Pages

Wednesday, 29 February 2012

Chinese Threat Actor Part 2

Follow up on Joe Stewart Investigation

http://www.secureworks.com/research/threats/sindigoo/

Chinese Threat Actor Part 1

http://cyb3rsleuth.blogspot.com/2011/08/chinese-threat-actor-identified.html

king_public@hotmail.com also owns another email king_public@163.com

RootKit Database

(23025,'king-rose','e211f11c0b28434bf7f1c8fb510fa9ae','Club tom','king_public@hotmail.com',1,1106582903,'','','','','','',0,'','',1106837367,'61.51.59.63',0,0,0,1106583113,0,0,0,'BH','19800126','','','',0,'')

IP - 61.51.59.63

Location     CHINA, BEIJING, BEIJING
Connection through    CHINA UNICOM BEIJING PROVINCE NETWORK

IP - 123.120.127.153

20446,'king-z','e211f11c0b28434bf7f1c8fb510fa9ae','k,z,y','wzy_100@hotmail.com',1,1097652186,'','','','','','',0,'','',1284013010,'123.120.127.153',0,0,0,1284013010,0,0,0,'','','','','',0,'')

Location     CHINA, BEIJING, BEIJING
Connection through    CHINA UNICOM BEIJING PROVINCE NETWORK



The Kaixin profile linked to king_public@hotmail.com reveals the name Wang Liang Chen (王亮晨 ) and his other email king_public@163.com is also linked to a Kaixin profile.

Wang Zhong Yun (王仲俊)

http://www.kaixin001.com/home/22655901.html

http://www.kaixin001.com/photo/logolist.php?uid=22655901



Gender: Male
Current residence: Beijing
Zodiac Sign: Pisces

The spacewalk picture is used as profile picture for king_public@hotmail.com kaixin. 

His social network got many friends and the profile appears genuine.











Further analysis reveals that king_public@163.com is linked to many tech and hacker forums with handles "W100", "King-W" and "King-Z"

Tianya Board


Male, Beijing, Pisces





http://topic.csdn.net/t/20031223/17/2594994.html



http://topic.csdn.net/t/20050926/19/4295450.html



51CTO Blog



8dragon










Known emails and handles of the actor

king_public@hotmail.com

wzy_100@hotmail.com

king_public@163.com

king_w100@163.com

Handles - King-Z, King-W, W100, King-rose


Chinese Threat Actor Part 3

Monday, 13 February 2012

Gigabid Affiliate

Gigabid - Clickbot and Fake AV Affiliate

INCOME UP TO 400 $ - 1K US

US, GB, CA, AU, AT, BE, BG, DE, GR, DK
IE, ES, IT, CY, LU, MT, NL, PT, FI, FR, SE

STANDARD US CA GB AU

up to 90%

NEW METHOD FOR THE ENVELOPE!
Earn up to $ 830 A DAY
UP TO 20% Referral
COMPATIBLE with other software



















Friday, 10 February 2012

Evade Antivirus Detection

Bad Guys way


- Scan malware at multiple Anti Virus Checker that do not send samples to AV companies.
- Crypt malware with Polymorphic crypters to avoid detection.


MyAV Scan - Private AV Scanners and Crypters


About




 Services



Multiple Scanners & Crypters






Desktop Version


Wednesday, 1 February 2012

Andromeda Bot


English translation by @Sherb1n

Coder - Waahoo - Adv on Private Forum

Description:

This versatile modular bot can be used as the foundation for a botnet with an endless variety of possibilities. The bot’s functionality can be expanded through a system of plugins, any number of which can be added at any time.

Supports unlimited number of reserve domains.

Data exchange protocol between the bot and the admin server is RC4-encrypted.

 You can reconfigure your botnet to your needs at any time, by yourself.

Doesn’t overload the system, doesn’t require admin rights to install, doesn’t trigger a UAC pop-up.

The bot protects itself, so an unskilled user will not be able to remove it from the system.

Bypasses firewalls, doesn’t appear in the list of processes, injects into a trusted process.

Doesn’t produce any DLLs, doesn’t contain TLS, easy to encrypt.

Regardless of how successful the installation is, the original executable is deleted.

Works on WinXP through Win7, including x64 systems.

Very lightweight, written entirely in Assembler.

There are two versions of this bot:

01.* public inject-based, uses QueueUserAPC
02.* bypass-based; this version, unlike the one above, can get through proactive defense.

Written in PHP, bundled with MySQL.
Detects bots behind the NAT.
Keeps botnet stats: # of bots online/offline/dead, breakdown by country, breakdown by platform.
Keeps track of the number of finished/unfinished tasks.
Can set a limit on the number of times the task will be executed.
Can assign tasks to individual bots.
Assign tasks based on the bots’ countries.
Clear all stats/delete all dead bots from the DB.

Admin panel screenshots:










Price list:

01.* - $200
02.* - not for sale at the moment.
Rebuild for a new URL (main URL) - $10
For each additional reserve URL - $10

We accept:

Liberty Reserve (preferred)
Webmoney.

Tuesday, 31 January 2012

StyxCrypt

About

World's first fully automated online obfuscation service is a service to provide a full range of obfuscation services of binary data and source code by nine input data formats.

Currently we support the most demanded spectrum of morphing formats which are demanded by thousands of webmasters:

JavaScript;
HTML;
EXE;
DLL;
PDF;
SWF;
IFrame;
PHP;
ASP;

Multi Obfuscator has it's own polymorphic engine which enables a possibility to morph a vide range of inupt data. This means every time you morph something you will get absolutely different binary and source code.
System provides an external API and gives a possibility to automate software and services for all customers.
You will be fully satisfied by morphing quality and speed of updates.







FAQ

Q: What's this service about?
A: Our service is first world-class fully automated multicrypt service. At the moment we have the maximum quantity of morphing input data types, fully automated system based on polymorphic engine and API suported.


Q: What types of crypting do you support?
A: We support nine morphing data tyes:

HTML: source code with or without JavaScript;


JavaScript: inside HTML or standalone (which is helpful for clickunders, popunders and morphing any type of context advertising);
EXE and DLL as Windows Coff PE executables;
PDF: content morphing;
SWF: morping source AS3-scripts;
PHP / ASP source scripts;


Q: Who are your customers?
A: Our customers are partners program, online casino, traffic stocks, banner networks, adult, pharma and so on.


Q: What are your benefits compare to private services?
Firstly no one of private services can't morph such quantity of data types as we can. We have a polymorphic kernel that guarantees that all output code will be fully different and enthropy will be almost 100%. As we have a polymorphic stub every crypted fule will be unique and can live before reversing and disassembly long time. We have rapid updates and you will not wait and waste your time. Also we have API to automate your services. Hope reasons above will help you to make right decision to work with us.


Q: Can you guarantee 100% FUD on Coff/PE? Do you provide money back in this case?
A: No, we cannot guarantee 100% FUD. Also we don't have money back system (but in any case support can add an amount to your balance by it's own opinion in case of detects). If you can use it — welcome. If you noticed a detect please contact support and tell them details and check URL; it can help to make FUD in a short time. For the projects with huge loads we have private cryptor. Please contact support for it.


