SpamVampire

SpamVampire -

"Non-caching, image-reaping, website-burning, bandwith-sucking action, all with a scorecard and a throttle."

ALERT: Mortgage Spammer Flash-Mob currently underway. Click Here

After much packeting, Alex Polyakov has apparently disabled his automatic IP address blocker... probably because he was needlessly blocking millions of IP addresses. He still appears to be manually blocking IP addresses (although he may have just blocked mine because I've been so brutal to his sites).

He's still blocking by Referer, so you'll have to strip out the Referer or save the SpamVampire code to your computer and run it from there (see the "SpamVampire Source Code" link to the right).

Tell all your friends to fire up SpamVampire and let it run, too.

He'll try to turn off his websites at night to conserve bandwidth... keep running the SpamVampire, no matter what... he'll come back, and when he does, we'll drain him.

We need 5000 people all running SpamVampire for a few months to beat him, so tell everyone you know.

This is one of the world's largest spammers (accounting for approximately 12% of spam worldwide), and a prolific scammer (all his mortgage refinancing spams are phishes, he's done several investment scams, he's also doing money laundering, and he's luring unsuspecting innocent people (scroll down about halfway) to participate in his money laundering), so taking him down will be a very good thing.

[UPDATE #1]
I got a series of telephone calls, purportedly from Leo Kuvayev, another Russian spammer... it is my belief that Kuvayev is working with Polyakov. The telephone calls consisted of death threats.

[UPDATE #2]
This spammer has now changed the way they're registering their domains. Rather than domains such as known-3.com and j0hndoe.com, they are registering numerical domains, such as l2981.net and m9281.com.

[UPDATE #3]
They are now contacting businesses using my name and telephone number, in a (very lame) attempt at flooding me with telephone calls. They're dumb enough to do so with the very mortgage brokers they sell leads to! You can see the problem with that... they lose those mortgage brokers' business.

NOTE: Announcing the SpamVampire logo contest. Please see the "Latest News" (18Oct2005) section for additional information.

Q: What is SpamVampire?
A: SpamVampire is a spam abatement tool. It is an image rotator on steroids, basically downloading images from spamvertised websites repeatedly, running up the hosting costs of the spammer who owns the spamvertised domain.

Q: But why would you want to repeatedly download images from a spammer's website?
A: Doing so causes the costs associated with hosting that spamvertised website to increase. Most bandwidth consumers are subject to purchasing bandwidth on what is known as the 95/5 plan. This is the way most ISPs purchase their bandwidth and they pass the same scheme on to their customers. Read Item 4 on this page ... http://www.colomax.com/colocation/faq/billing.aspx

What this means is that to totally "hose" the economics of a web site customer who is on this plan, 37 hours of high bandwidth utilization will cause them to be billed as if the entire MONTH of 720 hours was used at this super-high rate. That immediately changes the entire economic outlook for anyone hosting a web site. Since it is probably possible to deliberately pull several hundred times more bandwidth than normal from a site, it is possible -- in less than just two days -- to cause the bandwidth charges for an entire MONTH of a 95/5 billed site to be several hundred times higher than usual. Since the ISP has to pay their peering partner for this usage, so does the ISP's customer.

Q: OK, so you increase the spammers' costs associated with sending spam to reduce the incentive to send the spam. But what do you hope to accomplish?
A: It is hoped (in a best-case scenario) that the spammers will get the message that their spam is unwanted by anyone, and they quit spamming. Being firmly grounded in reality, we all know this will most likely not occur. So, our next best scenario is that the spammers learn that there are certain domains protected by the SpamVampire, and spamming those domains is a negative-income endeavor. Thus, they will learn to avoid sending spam to those domains.

Q: So, does it work?
A: Indeed, it does. We have experienced a significant decrease in our rolling monthly spam receival rate.

Q: How do I put SpamVampire to work for me?
A: If you wish, you can run SpamVampire directly from the links above. It is highly recommended, however, that you grab the source code of the SpamVampire, edit the source code to reflect the spammers that are bothering you, and run it to increase the hosting costs of those spammers. SpamVampire runs just as well from your desktop as it does from a website, so even if you don't have a website, you can run it.

