ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
The Register of Known Spam Operations
Vincent Chan gang

Evidence Menu:

Vincent Chan gang Index

Country: Hong Kong
Vincent Chan and his Chinese partners have been sending spam for years. They mainly do pharmacy, and are able to send out huge amounts daily. They use vast numbers of compromised computers -- for sending, hosting and proxy hijacking. Now seem to be an "oursourced" server obtainer for other spam gangs.

Vincent Chan gang SBL Listings History
Current SBL Listings
Archived SBL Listings

Main info

Vincent Chan is working together with a Lap Chung Chan (presumably his brother or an alias) and a group of Chinese spammers. They are heavily into pharmacy, but have also spammed for watches and some mailshots for OEM warez, toner and ink cartridges, and mortgages. They have been, or are, an affiliate in Kuvayev's "Taiwanmedia" program.

Chan's own hosting (and hosting he sells to other spammers) have popped up all over China, and he seems to have quite some supply in botnet proxies. Chan and company were the first to massively abuse Geocities redirectors in October of 2005. Now they seem to be into hosting redirectors on compromised Windows machines. In the summer of 2006 they also started hosting the proxy hijackers on compromised Windows machines.

These people have been at it for years, are experienced and put out massive volumes.

They now use their Chinese gang to sign up for cheap VPS systems (Windows OS) to use to host pages and DNS. They seem to sell these to others in the botnet spam underground.

They also hack or use purchased hacked PCs to host their websites & DNS. One host wrote:

"Found that port forwarding was set over ports 80, 8080 and 25. Also found 2 malwares: legacy_360 and worm.autorun."

Another wrote:

"It's a VM that runs win2008 and it seems hacked. It's running a process called TCPPortmapSvc.exe that connects to some Russian IP addresses.""TCPPortmapSvc.exe"



Yoric Network Limited
133 Connaught Rd
Rm 802, Alliance Building

Domain name: YORIC.NET

Administrative Contact:
Administrator, Domain
133 Connaught Rd
Rm 802, Alliance Building
+852 2391 4685
Technical Contact:
Administrator, Domain
133 Connaught Rd
Rm 802, Alliance Building
+852 2391 4685

Registration Service Provider:
Yoric Network Ltd.,
+852 2391 4685
This company may be contacted for domain login/passwords,
DNS/Nameserver changes, and general domain support questions.

Registrar of Record: TUCOWS, INC.
Record last updated on 10-Oct-2005.
Record expires on 09-Nov-2006.
Record created on 10-Nov-1998.

Domain servers in listed order:

Domain status: ACTIVE

Alias used:

First Name susan
Last Name manuel
Company Name vran
Email Address
Address 1 block 17 lot 23 st. michael st
Address 2 villa nova subd. novaliches
City Quezon City
Postcode 1123
Country PH - Philippines
Phone Number 3555184


Related URLs

Leo Kuvayev
Taiwan Media Ltd.

The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is:

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2016 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy