Silent noise - about spam, trojans and other nasty stuff

I stumbled over hackerbug.com.
Registered to "European Financial Services" / William Stanley.

Hackerbug is supposed to be a security company according to the website.
Once again, spamley relies on "the power of numbers". And again he has no clothes on.
Well he may have some clothes on, but he borrowed them this time. From someone else of course.

Now let me have a look at one page at hackerbug.com:

The answer is 6.

William Stanley needs a new calculator. Actually, no he does not. He probably has enough fingers to figure this one out, he only needs 9 (that is the number "nine" for you, spamley). And probably he won't need all those either.

He is on a crusade against ripoffreport.com. (I will not go in detail about that right now, but I think Helene Goldnadel has something to do with it, as spamley's customer)

And all the forumspamming aside, he has managed to get a site up and going, defamationaction.com.
Based on phpBB, same as thousands of the forum sites he is spamming to death.
Now let us quote a couple of sentences from the frontpage:

This organization is about taking action against those who defame others on the Internet and think they can operate with impunity.
We have proven over and over that the power of numbers is the answer.

I am not sure what he is thinking about when mentioning numbers. It could be the registered members at defamationaction.com. An impressive number as this is being written:

We have 3721 registered users

That's quite a lot. Hey, but wait! When I first arrived at the frontpage, it had 3721 members and the latest one was one "AlieXai". I took a look at the forum itself and then went back to the index page. Still 3721 members, but now the latest one was "The Testeur". That's a bit odd and I thought the worst; One of his members could have died maybe. Sad for both the member and spamley.
But something else looked funny:

In total there is 22 user online :: 0 Registered, 0 Hidden and 4 Guests

I used all fingers and toes and counted to 20 and found out that 22 must be higher than 4.
Strange bug in his forum I thought. "I must alert the phpBB guys."
Then I clicked a link that said "Who is Online" and there were actually only 2.
I have fingers enough so I found out that two had left. Or was it 22-2? I didn't know. (With the help of my sons fingers I found out that 22-2 is 20, btw.)

Anyway; I have seen some phpBB sites during the years, even installed a couple of them. So I know there probably is some kind of memberlist lying around. And dang, it was:

1. admin
2. eric
3. NoMoreMrNiceGuy
4. dai
5. fuckROR
6. iulianh
7. rebel
8. ByeEd
9. AUspider

When I disregard himself, eric (the guy answering his livehelp) and his rumanian friend iulianh (only those two, I am in a good moode today), we have 7. Correction; 6, there was a stiff middle finger not bending down there.
Now I resigned (I don't have that many friends and neighbours) and fired up a spreadsheet that told me: 3721-6= 3715.
That is a big difference I think! It must be, 3715 is a big number.

And I have to admit that I had a look at the site earlier, not too many hours ago.
The front page then said 8 members. His site would probably have bent over with such a large number registering and posting that many posts in such a short time.
Hosted at 66.185.126.188. Serverflo, "Nameless Host". Numberless would have been a more fitting name when hosting spamleys ghostmember site.

An old danish fairy tale flashbacked in my brain:

"But he has nothing on!"

Only difference is that you had to take a closer look at spamley.

I quote again:

We have proven over and over that the power of numbers is the answer.

Yes Mr. Spamley. And the answer is the power of 6!
Or if you prefer: -3715 (there is a minus sign in front of that, spamley).

William Stanley - dressing in clothes he doesn't have.

From sex, bulletproof hosting, wine storage and other stuff he now moves into diapers.
americanhygienics.com, "Your Premier source for Private Label Diapers, Wet wipes and more!", hosted at 80.109.231.7. Which is Chello in Klagenfurt, Austria. He hosts some more or less half-chewed mambo installations at Chello.
And of course he spamming various forums with americanhygienics.com.

   Domain Name: AMERICANHYGIENICS.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.AMERICANHYGIENICS.COM
   Name Server: NS2.AMERICANHYGIENICS.COM
   Status: ok
   Updated Date: 20-dec-2006
   Creation Date: 31-oct-2006
   Expiration Date: 31-oct-2008

Registration Service Provided By: European Financial Services
Contact: overstock@gmail.com

Domain name: americanhygienics.com

Administrative Contact:
   European Financial Services
   William Stanley (overstock@gmail.com)
   +43.5128539790
   Fax: 5128539790
   8 Redetsky Strasse
   Klagenfurt, Kanten 9020
   AT

Technical Contact:
   European Financial Services
   William Stanley (overstock@gmail.com)
   +43.5128539790
   Fax: 5128539790
   8 Redetsky Strasse
   Klagenfurt, Kanten 9020
   AT

Registrant Contact:
   European Financial Services
   William Stanley (overstock@gmail.com)
   +43.5128539790
   Fax: 5128539790
   8 Redetsky Strasse
   Klagenfurt, Kanten 9020
   AT

Status: Active

Name Servers:
   ns1.americanhygienics.com
   ns2.americanhygienics.com

He is his own registrar too now. Scary.
And supplying the world with diapers.

He is a piece of shit anyway, so it is a fitting business for him.

canadabankaccount.com - nah, that one is mirroring the repsavior stuff.
lyfe-card.com, vegacash.com, vegapay.com looks like him.
Hosted at 66.185.124.10. ServerFlo. Safely SBL-ed already for hosting other spammers.

He made his own blog at greenpeace: http://members.greenpeace.org/blog/lyfecard

And a new ICQ I have not seen before: 288090206 / 288-090-206

And he is babbling about a class action lawsuit against SpamHaus. Using spam of course, both email and forum polluting.

European Financial Services
   8 Redetsky Strasse
   Klagenfurt, Kanten 9020
   AT

  

Some years ago, some disgruntled spammer wrote the following:

Hi.
I am writing this short letter to you because I saw a reference to candidhosting on your website. I want to give you this warning about these porn sleaze scumbags.

William Stanley offers socalled "Search Engine Optimization". There is obviously several ways to do this. One of his methods is spamming forums, other people's forums.

Stanley is also offering to "protect you reputation". As I write this, his latest domain where he is offering these services is complaintremover.com.
From that page:

We submit positive information about you or your business, pushing aside negative Internet posts.

And where do they submit this information?: