📖Terminology: 📖
● Spamming
The act of performing phishing attempts towards individuals, called spamming
● Scam page
A scam page is the exact replica of the site you are going to impersonate. Usually
lands on a login page to extract information
● SIM
Has a unique phone number that enables you to send & receive messages.
Everyone should know what a SIM is.
● cPanel
cPanel is a web-based control panel that allows a user to manage their website
through a beautiful web interface.
● Web shell
A Web Shell is a script most often developed in PHP, ASP and which allows a hacker
to execute commands remotely on the attacked server. Examples of famous scripts
are C99 or R57 shells.
● “Letter”
A letter in spam context is the message content that we will use. Usually referred to
as content. Spammers try to mask the fake letter as close to the original company
they are impersonating.
● Sender ID (SID)
This means the sender of the message that the victim will see. If you use SID
PayPal, the user will see the message as it would’ve come from PayPal.
● Spoofing
Changing the original sender to something else. The SIM card has the number
123321 but when people receive it, they see your own SID that you choose freely.
● Red page
The term Red page is the “harmful and/or deceptive” page shown on Google
Chrome. Here is a screenshot INSERT
● Email Spamming
Using email as means to phish information from victims. A common way but gets
harder everyday.
● SMS Spamming
Using SMS as means to phish information from victims. Untapped method in some
countries, starting to get harder.
● Antibots
Antibots are automated bots which will analyze websites found on Google, Yahoo,
Bing. They do this to optimize search ranking and also look for phishing pages.
● SF
Some refer this as minimum deposit on a gateway
● Gateway
A website that lets you send SMS without owning your own SIM card. A solid way of
doing SMS spamming if you find a reliable and stable gateway. (smsroute.to)
● Link/URL shortener
A way of making a link shorter and masking the original URL to a shorter link that
redirects to your page.
● Logs
Bank login information that was most likely gained by spamming. Gives you access
to the bank account. (The end goal with spamming)
● Residential (IP)
This means that the IP is originating from a home IP address. This is a way to identify
real traffic versus bot traffic.
● Bulletproof
This means a hosting provider doesn’t respond to DMCA, respects privacy & allows a
a lot of stuff.
● Leads
This is what we refer to as our victims. It’s a long list of phone numbers to whom are
customers in a specific organization/company.
● VPN
Virtual Private Network, will mask your IP address to somewhere else making it hard
for you to be tracked.
● Keyword filter
A keyword that is marked fraudulent by carriers. For example, “account security alert”
might be picked up by SMS carriers as fraudulent.
● Sandbox
This is a computer program to test and try applications on a PC. Open Sanbox
program (now open source) and start the application. That ensures your system is
safe.
● SIP
Voice Over IP (not VoIP) that is based on a client-owner analog telephone adapter or
in our case, a SIP phone. A client-owned Caller ID spoofing
● OTP
One-time Password systems provide a mechanism for logging on to a network or
service using a unique password that can only be used once
● IVR
Interactive Voice Response is an automated phone system technology that allows
incoming caller to access information via a voice response system of pre recorded
messages without having to speak to a person.
● BOA
Bank of America, a big bank in the US.
● HLR
Home Location Register is a database that contains data regarding authorized
subscribers using a global system for mobile communication (GSM) core network. It
basically checks if the number is “alive”
● Bulletproof hosting
This type of hosting doesn’t scan your files for harmful content. They believe in free
speech & the hosting of more skeptical files. The hosting itself will not ban you for
your content.

Email or SMS Spamming?
This is a good question. For businesses, email has been a tried-and-true method to reach
audiences and send mass messages. However, as the use of mobile phones increases,
SMS messaging is quickly becoming a great new way to connect with customers.
Businesses today use SMS to communicate with their customers directly on their mobile
devices about new promotions, exclusive discounts, appointment reminders, and
time-sensitive updates.
According to Twilio, 9 out of 10 text messages are opened within the first three minutes of
being received, making it a great opportunity for brands to capture attention.
Since Businesses are expanding to SMS instead of old-fashioned Email, it might be easier to
trick a victim? One thing is for sure, both ways have their advantages. Penetrating Gmail's
anti-phishing system is extremely hard and will mark your mail content as fraudulent fast. If
you target self-hosted mails, you might penetrate their anti-spam filter but that still leaves
room for grammatical errors, issues with loading and a fishy email sender.
An SMS on the other hand is short, can be spoofed, used by companies (that has poor
security standards) & is overall faster (referring to Twilios study). That is why I believe SMS
spamming is more effective and people have their guard down on SMS, especially if it has a
spoofed SID matching the company. People have been learned since day one of emails to
check grammatical errors, the sender and content of the message. SMS is newer and is
seen by the general as safer.