Q: How can I crypt the file?
A: To encrypt a file or URL simlpy register in the system, charge your balance, select your tariff and upload a file to crypt in the user menu «Obfuscation».
Innovation is an automated service verification, which checks the file after obfuscation, provides a link to check the results of which you can agree (and get a file) or disagree (money back to your balance).
Therefore, if the job is "stuck" on the status of "Pending", you simply open the task, click on the link and make sure that you are satisfied.

Q: Do you have automation and possibility to work with API?
A: Yes, we provide API for development needs and also we have sample PHP library

Q: What's the maximum file size?
A: EXE / DLL is 160 kilobytes and other crypting services are 1 megabyte.

Q: What are your demands to Coff/PE files?
A: Files must be provided as is without packing by any Coff/PE packer like UPX, PECompact and so on.

Q: Can I obfuscate files with greater size?
A: Yes, you can. Knock support, it will answer all your questions.

Q: How scheduler works?
A: Scheduler morphs your source every time to let you get always new and fresh version. Morphing interval can be selected by customer by adding a new task to morph.


Q: What payment methods do you support?
A: Currently we support WebMoney in authomatic mode and Leberty Reserve in manual mode.


Q: I crypted the file, but not satisfied by result. What should I do?
A: You should fill the form in contacts where describe task number and your complain. We will answer in as soon as it will be possible.


Q: Did you pass the tests?
A: Yes, we did. You can ask public and private links by contacting our support.


Q: Is the service anonymous?
A: Yes, it's totally anonymous. All files are fully deleted in 30 days.


Q: What does it mean - Styx?
A: Just read wiki: http://en.wikipedia.org/wiki/Styx
The Styx (Greek: Στύξ, also meaning "hate" and "detestation") (adjectival form: Stygian, /ˈstɪdʒi.ən/) is a river in Greek mythology that formed the boundary between Earth and the Underworld (often called Hades which is also the name of this domain's ruler). It circles the Underworld nine times.

Sunday, 29 January 2012

Ann Loader

English Translation by @Sherb1n

Ann Loader Seller – Noncenz - Adv on Forums

You know our team from projects like RedZone password recovery system, MKL professional keylogger, Destination Darkness DDoS bot (aka Optima), PassView password viewer, and others. AnnLoader is a worthy addition to this collection!

[Functionality]

• You can set up tasks: X installs in country A, and so on.
• Set task priority
• Edit and re-arrange the tasks
• The build is only 14KB
• The program is written in API
• You can adjust the bot load and set up a white zone
• AnnLoad has a stable, fast, easy-to-use and safe admin panel.
• The control panel does not store your password in the config file, only in cache!
• AnnLoad algorithm does not contain anything that can mess with the encryption process (service mode, tls, etc…)

[Admin panel screenshots]












[Additional modules]

1) ThiefX. Version: 1.3. Password grabber. This module can grab passwords from 14 programs (more can be added upon request):
• Fxp (ftp)
• Total commander (ftp)
• Filezilla (ftp)
• Wsftp (ftp)
• Mozilla Firefox (включая 7-ю версию) (web, forms)
• Opera (включая последние версии) (web, forms, ftp)
• CuteFTP (ftp)
• Qip2005 (icq)
• Qip2010 (icq, eml)
• QipInfium (icq, eml)
• The bat (eml)
• RDP (rdp)
• Google Chrome (web)
• Safari (web)

2) Substitution. Version: 1.0. The module allows you to edit/substitute the hosts file on your bots.

3) We can create a module that will be modifying the Webmoney purse id in the clipboard. Contact us on ICQ if interested.

4) MKL Keylogger. Version: 1.1. Dependable keylogger, supports Cyrillic, can send logs to HTML/FTP.

[License agreement]

By accepting the license terms for this software, you acknowledge that you will use AnnLoad exclusively for testing your own systems. Any other use of this software is in violation of this agreement and of the laws of the Russian Federation. If you do not agree to one or more clauses of this agreement, do not use the software in any way or manner.
The DD team shall not be liable for any damage to you or third parties arising from the use of this software.
The product is delivered “as is”.
You may lose your license for violating the terms of this agreement or if such decision is made by the DD team.

[Payment]

•WebMoney (WMR/WMZ/WMU/WME).
•Liberty Reserve. (+ 5% of the price)
•Perfect Money.(+ 5% of the price)
•LiqPay. (+6% of the price)
•AlertPay (+6% of the price)
•YouMax (+ 7% of the price)
•Ukash (+5% of the price)
•We can work with an escrow. Escrow fees are paid by the client.
•We do not work with protection.

[Why you should buy from me]

• Fairness, friendliness, politeness.
• Honesty (I am ready to work through an escrow, but on your dime).
• I’m often online (daily, with rare exceptions).
• Personal WM passport (BL >120).
• I have been selling software for over 10 months.
• I will always try to answer all your questions, like ‘where to go for hosting’, ‘where to buy installs’, ‘who to order a script from’, etc.

[Referral program]

• Very straightforward: bring in a client, get anywhere from $45 to $100. The more clients you bring, the more $$$ you get!

[Price list]

• Minimal: Loader, no free updates - $330
• Standard: Loader, +1 month of free updates - $380
• Bronze: Loader, +3 months of free updates, plus 1 fee re-build - $480
• Silver: Loader, +6 months of free updates, plus 2 free re-builds - $530
• Gold: Loader, + free updates forever, + 5% discount on our other products, + 5 free re-builds, + module of your choice for free - $630.
• Platinum: Loader, + free updates, + 25% discount on our other products, + free re-builds, + 2 modules of your choice for free - $725.
• Diamond: Loader, + free unlimited updates, + free unlimited re-builds, + 30% discount on our other products, + all modules for free = $825.
• Updates - $35-$85 (depending on the importance of the update).
• Re-build (change of URL) - $35.
• Source code – contact us.
• New functionality – contact us.

[Modules]

• ThiefX. Password grabber - $50
• Subsitution. Hosts file substitution - $35
• MKL Keylogger - $55. This module can be purchased as a stand-alone product for $85.
• New modules request – contact us.

Saturday, 28 January 2012

Citadel Zeus bot

English Translation by @Sherb1n

- New clone of Zeus after ICE IX

Coder- Aquabox - Adv on Underground Forums

Citadel 1.1 - FF/IE/Chrome Grabber + Video Recording & Anti Tracker Protection

We’re offering a great solution for creating and updating your botnet.
We’re not trying to re-invent the wheel or come up with a revolutionary product. We have simply perfected the good old Zeus, making significant functionality improvements, adapting it to the survival conditions of today’s security landscape, and giving it a new name. Originally, we developed it for our own needs; during the development process, we also decided to create a “social circle” of support community, which is described later in this article.

Changes have been made both to the bot itself and to the web components.
We don’t sell “eye candy”. What you are paying for is the new functionality and coders’ motivation to support the product.

New features for the bot:

[+] Fixed VNC bug on Vista/Win7. Internet Explorer is now fully supported (there used to be a rendering problem in IE)

[+] Added support for Mozilla Firefox 7.0 (recent versions have had problems sending the reports; the problem is now fixed)

[+] Crypto-protection (the body is decrypted in memory)

[+] DNS-redirects (not through hosts). Any URL can now be blocked/redirected, undetectable by heuristics. For example, block AV servers or redirect bank pages to a different host.
!BONUS! The list of popular AV server URLs to clock is included.

[+] Software version is included in the report. The report will contain detailed information on the holder’s browser version. This can be used to imitate the holder’s settings.

[+] Extra layer of protection from trackers – Login Key.

[+] Authentication mechanism for config updates (no direct URLs). Adequate protection against established trackers.

[+] Grabber support for Google Chrome. (tested on latest versions 15.x/16.x)

[+] Inject support for Google Chrome. (tested on latest versions 15.x/16.x)

[+] Added function search caching, for faster hook setting in Chrome.

[+] Added feature: bot can run system CMD commands at startup (the CMDList section) and upload the report to server. For example, you can specify that upon installation your bot should upload the output of “ipconfig /all” or the list of all shared drives. This is a good feature to have when analyzing a company’s internal structure. (For example, you can often see bots with names like ACCOUNTANT_PC, POS_SERV, DATABASE…)

[+] Added mechanism to check the integrity of hooks in some Windows.

[+] Environment heuristic analyzer can use a stop-list to terminate undesirable software (significantly improves stealth), all popular AV products are included in the list.

[+] Small bugs have been fixed.

[+] Video grabber gives you a unique opportunity to see how your injects work “through the eyes of the holder”. Just specify the list of URLs and the recording time in seconds in the config file, and the bot will start recording video (in MKV format) as soon as the holder visits one of the URLs. Make sure your server can receive files of 10-60MB.

[+] Removed the “cookie clearing” feature, because it was messing up the machine’s fingerprint.

[+] Added support for HTTP 1.0 and extended headers (for example, the response doesn’t always look like “HTTP/1.1 200 OK”, sometimes it can be “HTTP/1.1 200 follow document”, where code 200 is followed by a couple of words), this is applicable to Firefox & Chrome

[+] Added gate generator (in case you want to place files on an intermediary host for redirect)

[+] All of Zeus’s basic functionality is included. I don’t think it needs to be listed here.

[+] Fully revamped, more user-friendly web-admin interface.


Figure 1. Builder, main screen



Figure 2. Web-panel, main screen



We’re not going to talk about the bot’s uptime, you’ll see it for yourself. Gratitude is accepted in the form of LR tokens.

This is the basic package. Price: $2,399.00

Important:

Our software does not work on Russian-language systems. If a Russian or Ukrainian layout is detected, the bot terminates.

This is done to prevent installs on CIS systems. You may disagree, but that’s taboo for us.

If you want to test the bot or develop your own injects – install an English-language system. We will provide URLs to download the OS image and VMWare to save you some time.

ADDITIONAL MODULES:

List of new features for web-admin panel (individual modules):

[+] Full-featured VNC control panel.
Now you can:
- Collect data on specific companies and accounts of interest into a separate DB and a separate script. It has a nice layout, you can see the list of online bots and details of the collected accounts.
- Create a VNC connection to any bot in 2 mouse clicks.
- View stats on active/dead accounts (or bots).
- Add/edit memos to the collected accounts.
- Receive automated Jabber alerts whenever a new account is added or a bot comes online. For convenience, the alert contains the IP:PORT for VNC connection.
- Sort the bots depending on their online/used/unused status.
- Specify a BotID, and have a VNC connection automatically created whenever the bot comes online.
Price: $495.00

Figure 3. VNC control panel



[+] High-quality SOCKS checker module.
You can specify several DBs of different botnets. The module uses web surfing to check the SOCKS, for a 99.9% accuracy.
Price: $49.00

[+] Executable files auto-encryption module.
Tired of manually encrypting your files or waiting for that encrypter to come back online? Automate the encryption task with this awesome auto-crypt module that will automatically refresh your botnets’ exe files. The script operates through Death’s jabber service called cbot. $15 per encryption.
We are not responsible for the encryption quality. Script is triggered through cron and can encrypt the file as many times as you need.
Price: $395.00

[+] Log parser module.
Many of you have had this problem: lots of bots generate tons of logs, and today’s DB search technologies take up way too much time. We have developed a script that can look across several DBs simultaneously and extract all http/https URLs and related data.
Additional features: caching and memos, for your convenience.
Price: $295.00

Modules can be purchased only if you also buy the basic package; they cannot be sold separately. When buying a module, you get the right to receive updates and support for this module.

CURRENTLY IN DEVELOPMENT:

[*] Advanced file search and upload. Search masks are specified in the config file. For example, “passwords*.txt”

[*] Ability to load the video-grabbing module from a remote host, to reduce the size of the build.


SERVICE & SUPPORT COMMUNITY (SOCIAL CIRCLE)

It’s hardly a secret that any product in this niche is a pile of junk on somebody’s hard drive unless it’s supported by a group of developers. As time goes on, a product must continue to satisfy the needs of the clients, but usually that’s where the problem occurs: there are lots of clients, but only one developer, and your IMs are often ignored. Time is money, that’s why we have created a social network-like platform for our clients.

Citadel CRM Store lets you influence the development of the product, namely:

- Report bugs and errors you discover in our software. All tickets are reviewed by tech support. You will receive a response in a timely manner and will not have to try to catch the developer in ICQ/Jabber.

- Every client has the right to create an unlimited number of requests and suggestions for new module/functionality. These requests can be public or private (visible to you only).

- Every client has the right to vote for ideas submitted by other members and to contribute money towards developing the module/functionality. Based on the voting results, the developers decide which module should be built.

- Every client has the right to comment on requests and talk to other members. Now you can find partners and like-minded people and take an active part in product development discussions.

- You can see all the stages of the development work if the new module is approved by the community. We provide timely updates on the status and completion date.

- If the module is approved, you can start making the initial deposits (50%). As soon as the deposits are made, developers start working on the project: the money is paid directly to the coders, and there will be no delays or procrastination. The process is transparent, every stage of the development work is displayed.

- Convenient notifications via Jabber about new comments or requests.

You will really appreciate this new approach!

When buying the basic package, you agree to make monthly maintenance payments of $125 (payments can be made for several months in advance). What’s included in this cost:

- We’re interested in working with our clients. There are lots of people who promise to “support the product, blah-blah”, but then either their updates come out once every 3 months, or the author just disappears. The problem is, authors need to be motivated. In our case – you support us, and we support you. As simple as that.

- Every month (around the 20th of the month) you get a builder update, including updated AV protection (bot body encryption, heuristic analysis prior to process injection).

