27, 2007 4:07 am
Post subject: Special dating program

Looking for some good mailers who can push the volume on highly converting dating program. Instant payments.
- you get the results, you get paid the same day

Then in private communication only, he describes how the spamming operation works:

yes, you wanted to find out about the dating program. the thing is pretty simple.
you send an email telling people that some girl wants to talk/chat to them and that if they don't mind, then they need to email at some email address that you get access to. you get paid for every 10k unique replies.
10k replies pays you $1500. i do it with some people. what good about this program is that you get the same minute you achieve something.
so like you do 5k replies today, i can pay the same minute. the other thing is that these kind of emails that contain no link to the website and look like personal emails do pass filters very easily and do not score anything on spamassin and do not get listed on razor for ages.

Which would explain why they routinely keep showing up to several accounts I and many of my colleagues monitor.

So nutshell: the domains are throwaways and bulletproof. They are merely used to capture "live" email addresses which are then fed over to someone to respond to individually.

Why the idiots who are spamming on their behalf don't clean their lists, and further insist on mailing to a large number of people who absolutely have no interest in their crappy "dating service" is unknown to me.

But lets continue.

Attempts to contact anyone at UALadys regarding this spam results in denial of any problem. That's when and if you get a response. See blog posting here, for example.

Assume for a moment that you actually do want to communicate with them? You send a response to Elizabeth@jolasite.com and wait. A few days later you will get a response, which indicates that "she" is interested in learning more about you.

From Marina Pretty

Hi my new friend

Im glad to see that you have decided to reply,I see it is very short letter. It is all right because you are astonished to get my letter. I want you to know that I have only good intentions and I have not any secrets. The thing is that I will work in your country for three months or so and I would like to meet a nice man to fall in love or just be closest friends. I don't want to live in Russia because I have not any chances here, it is hardly possible to explain from first time but I want you to know my plans. I will work in any shop, bar or restaurant the agency that i am going through will suggest me some locations. It will be my choice in the end as to what option to go for.

So I will have a simple work till I improve my English. And I can choose any town of your area,agency will only help me to get a visa and all travel documents + some suggested placed to work in. My best friend last year met the man from the USA when she worked there for three months, too. She had two jobs. From morning till 4 pm she worked in amusement park and after it she worked as a waitress in some bar till midnight.

She was very tired of course but made very good money there.It is special programm for young people who wants to work abroad and I think it is the right way for me , I am lost here,and I think that I look pretty enough to find a better place .I want to repeat the same way,it is only my chance to meet a nice man.I want to work in USA or in Europe or any nice country. I am full of plans and different dreams and I want to share my life with good man because I'm also full of love and tenderness,I know that I am not so beautiful like Hollywood Princess but I do hope to meet my Prince and I am sure he will be not be disappoined to meet me in the real life! This is why I am going to go through the same way. Well,I will close this letter and I do hope to get your reply.

I will leave russia in two weeks or so (I can't tell you everything exactly right now) and I would like to be sure that I have the man who waits for me there. I will work all day and I want to find a man to spend all free time together to get to know each other better.if you have any interest to meet me I will be more than happy to meet you too. I will tell you all details about me and my life if you like my pictures and want to meet me! please send picture of you too!!!

I write to you with my new mailbox [address removed], please write letters now only on this mailbox.

I will wait your next letter.
Kiss you , Marina (this is my name)!
PS here are my pics
I hope they to you will like.
I hope you to me will answer
Kiss Marina

It also includes a couple pictures.

Do a google search for the second sentence in that message ("It is all right because you are astonished to get my letter.", with quotation marks around it, so it's the exact match) and see what comes up: dozens of replies which have been posted in several attempts to figure out who is sending these messages, and why. All of them are related to reporting of marriage agency scams.

See a complete synopsis here. (He even got a response which used the exact same name as mine - Marina!)

UALadys.com temporarily changed their name to "UADreams.com" in January 2008, but quickly switched back. This was apparently due to some kind of conflict with the owners. They also apparently operate "RULadys.com". (Considering they must be profitable, perhaps they can hire someone who knows how to spell the plural of "lady". :) )

How do we know this is from UALadys?

Over the past year or more, I received enough spam for this crap that I was able to correlate a large amount of information about it. (Didn't even take very long.)

