Oleg Yegorovich Nikolaenko (; born July 17, 1987) is a Russian
computer criminal who created the
Mega-D botnet, violating the
CAN-SPAM Act of 2003
The Controlling the Assault of Non-Solicited Pornography And Marketing (CAN-SPAM) Act of 2003 is a law passed in 2003 establishing the United States' first national standards for the sending of commercial e-mail. The law requires the Federal Tra ...
. Federal investigators believe his activities may have been responsible for as much as one third of the world's
electronic spam.
Background
Oleg Nikolaenko, a resident of
Vidnoye, Moscow Oblast
Vidnoye ( rus, Ви́дное, p=ˈvʲidnəjə) is a types of inhabited localities in Russia, city and the administrative center of Leninsky District, Moscow Oblast, Leninsky District in Moscow Oblast, Russia, located south of Moscow city lim ...
,
Russia
Russia, or the Russian Federation, is a country spanning Eastern Europe and North Asia. It is the list of countries and dependencies by area, largest country in the world, and extends across Time in Russia, eleven time zones, sharing Borders ...
,
was identified as the "King of Spam" by the U.S.
Federal Bureau of Investigation
The Federal Bureau of Investigation (FBI) is the domestic Intelligence agency, intelligence and Security agency, security service of the United States and Federal law enforcement in the United States, its principal federal law enforcement ag ...
.
He is suspected of running the "
Mega-D"
botnet
A botnet is a group of Internet-connected devices, each of which runs one or more Internet bot, bots. Botnets can be used to perform distributed denial-of-service attack, distributed denial-of-service (DDoS) attacks, steal data, send Spamming, sp ...
to create a "zombie network" of as many as 500,000 infected computers.
Investigators stated that his operation was responsible for producing up to 10 billion unsolicited e-mails per day,
accounting for about 32% of all
spam
Spam most often refers to:
* Spam (food), a consumer brand product of canned processed pork of the Hormel Foods Corporation
* Spamming, unsolicited or undesired electronic messages
** Email spam, unsolicited, undesired, or illegal email messages
...
. The messages allegedly promoted counterfeit versions of
Rolex
Rolex () is a Swiss watch brand and manufacturer based in Geneva, Switzerland. Founded in 1905 as ''Wilsdorf and Davis'' by German businessman Hans Wilsdorf and his eventual brother-in-law Alfred Davis in London, the company registered ''Rolex ...
watches,
herbal supplement
Herbal medicine (also called herbalism, phytomedicine or phytotherapy) is the study of pharmacognosy and the use of medicinal plants, which are a basis of traditional medicine. Scientific evidence for the effectiveness of many herbal treatments ...
s and prescription drugs such as
Viagra
Sildenafil, sold under the brand name Viagra among others, is a medication used to treat erectile dysfunction and pulmonary arterial hypertension. It is also sometimes used off-label for the treatment of certain symptoms in secondary Ray ...
.
In October 2008, the U.S.
Federal Trade Commission
The Federal Trade Commission (FTC) is an independent agency of the United States government whose principal mission is the enforcement of civil (non-criminal) United States antitrust law, antitrust law and the promotion of consumer protection. It ...
moved to freeze the assets of individuals involved with the Mega-D botnet, though Nikolaenko's identity was not yet known at the time.
Investigation

The FBI got a break in the case in August 2009, when Jody M. Smith pleaded guilty in
Missouri
Missouri (''see #Etymology and pronunciation, pronunciation'') is a U.S. state, state in the Midwestern United States, Midwestern region of the United States. Ranking List of U.S. states and territories by area, 21st in land area, it border ...
to selling counterfeit Rolex watches.
Federal agents used
grand jury
A grand jury is a jury empowered by law to conduct legal proceedings, investigate potential criminal conduct, and determine whether criminal charges should be brought. A grand jury may subpoena physical evidence or a person to testify. A grand ju ...
subpoena
A subpoena (; also subpœna, supenna or subpena) or witness summons is a writ issued by a government agency, most often a court, to compel testimony by a witness or production of evidence under a penalty for failure. There are two common types of ...
s to trace financial payments of $459,000 from convicted
New Zealand
New Zealand () is an island country in the southwestern Pacific Ocean. It consists of two main landmasses—the North Island () and the South Island ()—and List of islands of New Zealand, over 600 smaller islands. It is the List of isla ...
spammer
Lance Atkinson to Nikolaenko, who had been using the alias of "Docent".
