(The quickest way to register)

Check out our new Mobile App

Forum

  1. User picture
    • alphacentauri on Sun 22 Aug 2010
    • 12:53:31 PM UTC

    Pharmacy Express

    These are domains for the "Pharmacy Express" Russian scam pharma affiliate program (not to be confused with the actual pharmacy called Pharmacy Express, located at the address these sites put on their forged pharmacy license).

    Despite the head of their affiliate program, Leo Kuvayev, being in prison charge with 50 counts of raping children lured from a Russian orphanage, the affiliate program is going strong. I noticed that some of these domains were rated as "spam" by other reviewers, though many had no other ratings than mine from what I could see. (I haven't rated all of them; I'm not qualified for bulk posting here yet.)

    I think a stronger designation than "spam" is called for. Gevalia Coffee spams, but I wouldn't be afraid they will steal my credit card number or send me arsenic-laced gravel and call it coffee. These sites do much worse than just "spam."

    List of domains/hosts:

    edit: removed 5 year old stale domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

Comments:

  1. User picture
    • Bob Zenith (not verified) on Sun 22 Aug 2010
    • 01:11:17 PM UTC

    reference link

    Here's the Spam Wiki reference link:
    http://www.spamtrackers.eu/wiki/index.php/Pharmacy...

  2. User picture
    • SuperHero58 (not verified) on Sun 22 Aug 2010
    • 02:26:43 PM UTC

    @ AlphaCentauri

    thank you RED> with a strong comment

  3. User picture
    • SuperHero58 (not verified) on Sun 22 Aug 2010
    • 02:30:53 PM UTC

    @ Bob Zenith

    thank you for such a great article link ===== I have learned quite a lot by articles like this one , and at the same time it worries me this Russian mafia ======

  4. User picture
    • c۞g on Sun 22 Aug 2010
    • 04:45:08 PM UTC

    re: Pharmacy Express

    I see these domains use a different site template compared to my last screen capture

    A few servers [Fedora] not listed:
    breavdns.com
    daftdns.com
    gruedns.com
    bagwdns.com

    FAKE pharmacies not listed:
    vapharmacye.com

    The shopping cart is courtesy of:
    cartinternetsite.com - whois created: 30 June 2010
    notice the lack of SSL
    and the phone number: +1-888-738-9650 - spamhaus.org
    It's also viewable on this fake Generic ED site: paymeddirect.com where at the bottom left you'll see reference back to: Fortex Investments LTD aka: fortexltd.com

    Oh!
    Rated and thanks!

    [EDIT]
    minor edit nothing changed

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

    • User picture
      • alphacentauri on Sun 22 Aug 2010
      • 05:36:36 PM UTC

      @g7w

      > I see these domains use a different site template compared to my last screen capture

      I haven't tried loading through a proxy, so I don't know if the American flag image is presented to visitors from other countries.

      There is some uproar in Russia right now, not only because Kuvayev has been jailed (and presumably every computer that can be traced to him has been seized), but because someone hacked or claims to have hacked Chronopay, a major online payment processor in Russia ( http://www.chronopay.com/en/ ). Chronopay handles lots of legitimate companies, but also pornography sites (allegedly including child pornography) and many other blackhat activities. Supposedly, they handled payments for all the scam pharma affiliate programs other than Glavmed (Canadian Pharmacy). The hackers have been posting blogs on livejournal (that get taken down as fast as they are posted) that appear to indicate the breach was real and was significant -- they have recordings of telephone calls, including one in which one of their officers is talking to his lawyer about suing Brian Krebs, the reporter who tied Chronopay to a rogue antivirus software operation.

      The scammers have operated with impunity only because they did not appear to be scamming Russians -- some of the trojans they use to create their botnets will abort installation if they detect Cyrillic keyboards, for instance. But they have no idea how much data was taken from Chronopay, and the hackers say they will only reveal password to the data to law enforcement agencies. So bottom line, they're nervous, and they've got reason to want to emphasize the fact that they're targeting Americans, not Russians.

      > FAKE pharmacies not listed:
      > vapharmacye.com

      Thanks. There are actually lots more, so everybody: have at 'em. (I'm so looking forward to being able to bulk post and spend time finding them instead of posting reviews one at a time :) )

      > The shopping cart is courtesy of:
      > cartinternetsite.com - whois
      >
      > created: 30 June 2010
      > notice the lack of SSL

      Thanks for that, too. I'm not confident enough to enable javascript on a site like this yet.

      > and the phone number: +1-888-738-9650 - spamhaus.org

      LOL!

      > It's also viewable on this fake Generic ED site: paymeddirect.com where at the bottom left you'll see reference back to:
      > Fortex Investments LTD aka: fortexltd.com

      That's a famous address, too: Harley Street 29, Suite B London, UK
      I guess it's the equivalent of Mailboxes Etc., because all kinds of companies use that suite number, including numerous scammers.

      One of the best known:

      Domain: spamit.com - Domain History
      Cache Date: 2008-01-17
      Registrar: INTERCOSMOS MEDIA GROUP, INC. D/B/A DIRECTNIC.COM

      Registrant:
      MEDIA CAPITAL LTD
      Suite B, 29 Harley street
      London, NA W1G 9QR
      GB
      4402070604540

      Domain Name: SPAMIT.COM

      Administrative Contact:
      Smirnov, Andrey admin@spamit.com
      Suite B, 29 Harley street
      London, NA W1G 9QR
      GB
      4402070604540

      Spamit is the evil twin of Glavmed -- both have "Canadian Pharmacy" sites, but Glavmed claims not to spam. Andrey Smirnov, however, is employed by Glavmed and is an admin on their affiliate forum. He claims Glavmed is unrelated to Spamit. I think the claim is pretty ludicrous, as the Spamit site templates change in response to information given to Andrey. If Spamit affiliates were stealing their templates, as he claims, it would be trivial to find out which Glavmed affiliate was giving it to them by concealing minor differences in the code of a site that large. And if they used his name to register their domain name, he could take possession of the name whenever he chose -- it would be an incredibly stupid move if Spamit were just trying to annoy a competitor.

      Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  5. User picture
    • TheBonobo4 on Sun 22 Aug 2010
    • 04:32:52 PM UTC

    Rated accordingly.

    Rated accordingly.

    Platinum Level Member of the WOT Community. If you see an incorrect rating of mine please feel free to point it out so I can amend it. However, if you don't state the URL(s) of the site(s) you wish me to fix, or if you spam my board, your message will in

  6. User picture
    • -Saad- on Mon 23 Aug 2010
    • 03:17:54 AM UTC

    Thanks. Rated.

    Thanks. Rated.

  7. User picture
    • alphacentauri on Wed 01 Sep 2010
    • 02:26:28 AM UTC

    here are some more

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  8. User picture
    • SuperHero58 (not verified) on Mon 30 Aug 2010
    • 06:57:23 AM UTC

    -

    AlphaCentaur = thank you ------ RATED!

  9. User picture
    • alphacentauri on Wed 01 Sep 2010
    • 02:25:00 AM UTC

    more Pharmacy Express

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  10. User picture
    • Anonymous on Wed 01 Sep 2010
    • 05:59:41 PM UTC

    more

    mediclu.com
    medicfi.com
    wafmedic.com
    etemedic.com

  11. User picture
    • alphacentauri on Thu 02 Sep 2010
    • 08:20:27 AM UTC

    well that was a waste

    I just noticed there are "noindex" tags on the scorecards. No point putting links here, as the search engines will never pick them up.

    Too bad. The SiteAdvisor pages are often the number one result when someone googles the name of a bad domain, but they don't always have accurate ratings, especially for sites that are fraudulent rather than phish or malware. I guess there is a concern about google caching ratings and comments that the users have subsequently changed. But I should think there would be a way to have enough of the page crawled to allow people to find it, even if the ratings aren't cached.

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  12. User picture
    • Anonymous on Thu 02 Sep 2010
    • 08:42:02 AM UTC

    I think

    I think the problem could be solved if wot would enable profile viewing without having to register.

  13. User picture
    • alphacentauri on Thu 02 Sep 2010
    • 12:12:50 PM UTC

    They're actively blocking search engines

    It's not just that the links in the profiles aren't visible without registration. Although this forum is indexed by search engines, the html code in the scorecards has a command telling search engines not to index those pages. My live links to scorecards here still won't get them indexed.

