The forum is up and running normally. There has been continued attack activity, but most has been blocked. Our hosting service, Servint, has done an outstanding job blocking a lot of the traffic before it even hits our server. The remainder has not been enough of an issue to slow anything down.
If you are still unable to access the forum, your IP address may have been included in a block of troublesome addresses. Let us know, so we can try to troubleshoot the problem. You can reply to the administrative email address for the forum (the one where your forum notifications come from). Or you can post it as a comment to this blog.
Tuesday, November 3, 2009
Sunday, November 1, 2009
Continued DDoS attacks on InboxRevenge.com
The DDoS attack from yesterday continues. Blocking a few troublesome IPs brought the traffic down to a level that was not a serious inconvenience, so the site came back on line this morning. You can expect it to go up and down or be slow intermittently for now. The server will be up at times even during a heavy attack to collect IP addresses of attacking bots for evidence.
If you're a regular member and not able to get on at all, please email us to make sure your IP isn't blocked. The easiest way is to reply to one of the emails you have received notifying you of forum post replies.
If you're a regular member and not able to get on at all, please email us to make sure your IP isn't blocked. The easiest way is to reply to one of the emails you have received notifying you of forum post replies.
Good news -- DDoS attacks not over
Members may have noticed another recent outage for several hours. It was another confirmed DDoS, via a method called "syn flood." In the past, these sorts of attacks have gone on for weeks. We just roll with it.
Why is it good news? It lets us know our efforts are worthwhile, because making internet crime less profitable is exactly what we're trying to accomplish. If we weren't making criminals want to attack us, we'd have to wonder what we were doing wrong. We never expect to achieve the amazing level of spammer ire that Blue Security suffered in it's famous 2006 attack, but then we aren't planning to try to keep the site on line during the attacks. We just fall back to the alternate methods of spreading information. If our attackers would like to try to simultaneously take down Google, Microsoft, Twitter, Wordpress, and all the other sites we've established a presence on, they'll get themselves a lot more law enforcement attention than they're currently planning on.
Comments are open for this blog, though they have to be approved by a moderator. And if you have a comment that seems to merit its own "thread," we can repaste it as a blog post that can get its own comments.
Remember that SiL also has his two blogs, which also accept moderated comments:
http://ikillspammers.blogspot.com/
http://spamitmustfall.blogspot.com/
And we have our other sites for announcements:
http://twitter.com/inboxrevenge
http://inboxrevenge.wordpress.com/
http://inboxrevenge.webs.com/
http://spamtrackers.org
http://inboxrevenge.spaces.live.com/
As always, the best response to retaliation is to continue to do the reporting you were doing before -- but to do more of it.
Why is it good news? It lets us know our efforts are worthwhile, because making internet crime less profitable is exactly what we're trying to accomplish. If we weren't making criminals want to attack us, we'd have to wonder what we were doing wrong. We never expect to achieve the amazing level of spammer ire that Blue Security suffered in it's famous 2006 attack, but then we aren't planning to try to keep the site on line during the attacks. We just fall back to the alternate methods of spreading information. If our attackers would like to try to simultaneously take down Google, Microsoft, Twitter, Wordpress, and all the other sites we've established a presence on, they'll get themselves a lot more law enforcement attention than they're currently planning on.
Comments are open for this blog, though they have to be approved by a moderator. And if you have a comment that seems to merit its own "thread," we can repaste it as a blog post that can get its own comments.
Remember that SiL also has his two blogs, which also accept moderated comments:
http://ikillspammers.blogspot.com/
http://spamitmustfall.blogspot.com/
And we have our other sites for announcements:
http://twitter.com/inboxrevenge
http://inboxrevenge.wordpress.com/
http://inboxrevenge.webs.com/
http://spamtrackers.org
http://inboxrevenge.spaces.live.com/
As always, the best response to retaliation is to continue to do the reporting you were doing before -- but to do more of it.
Friday, October 30, 2009
InboxRevenge forum is back up
Apologies for the forum being unavailable a few days. The DDoS has subsided for now. Our policy is to just go off line as needed rather than to expend energy fighting such attacks.
Our time is much better spent continuing to investigate and report the internet criminals behind your spam and all the illegal activity that goes with it. Notifications on blogs like this one are part of the layers of redundancy we've set up to make it possible to continue our usual activities when the forum is unavailable. If anything, having the effectiveness of our activities acknowledged by spammers has been a shot in the arm to motivate our members, who primarily are busy professionals doing this as a volunteer effort outside of their usual jobs.
The forum thread for more information about this DDoS is at
http://ksforum.inboxrevenge.com/viewtopic.php?f=1&p=42237#p42237
Our time is much better spent continuing to investigate and report the internet criminals behind your spam and all the illegal activity that goes with it. Notifications on blogs like this one are part of the layers of redundancy we've set up to make it possible to continue our usual activities when the forum is unavailable. If anything, having the effectiveness of our activities acknowledged by spammers has been a shot in the arm to motivate our members, who primarily are busy professionals doing this as a volunteer effort outside of their usual jobs.
The forum thread for more information about this DDoS is at
http://ksforum.inboxrevenge.com/viewtopic.php?f=1&p=42237#p42237
Wednesday, October 28, 2009
Google Feedproxy Abuse
Well, just as the Yahoo Groups Spam becomes less overwhelming, along comes a new abuse: feedproxy.google.com URLs that redirect to the following Canadian Pharmacy domains:
pharmsstockmeant.com
caringbread.com
As InboxRevenge.com members know well, "Canadian Pharmacy" (CPh) is a scam.