Operational security (OPSEC)
This niche is purely a game of cat and mouse. The lawmakers and organizations enforcing
the law are always trying to catch up to people breaking it.
Even though SMS spamming is fairly new, they are working hard both day and night to set a
stop for it. We see more filters taking place in carrier networks, spoofing is harder, corner
store SIMs not lasting long, limits on SMS per day and information being spread about these
phishing attempts.
That is why your OPSEC is of utmost importance when operating in this niche. You should
always be browsing using a VPN, preferably the router using a VPN. I highly recommend
Mullvad VPN or IVPN.
Don’t share information with others, use encrypted message systems, don’t brag to friends
and remove all META-information when sharing pictures. That also includes screenshots.
This book is not about OPSEC so I will leave as is. Please ensure you are safe!

Why does a phishing page go red?
According to Google, there are several types :
The site ahead contains malware: The site you start to visit might try to install bad software,
called malware, on your computer.
Deceptive site ahead: The site you try to visit might be a phishing site.
Suspicious site: The site you want to visit seems suspicious and may not be safe.
The site ahead contains harmful programs: The site you start to visit might try to trick you
into installing programs that cause problems when you’re browsing online.
This page is trying to load scripts from unauthenticated sources: The site you try to visit isn't
secure.
Source :
https://support.google.com/chrome/answer/99020?hl=en&co=GENIE.Platform%3DDesktop
The question comes now, how does Google Safebrowsing recognize my site as phishing?!
Well, that is simple to answer :
The code matters, but not always.
Why not always?
These have been phishing pages that had 'bot' and 'victim' traffic, and didn't turn red, and the
code was 1:1 from the original website.
Now let's deal with a few other points. How is our site selected according to the
safebrowsing principle and does my site have anything to do with it, e.g. Antibots?
Usually, Antibots were coded, to block a bunch of IP ranges, Crawlers and Bots. Bot traffic is
like a virus, nobody wants it. Bot traffic fills on bad coded pages empty forms out, continue
without clicking submit button and fills your mail with empty logs. Another reason to use
Antibots is also to avoid web security scanner and analyzer to explore our page.
So what happens when a bot passes our antibots?
This is not bad at all if the page has a good anti skip form validation like Scarletta pages. But
if this happens you will get empty logs.
Does my site have any damage like RED after passing a bot?
In most cases, no. It can happen if a lot of bots happen that it comes to this, but by a single
one you can not make yourself a picture of the whole site as an anti-phishing company
because there are now times false positives.
What does Safebrowsing pay attention to ?
● URL
● HTML Code
● Resource file names (CSS, JS, IMAGES...)
● Post Field Values (username, password ....)
● Known HTML Comments Of Coders
● Drops If Invalid Actions Are Done (like 404 page, die or exit in PHP*)
● Does The Application/Page Looks Suspicious ?
● Phishing Terms Found ?
* Dropping 404 errors are also suspicious to google, they notice that they have an error and
try to visit the page maybe multiple times.