For a period of time, the throwaway domains which were used in the email addresses led to websites. At first these were for the long-dead online pharmacy "Pharma Shop" (see the Spam Wiki entry for that one here), then later it led to UALadys.com front-end pages, usually all showing the same fake "ad" for a girl on that site who never was actually present in the site.

If the goal was to turn into a signup on that site, it wasn't a very effective tactic. Instead it appears that they just want to reel you in slowly, eventually getting you to purchase "gifts" for the girl you correspond with. That portion of this scam is well documented on several marriage scam sites on the web. This discussion thread has some of the more interesting comments regarding how the whole thing works. (It's a long discussion, and it uncovers that the company used to be an even scammier operation known as "Confidential Connections". The girls themselves are only allowed to communicate with you via a "handler" who does all the translating and letter writing on their behalf. They also encourage you to purchase gifts for the girls. Apparently any attempt to meet the actual girl leads to a sudden "trip" or other abrupt disappearance with no logical explanation.

In short: there is only one use for these spam addresses: as fodder for filling out fake orders on illegal pharmacy sites you also get spammed with. :)

SiL / IKS / concerned citizen

On The Trail Of SanCash And [so-called] "Infinity Secure"

In my continuing research into the SanCash operation, I have noticed that all SanCash properties have now switched completely to the use of an ordering page which claims to be from "Infinity Secure." There is no such operation, of course. But they now include a page within a subdirectory called "/order". It's not secure, the back end connection it makes to the third party card-processing page is not secure. As usual: they are lying to us. (Just like they are about the contents and quality of their "products."

The "Infinity Secure" page on all SanCash sites now lists the following address on all sites which feature that type of ordering page:

17 Bank St.
Ottawa, ON K1V 7Z5
Canada

Of course, there is no such address. There is an approximate location, but the site itself does not exist. This has been independently verified.

The postal code "K1V 7Z5" is also incorrect, and is in use for a series of addresses several blocks south of "17 Bank St." A quick Google search pulled up 127 Bank St., which houses Currey D S & Son Insurance Brokers Ltd. (Among several other addresses.)

In fact searching for the 17 Bank St. address distinctly only pulls up the "Infinity Secure" page from an "ED Pill Store" site:

http://www.edpillstores.com/order2.php?option=3

Which is handy, since it now ties "ED Pill Store" to the list of SanCash-spammed sites

That list so far:

• VPXL / Express Herbal


• Max Herbal


• Target Pharmacy


• Diamond Replicas


• King Replicas


• Prestige Replicas


• ED Pill Store

Contact email addresses for these properties:

VPXL / Express Herbal: support@vpxlherbalgrowth.com
Max Herbal: support@maxherbalgrowth.com
Target Pharmacy: support@propharmasales.com
King Replicas: support@kingreplication.com
ED Pill Store: support@edpillstores.com

[For the others, no spamvertised domains are still active, so I'll add those later when I inevitably receive more spam for them.]

Each of those domains appears to be a "top-level" source for each of those properties.

Here is typical completely fake domain registrant contact info for each of those domains:

The Authorizing Registrar for each of these domains, as well as most of the spamvertised throwaways is (as usual, of course) XIN NET Technology Corporation.

vpxlherbalgrowth.com:

jiangjiang
xing xing
liao da lian
dalian Beijing 456123
CN
tel: 101 2345678
fax: 101 2345678
cncliup@21cn.com

maxherbalgrowth.com

jiangjiang
xing xing
liao da lian
dalian Beijing 456123
CN
tel: 101 2345678
fax: 101 2345678
cncliup@21cn.com

propharmasales.com:

liuhai bin
liu haibin
hai kou
hai kou Beijing 891000
CN
tel: 3219001
fax: 3219001
yayun22@21cn.com

kingreplication.com:

liuhai bin
liu haibin
hai kou
hai kou Beijing 891000
CN
tel: 3219001
fax: 3219001
yayun22@21cn.com

edpillstores.com

liuhai bin
liu haibin
hai kou
hai kou Beijing 891000
CN
tel: 3219001
fax: 3219001
yayun22@21cn.com

As you would expect, none of those email addresses do anything in terms of response. None of those phone numbers or addresses are legitimate in any way. It's all 100% fake.

But just in case:

According to Wikipedia, "Dalian "is the governing sub-provincial city in the eastern Liaoning Province of Northeast China." [Wikipedia Link]
Dalian is distinct and separate from Beijing.
"891000" is a legitimate Chinese postal code type, but it is for neither Dalian (whose postal code is 116000) or Beijing (which would feature a range from 100000 to 102100.) In all of China, there is no "891000" postal code.

I could go on, but you get the picture.

SanCash has representatives based in India (notably Sanjay, who has rather suddenly gone underground since the exposition of the links connecting SanCash with Genbucks, Tulip Labs and Elite Herbal.) There are (or were) also representatives located in Christchurch, New Zealand.

The SanCash.com domain name has gone dark since approx. December of 2007. They have instead moved their operation further underground. That isn't stopping NZ law enforcement from continuing their investigation.

I normally would bemoan the sheer volume of spam from one such identifiable sponsor, but in this case the more they spam, the more they lie, the greater the exposure and ease of tracking them down.

SanCash: your days as a sponsor of illegal spammers are numbered. Spammers in the SanCash program: we will find you, and you will lose everything.

SiL / IKS / concerned citizen.

Who is Servman? (now that Bulkerforum is down)

Since Feb. 12th, bulkerforum.biz has been dormant. Domain does not resolve and it's not hosted on any of the previously known hijacked IP's. That's interesting in itself, in light of the slew of recent arrests involving illegal spammers.

But there's other interesting news regarding that site. Several members have suddenly been unceremoniously removed. I'll report back on a few of them in the coming weeks, but for now I thought I'd cover one particular member who seems to have actively wanted to cover his tracks: ServMan.

Back in November when Marion Lynn created his blog, spamgossip, he began exposing individual members of bulkerforum.biz, the go-to forum for illegal spammers.

Initially he listed handfuls of people per day, then removed a bunch, then removed a bunch more. Since then it's remained pretty dead, and numerous postings have been removed altogether. As one would expect, this caused people (like me) to dig a little deeper. I checked out some of the postings of the exposed users. At the time, none of it seemed particularly important.

I and many others had recently noticed (before the forum was shut down, if that's what's taken place) that some of those members have suddenly "gone dark" on that forum, notably Phantom (aka: Norman Keith Holmes.)

Then in mid-January I noticed that one of the members, ServMan, had either been systematically deleting any postings he had on the forum, or getting someone else to. (Or, alternatively, one of the admins of that forum may feel that having his particular info on that forum is a bad idea.)

Whenever I see this kind of thing happen, it definitely seems to indicate that there is truth to the exposed information. Why would somebody suddenly shut up unless the name was correct? Especially in light of how that group has acted whenever someone like myself has done this in the past (claiming libel, claiming my info is way off base, etc.) it is stunning just how silent some of the members have become.

Servman was listed as one Adam J. Minic. Searching for that turns up very few hits, but there is one interesting one from the NANAE newsgroup:

Newsgroups: news.admin.net-abuse.email
From: DarkFiber
Date: Sat, 24 Nov 2007 20:46:21 -0000
Local: Sat, Nov 24 2007 3:46 pm
Subject: Re: TURKEY STUFFING: ANOTHER SHITBAG!

On Thu, 22 Nov 2007 19:46:51 -0800, spamgossip wrote:
> SPAM AND EGGS! On Thu, 22 Nov 2007 19:46:51 -0800, spamgossip wrote:
> SPAM AND EGGS!

> The spam is in your mail and the egg is on the faces of these Bulker
> Forum members!

> servman - Adam J Minic - Boise, ID

Highly believable as there is evidence as recent as summer 2007 that Adam Minic associates with veteran spammer Todd Springer of the S & S Global LLC spam business that Todd and his brother, Scott used to run. Adam is perhaps a protege of theirs.

Kind of makes one wonder if Todd and Scott Springer didn't really retire from the spam business.

One also has to wonder if KEVIN JAMES MINIC #18299 who was discharged (as an inmate) from the Idaho Department Of Correction on 03/21/2005 is any relation.

On Dec. 27th, 2007 - the last time I bothered to check into it, Servman was responsible for 11 postings. Prior to that the number was much higher, around 30 or so.



I checked it on Jan. 28th, 2008, just out of curiosity. There were zero postings from Servman. None.