- You get access to the CRM: a great opportunity to suggest new features and improvements, vote for others’ projects, and communicate with other members of the Citadel CRM Store.

- You get our support: we answer your questions (via ticketing system), provide installation assistance and usage recommendations. You are prohibited from transferring your personal CRM account to anyone else.

- In the near future, our CRM will start working with web programmers who will be focused exclusively on injects (including auto-transfers). The CRM allows our clients to create tasks, declare completion dates and prices, so that our coders can work on the approved projects. If you can write high-quality injects, let’s talk.

Figure 4. Citadel CRM Store



Demo access upon request (allow up to 24 hours).

Builder is tied to your PC; you can create unlimited number of domains.

We accept LR only. For WM-LR conversions, go to forums like mmgp.ru. We do not accept Webmoney.

To avoid wasting our time (and yours), don’t send us messages like “You there?”, etc. Just give us your request in this format: “Need to buy basic package, plus VNC, Auto-crypt, and SOCKS modules. What’s the total price with the discount?”

Citadel Zeus Bot Version 1.3


http://cyb3rsleuth.blogspot.co.uk/2012/03/citadel-13.html

Saturday, 21 January 2012

Game Hacker Shop






Online Game Account Project:

We only need large quantity online game account usa server and europe server.
First of all you need find some good game site, type key word “mmorpg” search on google,then try hack them and put trojan on site to collect player account information.

The account information we need :

For example :

Game Name : World Of Warcraft
Server : USA
Account Name : xxxxxxxxx
Account Password : xxxxxxxxx

PS: “World of Warcraft” Online account is hot now.We are buying World Of Warcraft Accounts always, unlimited quantity,If you have 10 000 accounts, we will buy 10 000 accounts.

usually we pay 100 accounts each time, and we will check if the accounts works, we will pay money in 1 hours.as more accounts you selling to us as higher price we will pay.

For each account,the price is not stable, it is around 1-2 usd for each accounts. if you got a good site, usualy you can get 1000 -10 000 accounts information.

Collect information and send to us, we will help you exchange account information to cash, as soon as possible.

In the future we will keep find some new projects which no law risk and high profit.and post them on my site.

We think if you have ability ,sure you will get rich !

Welcome be partner with us !

(All online game account we buying must be Europe Server and American Server,online Game Account from korea,china mainland ,taiwan is very cheap, only 0.3-0.5 usd around each one.
Japanese online account higher price, but not easy to sell. So USA and Europe Account will be the best.)

List of Game We buying:

USA server and Europe Server:

World of Warcraft
Star Wars: The Old Republic
RuneScape
Final Fantasy XI
RIFT: Planes of Telara
EverQuest
EverQuest 2
Eve Online
Dark Age of Camelot
Rappelz Online
Lineage 2
Aion
Dungeons & Dragons Online
Tibia
City of Heroes
Guild Wars

Other MMORPG game, if you have large quantity of accounts, please contact us, we will try to buy them all.

----------------

This project are no risk on law, Most of countries in the world they do not have a law to protect virtual wealth in game. and especially If we do this business in another country. for example, you are in russia or usa, but you take account information from Europe.There are no police will start a case for 100-1000 accounts.

So the law risk for online game account business currently is zero.

--------------------
We can help you convert online game account to cash in 1-3 days, depending on the quantity of accounts.

We are also expecting good hackers to join us for new projects.We will pay money directly to you by West Union, or WEBMONEY E-gold、Liberty Reserve.

If you are good hacker,We will be glad to work with you for longtime partnership.and we will pay higher price for longtime partners.

Fast , Safe, that is always our target for online business.

Email onlineAbusiness@gmail.com
ICQ 607157280
Gtalk onlineabusiness

Wednesday, 21 December 2011

Malware Guard

English Translation by @Sherb1n

Malware Guard - Cyber Criminals now track their enemies

Malware Guard is a netfilter/iptables module for class-based filtering of incoming/outgoing packets.

 Purpose of the product - building a database of IP addresses belonging to leading anti-cybercrime organizations. Low update prices make Malware Guard an affordable system for protecting your admin servers, kits, and domains.

Specifications for version 0.1.7

- 7,881,166 IPv4 addresses. That's 0.18% of the entire IPv4 space.
- Database compression through subnet grouping.
- Extremely fast packet checks thanks to Linux kernel patch.

Data collection methods:

- RIPE scans.
- Fake collectors for SpyEYE, IRC networks, etc.
- Info on fresh FBI honeypots from an Insider.
...other more effective methods that we will not name here.

- All buyers will be verified through PM here on the forum, people with shady reputation will be turned down.
- Reselling is forbidden.
- We do not guarantee that your domain will not be black-listed. It's very easy to get burned (content analyzers in your browsers, abuse complaints, etc.)
- We do not answer questions that are not related to Malware Guard

By purchasing a license, you agree to abide by these terms.

Price list

1 server license: $250 (while in beta)
DB update: $10

----------------------------------------------------------------------------------

Original

Malware Guard — модуль для netfilter/iptables, позволяющий фильтровать входящие/исходящие пакеты по их классификации.
Цель продукта — регулярный сбор базы данных IP адресов, организации ведущих активную борьбу с кибер-преступностью.
Демократичные цены на обновление баз данных, делают «Malware Guard» доступной системой защиты Ваших админок, связок, доменов.

Технические характеристики версии 0.1.7

7 881 166 адресов IPv4. 0.18% от общего числа.
Компрессия базы данных за счет группировки в диапазоны(subnet)
Максимально быстрая проверка пакетов, за счет патча ядра Linux'a.


Методы сбора данных

Сканирование RIPE.
Фейковые коллекторы SpyEYE, IRC-сети, etc
Получение самых актуальных ФБР honeypot'ов от Инсайдера.
... более эффективные методы, которые останутся за кадром
— Все баеры верифицируются через ПМ на форуме, людям с смутной репутацией будет отказано в продаже.
— Перепродажа запрещена.
— Сервис НЕ гарантирует чистоту Ваших доменов. Спалится можно на чем угодно(анализаторы контента в Ваших же браузерах, абузы, etc)
— Сервис не отвечает на вопросы, не связанные с Malware Guard.

Покупая лицензию, Вы соглашаетесь с данными правилами.


Прайс-лист

Лицензия на 1 сервер: $250(в рамках beta-тестирования)
Обновление базы данных: $10

Saturday, 24 September 2011

Web Spam System






English translation by @Sherb1n

Frequently Asked Questions

What is this software and how does it work?
Before you begin
Creating mailing tasks
Randomization
FAQ
Suppliers

What is this software and how does it work?

What is web-spam (web-mailing, webmail)?

In a nutshell, it’s automated spamming via webmail interface (yahoo, gmail, mail.com, etc), using real email accounts registered with these email providers.

This software:

- uses a given set of SOCKS proxies to log into real email accounts (you have to supply those),
- performs the necessary tasks (sends emails),
- resolves CAPTCHAs if needed (using an anti-captcha service) and
- terminates the session

In other words, it fully imitates actions of a real user.

