ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
The Register of Known Spam Operations
BadCow / mAiLIEN

Evidence Menu:

BadCow / mAiLIEN Index

Country: Russian Federation
*** Leo Kuvayev now in prison ***

Founded by Russian/American criminal Leo Kuvayev. Now all in Russia. Spamming "OEM CD" pirated software scams, fake pharmaceuticals, porn spam, porn payment collection, etc. Spam using virus-created botnets and seems to be involved in virus distribution. Partnered with Vladislav Khokholkov - aka "Mr. Green".

BadCow / mAiLIEN SBL Listings History
Current SBL Listings
Archived SBL Listings

Main Info

Russian/American spammer, a spin-off or occasional partner with Alan Ralsky, Ibragimov, Lindsay and also the P/A/Y gang. In partnership with other Russians, he has grown this botnet fully-criminal spam operation into one of the world's largest, probably sending billions of spams each day. They recruit "affiliate" spammers using ads on many of the underground spam/crime forums.

Does "OEM CD" pirated software spam, child and animal porn spam, porn payment collection, pharma/pills, phishing, and others. Does his own DNS, possibly does DNS for other spammers. Buys bulletproof hosting where ever he can get it. Noted for enormous numbers of domains (bogus registration info, of course), often rotating every three hours in the spam to avoid URIBL/SURBL/DBL type domain filters. Mails via proxy-botnests using the usual spamwares, probably off his own (leased) servers. Noted for having "fresh" peas (proxies), meaning he is very close to the botnet masters collecting new, unlisted, zombie IPs. Was part of Sun Network spamhaus on MCI, gets BP hosting in Brazil, China, Russia, etc.

Some of his programs include:

Pharmacy Express (PharmacyExpress)

Some say he could be the "Pharmamaster" spammer who DDoS'd the BlueSecurity company.

UPDATE: Arrested in Moscow on "multiple child molestation charges" on September 15, 2009.

Related URLs

Partners in spam Pavka/Artofit and Yambo Financials
Partner in spam Ruslan Ibragimov/Send-safe
Partner in spam Alan Ralsky

Doing massive damage to a USA-based domain owner

The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is:

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2022 The Spamhaus Project SLU. All rights reserved.
Legal  |  Privacy