As it happens, I still have copies of some of his postings on the forum. In my opinion, while they are definitely damning evidence pointing to a string of the usual offences associated with illegal spamming, they aren't terribly different from those of numerous other members of the site. Nonetheless, either Servman or someone else must have assumed that this was too much exposure for him.

Here are the details I managed to glean from the postings I was able to archive from bulkerforum.biz last year following the exposition of Servman:

• He expressed interest in Hotmail and Yahoo email list verifier software.


• He was interested in purchasing lists from numerous members.


• He offered a new RX program (ie: Pharmacy spam, like we needed more of this crap.) He paid a 45% commission per sale.


• He used (or uses) DarkMailer (aka: DM) to perform his spam runs.


• He was (or still is) an active member of Sancash, the now-renowned "herbal remedy" spammer affiliate program with ties to Genbucks and Tulip Lab. (yes, VPXL / Elite Herbal / Manster / Megadik, again: like any of us wants to hear about it.) He liked spamming for them and made okay commission apparently. His conversion ratio indicates that he's spamming lots of people who definitely do not want to hear about these products: "My conversions started at 1:80 and have been at 1:150-1:250 ever since." More on this below.


• He was also a member of the bulker.biz affiliate program. (Canadian Pharmacy, I believe, is one of their properties.)


• He has dealt with diploma spamming in the past. Whether he actually mailed it himself is unknown. This is very obviously illegal activity.


• He was in need of new servers in Sept. 2007. He had very specific requests as to the specs of these servers, which were to be used for "proxy mailing", in other words: to use a botnet to send spam, which is illegal. It appears that he may have done a deal with RackSpace06 for those servers, and that he got ripped off by him (or nearly so.)


• In March 2007 he stated "We have entered a new era in mailing. Botnet is your best canidate for re-entering this industry." He then outlined how to get started in the bot-spamming business. It's pretty clear he knows a lot about how to send spam using hijacked and infected computers, to lists of people who very likely don't want to hear from him.


• He hates "antis" (such a stupid term.) Yet he continues to mail to people he knows would prefer not to hear from him. Their complaints make him angry.

What other dealings does Mr. Minic feel would be threatened by exposing him as a spammer? A google search for "Adam Minic" (with quotes) and "boise idaho" (without quotes) turns up a posting dated Jan. 23rd, 2008 on the forum "averyoutdoors.com" from a user named Camo Coatings discussing goose hunting. He is also located in Boise Idaho. I had previously suspended this posting because someone claiming to be Mr. Minic complained that someone was threatening his life based solely on my posting on this blog, ignoring completely that this information was already widely publicized last year by Marion Lynn on his spamgossip blog.

Since he has not shown me any proof of these alleged threats, this posting has been reactivated, with his comments intact. I have excised the contact info, which as mentioned before is already available elsewhere.

I mentioned his "conversion ratio." Conversions are the meat and potatoes of the spam industry if you spam on behalf of an affiliate program. A ratio of 1:80 is not good, by legitimate marketing standards. That means that for every 80 people who end up clicking through to your site, only one of them bought something. Legitimate companies, companies like (let's say) Amazon.com, or Lavalife.com, or any other above-board business which relies on third parties for some of their marketing needs would be hoping to see conversions more along the lines of 1:4, or 1:10. Even 1:10 is not considered a good ratio by legitimate companies. This goes quite a way to explaining the spammer mentality. They don't care how many people (like me) don't want to hear from them, they want money. They want the money for as little effort as possible. They want to follow only two steps:

1. Hit "send"
2. Get paid

Your complaints mean nothing to a guy like Adam Minic / Servman. He can't be bothered to clean his lists because that involves more steps than the two outlined above. Steps like: cleaning your list. Or possibly: choosing NOT to promote fake herbal remedies or illegally supplied fake pharmaceuticals which have no proven medicinal value.

A posting from January 2007 is probably the biggest indicator as to why he doesn't want his personal data out there. It's in response to a posting by mcproxy regarding exposing the personal data of someone who scams you in the spam industry:

The thing is, maybe not posting personal info. but enough to get the point across. Ie: icq, alias, etc.. In a perticular section of the forum. I was just expressing my idea in hopes that we could build something workable. I vote for a scammer section for misconduct and wrong-dooing un-becoming of a valid contact in this biz type of section.. hehe.