The software supports multiple concurrent sessions for faster spamming; SOCKS proxies allow every session to have a unique IP!

This web-spam system can have the highest inbox ratio (emails that arrive directly into the Inbox folder), depending on your approach to creating and managing the spam tasks. With a proper approach and if you really want it, you can achieve a 100% inbox ratio!


Before you begin

Here’s what you need:

1) SOCKS list (50+ fresh SOCKS every 10-30 minutes) at least (!); the more the better…
2) Hotmail.com or yahoo.com email accounts (always available on shopaccs.com)
3) Anti-CAPTCHA account (antigate.com), I can provide an invite if you’re not registered there yet.

So, now that you’ve got that:

Load the interface, enter login/password, and open the main page.

Take a look at the menu bar on the right.

1) In the “CAPTCHA balance” section: go to ‘change key’, and enter the key from your antigate.com account (located at TOOLS – ACCOUNT SETTINGS – “Your CAPTCHA key”).

2) In the “SOCKS-list” section: enter your SOCKS-list URL into the “Load SOCKS proxies from URL:” box and click “Send”. If you don’t have a SOCKS-list and want to use disposable SOCKS, you can load them from a file (using the “Load SOCKS proxies from file” option).

Now you’re all set, proceed to spam tasks.


Creating mailing tasks

Let’s proceed to the main part of the system.

1) “My mailing tasks” menu. This is the main module for creating/managing your email tasks.

At the time when this help is written, the popup menu in the “My mailing tasks” section has 2 modules: for Hotmail.com and yahoo.com. The setup is the same on ALL modules. Contact me on ICQ to find out which one is better for
spamming.

Click on either module to proceed. The main page has 2 menus (1. “List”, 2. “New Task”). The “List” menu shows all your mailing tasks (Created, Running, Paused, etc); it’s currently empty. Click “New Task” to get a form with a bunch of fields to fill out. Here’s what they are for:

a. Load a list of Hotmail accounts from a file. These are the accounts to send emails FROM. Make sure that the list is in the account:password format, one account per line!

There’s also a “Replace the accounts with the new list” option in this section. Use it when loading a new list of accounts, because otherwise the new accounts will just be appended to the list of old accounts.

b. Load the database of target addresses from a file. These are the accounts to send emails TO. Please note that the “Replace the accounts with the new list” option in this section works in the same way as above.

“Database format”: this describes the format of your email list. If it’s a standard format (one email address per line), keep the first option; if your list fits the second pattern (“name” for example “Alexey Nikolaev”), pick the second option. If you are using a non-standard database, write your own format.

“Email” is a required field name to let the system know where emails are located. If you have questions in the area of non-standard list formatting, feel free to ask me, I’ll help you out.

One more thing: loading DBs with over 1 million emails is NOT RECOMMENDED. Ideally, you should split your large DB into lists of UNDER 1 million addresses and spam each of them separately.

c. Email subject list. These are what goes into the Subject field of your emails. One subject per line. Subjects are randomly selected, each new message goes out with a new Subject, until all the subjects in the list are used up, and then the list is recycled. Synonymization is supported as well.

d. Email text. This is where the body of your message goes. Texts should be RANDOMIZED, I’m going to describe the process in detail below. Synonymization is supported here as well.

e. The number of messages to send per account per session. This field sets the number of emails that will be sent from a single email account (loaded in section a) above). The optimal setting here will be different for everyone, because the more emails per account you’re sending, the more CAPTCHAs you’re going to get (which affects the speed of email processing and your anti-CAPTCHA balance). My optimal setting here is 15. You can experiment with it and see which number works better for you.

f. Senders’ names. This is the name (not email address) that will be displayed on the incoming message! For example, “James Bond”. Try to put more names here (at least 15-20). Format: one name per line.

g. Email address used in the Reply-To header. This is where you specify the email address(es) that will be used for replies. When the recipient clicks “REPLY”, the message will be sent to these addresses!
When using this field, you DON’T HAVE TO specify the same return email address in the body of the message, but it’s a personal preference, you can if you want to.

h. Email content type. “Text” if you’re sending plain-text message, and “HTML” if you’re sending an HTML email. When “HTML” is used, make sure that the message body (section d)) uses HTML source code.

i. Attachment name, without the extension. This is the file you are attaching to the email. If you don’t use attachments (don’t attach files to your messages), leave this field as it is (blank). If you do use attachments, specify the file name you want to create (sysnonymization is supported). You can attach up to 3 files in the fields below. If you leave the “Attachment name” field blank, the attachment will preserve it original name (for example, Foto.jpg).

Fill out all the fields, double-check, click “Save” and wait for the data to load into the system. When the data is successfully loaded, you will see a preview window that will show what your email will look like to the recipient.

If you chose to use randomization/synonymization, the preview window will display a random email version.

If you find a mistake or decide to change something else, you can go back to the Edit mode by clicking “MODIFY”. Please note that when in Edit mode, you don’t need to RELOAD the lists of email addresses, sender accounts, etc., all that is already saved. Just correct/add/modify whatever you need and press “SAVE”.

The setup is complete. You can view the status of your email task in the “My email tasks” menu. To launch the task press “Start”.

Upon initialization, you will see a notice that the task is started. Spamming will begin within a couple of minutes. You can always see the statistics of how many emails have been sent simply by selecting “My email tasks”. By refreshing this section you will be able to see the current stats of how many emails have been sent (in the PROGRESS section). The first value is the number of emails sent, the second one is the total number of emails in your Spam Database.


Randomization

Randomization is used to make every text unique. The more randomized the text is, the greater the number of unique emails you send. Why randomize? The answer is simple – to avoid triggering text filters, it’s a very important aspect of middle and large email campaigns. Remember, the inbox rate often depends on how well you have randomized your emails.This software uses the following randomization types at this time:
1) Synonymization (using synonyms)
Format: (Hi|Hello|Good day).
What does that mean? When a new email is sent, only one of the 3 above-mentioned words will be used. Here’s an example of a short message using synonymization:

(Hi|Hello|Good day) Alex.
How are you?
(Bye|Good Bye|Good luck).

So, the system will continue to send out unique emails until it uses up all of the synonyms, and then it starts over again. Here’s an example of a random email using the above setup:

Hello Alex.
How are you?
Good luck.

The next email will be different, using other words from the list…

You can randomize entire sentences and expressions!
Synonymization also supports unlimited nested expressions! For example:
(Hi (Masha|Dasha|Katya)|Hello(Marina|Vika|Valentina)).

DON’T forget to close parentheses! Check your format, or it won’t work!

==================================================
2) Random line order.

Format:
{{{
Line 1
Line 2
Line 3
}}}

Every new message using this type of randomization will use lines in random order, which will result in a different text structure. Can be used together with synonymization.

==================================================
3) Email databases can have different formats, and it’s possible that you have a name-email database (meaning that for each email you also have the email owner’s first and last name), and want to use this information in your messages.

Format:
{email} = recipient’s email.
{name} = recipient’s name.