Google
Google LLC (, ) is an American multinational corporation and technology company focusing on online advertising, search engine technology, cloud computing, computer software, quantum computing, e-commerce, consumer electronics, and artificial ...
provided the FBI with Nikolaenko's e-mail records. Investigators subpoenaed his travel records from the
U.S. State Department
The United States Department of State (DOS), or simply the State Department, is an executive department of the U.S. federal government responsible for the country's foreign policy and relations. Equivalent to the ministry of foreign affairs ...
, which indicated that he had visited
New York City
New York, often called New York City (NYC), is the most populous city in the United States, located at the southern tip of New York State on one of the world's largest natural harbors. The city comprises five boroughs, each coextensive w ...
,
Los Angeles
Los Angeles, often referred to by its initials L.A., is the List of municipalities in California, most populous city in the U.S. state of California, and the commercial, Financial District, Los Angeles, financial, and Culture of Los Angeles, ...
, and Las Vegas over the course of two trips in 2009.
However, the
Constitution of Russia
The Constitution of the Russian Federation () was adopted by national referendum on 12 December 1993 and enacted on 25 December 1993. The latest significant reform occurred in 2020, marked by extensive amendments that altered various sections ...
specifically prohibits the
extradition
In an extradition, one Jurisdiction (area), jurisdiction delivers a person Suspect, accused or Conviction, convicted of committing a crime in another jurisdiction, into the custody of the other's law enforcement. It is a cooperative law enforc ...
of its citizens.
In November 2009,
FireEye
Trellix (formerly FireEye and McAfee Enterprise) is a privately held cybersecurity company that was founded in 2022. It provides hardware, software, and services to investigate cybersecurity attacks, protect against malicious software, and ana ...
, a
computer security
Computer security (also cybersecurity, digital security, or information technology (IT) security) is a subdiscipline within the field of information security. It consists of the protection of computer software, systems and computer network, n ...
firm, was able to shut down servers in the United States under the control of the Mega-D botnet. Nikolaenko, who had been in
Las Vegas
Las Vegas, colloquially referred to as Vegas, is the most populous city in the U.S. state of Nevada and the county seat of Clark County. The Las Vegas Valley metropolitan area is the largest within the greater Mojave Desert, and second-l ...
,
Nevada
Nevada ( ; ) is a landlocked state in the Western United States. It borders Oregon to the northwest, Idaho to the northeast, California to the west, Arizona to the southeast, and Utah to the east. Nevada is the seventh-most extensive, th ...
to attend the 2009
SEMA
Sama (; ) is a Sufi ceremony performed as part of the meditation and prayer practice dhikr. Sama means "listening", while dhikr means "remembrance".During, J., and R. Sellheim. "Sama" Encyclopedia of Islam, Second Edition. Ed. P. Bearman, T. B ...
auto show
An auto show, also known as a motor show or car show, is a public exhibition of current automobile models, debuts, concept cars, or out-of-production classics. It is attended by automotive industry representatives, dealers, auto journalists a ...
, was forced to return to Russia two days early to undo the damage to Mega-D's functionality.
By the end of 2009, Nikolaenko was able to restore capacity to generate 17% of worldwide spam.
Arrest and legal proceedings

Nikolaenko returned to Las Vegas to attend the 2010
SEMA Show
Sama (; ) is a Sufi ceremony performed as part of the meditation and prayer practice dhikr. Sama means "listening", while dhikr means "remembrance".During, J., and R. Sellheim. "Sama" Encyclopedia of Islam, Second Edition. Ed. P. Bearman, T. B ...
and was apprehended by federal agents at the
Bellagio Hotel
Bellagio ( ) is a resort, luxury hotel, and casino on the Las Vegas Strip in Paradise, Nevada. It is owned by Blackstone Inc. and operated by MGM Resorts International. Bellagio was conceived by casino owner Steve Wynn, and was built on the for ...
on November 4. He was found with two passports and $4,000 cash. Nikolaenko was transported to face charges in
Milwaukee, Wisconsin
Milwaukee is the List of cities in Wisconsin, most populous city in the U.S. state of Wisconsin. Located on the western shore of Lake Michigan, it is the List of United States cities by population, 31st-most populous city in the United States ...
, where an undercover agent ordered Viagra from an alleged
e-mail spam
Email spam, also referred to as junk email, spam mail, or simply spam, refers to unsolicited messages sent in bulk via email. The term originates from a Monty Python sketch, where the name of a canned meat product, "Spam," is used repetitively, m ...
and instead received herbal pills.
