Let's go again?

Looking at the start blocks. Maybe, maybe. Veru was very persuasive. Old backups have been checked, they are lumped together in a terrible mess. New version(s) of software is a challenge. The backups are way behind. Haven't been totally passive the last years. Some info has floated this way, but I have not spent time looking closely at it. There is also tons of info from the old days of spam-court.com that we never had time to take a closer look at back then. Laying puzzles has always been interesting. Now we have some new pieces from the last 11 to 12 years, not sure if I'm quite ready to fit them together with old ones. Maybe they don't fit at all. Asymmetric 3D-puzzles are difficult. Maybe just start with the members from the old bulkerforum, as Veru suggests. We'll see.

Oleg Nikolaenko - Docent

Another member of the dead bulkerforum locked up: Docent, Oleg Nikolaenko.

For your readings:

Brian Krebs:
http://krebsonsecurity.com/2010/12/fbi-identifies-russian-mega-d-spam-kingpin/

Gar Warner:
http://garwarner.blogspot.com/2010/12/oleg-nikolaenko-mega-d-botmaster-to.html

In short: Docent was the Mega-D botmaster and a criminal spammer.

According to his one posting on bulkerforum.biz, he may also have been a stockspammer:

Stocks - who knows these symbols? CYTV, CWTD - contact me please, I need same class deals. NO 4 resellers & references a must!

Did we forget Atkinson? Maybe.

Another MegaDick jailed.
Time will tell when the next criminal from bulkerforum goes down.

We have mail!

From "Paul Walker", using the contact form:

Paul Walker sent a message using the contact form at
http://www.spam-court.com/?q=contact.

You are one hilarious guy. A senior citizen who wanted to become a spammer
but was shunned, now pretending that spammers are scum. AHAHAHAHA. You are
one of the dumbest 60 year old men in existence (if not the dumbest), and
your rants are nothing short of hilarious. This website is basically your
personal livejournal, where you bitch and moan. Nobody cares about your
site and the only people that frequent it are the ones that need a good
laugh. You're a great joke to spammers and anti spammers everywhere. Keep
up the good work fonzi, just watch that ulcer. HAHAHAHA

We don't comment his mistake about thinking that the miserable Marion Lynn is a part of this site.

But you know, David: It does not help hiding behind a Tor node at 202.106.212.226 when you are as stupid as you are.

Yes, David Barsky. Known as "David" on bulkerforum.biz. Not "Paul Walker". But David Oleg Barsky.
Who serves "peas" to the spammers on the forum.
He probably was a bit mad after we wrote about him last time.

With a brand new server on ThePlanet too:

network:Class-Name:network
network:ID:THEPLANET-BLK-13
network:Auth-Area:70.84.0.0/14
network:Network-Name:TPIS-BLK-70-85-188-0
network:IP-Network:70.85.188.0/29
network:IP-Network-Block:70.85.188.0 - 70.85.188.7
network:Organization-Name:Dave
network:Organization-City:Houston
network:Organization-State:TX
network:Organization-Zip:77071
network:Organization-Country:US
network:Description-Usage:customer
network:Server-Pri:ns1.theplanet.com
network:Server-Sec:ns2.theplanet.com
network:Tech-Contact;I:abuse@theplanet.com
network:Admin-Contact;I:abuse@theplanet.com
network:Created:20080116
network:Updated:20080116

David Barsky, the potbob aka God from the old days.
You can run, but please show a bit more intelligence.
Or else you cannot hide, David.

Did you enjoy the Cowboys vs. Redskins game in November? I did.

n0fx - delivers bp hosting and exploits

A young oldtimer. A digital gangsta (not my words). Found traces of him dating back a few years, probably back to the spamvault.net days.
Just out of his diapers back then.

Let's start with a one of his postings from bulkerforum.biz:

n0fx
Joined: 26 Mar 2007
Posts: 50
Posted: Tue Oct 02, 2007 4:44 pm Post subject: bp servers 4 sale - can use for ANYTHING but direct mailing
$250 Dedicated BP FAST China Servers

* 110% ANONYMOUS - your name and info not tied to them at all!

* Direct Mailing not allowed but pea mailing and any other applications running is fine -- social networks, chat bots, etc.