What are Antibots anyways?
Antibots are so called Bots which will analyze websites like google, yahoo etc for marketing,
SEO and security. It’s to ensure the website is authentic, legitimate and can be found on the
search engine.
Popular sites like Spamhaus, Phishtank and Google created so called "crawlers" which
search the whole world wide web for sites which contains:
● Phishing
● Malware
● Suspicious Activity
● Virus
● and a few more things
These crawlers are hunting the web with different search queries and hope to find some
results. Some people created a solution for avoiding these crawlers — robots.txt.
But as we could assume, the companies didn’t like this so they got smarter and created
humanized bots with normal-looking user agents.
Only, with a DNS query or reverse IP, can you see what kind of visitor is visiting this page.
That's why the antibots were programmed in PHP. Numerous arrays (so called lists) with
regular expressions, e.g. 19.123.3.* were created to switch off and forward whole IP ranges
that are known to be used by these companies.
It is always a race against time until the companies create new bots with more and more
unknown user agents and even with different IP addresses. A simple yet advanced cat and
mouse game.
For example, you can test the antibots of a phishing site in the following way:
Virustotal.com analysis (0 detections = ✓)
Host and create traffic (14 days no red = ✓)
Some people also thought to create more and more sites that catch bot IPs and are now
selling databases of BOT IP addresses such as antibot.pw, killbot, etc.
Let me just say this:
No matter IP, most of the time bots use headless-browsers which means without header. You
can do browser fingerprinting with simple JavaScript and save expensive API keys from bots
databases.

Leads
Who do you send your spam to? This is where leads come into the picture.
Believe it or not, leads are a very important and valuable source for spammers. You might’ve
solved the spamming act but you don’t know who or what group to target.
Leads account for ~40% of your success-rate, having a good page and good message
content is of course crucial but it all depends on the person who receives it. You can’t target
a customer of BOA with a Wells page. That is why leads are an important factor when it
comes to spamming.

Email Leads
If you plan on sending email spam, you need to acquire email leads. These can be found
using multiple ways.
Using data leaks is the most common way and the cheapest. Getting hold of databases filled
with mails from data leaks online is not hard. A few recommendations are
● d7leadfinder.com
● raidforums.com (Combo & Leak section)
● cracked.to (Combo & Leak section)
● nulled.to (Combo & Leak section)
You should divide them into their respective domains (mail services). Your mails might hit
Yahoo inbox but land in the spam box on Gmail. To ensure your sendouts are as successful
as possible, you should only spam one domain at a time. Every service has their own
system to identify spam and will react differently.
Many website that sell leads usually does this by default.
If you want to learn how to get your own leads you will have to know how to inject & dump
SQL and dehash them.
One thing to have in mind is that public email leads are usually already spammed to its full
capacity. That means the user is already familiar with spam attempts and will probably have
used another mail service provider. They are also much more skeptical.
Private leads usually hold better quality which returns better results.

SMS Leads
Finding leads with SMS is a bit harder but not impossible. You can either generate phone
numbers yourself or get a real database filled with phone numbers.
You can choose to buy leads from a lead provider or scrape them from a database that
contains numbers. Below are some free websites to acquire numbers for free from a
database leak.
● d7leadfinder.com
● raidforums.com (Go to their database and leak section and get leads that includes
phone numbers)
● cracked.to (Go to their combo and leak section and get leads that includes phone
numbers)
● nulled.to (Go to their combo and leak section and get leads that includes phone
numbers)
Getting numbers from these databases/combos without extensive knowledge with text
editors might be hard. That is why I’ll leave 4 websites that might be of use to extract these
numbers in one go from the databases/combos list. Then you copy the extracted numbers
and put them on notepad one on each line.
● www.bethnan.com/ext
● miniwebtool.com/phone-number-extractor
● www.convertcsv.com/phone-extractor.htm
● monkeylearn.com/phone-extractor-online
As mentioned before, Twilios study shows that 9 out of 10 text messages are opened within
the first three minutes of being received. SMS spamming in general is more active becuase
everyone checks their text messages and due to poor business practice, many companies
send links in the SMS. This makes SMS spamming much faster and people usually don’t
have their guard up. If you have a list of “real” Wells phone numbers and send them an alert
about suspicious activity on their account, most people will without a second thought secure
their account by clicking the link in the SMS.
You will have a high success rate since the victim is a customer at that bank.
Most people who have spammed both email and SMS find that their pages are flagged RED
faster than with an email. The reasons behind this are yet to be determined but it’s said to be
because of the high-volume it usually receives. We all know that the last thing we want is to
receive a RED page.
Back to leads, you can also generate your own leads with an area code and spam an exact
area. This will save you money since you don’t have to buy leads nor use public leads from a
database leak. Just generate a specific area code centered around 1 common bank. You
can check what an area code is centeredted by going into Maps and simply finding a bank.
After generating numbers, you should always HLR check them. This makes sure the number
is live and can receive messages, otherwise you will be sending to dead numbers. This is
usually done by yourself with a tool. However there are services that you can use but they
cost money.
Bonus: SMSRoute.to offers HLR checking & sells leads at an affordable price worldwide.