Currently if any of us get scammed, I can speak for myself anyways, I will post their alias info at least. I have never posted anyone's personal info. and I am sure never will. But many of us know each other past our alias. So therfor thats the assumed risk we take in business through gui interface..

Maybe my "quick reference section to scammers" is not a great or even good idea, but just wanted to convey my thoughts about this issue.

Any-thoughts guys???

Maybe he's worried about being perceived as a scammer. Or maybe he does business in other areas which would be impacted by having his real name associated with activities like spamming or using a botnet. Aside from the purely legal ramifications, I guess that would definitely impact his bottom line. But then why continue to spam? Why knowingly participate in these activities if you weren't already well aware of the risks?

I'm intrigued to see if he appears anywhere else out there in terms of forum postings. Having said that: I have a life. I'm not going to knock myself out about it. Digging this bit of info didn't take long at all. I like to keep it that way.

It appears that Lynn was correct in identifying Servman. (Surprise!) I'm still not sold that he's effectively identified anyone else, or that doing so has had the desired effect.

SiL / IKS / concerned citizen

A Spammer Responds, re: VPXL / Elite Herbal / Sancash / Genbucks

I received what is quite possibly a complete impossibility: A comment on this blog which wholeheartedly supports the spamming of VPXL, since it's such a "great product":

Hey, IKillSpammerz.

I purchased the penis enlargement product and used it continuously for 6 months. The product works well and I am very pleased with this product.

I have no problem with people selling stuff on the internet. Businesses around the globe use the internet as a vehicle to market their products and services to tens of millions of people every day. The retail market on the internet is a multi-Billion dollar market which is growing larger by the day, worldwide.

Personally, I have no problem with people selling their stuff on the internet. I sell stuff myself.

Wow. Just... wow This is one of the stupidest -- and most fictitious -- responses to any posting I have ever posted, ever, in any online forum.

I have a few choice words for whoever it was that posted this and assumed it was any kind of reasonable argument regarding the insane amount of spam which is present on an hourly basis promoting Genbucks / Sancash products:

1) You are rather obviously a spammer, and not a geniune customer. I am not overtly biased when I say this: the only time I ever receive this kind of positive response regarding what 99.999% of the email receiving public KNOW to be an illegal scam is when it's posted by a spammer themselves, or someone else within the spammer hierarchy. This has been proven numerous times, on several forums. (Including my favorite one, which spammers chose to attack extensively.)

2) Since this is not a blog which rails against "people selling their stuff on the internet" (I have absolutely no problem with amazon.com or ebay.com, and you will notice I never mention any [comparatively] legitimate online retailers who sell legitimate products) your comment is completely off topic. Online e-commerce is a great idea, and the companies who operate above board and market to people who WANT to hear from them are not mentioned in this blog.

I notice you worded your comment in much the same way as most spam messages we all recieve. You "purchased the penis enlargement product". Really. Which would that be? You obviously don't want to date your response, since the name of this product has changed approximately 9 times in the past six months. Only a spammer of these "products" would make that kind of choice.

Do you want to know the exact date I "opted in" to receive spam on behalf of VPXL or Elite Herbal or Herbal Max? Or Spur-M? Or WonderCum? Want to take a blind guess?

I can save you the hassle (but since you're a spammer, you already know this): I have never "opted in" -- EVER -- to receive email promoting this product. I never would. I have absolutely no interest in any "penis enhancing product" of any sort, but assuming I ever did: I would never trust that product if the only way I ever heard about it was via spam from a fictitious address, sent to me when I did not actively request it. That's most likely because I have a brain.

But in spite of this crucial detail, here's how much of my daily email intake is solely responsible for promoting this "product":

I receive 40 - 60 messages PER DAY promoting VPXL to only one of my email accounts. To my other three accounts which receive this type of spam - none of which were created for anything other than automated reporting of web stats and the like - I receive several dozen emails per day. I have never given ANYONE permission to send email to those accounts, and no living human being has ever been told of their existence.

As a test last year, a colleague of mine created a Gmail account which he never even used. He set it up, verified it, and left it alone for a month. He told absolutely nobody what that gmail account was, and he never posted it anywhere, in any public forum.