The site has nothing to do with Canada. The phone number they list, +1(650)452-6975, has a Texas area code but is a voice-over-internet number which connects to an overseas operator -- if it gets answered at all. The address listed on their sites belongs to a legitimate Canadian pharmacists' organization that denies any relationship to CPh. Why doesn't that organization make them stop? Because CPh sites are part of an affiliate program run by criminals in Russia, out of reach of Canadian or US law enforcement.
The pills they sell are counterfeit generic versions of drugs that aren't legally available in generic version. A drug can't be sold generically until its patent has expired -- but again, they're out of reach of law enforcement.
CPh markets them like some late night infomercial for Ginzu Knives, throwing in free tabs of their counterfeit "Viagra" with every order -- even when that would be a potentially fatal combination. So either people are dying or the drugs are completely fake. Clearly no pharmacist has had any input into the operation, either way. And they're out of reach of law enforcement
It's extremely stupid to give the operators of CPh your name, address, phone number, and/or credit card number. It's extremely stupid to wait however long they tell you to wait for delivery, allowing the time limit to file a complaint with your credit card company to expire. And it's even more stupid to swallow pills of unknown makeup from an unknown country made under unknown conditions of sanitation, should anything actually show up in your mailbox.
That, and the fact that smuggling drugs is a federal crime. And you're not out of reach of law enforcement.
There's more information on the spamwiki:
http://spamtrackers.eu/wiki/index.php/Canadian_Pharmacy
pharmsstockmeant.com
caringbread.com
As InboxRevenge.com members know well, "Canadian Pharmacy" (CPh) is a scam.
The site has nothing to do with Canada. The phone number they list, +1(650)452-6975, has a Texas area code but is a voice-over-internet number which connects to an overseas operator -- if it gets answered at all. The address listed on their sites belongs to a legitimate Canadian pharmacists' organization that denies any relationship to CPh. Why doesn't that organization make them stop? Because CPh sites are part of an affiliate program run by criminals in Russia, out of reach of Canadian or US law enforcement.
The pills they sell are counterfeit generic versions of drugs that aren't legally available in generic version. A drug can't be sold generically until its patent has expired -- but again, they're out of reach of law enforcement.
CPh markets them like some late night infomercial for Ginzu Knives, throwing in free tabs of their counterfeit "Viagra" with every order -- even when that would be a potentially fatal combination. So either people are dying or the drugs are completely fake. Clearly no pharmacist has had any input into the operation, either way. And they're out of reach of law enforcement
It's extremely stupid to give the operators of CPh your name, address, phone number, and/or credit card number. It's extremely stupid to wait however long they tell you to wait for delivery, allowing the time limit to file a complaint with your credit card company to expire. And it's even more stupid to swallow pills of unknown makeup from an unknown country made under unknown conditions of sanitation, should anything actually show up in your mailbox.
That, and the fact that smuggling drugs is a federal crime. And you're not out of reach of law enforcement.
There's more information on the spamwiki:
http://spamtrackers.eu/wiki/index.php/Canadian_Pharmacy
Inboxrevenge.com, the little forum that creates big headaches for internet criminals, is under another distributed denial of service (DDoS) attack. That means hundreds or thousands of zombie computers -- computers like yours that have been infected by malware and put under the control of criminals -- are all trying to access the site simultaneously. Websites can only handle a certain amount of traffic, so having so many requests going on continuously shuts out legitimate visitors.
Frankly, we were wondering what took them so long. We've been through this before. We've got lots of backup means for forum admins and mods to communicate with each other and with the other members. We are prepared to just let the site be off line while these guys spend their money attacking. We'll just chill and spend the extra time reporting their domains and bots. The difference is they don't get to read about it.
What the rest of our members can do is take extra time reporting. Report your spam emails to spamcop.net, so more of their IP's are blocklisted and more of their bots are disinfected. Fire up Complainterator and report domains and their nameservers to registrars. We are not some discrete target that can be shut down with a DDoS. We are our members, all over the world, and we're in it for the long term.
http://twitter.com/inboxrevenge
http://inboxrevenge.wordpress.com/
http://inboxrevenge.webs.com/
http://spamtrackers.org
http://inboxrevenge.spaces.live.com/
Frankly, we were wondering what took them so long. We've been through this before. We've got lots of backup means for forum admins and mods to communicate with each other and with the other members. We are prepared to just let the site be off line while these guys spend their money attacking. We'll just chill and spend the extra time reporting their domains and bots. The difference is they don't get to read about it.
What the rest of our members can do is take extra time reporting. Report your spam emails to spamcop.net, so more of their IP's are blocklisted and more of their bots are disinfected. Fire up Complainterator and report domains and their nameservers to registrars. We are not some discrete target that can be shut down with a DDoS. We are our members, all over the world, and we're in it for the long term.
http://twitter.com/inboxrevenge
http://inboxrevenge.wordpress.com/
http://inboxrevenge.webs.com/
http://spamtrackers.org
http://inboxrevenge.spaces.live.com/
Thursday, April 9, 2009
We have posted an open letter to the new FTC Chairman, Jon Leibowitz, at http://ksforum.inboxrevenge.com/viewtopic.php?f=9&t=2574
It's about how the spam/internet fraud economy is interlaced with the less overt types of cyber crime that constitute a threat to national security. We think if the overt criminal activity like spam were pursued, it would rein in the types that are harder to detect, too.
Please drop by, read the letter, comment, and recommend it to others, including your local media or US congresspersons.
It's about how the spam/internet fraud economy is interlaced with the less overt types of cyber crime that constitute a threat to national security. We think if the overt criminal activity like spam were pursued, it would rein in the types that are harder to detect, too.
Please drop by, read the letter, comment, and recommend it to others, including your local media or US congresspersons.
Subscribe to:
Posts (Atom)