Example:

Hello {name}.
You email is {email}.

What you get as a result (for example):

Hello, Alexey Popov,
You e-mail is alex@mail.ru

Important:
To make it work properly, make sure to set up your spam database correctly!

===================================================
4) Whenever you just need unique alphanumeric strings you can use the following variables:

{id} – this is timestamp (number of milliseconds since 1900)
{hash} = md5({id}) – this is hash of the timestamp

===================================================

Using the above-mentioned randomization types, either together or separately (whatever works for you), you can achieve a high inbox rate!


FAQ

Q: Anti-CAPTCHA (antigate.com) needs an invite for registration, where do I get that?
A: Contact me on ICQ, I’ll get you an invite.

Q: How many CAPTCHAs does spamming process consume?
A: The amount of CAPTCHAs spent depends on many factors: the number of SOCKS you use, the number of messages sent per account per session, the mail server configuration (this one can change a lot, for example Hotmail.com). Having to solve lots of CAPTCHAs slows down the mailing process, so don’t set the number of emails sent per account per session to something very large; optimal number is 15 (give or take some, see for yourself), find your own number through trial and error.

Q: Why do some emails get delivered to Spam folder and sometimes don’t get delivered at all, especially on large domains like Yahoo.com?
A: This often depends on you. To minimize the number of mishaps like this use high-quality materials (good SOCKS proxies, fresh outgoing accounts) and better randomize your texts. Don’t keep reusing the same text for a long time!

Q: Why does the Yahoo.com module sometimes hangs up while spamming?
A: The issue is with the SOCKS. Most probably you’re using proxies from anonimsurfer.ru, and Yahoo.com module doesn’t work well with those.

Q: What kind of accounts are better for spamming: auto-registered or accounts from logs?
A: Accounts from logs are ideal: they are better quality, allow you to send more emails per account, not as many CAPTCHAs. Auto-registered accounts are fine, too, but have lower sending limits, which increases your costs!

Where can you buy the materials?
This section provides contact information for a variety of suppliers who are successful in their field and have been tested by the users of our system!

Accounts for sale:

Accounts from logs – you can always buy them from me, from $30 per 1K of valid accounts. I almost always have them available. I DON’T SELL AUTO-REGGED accounts!

ICQ: 246621644 (evro) – the guy has been pretty successful at selling AUTO-REGGED accounts from a variety of email providers for a long time! Advantages: nice pricing, and the first account CAPTCHA is already solved!

http://shopaccs.com – Excellent automated webstore of auto-regged accounts (registered using software) from a variety of email providers, good prices!

http://buyaccs.com – Automated webstore of auto-regged accounts (registered using software) from a variety of email providers, average prices.

http://accshop.seounion.co.uk – Automated webstore of auto-regged accounts (registered using software) from a variety of email providers, prices are a bit inflated.


SOCKS for sale:

There are both low-budget and high-quality solutions in this category. The difference is in price and quality. Of course, you can use low-budget options with moderate results (many people do just this), but the speed and quality suffers, and even CAPTCHA consumption may increase.

Low-budget solutions:

http://anonimsurfer.ru – it’s better to buy their service for a whole week, otherwise you don’t get the option to export proxies to URL (you need the URL when setting up the system). The quality is so-so, but it works! Yahoo.com module doesn’t work well with these SOCKS, Hotmail.com is satisfactory.

http://awmproxy.com/?adv=104793 – An OK combination of speed and quality. Average prices. BUT for the same money (and even cheaper) it’s better to use soks.biz (read more below). This option can be used when soks.biz is temporarily out of service, etc.

Higher-quality solutions:

http://soks.biz/?users/register&referer=jim – Excellent SOCKS for your money! The best option at the moment! All modules work great! The prices are very decent! General mix 500 is the optimal package for any spam task!
Please use the URL above to register!

http://socks.to – An adequate service with a variety of subscription plans and excellent back-connect SOCKS proxies. A minimal package of 50-100 SOCKS proxies will be good enough for work, but if you rent a dedicated server then it’s better to get more.

ICQ: 448845 – A pretty good seller of average SOCKS proxies. 1000 proxies with 10 minute refresh: $100/week. Double-check with him via ICQ.

Redirects for sale:

Redirects are required if you spam out a URL in your emails, they allow you to avoid URL-based bans. You can buy redirects from people on forums or from stores. Unfortunately, we cannot recommend anyone in this category at this time. Look for contacts on forums or ask your friends.

Email databases for sale:

Unfortunately, we cannot recommend anyone in this category at this time: there aren’t any. Look for these databases on forums, ask your friends, etc.

----------------------------------------------------------------------------------
Original Version

Что это за софт и как он работает?
Подготовка к работе
Создание рассылок
Рандомизация
Вопрос - Ответ
Где покупать материалы

Что это за софт и как он работает?
Что такое вебспам (вебмайлинг, вебмыл)?
Вкратце, это автоматизированные рассылки посредством веб-интерфейса почтовых служб (яху, гмаил, маил и пр.), использующие реальные зарегистрированные аккаунты используемой почтовой службы.

Суть работы софта заключается в том, что он используя заданные соксы логинится под реально существующими аккаунтами (которые вы загрузили) в почтовую службу, выполняет необходимые действия (отправляет письма), при необходимости вводит капчу (используя сервис антикапчи) и завершает сеанс, т.е. полностью имитирует действия реального пользователя.

Высокая скорость рассылок достигается за счет многопоточной работы софта, а уникальность каждого сеанса по IP обеспечивается за счет использования соксов!

Данная система веб-спама предназначена для e-mail рассылок с максимальным инбоксом (письма попадающие в папку входящие), процент которого будет зависеть от Вашего подхода к созданию и управлению рассылками! При надлежащем подходе и желании Вы сможете добиться до 100% инбокса!

Подготовка к работе
Для работы с системой от Вас требуется:

1) Сокс лист (от 50 обновляемых соксов каждые 10-30 минут) это минимум (!) лучше больше..
2) Аккаунты Hotmail.com или Yahoo.com (купить можно всегда на shopaccs.com)
3) Аккаунт на антикапче (antigate.com), инвайт для регистрации я выдам, если Вы там не зарегистрированы.

Итак, Вы все подготовили, приобрели.
Заходим в интерфейс, авторизуемся (вводим имя/пароль) попадаем на главную страницу. Видим с правой стороны колонку с меню.

1) Раздел "Баланс капчи", в нем выбираем сменить ключ, после чего вписываем ключ с Вашего акка
антикапчи antigate.com (находится он там в меню ИНСТРУМЕНТЫ - НАСТРОЙКИ АККАУНТА - графа "ваш captcha ключ").

2) Меню "Сокс-лист". Видим поле "Загрузить список socks-прокси по URL: " прописываем туда ссылку на Ваш
сокс лист, затем нажимаем "отправить". Если у Вас нет сокс листа, а только разовые соксы, то загружаете
их из файла (графа "Загрузить список socks-прокси из файла).

Подготовка завершена, теперь Вы готовы к рассылкам.