That account, which no human being is at all aware of, and which has certainly never "opted in" to anything, is currently receiving from 60 - 70 spam messages per day (all caught by Gmail's filters) solely for VPXL.

Explain to me, anonymous, how this can ever be perceived as "legitimate marketing" by anyone. Whoever is sending to my colleagues Gmail account is clearly attempting to send to the entire internet population whether they want it or not. That is just a blatant abuse of public (and in this case, corporate) services and processes, and costs everyone a huge amount of money every single day. It's fraud, it's abuse, and it's promoting a "product" which has already widely proven to have no medicinal value whatsoever.

I know of absolutely NOBODY AT ALL within my circle of professional or personal relations who has ever asked to recieved email regarding penis enhancement products, ever. I'm talking in over ten years of seeing the word "penis" in my inbox (which I certainly don't enjoy), I have never, ever, at any time, known anyone who was actively seeking these products, or who had ever given anyone permission to email them regarding these bogus products.

That's only part 1.

Part 2 is: there is a slew of very well written scientific evidence, especially in light of the investigative journalism the ongoing daily barrage of this crap unwanted email has given rise to, which unequivocally proves: this product is 100% bullshit.

The recent BBC investigation went to both a penile health expert and a pharmacologist. I myself have had communication with more than a few pharmacists regarding Elite Herbal / Manster / Megadik and (now) VPXL / Express Herbals.

I quote from the BBC article posted by Richard Cox on the BBC website:

Two weeks after I placed my order a brown envelope arrived from India. Inside was a bottle of Manster pills and the promise of a month's worth of enhanced sexual performance - although there is no mention of penis enlargement.

I sent the list of herbal ingredients to David Schardt, a senior Nutritionist at the Center for Science in the Public Interest in Washington DC.

He couldn't find any evidence to show that most of the ingredients would have any effect. What had cost me £35, he said, I could pick up for 50p in India.

This is only the most public, and most recent example of the exposition of this product as an outright fraud. In light of the considerable law enforcement and media awareness of this case around the world, that you would choose to word your pathetic comment in similarly vague terms is unsurprising, but phenomenally stupid.

Your idiotic comment is only present on this blog to somehow promote positive page ranks towards spam-friendly sites, most likely fraudulent comment spam postings. You are incorrect. You're likely one of the spammers (possibly the one who sends me the dozens of spams per day promoting this retarded non-product.)

Don't waste my (or the public's) time with stupid "comments" on my blog like this one.

I chose not to publish that comment, and instead opted to highlight it in its own posting as yet another desperate ploy by a scumbag spammer (or colleague of a spammer) trying to weight this blog in such a way that it end up supporting VPXL spam runs. It's still in the comment queue as evidence (since, trust me, law enforcement is well aware of this blog.)

Telling me that "The retail market on the internet is a multi-Billion dollar market which is growing larger by the day, worldwide" is a nice broad, pointless, non-statistical statement. You are purposely missing the point:

• Nobody opts in to VPXL spam. Nobody. There is absolutely no proof that the morons behind Sancash spam have ever used a targeted list, and this is borne out by numerous comments on pro-spam forums and the recent subversive actions of Sancash by attempting to hide their new affiliate program's location.


• The product is arguably fake, and overpriced.


• The product does not do what it claims


• The sites lie: they claim to be secure, when they are not. My own research has uncovered that not even the back-end processes of any Genbucks or Sancash website operates with any sort of security whatsoever.


• Their emails do whatever they can to get around spam filters, highlighting just how illegitimate their "marketing efforts" are. Numerous incoming messages promoting Elite Herbals are virtually unreadable. The only one who can compare on this level are the idiots behind "Canadian Pharmacy", whose emails abuse so many services it's impossible to list them all here.


• Their "testimonials" are completely fake and known to be written by staff members.

This rogue (and I hasten to emphasize: anonymous) commenter is only proving just how stupid a spammer can be. The only people who ever post this kind of crap responses are spammers. I have NEVER seen anything to prove otherwise.

As a final note: this blog has never claimed to be the expert on this topic. You can search the entire internet and find a plethora of similar distaste for this "product" and the individuals who choose to spam in hopes of promoting it. It is next to impossible to find any posting which is positive or supportive of the relentless assault of spam promoting VPXL (etc.) Don't just take my word for it, look for yourself.

SiL / IKS / concerned citizen