We'll soon be posting spamming tutorials to the channel.

Please join this channel to receive updates on when we drop free tutorials on how to run spam.

🏄‍♂️ We are still working on the spamming tutorial!

We will be posting new pages and updates soon!

Stay grinding and we'll launch soon.

Fraud is a very serious crime that can lead to prison time. ⚡️
This guide is for educational
purposes only. Any and all information found in this book is strictly educational and not to be
used to commit fraud. 📚

The information below is a general view on the laws in the EU. (UK included)

This is the part where you are going to take the most. There is a certain "lightening" because
the law is not yet very well aware of the offenses computer science. However, in the case of
concealment and theft of BANK information , the law knows how to proceed, and the Prosecutor will assassinate you and the complainant who will not spare you during his testimony. For the theft of information, you are accused of theft in the judicial sense of the
term:
- Theft of information harming others (art. 311-11 of the Penal Code - 76,000 euros fine and
up to 5 years in prison)
If you obtained the banking information by phishing, the Prosecutor will also subpoena you
for fraud, the reason cannot be brought.

During the Call:
- Fraud (art. 313-1 of the Penal Code - 375,000 euros fine and up to 5 years in prison)
If you trade or even worse sell this information to a third party, serve as an intermediary or
mediator, you are guilty of one of the heaviest penalties possible
- Receiving confidential information (art. 321-1 of the Penal Code - 400,000 euros fine and
up to 7 years in prison) If you have laundered, aided in laundering, or participated in any way
in money laundering, you will be charged with embezzlement and money laundering:
- Money laundering (art. 324-1 of the Penal Code - 375,000 euros fine and up to 5 years in
prison)
On the basis of the offense of fraudulent collection of personal data in application of article
226-18 of the penal code. Because in the end, the hacker obtains personal data and
processes them fraudulently in a computer. This offense is punished by five years'
imprisonment, and a fine of 300,000 euros.
Any collection of electronic addresses must be done in accordance with the provisions of the
texts in force. Any fraudulent action will be punishable by a fine of 300,000 euros and
imprisonment for a period of 5 years. It is often worth it with respect to spammers who feed
their databases using phishing.

What is spamming? Or should we call it phishing? 🤔💭
In the community of fraud we usually call it spamming. Spamming isn’t limited to phishing
attempts and is usually defined by the average citizen as unwanted mail, not necessarily
dangerous. Webroot.com has a text that I’ll loan for the sake of explaining both spamming
and phishing.
“Spam is called junk mail for good reason. It’s existed for almost as long as the internet itself
as a means of selling products or services to a larger market of buyers than have ever
expressed interest in those products or services. After obtaining the email addresses of a
huge number of individuals, spammers bulk send their offers hundreds or thousands at a
time.”

What is phishing?
“Whereas spam is simply unwanted, phishing is expressly designed by a malignant actor to
harm a company or individual by obtaining sensitive information. It often takes the form of a
seemingly legitimate-looking message from a trusted sender. Phishing emails target banking
credentials, passwords, cash advances, or other information of value. Identity theft often
results. “
With that out of the way, I will be calling them by both spamming and phishing depending on
the context. The meaning is still the same.

Phishing consists of multiple bad-actors
UKs division for fraud “National Economic Crime Centre” (NECC) has a map of all the
actors involved in the scene of phishing
We are mainly going to focus on the Fraudster 2 “Spammers” work involved in this book.
This doesn’t capture the full circle, I have decided to keep out the “mule network” in this
example.

📖Terminology: 📖
● Spamming
The act of performing phishing attempts towards individuals, called spamming
● Scam page
A scam page is the exact replica of the site you are going to impersonate. Usually
lands on a login page to extract information
● SIM
Has a unique phone number that enables you to send & receive messages.
Everyone should know what a SIM is.
● cPanel
cPanel is a web-based control panel that allows a user to manage their website
through a beautiful web interface.
● Web shell
A Web Shell is a script most often developed in PHP, ASP and which allows a hacker
to execute commands remotely on the attacked server. Examples of famous scripts
are C99 or R57 shells.
● “Letter”
A letter in spam context is the message content that we will use. Usually referred to
as content. Spammers try to mask the fake letter as close to the original company
they are impersonating.
● Sender ID (SID)
This means the sender of the message that the victim will see. If you use SID
PayPal, the user will see the message as it would’ve come from PayPal.
● Spoofing
Changing the original sender to something else. The SIM card has the number
123321 but when people receive it, they see your own SID that you choose freely.
● Red page
The term Red page is the “harmful and/or deceptive” page shown on Google
Chrome. Here is a screenshot INSERT
● Email Spamming
Using email as means to phish information from victims. A common way but gets
harder everyday.
● SMS Spamming
Using SMS as means to phish information from victims. Untapped method in some
countries, starting to get harder.
● Antibots
Antibots are automated bots which will analyze websites found on Google, Yahoo,
Bing. They do this to optimize search ranking and also look for phishing pages.
● SF
Some refer this as minimum deposit on a gateway
● Gateway
A website that lets you send SMS without owning your own SIM card. A solid way of
doing SMS spamming if you find a reliable and stable gateway. (smsroute.to)
● Link/URL shortener
A way of making a link shorter and masking the original URL to a shorter link that
redirects to your page.
● Logs
Bank login information that was most likely gained by spamming. Gives you access
to the bank account. (The end goal with spamming)
● Residential (IP)
This means that the IP is originating from a home IP address. This is a way to identify
real traffic versus bot traffic.
● Bulletproof
This means a hosting provider doesn’t respond to DMCA, respects privacy & allows a
a lot of stuff.
● Leads
This is what we refer to as our victims. It’s a long list of phone numbers to whom are
customers in a specific organization/company.
● VPN
Virtual Private Network, will mask your IP address to somewhere else making it hard
for you to be tracked.
● Keyword filter
A keyword that is marked fraudulent by carriers. For example, “account security alert”
might be picked up by SMS carriers as fraudulent.
● Sandbox
This is a computer program to test and try applications on a PC. Open Sanbox
program (now open source) and start the application. That ensures your system is
safe.
● SIP
Voice Over IP (not VoIP) that is based on a client-owner analog telephone adapter or
in our case, a SIP phone. A client-owned Caller ID spoofing
● OTP
One-time Password systems provide a mechanism for logging on to a network or
service using a unique password that can only be used once
● IVR
Interactive Voice Response is an automated phone system technology that allows
incoming caller to access information via a voice response system of pre recorded
messages without having to speak to a person.
● BOA
Bank of America, a big bank in the US.
● HLR
Home Location Register is a database that contains data regarding authorized
subscribers using a global system for mobile communication (GSM) core network. It
basically checks if the number is “alive”
● Bulletproof hosting
This type of hosting doesn’t scan your files for harmful content. They believe in free
speech & the hosting of more skeptical files. The hosting itself will not ban you for
your content.