Создание рассылок
Итак, теперь переходим к основной части системы.

1) Меню "Мои рассылки". Это основный модуль для создрания/управления Вашими e-mail рассылками.
Заходим в меню "Мои рассылки", во всплывающем меню появляется на выбор (на момент написания этого хэлпа)
2 модуля рассылок Hotmail.com и Yahoo.com. В плане подготвки управления рассылками ВСЕ модули
работают одинаково. Когда каким лучше спамить Вы можете спросить у меня в аське. Выбираем любой модуль
нажав на него. На основной странице видим 2 меню (1. Список 2.Новая рассылка). Меню список показывает Ваши
рассылки (созданные,запущенные, рассылки на паузе и т.д.) у нас он пока пустой. Выбираем "Новая рассылка",
после чего попадаем в форму со множеством полей для заполнения, сейчас расскажу суть каждого из них.

а) Загрузить список аккаунтов Hotmail.com из файла. Это файл с Вашими аккаунтами ДЛЯ рассылки. Обратите внимание,
что формат акков должен быть акк:пароль, один акк на одной строке!
Также в этом разделе есть опция "Заменить аккаунты новым списком" она нужна при загрузке новых акков, т.к. старые аккаунты
которые Вы уже добавляли в базу сами не удаляются, каждая новая загрузка акков (если тут не стоит галочка) добавляет Ваши
Новые аккаута к тем, что уже были добавлены Вами ранее.

б) Загрузить базу рассылки (адресатов) из файла. Это Ваша e-mail база ПО КОТОРОЙ Вы будете спамить.
Обратите внимание, что опция "Заменить базу новым списком" работает также как Вышеописанная опция по аккам.
Формат базы: - это формат Вашей e-mail базы. Если она стандартная (одно мыло на каждой строке) то оставляйте первый вариант,
если формат базы соотвествует маске второго варианта "name" например "Alexey Nikolaev" то выбирайте
второй вариант. Если у Вас нестандартная база Вы можете сами написать для нее маску. Обязательное поле маски "email"
чтобы система понимала, что это мыло. Если будут вопросы по нестандартным форматам базы и нужна будет помощь или консультация
по составлению маски можете спросить у меня, я подскажу. Еще момент, загружать базы более 1 миллиона адресов одним файлом НЕ РЕКОМЕНДУЕТСЯ,
в идеале разбейте базу (если она у вас большая) на несколько количеством ДО 1 миллиона каждая и спамьте поочередно.

в) Список тем письма. Это темы (сабжи/заголовки) Вашего письма. Одна тема на одной строке. Работает рандомно, каждое новое письмо
с новой темой (и так по кругу, т.е. когда заканчиваются неуспользованные темы софт снова начинает перебирать их с первой. (поддерживается
синонимизация).

г) Текст письма. Здесь собственно пишется текст Вашего письма. Тексты надо РАНДОМИЗИРОВАТЬ, чуть ниже будет описан этот процесс
подробно. (поддерживается синонимизация)

д) Количество писем, отправляемых с одного аккаунта за сессию. Это поле устанаваливает значение сколько писем отправлять с одного
почтового аккаунта (которые Вы загрузили, смотри пункт а). Оптимальное значение для всех разное, т.к. если отправляем больше писем
с одного акка, получаем больше капчи (что влияет на скорость рассылки и баланс антикапчи). Оптимальное значение 15, Вы можете
экспериментировать с этими значениями и выбирать, какие Вам больше подходят.

е) Имена отправителей. Имя отправителя (не email) от которого будет приходить письмо адресату! Например James Bond. Имен ставьте по
возможности больше (от 15-20). Формат - одно имя на одной строке.

ж) Адрес для заголовка Reply-To в письме. Здесь Вы указываете Ваше мыло или мыла, на которые Вам будут отвечать, когда получатель
получит Ваше письмо и нажмет ОТВЕТИТЬ именно это мыло будет указано в получателе! Используя это поле НЕ оБЯЗАТЕЛЬНО дублировать
Ваше мыло в тексте письма, но можно, кому как нравится.

з) Тип содержимого письма. Текст - если Вы шлете обычный текст, HTML - если Вы шлете ХТМЛ письмо. При выборе HTML варианта текст
письма (раздел г) должен быть в исходном коде HTML.

и) Имя присоединенного файла без расщирения. Это аттач (прикрепленный к письму файл). Если не используете атач (не прикрепляете
файлы к письму) остальте как есть (пустым). Если используете, то напишите в этом поле имя файла, которое хотите сделать (поддерживается
синонимизация). Прикрепить можно от 1го до 3х файлов, в графах которые ниже. Нажимаете обзор и выбираете файл который надо прикрепить.
Если Вы не заполнили поле "Имя присоединенного файла" то файл останется с тем названием (например Foto.jpg) какое у Вас указано сейчас.

Все заполнили, проверили, нажимаем Сохранить данные и ждем, пока все данные загрузятся в систему. После успешной загрузки Вы увидете окно
предварительного просмотра, в котором Вы увидите как Ваше письмо увидит получатель. (если Вы использовали рандомизацию/синонимизацию), то
прежварительный просмотр покажет случайный вариант письма. Если Вы нашли ошибку, или что-то забыли Вы можете вернуться в режим редактирования,
выбрав в меню "ИЗМЕНИТЬ". Обратите внимание, что при редактировании загружать СНОВА базы адресов, акков и прочее не надо, все уже сохранено,
просто поправьте/добавьте/измените те данные которые Вы указали неправильно, затем нажмите СОХРАНИТЬ.

Подготовка завершена, Вы можете увидеть статус своей рассылки в меню "Мои рассылки". Чтобы запустить рассылку нажмите "Start".
После инициализации Вы увидете нажпись, что рассылка запущена.. В течении нескольких минут начнется процесс спама. Увидеть статистику,
сколько отправлено Вы можете в любое время просто Выбрав "Мои рассылки". Каждый раз обновляя этот пункт вы видите текущую статистику по
количеству отправленным e-mail (графа ПРОГРЕСС), первое значение - это количество отправленных мыл, второе - общее количество мыл в Вашей Спам базе.

Рандомизация
Рандомизация. Суть рандомизации это получение уникальности каждого текста, чем больше рандомизирован текст, тем больше уникальных писем
будет отправлено. Зачем рандомизировать? Ответ прост - чтобы не срабатывал фильтр по тексту, эта мера очень актуальна на средних и больших рассылках.Рандомизация. Суть рандомизации это получение уникальности каждого текста, чем больше рандомизирован текст, тем больше уникальных писем
будет отправлено. Зачем рандомизировать? Ответ прост - чтобы не срабатывал фильтр по тексту, эта мера очень актуальна на средних и больших рассылках. Помните, что процент инбокса зачастую зависит от того насколько хорошо Вы зарандомизировали свою рассылку.

Данный софт в настояший момент использует следующие виду рандомизации.

