Spam Alert
 
 Full Report: /VPXL_spam70891.html
 
 Consumed following related reports:

[70612] http://www.anherbal.com/
[70761] http://www.google.com/search?hl=en&q=inurl:anherbal&btnI
Changed status to confirmed spam.Criminal Evidence
Alias MaxGain+, VPXL, Express Herbals, Elite Herbal, MaxHerbal, and Herbal King, among others, this is a highly spammed website. Often the spam emails only contain domain names that redirect to a destination site, such as ebaygods.com, where victims are defrauded through sale and delivery (or sometimes nondelivery) of fake drugs, and appropriation of their personal details for use in future fraud. MaxGain+ exploits many different methods of redirections to try to escape detection.

Geographical locations are India and Hong Kong.

Spamming Criminal sponsor = SanCash
http://www.spamtrackers.eu/wiki/index.php?title=SanCash
SanCash came to light in late 2007 as the sponsor behind some of the most rampant spam runs on the Internet promoting "Elite Herbal" and (later) "VPXL / Express Herbal".

SanCash is believed to be directly related to the GenBucks organization, a sister company which also engages in the promotion of what could best be described as questionable products, usually herbal remedies of one sort or another. As of this writing (Feb. 2008,) SanCash's affiliate portal's location is unknown. They shut down their main domain (sancash.com) in mid-December 2007 following a raid on several properties in Christchurch, New Zealand : Ascoop.co.nz [http://www.scoop.co.nz/stories/PO0712/S00250.htm] Anti-spam raid in Christchurch, Dec. 19, 2007. . This followed an investigation by the BBC's Simon Cox on his radio show "The Investigation." [http://news.bbc.co.uk/2/hi/uk_news/magazine/7140449.stm] bbc.co.uk: Super scam me, Dec. 13, 2007.

See the Spam Wiki entry at http://www.spamtrackers.eu/wiki/index.php?title=VPXL
or from China: http://www.spamtrackers.hk/wiki/index.php?title=VPXL
See the McAfee Site Advisor information at http://siteadvisor.com/sites/anherbal.com


> Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
REGISTRATION OF THE WEB SITE: anherbal[dot]com
ACTION: To suspend this criminal site which breaks your terms of service, set the domain status to clientHold


> XIN NET TECHNOLOGY / SINO-I.COM
REGISTRATION OF THE NAME SERVERS
These name servers are registered by criminals to resolve only illegal web sites. This breaks your terms of service. You can safely suspend them:
NS1.NS-NNPPSS[dot]COM NS2.NS-NNPPSS[dot]COM

ACTION: To suspend these name servers successfully, follow these steps. Just setting the domain to Client Hold is not enough to suspend these name servers.

1. set the ns Address records to a non-routable address, such as 127.0.0.1 or 61.61.61.61.
2. Set the domain status to clientUpdateProhibited, clientTransferProhibited, clientDeleteProhibited, and clientHold

Due to SURBL blocking at Beijing Innovative Linkage Technology, (DNS.COM.CN), this message had to be reduced to contain only:

CastleCops® has discovered a VPXL spam operating at the link(s)
below. We are sending this email to request your assistance in removing this
fraudulent webpage(s). In addition, CastleCops works on a daily basis with law
enforcement and brand owners to try to identify spammers. You may be in possession
of critical clues that would help that process.

Reference this ticket for a detailed analysis including spam HTML source code:

/VPXL_spam70891.html

If it is within your power, we are requesting that you identify any files placed on
the server by the spammer, and share a copy with an appropriate law enforcement agency.
If you do not have a relationship with a law enforcement agency, CastleCops SIRT Team
would be happy to forward these files to our chosen law enforcement partner, the FBI.
If you would prefer to send these files directly, they may be sent to the National
Cyber Forensics Training Alliance at phish@ncfta.net. Please reference [SIRT#70891].

Web server log files may reveal the IP address used by this hacker. Even if it is not
his "true" IP address, it may help us to link this spammer to other crimes. Spam
"kit" files may reveal the email address used by this hacker to harvest stolen data.
Again, this may help us to link this spammer to other crimes, and to provide assistance
to victim brands or individuals.

Thank you for your cooperation!

CastleCops SIRT Squad
(Spam Incident Reporting & Termination)
_________________________

The following organizations receive our feed:

Federal Bureau of Investigation (FBI), National Cyber-Forensics and Training Alliance (NCFTA), Team Cymru

Public response thread: /t222601-.html
Reference: CastleCops SIRT Squad Report #70891
SIRT FAQ: http://wiki.castlecops.com/SIRT
Submit Spam: sirt@
Copyright CastleCops® 2007-2008, All Rights Reserved. http://www.castlecops.com