SMS Sending
This is usually one of the hardest parts to manage yourself. Ensuring SMS is getting sent
and hits the victim without blockage from carriers or individual phones is hard.
You will need a few things for SMS sending but that depends on how you want to approach
this and your budget. We will dive into three different ways of sending SMS.
It will cost money and time to test different ways of sending SMS and find a way that’s
reliable.
There are some softwares out there that run on prepaid numbers or imported routes, you
can also find a websites that solves all these technical issues and has it ready for you after
registration (on the website). You pay a rather high amount per SMS but avoid the headache
of running your own operation.
You could also buy your own route and import it into a software and get started.

Website Gateways - SPONSORED BY SMSROUTE.TO - ALL IN ONE SPAMMING SOLUTION
These are websites that let you register and deposit money onto the website. You will be
able to send messages with SIM or extra cost. It comes at a high price per SMS but solves
the issues of running your own routes or getting SIMs & softwares.
They will also ensure a good OPSEC when spamming, you can use a VPN or proxy to visit
the website, making it very hard to track the spammer.
These are usually very regulated, finding a good website gateway is the SMS spammers wet
dream, I’m not exaggerating.
They usually implement a whitelist policy where you have to submit information about the
website/link you are trying to send. This is a tricky one since they will be checking the
website and doing regular check-ups on it. Sometimes using a residential IP with a real
agent. Smart systems and algorithms to track suspicious words and activity is also a daily
struggle for the spammer.
It sounds like a nightmare, does it not? Either way, if you do find a newly started gateway or
one who hasn’t been utilized by spammers, you will find that it’s very effective. They lack the
system to track down illicit traffic and don't check for suspicious words.
There are also bad actors disguised as good guys. They allow spam for a shorter (or longer)
period before being forced to shut you down.
In the spammer community, these gateways are sold to individuals looking for an easy way
to spam for anything from $200 to $3000. I wouldn’t trust someone selling a gateway for
$3000 but I’ve seen deals done with that amount.
They usually hit all carriers if they are a legit company while some smaller ones don’t hit
every carrier. This can cause some serious budget damage since you won’t be getting any
hits from those messages. Always test the waters before sending a high amount!
It’s always recommended to leave your own number at the end of every spam, that way you
can see if the sendout was successful. If you don’t get an SMS with the bulk sending action
but with a single send, you can be certain the send out failed.

Prepaid SIMs
SIMs is a bit trickier and requires knowledge on how the national SIMs work at the moment. I
can’t list every country and it’s details, I don’t even know them all. I will be teaching you the
general knowledge of SIMs and using them to spam.
The basic idea is that you get ahold of SIM card(s) and insert them into android phones. You
download a file onto the Android phone, that takes control of the phone.
You use a website hosted online, control the android and do sendouts via the website. The
command from the website gets sent to the android and it starts to send out your messages.
This requires the SIM to handle a lot of messages being sent. It also has to be loaded with
money or a subscription to send messages.
You can buy them from stores, usually corner stores with a plan on cash on it. The problem
is that these SIMs can’t handle much traffic before being blocked by the carrier. It’s not
normal for an average user to send 500 messages without receiving a single one, right?
The UK has had issues with spamming for a while now and that resulted in cornerstone
SIMs getting banned fast and not being able to handle a lot of traffic. This has resulted in
people ordering SIMs under businesses and sending them to a “drop”. A drop is a dead
address in which they pick it up on someone else's porch/mailbox.
I’ve only explained the simple process with SIM cards. If you want to skip the android part,
you can order yourself a GSM board that you insert SIM cards to. This is a bit too tech-savvy
and requires a lot of money and time to set up properly.
As for the Android system, a popular system is called Zender. It can be found here and it
allows for you to send SMS using an android.

@SMSRouteAnnouncement

For all SMS sending that you need. More tutorials will come soon, including videos.