1) синонимизация (использование синонимов).
Формат: (Hi|Hello|Good day).
Что это значит? При отправке каждого нового письма будет использовано только одно слово из трех представленных выше. Приведем пример короткого письма с использованием синонимизации:

(Hi|Hello|Good day) Alex.
How are you?
(Bye|Good Bye|Good luck).

Т.е. каждое новое письмо которое будет отправлять наша система будет разным, пока не закончаться значения, затем снова пойдет перебор новых слов по кругу. Пример случайного письма описанного выше:

Hello Alex.
How are you?
Good luck.

Следующее письмо уже будет другим с другими значениями..

Можно раномизировать целые предложения и выражения!
Также в синонимизации поддерживается неограниченная вложенность! Например:
(Hi (Masha|Dasha|Katya)|Hello(Marina|Vika|Valentina)).

НЕ забывайте закрывать скобки при окончании рандома! Проверяйте формат! Иначе работать не будет!

========================================================

2) Вывод строк в случайном порядке.

Формат:

{{{
Строка 1
Строка 2
Строка 3
}}}

Каждое новое письмо с использованием этого вида рандома будет выводить строки в случайном порядке, что меняет структуру текста. Можно использовать в совокупности с синонимизацией.

=========================================================

3) Как известно e-mail базы бывают разных форматов и допустим у Вас именные базы (т.е. кроме мыла в базе имя/фамилия владельца мыла), и вы хотите использовать эти данные в своем письме.

Формат следующий:
{email} = Емэйл получателя.
{name} = Имя получателя.

Пример использования:

Hello {name}.
You email is {email}.

Результат работы (пример):

Hello Alexey Popov,
You e-mail is alex@mail.ru

Важно!
Для корректной работы при добавлении базы необходимо правильно указывать маску вашей спам-базы!

=========================================================

Когда Вам нужны просто уникальные строки из цифр либо цифр и символов Вы можете использовать следующие переменные:

{id} - это таймстемт (кол-во миллисекунд с 1900 года)

{hash} = md5({id}) - это хэш таймстента.

==========================================================

Используя описанные выше варианты рандомизации вместе или по отдельности (как Вам удобно), Вы добьетесь высокого инбокса!

Вопрос - Ответ
Часто задаваемые вопросы.

Вопрос: При регистрации на антикапче (antigate.com) просит инвайт, откуда его взять?
Ответ: У меня, стукните в аську я выдам инвайт для регистрации.

Вопрос: Какой расход капчи на рассылках?
Ответ: Количество капчи - это динамическая величина, зависит от многих факторов, от качества соксов, от количества мыл отправляемых с одного аккаунта за сессию, от конфигурации со стороны почтового сервера, которая частенько меняется (например, hotmail.com). Большое количество капчи замедляет рассылку, не ставьте большие значения в количестве мыл отправляемых с одного аккаунта за сессию, оптимальное значение 15(+/- по вашему усмотрению), опывтным путем Вы найдете приемлимые для себя значения.

Вопрос: Почему некоторые письма на больших доменам (например yahoo.com) иногда попадают в папку спам и бывает даже не приходят?
Ответ: Зачастую это зависит от Вас. Чтобы сократить до минимума эти нюансы используйте качественные материалы (хорошие соксы, свежие аккаунты для рассылки) и хорошо рандомизируйте Ваши тексты. Не шлите долго один и тот же текст, который спамили раньше!

Вопрос: Почему модуль Yahoo.com иногда сам останавливается в процессе рассылки?
Ответ: Разгадка кроется в соксах, скорее всего вы используете соксы от anonimsurfer.ru, с ними модуль рассылки yahoo работает нестабильно.

Вопрос: Какие акки лучше использовать для рассылки, авторег или с логов (фэйков)?
Ответ: Идеальный вариант в плане качества, количества отправляемых мыл с аккаунта, капчи - это использование аккаунтов с логов! Авторег аккаунты тоже вполне пригодны к использованию, но имеют меньшие лимиты отправки, соответственно повышая расход!

Где покупать материалы
Здесь описаны контакты продавцов которые успешно работают в своей сфере и были опробованы пользователями нашей системы!

Продажа аккаунтов:

Логовые аккаунты - всегда можно купить у меня, от 30$ за 1к валида. В наличии имеются практически всегда. АВТОРЕГ аккаунты я НЕ ПРОДАЮ!

ICQ: 246621644 (evro) - Человек успешно продает АВТОРЕГ аккаунты различных почтовых систем довольно долгое время! Плюсы - приятные цены, распознанная первая капча в акках!

http://shopaccs.com - Отличный автоматизированный магазин с авторег (регистрированными софтом) аккаунтами различных почтовых систем с нормальными ценами!

http://buyaccs.com - автоматизированный магазин с авторег (регистрированными софтом) аккаунтами различных почтовых систем и др., цены на акки средние.

http://accshop.seounion.co.uk - автоматизированный магазин с авторег (регистрированными софтом) аккаунтами различных почтовых систем, цены на акки довольно завышены..

Продажа соксов:

По соксам есть как бюджетные так и более качественные варианты.. Разница в цене и качестве, конечно можно использовать бюджетные варианты и слать со средним качеством (многие работают именно так), но будет страдать скорость и качество рассылок, возможно увеличение количества капчи.

Бюджетные варианты:

http://anonimsurfer.ru - нужно брать со сроком на неделю, иначе недоступен экспорт соксов по URL, это нужно чтобы вписать ссылку в этот софт). Качество удовлетворительное, но работать можно! Yahoo.com модуль с этими соксами не работает, Hotmail.com шлет посредственно.

http://awmproxy.com/?adv=104793 - Нормальный по качеству и скорости вариант. Средний ценник. НО за эти деньги (даже дешевле) на данный момент лучше использовать soks.biz (читай ниже), этот вариант подойдет если soks.biz временно не работает и т.д.

Более качественные варианты:

http://soks.biz/?users/register&referer=jim - Отличные соксы за свои деньги! Самый лучший на данный момент вариант! Все модули работают отлично! Ценник очень гуманный! Общие миксы 500 штук - самый оптимальный вариант для любых рассылок!
P.S. Пожалуйста регистрируйтесь по указанной выше ссылке!

http://socks.to - Адекватный сервис с различными тарифными планами и отличными бэкконект соксами. Для работы вполне подходит минимальный вариант с 50-100 соксами, но если вы арендуете выделенный сервер то желательно большее количество.

ICQ: 448845 - Неплохой продавец с соксами среднего качества, 1000 соксов с обновлением 10 минут 100$/неделя. Уточняйте у него в аське.

Продажа редиректов:

Редиректы нужны в основном если вы шлете ссылку в письме. Чтобы не было банов по урл используйте редиректы, купить их можно у людей на форумах или в шопах.
Рекомендаций в данной области продавцов к сожалению пока выдать не можем, ищите контакты на форумах или спрашивайте у знакомых.

Продажа e-mail баз:

К сожалению рекомендаций в данной области селлеров мы Вам выдать не можем, т.к. их нет, ищите базы по форумам, знакомым и пр.