* IF for some reason the IP gets in trouble, your server will NEVER go down -- you will just be assigned new ip.

* WINDOWS OR FREEBSD O/S. No hosting on these servers.

***************

If you need FAST hosting BP, $500 a month. no adult or child porn *anything else is fine* - 25 Domains.

Contact me and I'll get you setup ASAP!

aim - batonRouge
skype - killpolice
icq - 216.587.192

Hm, hosting *anything* except adult and child porn. So malware and phish pages are just fine, me thinks.

Ties to Matt Leppala (Link to Leppalas ROKSO listing).
Has at least one site hosted at Leppalas (webnos) space on Staminus.
And some sites on phatservers.

A nice soul sent us a picture of three guys.
The problem is that we don't know which one is n0fx. And the source is silent.

Other nicks used around: skunx, PunkRockXXX, squatterpunx, Punk Rocks

Personally, I prefer to call him Steve.
No, I changed my mind. I prefer to call him Edmond. I wondered what that e@ in several domain registrations meant.
Now I know.
Ugly piece of shit according to a photo.

sanjay aka sancash

The Elite Herbal guy.

I originally included him in the "Snippets" posting, very briefly:

A quick note to self:
This guy is involved with Elite Herbal.
How high up he is in the food chain cannot be established accurately.
If not on top, he is very high up.

Definately to be continued.

There is a lot of buzz about Elite Herbal and genbucks going on now.
That is the only reason for this posting. I don't have that much new info on sanjay.

One tiny little detail is found in an old dig for the domain sancash.com (and this is sanjay's domain):

; <<>> DiG 9.2.4 <<>> sancash.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49188
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;sancash.com.                   IN      A

;; ANSWER SECTION:
sancash.com.            130     IN      A       66.11.113.41

;; AUTHORITY SECTION:
sancash.com.            172800  IN      NS      ns2.sancash.com.
sancash.com.            172800  IN      NS      ns1.sancash.com.

;; Query time: 57 msec
;; SERVER: 
;; WHEN: Sat Sep 22 18:46:19 2007
;; MSG SIZE  rcvd: 81

Then we take a look at that IP, 66.11.113.41:

Suavemente, INC. SUAVEMENTE-SAN-DIEGO (NET-66-11-112-0-1)
                                  66.11.112.0 - 66.11.127.255
IzoWeb, Inc IZOWEB-SANDIEGO (NET-66-11-113-0-1)
                                  66.11.113.0 - 66.11.114.255

Who else has IzoWeb/WireSix as a favorite hoster?
You're right: GenBucks.
Another small piece in the Elite Herbal/Genbucks connection.

And regarding IzoWeb: By the number of hosted genbucks sites and their related sites, is this really an independent host?
Or is it GenBucks themselves?

I am wondering a bit about Suavemente too.

Let's jump back:

Post subject: Penis enlargement pills .. Big Commissions! Epassporte Pay!
We are looking for a few more affiliates who are intrested in marketing enlargement pills, great alternative to replica or RX, our pills are converting great with average order of 6 bottles!. Payments every week. fast BP hosting, private bp domains.

We have solid references for those that dont know us.. affiliates will also need references.

Thxs Sanjay

AIM: sancash44
MSN: sancash44@hotmail.com
ICQ: 654052
SKYPE: sancash1

That was back in October 2006.

And a bit earlier in October 2006:

Herbal sites, high converting penis pills and Cum pills, Hoodia... market these and get weekly epassporte payments or wire if needed.

If you dont have an epassporte account, get just 1 sale we can send you a free ATM card.. get paid and withdraw it every week!

- multiple servers
- lots of fresh domains
- private domains
- add your own domains!
- detailed stats
- lots of sites, herbal, RX, adult products
- fast servers
- high commissions

plus lots more nice features

We have been in the industry for over 4 yrs, program was made by mailiers 4 mailers!

get your account today..

ICQ - 654052
SKYPE - sancash1

We dont normally hang at boards but do have people that can vouch for us.

Thxs Sanjay

Note: program was made by mailiers 4 mailers!.
Yeah, right genbucks. We rephrase that one:
The program was made by spammers for spammers.