Email or SMS Spamming?
This is a good question. For businesses, email has been a tried-and-true method to reach
audiences and send mass messages. However, as the use of mobile phones increases,
SMS messaging is quickly becoming a great new way to connect with customers.
Businesses today use SMS to communicate with their customers directly on their mobile
devices about new promotions, exclusive discounts, appointment reminders, and
time-sensitive updates.
According to Twilio, 9 out of 10 text messages are opened within the first three minutes of
being received, making it a great opportunity for brands to capture attention.
Since Businesses are expanding to SMS instead of old-fashioned Email, it might be easier to
trick a victim? One thing is for sure, both ways have their advantages. Penetrating Gmail's
anti-phishing system is extremely hard and will mark your mail content as fraudulent fast. If
you target self-hosted mails, you might penetrate their anti-spam filter but that still leaves
room for grammatical errors, issues with loading and a fishy email sender.
An SMS on the other hand is short, can be spoofed, used by companies (that has poor
security standards) & is overall faster (referring to Twilios study). That is why I believe SMS
spamming is more effective and people have their guard down on SMS, especially if it has a
spoofed SID matching the company. People have been learned since day one of emails to
check grammatical errors, the sender and content of the message. SMS is newer and is
seen by the general as safer.

Operational security (OPSEC)
This niche is purely a game of cat and mouse. The lawmakers and organizations enforcing
the law are always trying to catch up to people breaking it.
Even though SMS spamming is fairly new, they are working hard both day and night to set a
stop for it. We see more filters taking place in carrier networks, spoofing is harder, corner
store SIMs not lasting long, limits on SMS per day and information being spread about these
phishing attempts.
That is why your OPSEC is of utmost importance when operating in this niche. You should
always be browsing using a VPN, preferably the router using a VPN. I highly recommend
Mullvad VPN or IVPN.
Don’t share information with others, use encrypted message systems, don’t brag to friends
and remove all META-information when sharing pictures. That also includes screenshots.
This book is not about OPSEC so I will leave as is. Please ensure you are safe!

Why does a phishing page go red?
According to Google, there are several types :
The site ahead contains malware: The site you start to visit might try to install bad software,
called malware, on your computer.
Deceptive site ahead: The site you try to visit might be a phishing site.
Suspicious site: The site you want to visit seems suspicious and may not be safe.
The site ahead contains harmful programs: The site you start to visit might try to trick you
into installing programs that cause problems when you’re browsing online.
This page is trying to load scripts from unauthenticated sources: The site you try to visit isn't
secure.
Source :
https://support.google.com/chrome/answer/99020?hl=en&co=GENIE.Platform%3DDesktop
The question comes now, how does Google Safebrowsing recognize my site as phishing?!
Well, that is simple to answer :
The code matters, but not always.
Why not always?
These have been phishing pages that had 'bot' and 'victim' traffic, and didn't turn red, and the
code was 1:1 from the original website.
Now let's deal with a few other points. How is our site selected according to the
safebrowsing principle and does my site have anything to do with it, e.g. Antibots?
Usually, Antibots were coded, to block a bunch of IP ranges, Crawlers and Bots. Bot traffic is
like a virus, nobody wants it. Bot traffic fills on bad coded pages empty forms out, continue
without clicking submit button and fills your mail with empty logs. Another reason to use
Antibots is also to avoid web security scanner and analyzer to explore our page.
So what happens when a bot passes our antibots?
This is not bad at all if the page has a good anti skip form validation like Scarletta pages. But
if this happens you will get empty logs.
Does my site have any damage like RED after passing a bot?
In most cases, no. It can happen if a lot of bots happen that it comes to this, but by a single
one you can not make yourself a picture of the whole site as an anti-phishing company
because there are now times false positives.
What does Safebrowsing pay attention to ?
● URL
● HTML Code
● Resource file names (CSS, JS, IMAGES...)
● Post Field Values (username, password ....)
● Known HTML Comments Of Coders
● Drops If Invalid Actions Are Done (like 404 page, die or exit in PHP*)
● Does The Application/Page Looks Suspicious ?
● Phishing Terms Found ?
* Dropping 404 errors are also suspicious to google, they notice that they have an error and
try to visit the page maybe multiple times.