Harvesting Data on the Xarvester Botmaster
Summary: Krebs reports that the Xarvester spam botnet, which M86 Security described in a January 2009 report as a pharmacy spam machine tied to SpamIt that emerged as Srizbi went offline, was likely run by a SpamIt affiliate known as Ronnie. UCSD researchers who reviewed their 2010 botnet data found Xarvester spam promoting pill sites tied to SpamIt, each carrying an affiliate ID assigned to Ronnie, and historic WHOIS records show the domain reactor2.com was registered to his email address.
What you should know: The link rests on an affiliate ID and a WHOIS record, while Ronnie's WebMoney accounts were registered to clearly fake identity details and his Google Analytics code appears on no other site - so the person behind a botnet that pushed pharmacy spam for years remains unidentified even after the infrastructure was mapped.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026