Q: How much data should I drain from a spamvertised website, in order to make the SpamVampire effective?
A: That depends upon how much bandwidth you wish to devote to abating spam... a good round number is 25 GB (GigaBytes) of data per spamvertised website per spam received. You can, of course, take more... but 25 GB is a good starting point. The more people who use the SpamVampire, the less data each person would need to drain, in order to make the SpamVampire effective for everyone. So, tell your friends about the SpamVampire!

Setting up to run SpamVampire

There is one setting you should change if you want to run SpamVampire using Internet Explorer.
Go to Start » Settings » Control Panel » Internet Options » Advanced (tab) » Multimedia » "Play animations in web pages" (uncheck).

If you wish to run SpamVampire using Firefox, you should do the following:
Start Firefox » type "about:config" in the Address Bar » enter or change the following settings to what you see below:
browser.cache.disk.capacity | 0 (integer)
browser.cache.disk.enable | false (boolean)
browser.cache.memory.capacity | 0 (integer)
browser.cache.memory.enable | false (boolean)

For additional security when running either Internet Explorer (IE) or Firefox (or any other application accessing the internet, for that matter), if you are running as an Administrator in Windows XP (unless you've changed this, you are running as an Administrator), you should implement the DropMyRights program to lower the system permissions that the browser has:

Download the DropMyRights program and install it to 'C:\Program Files\DropMyRights\'.
(It installs to a different directory by default, so be sure to specify this path.)
Create a shortcut icon on your desktop for IE. Rename it "SAFER Internet Explorer"
Right-click the icon, and select 'Properties'.
In the 'Target' line, add the following (including the quotes) in front of the existing text:
"C:\Program Files\DropMyRights\DropMyRights.exe"

So, the new 'Target' line (for IE) should read (including the quotes and the space between the two text blurbs):
"C:\Program Files\DropMyRights\DropMyRights.exe" "C:\Program Files\Internet Explorer\iexplore.exe"

Click the "Ok" button.
You'll probably notice that the icon is no longer showing correctly (since it is trying to pull the icon from the DropMyRights program now). Fix this by right-clicking the "SAFER Internet Explorer" shortcut icon, selecting "Properties", and clicking on the "Change Icon" button. Browse to the following:
C:\Program Files\Internet Explorer\iexplore.exe
and click the "Open" button, then click the "Ok" button.

For a detailed explanation of what this does, please see the link above. Quoting from that site:
"DropMyRights is a very simple application to help users who must run as an administrator run applications in a much safer context - that of a non-administrator. It does this by taking the current user's token, removing various privileges and SIDs from the token, and then using that token to start another process, such as Internet Explorer or Outlook. This tool works just as well with Mozilla's Firefox, Eudora, or Lotus Notes e-mail."

[ NOTE #1: There is a known memory leak in Firefox (prior to version 1.5), related to image loading. Because of this memory leak, you will have to shut down and reload the Firefox browser every few hours to keep it from taking all your memory. This appears to be fixed in version 1.5 of Firefox. ]

[ NOTE #2: If you experience high CPU usage while heavily using the alternate image loading mechanism (indicated by a light green image container), try disabling Remote Access Auto Connection Manager. For some reason, every time a new third level domain URL is created and accessed via SpamVampire, Process Explorer showed rasauto.dll, running under svchost.exe (as the Remote Access Auto Connection Manager) taking a lot of the CPU time. Disabling that service via Start » Settings » Control Panel » Administrative Tools » Services seems to have fixed it. If your WAN or LAN connections break as a result of disabling that service, set it back to Automatic and start the service. ]

Computer tweaks for maximum performance (advanced users only)

First, change the TCPIP.SYS file so it allows more than the default 10 simultaneous connections. It is recommended to set this to 50 simultaneous connections.

You can change yours with a program located here:
http://www.lvllord.de/
The program is called "Patcher".

Make a copy of your original TCPIP.SYS file, renaming it to TCPIP.SYS_OLD. If anything goes wrong in changing the file, you can simply delete the changed file, rename the original file to its original name, reboot, and you're up and running again.

--------------------

Next, increase the number of simultaneous connections IE can handle. It is recommended to set these settings at 50.

Start the Registry Editor
Go to HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings
Select New > DWORD Value from the Edit menu
Name the new value MaxConnectionsPer1_0Server
Right-click the MaxConnectionsPer1_0Server value and choose Modify
Under Base, click the radio button next to Decimal
In the Value Data: box enter the number of simultaneous connections you want to set, and click OK
Repeat steps 3 - 7 using the new value MaxConnectionsPerServer
Exit the registry editor
Reboot your computer

--------------------

Next, tweak the connection settings using DrTCP or CableNut:

For RWIN, calculate the optimum setting using this page:
http://www.dslreports.com/tweaks/RWIN

To determine MTU settings, use this page:
http://www.dslreports.com/faq/695

--------------------

Next, increase the priorities:

Navigate to this registry entry and change the following settings:
----------
For XP & 2K:
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ ServiceProvider
----------
For 98, 98SE & ME:
HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Services \ VxD \ MSTCP \ ServiceProvider
----------
On the right for ALL OS's change these entries: (ALL values are HEXIDECIMAL)
Class - 1
DnsPriority - 1
HostsPriority - 1
LocalPriority - 1
NetbtPriority - 1

--------------------

Then, tweak the DNS cache settings:

By default Windows 2K & XP cache everything in the DNS cache service, both correct and faulty DNS lookups. To increase performance by eliminating the caching of faulty DNS lookups, change the following values from whatever their original values are to zero.

[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Dnscache \ Parameters]
"NegativeCacheTime"=dword:00000000
"NetFailureCacheTime"=dword:00000000
"NegativeSOACacheTime"=dword:00000000

The SpamVampire uses cookies to save and set the state of the data-draining session. This allows you to quit data-draining, come back to it at a later time, and not have to start over at zero images and zero bytes.

The specific data saved in the cookie is as follows:

dSpeed - The throttle setting.
saveProgress - The state of the 'Stats' checkbox.
AutoUpdate - The state of the 'Auto-Update' checkbox.
ExpertMode - The state of the 'Expert Mode' checkbox.
LoadCounter - The counter added to the end of the image URL.
iBytes - The total number of bytes data-drained.
fSRunning - The total running time of all data-draining sessions.
iImagesLoaded - The total number of images loaded.
iImageLoadFailures - The total number of image load failures.
ThrottleRate - The image load timeout period used to bring the image loading rate to equal dSpeed.
imageAvg - The images / sec average.
bytesAvg - The average data rate.

Saving the above data means that when you start data draining again, SpamVampire picks up where it left off, rather than starting over from zero each time.

You can disable saving this data by unchecking the 'Stats' checkbox in SpamVampire. When the 'Stats', 'Auto-Update' and 'Expert Mode' checkboxes are both unchecked, the cookie file is automatically deleted.

Stats are saved every 10 seconds.

Auto-Vampire

The SpamVampire can be set up to auto-run and automatically exit on a schedule. Go here for the steps to do so.

Auto-Reload

The SpamVampire can auto-reload. This allows you to run SpamVampire 24/7 and it will automatically start data-draining newly added sites as they are added to the source code.

You can disable the auto-reload by unchecking the 'Auto-Update' checkbox in SpamVampire.

Fiddler

Fiddler is an HTTP Debugging Proxy which logs all HTTP traffic between your computer and the Internet. Fiddler allows you to inspect all HTTP Traffic, set breakpoints, and "fiddle" with incoming or outgoing data. Fiddler is designed to be much simpler than using NetMon or Achilles, and includes a simple but powerful JScript.NET event-based scripting subsystem.

Using Fiddler, you can dynamically rewrite the Referer header, inspect packets and do pretty much anything any other packet sniffer can do, and a lot more. This comes in handy when inspecting a spamvertised site, as well as when a site being data-drained is blocking or redirecting by Referer (keep in mind that you can also get around Referer blocking by running SpamVampire from your local computer, rather than from a website).

