04/19/2009 00:53

1123 goforfling.com AIM Spammer Tracked Down

Lately I've been receiving a lot of AIM spam for goforfling.com. IM spam is particularly annoying to me, because it's suddenly there in your face. Almost any IM is a productivity-killer (unless it's from a coworker), but they provide something of value, like a quick conversation. Spam IMs give me nothing but hassle, so when I get one I have a tendency to rage. goforfling.com has sent me spam IMs in the past, last year if memory serves. So having them pop up on my radar again inspired me to track down who's responsible. Whois points to a Michael Evanchik with an email address of evanchik@gmail.com, but as unreliable as whois data can be, I thought I'd try to find some corroborating information. As it turns out, goforfling.com is just a 302 redirect to an affiliate link to fling.com (an online dating site). The affiliate ID in the URL is mcbain942. That's a fairly unique userid and a quick check on Google brings up all sorts of things. He has a blog on BitComet, where in one of his posts we learn that his alternate email address is mikesecure@hotmail.com. Looking that up, we can find a few more resources. He plays Halo 3, and has posted on bungie.net indicating that his Yahoo! Messenger account is mre224, and his AOL Instant Messenger account is McBain. There he alludes to mi7clan.com, which is no longer valid. The good McBain is also registered at the HTC Smartphone Wiki, where he gives his name as Michael Evanchik. Things are matching up. He's also registered at Xiled Gaming, giving a birthdate of 02/24/1976. And he's posted on MSDN, too, providing a link to before0day.com. Whois for before0day.com points to the same registrant as goforfling.com, Michael Evanchik in Stamford, CT, evanchik@gmail.com. before0day.com returns a 503 Service Unavailable error, so if you were looking for some sort of security insight or negative-one day exploits, you're shit out of luck. Mike has posted at Digital Gangster looking for a business partner. In this post he demonstrates his high ambitions and low spelling capabilities while trolling for someone who wants to "put down your useless proprietry tecnolgoy infomatoin and apply it to a main stream internet business." He defines his ideas and methods as "upmost elite" and his code as "upmost golden style," then goes on to berate readers by suggesting that it's unlikely he'll find a qualified candidate. The redemption is that the thread has an almost eBaums-like reply chain, where three different people have mockingly posted the same response: "if i wasnt so busy, i'd take this up... sounds like a great opportunity." That's enough. I'm convinced that the goforfling.com AIM spammer is Michael Evanchik, whose personal details I've omitted out of courtesy. I sent him an IM on his AIM McBain account requesting that he remove my screen name from his spambot's target list, but it wound up going to his phone as a text message, and I never heard back*. If I'd received an affirmative response, I may not have posted all of this. Or maybe I would have anyway. I hate IM spam. Also, a big shout-out to Deputy Ron Taylor, who I ran into while I was shopping tonight. Buckle up and slow it down! And you drink well too, my kind sir. Update: On Friday, April 24, I began receiving AIM instant messages from the screen name "FBI mcbain" inquiring as to how I knew he was the goforfling.com spammer. I didn't bother to reply. However, "FBI mcbain" brings up further connections, such as another Bungie account and his Myspace page. * I never heard back until I'd made this initial post. Suddenly, when I became the #1 result on Google for 'goforfling.com', I started getting hit up like cray-zee via IM, by the gentleman "FBI mcbain." I'm thinking that just happens. Random idiots, and whatnot.