Nikolaenko was indicted on November 16 at the
U.S. District Court of Eastern Wisconsin and faced up to five years in prison.
He was accused of deliberately falsifying the header information of commercial e-mails and sending over 2,500 spam e-mails per day, both in violation of the
CAN-SPAM Act of 2003
The Controlling the Assault of Non-Solicited Pornography And Marketing (CAN-SPAM) Act of 2003 is a law passed in 2003 establishing the United States' first national standards for the sending of commercial e-mail. The law requires the Federal Tra ...
.
He was extradited to Wisconsin and assigned a case #: 2:10-cr-00246-CNC-1 in the Eastern District of Wisconsin. Nikolaenko pleaded not guilty and retained defense attorney Christopher Van Wagner, who stated: "We're prepared to present a rigorous defense."
Wagner requested that Nikolaenko be released on bail as his wife and daughter were planning to travel from
Moscow
Moscow is the Capital city, capital and List of cities and towns in Russia by population, largest city of Russia, standing on the Moskva (river), Moskva River in Central Russia. It has a population estimated at over 13 million residents with ...
to the United States to attend the trial. However, bail was denied by U.S. Magistrate Judge Patricia Gorence.
On December 21, 2010, Federal prosecutors turned over 4,600 of 6,000 pages of documents to Nikolaenko's attorney for pre-trial
discovery
Discovery may refer to:
* Discovery (observation), observing or finding something unknown
* Discovery (fiction), a character's learning something unknown
* Discovery (law), a process in courts of law relating to evidence
Discovery, The Discovery ...
.
Information was redacted for the protection of witnesses. The trial was scheduled to begin by February 11, 2011, but later was adjourned.
Nikolaenko later fired Wagner and retained criminal defense attorney
Arkady L. Bukh who stated that "the previous motions by Nikolaenko's lawyers had been ruled by the judge in favor of the prosecution".
In June 2012, Nikolaenko agreed to a plea deal. On February 27, 2013, he was sentenced to time served plus three years of probation.
The
M86 Security
M86 Security was a privately owned Internet threat protection company that specialized in Web and email security products and content filtering appliances. The company's international headquarters were located in Basingstoke, with development cent ...
company stated that spam output from Nikolaenko's Mega-D botnet fell below 5% of the worldwide total by December 2010.
Spam e-mail traffic dropped sharply worldwide during the 2010 holiday period while Nikolaenko was detained, though Paul Wood of computer security firm
Symantec Symantec may refer to:
* Gen Digital, an American consumer software company formerly known as Symantec
* Symantec Security, a brand of enterprise security software purchased by Broadcom
Broadcom Inc. is an American multinational corporation, ...
attributed the downturn to the disruption of various other botnets, including
Rustok,
Lethic and
Xarvester.
According to information technology experts, Mega-D is no longer considered a very large network, though it may have been the largest designed specifically for spam.
See also
*
Sanford Wallace Sanford 'Spamford' Wallace (born c. 1968) is an Internet spamming, spammer. He initially sent junk faxes before coming to notoriety in 1997, promoting himself as the original "Spam King". Wallace's prolific spamming has resulted in encounters with ...
*
Leo Kuvayev
References
External links
Oleg Nikolaenkoat
The Smoking Gun
The Smoking Gun is a website that posts legal documents, arrest records, and police mugshots on a daily basis. The intent is to bring to the public light information that is somewhat obscure or unreported by more mainstream media sources. Most ...
Oleg Y. Nikolaenkoat
Federal Bureau of Prisons
The Federal Bureau of Prisons (BOP) is a Federal law enforcement in the United States, federal law enforcement agency of the United States Department of Justice that is responsible for all List of United States federal prisons, federal prisons ...
United States of America v. Oleg Y. Nikolaenkosmall> –
U.S. District Court of Eastern Wisconsin (November 3, 2010)
Indictment: United States of America v. Oleg Y. Nikolaenkosmall> – U.S. District Court of Eastern Wisconsin (November 16, 2010)
{{DEFAULTSORT:Nikolaenko, Oleg
1987 births
Russian cybercriminals
Email spammers
Living people
People from Vidnoye
Prisoners and detainees of the United States federal government
Prisoners and detainees of Wisconsin
Russian people imprisoned abroad
People extradited within the United States