The specific Fiddler code to use for rewriting and / or removing Referer:
Under class Handlers:
public static RulesOption("Spoof Referer")
var m_RefererSpoof: boolean = false;

public static RulesOption("Strip Referer")
var m_RefererStrip: boolean = true;

Under static function OnBeforeRequest(oSession:Fiddler.Session)
if (m_RefererSpoof){
oSession.oRequest["Referer"] = oSession.host;
}

if (m_RefererStrip){
oSession.oRequest["Referer"] = "";
}

RefControl Firefox Extension

RefControl does the same as Fiddler above, without having to know any code. It can either block or rewrite the Referer, so spammers cannot block or redirect traffic based upon the Referer. RefControl is for Firefox only.

Anonymous Proxies

The spammers have escalated the situation once again, not only by refusing to remove email addresses of people who do not wish to receive their junk, but by blocking the IP addresses of those people from visiting their sites. Consider the insanity of spamming a person, while blocking that person from visiting the sites advertised via that spam.

Two programs are called for... one to find anonymous proxies, and one to utilize them.

To find anonymous proxies, there is Charon. To use the anonymous proxies, there is MultiProxy.

Charon will search for the proxies, test them for speed, content filtering and anonymity, filter out the proxies that are run by educational, law enforcement, government and military organizations, and list the remaining proxies. You then save that list to a text file, which you import into MultiProxy.

When using Charon, you can check that the proxies are actually loading in web pages like they are supposed to, by putting the URL of a spammer's web page into the 'Site Options' list, and grabbing a bit of text from that page for Charon to search for.

If you have a website, and want to set up your own IP address verification web page to use with Charon's ProxyJudge capabilities, you can't go wrong with AZenv. It's small and very light on server CPU resources, unlike ProxyJudge (which I had to remove from our server because it was maxing out the CPU).

Simply install AZenv per the instructions, then in Charon go to "Connect Options" >> Check "Use External Proxy Judge", and enter the URL to your AZenv.

Other Vampires:

* If you have a Vampire you'd like added to the list, contact me via our website feedback form.
* If you set up your own SpamVampire, please be very careful to include only sites that are advertised in spam emails so that no 'innocent' websites are listed.

The easiest way to determine whether or not a site is advertised via spam is to see if others are reporting the same site as being spamvertised.

You can do this by utilizing the following:

Simply enter the Second Level Domain (example: SpamSite.com) into the text box, and click the button.

Other uses:

CamVampire -

Another use for the SpamVampire, with minimal tweaking, is that of a security monitor (CamVampire).

By tweaking the image size in the CSS, and the image load rate range in the source code, you could easily have a nifty multi-camera security monitor application.

LAN camera prices have fallen enough now that setting up a 4 or 8 camera security system should be pretty cheap, and the CamVampire code will alert you immediately if any camera stops operating for any reason (via the color surrounding the image).

This would be an especially good application for use in places such as day-care centers, so parents could view their childrens' activities throughout the day.

If anyone needs help tweaking the code to set up the SpamVampire as a CamVampire, please let me know. The code is open source (i.e.: free), so feel free to use it however you wish.

If anyone has an internet-accessible CamVampire set up as a security monitor, and would like it listed here, please contact me via our website feedback form.

Internet Connection Speed Test -

Unlike other internet connection speed tests, the SpamVampire can be run for hours (or days, or weeks) at a time, allowing you to pinpoint specific problems that your internet connection is having when fully utilizing the available bandwidth.

And, unlike other internet connection speed tests, if you have multiple WAN connections running into an aggregating router, the SpamVampire will test all the WAN connections at the same time, giving you an overall indication of the speed of all your WAN connections.

The whole point of a connection speed test is to test the effects of any tweaks to your connection settings, and the SpamVampire allows you to fully test those tweaks.

The fact that while you're testing your internet connection speed, you're also helping to abate spam, is icing on the cake.