    Here are some more links. These are not pharmacies, and I don't recommend visiting them. I noticed that one of the domains above looked different in the blurred picture on the scorecard and checked it again. They're using pages of zoo and lolita porn to link to Pharmacy Express sites. These pages all share the same IP:

    edit: removed old domain list

    (Reported to cybertipline)

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  14. User picture
    • alphacentauri on Sat 04 Sep 2010
    • 06:18:15 AM UTC

    More

    I don't think these have been listed above. Most of these are thanks to Nodus, a member at InboxRevenge.com:

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  15. User picture
    • alphacentauri on Sat 04 Sep 2010
    • 06:30:14 AM UTC

    a few more

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  16. User picture
    • c۞g on Thu 03 Feb 2011
    • 08:40:56 PM UTC

    also

    List of domains/hosts:

    ovmedic.com
    growtmed.ru
    druglith.ru
    caumedic.com
    bromedic.com
    diximedic.com
    pharmacyog.com
    highdoctor.com
    ableo.in
    autho.in
    revdrug.ru
    uppermedworld.com

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  17. User picture
    • c۞g on Sat 04 Sep 2010
    • 04:37:18 PM UTC

    payment gateway

    shopping cart at: paycartservice.com - whois | DNS - created 28 August 2010 sitting on IP: 95.169.187.91

    paycartservice.com

    Screen capture

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  18. User picture
    • alphacentauri on Sun 19 Sep 2010
    • 08:32:01 PM UTC

    These are the currently

    These are the currently active domains I can find (sorry, unable to dedupe with lists already posted)

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  19. User picture
    • Anonymous on Mon 20 Sep 2010
    • 01:43:12 AM UTC

    This list is just mind

    This list is just mind boggling.
    Been trying to rate a few now and then, may take awhile.

  20. User picture
    • c۞g on Thu 03 Feb 2011
    • 08:42:04 PM UTC

    flukpills.com

    SCAM online pharmacy: flukpills.com - whois - DNS sitting on IP: 200.160.238.187
    200.160.238.187
    flukpills.com

    FAKE payment processor: payquickonline.com - whois - DNS sitting on IP: 88.255.78.22
    88.255.78.22
    payquickonline.com

    Spamvertised domains that redirect to flukpills.com
    (normally used in spam email links)

    List of domains/hosts:

    usuamedic.ru
    medictuni.ru
    cavmedic.ru
    abelymedic.ru
    medicryop.ru
    medicpboa.ru
    enmmedic.ru
    medicfusi.ru
    medicmili.ru
    medicotry.ru
    capmedic.ru
    medicbeck.ru
    ramemedic.ru
    merbmedic.ru
    medicshot.ru
    busbmedic.ru
    wastwmedic.ru
    medichand.ru
    mediccoll.ru
    sondmedic.ru
    orumedic.ru
    medicnate.ru
    nonsmedic.ru
    karamedic.ru
    medicosed.ru
    litwmedic.ru
    pushbmedic.ru
    datmedic.ru
    consmedic.ru
    panmedic.ru
    permedic.ru
    auramedic.ru
    sweamedic.ru
    medicersi.ru
    medicized.ru
    minwmedic.ru
    petiomedic.ru
    carrimedic.ru
    cytmedic.ru
    medicperm.ru
    medicnect.ru
    medicopti.ru
    wingtmedic.ru
    medicnctu.ru
    midrmedic.ru
    janemedic.ru
    medicwcyst.ru
    doctoresta.ru
    essinmedic.ru
    doctordema.ru
    utmedic.ru
    doctorlc.ru
    doctorip.ru
    bidoctor.ru
    lindoctor.ru
    medicoist.ru
    medicraul.ru
    doctorft.ru
    doctorlase.ru
    mondoctor.ru
    doctordr.ru
    medicllyw.ru
    spedoctor.ru
    bivedoctor.ru
    gramedic.ru
    doctorypan.ru
    bodoctor.ru
    doctorimil.ru
    doctorinny.ru
    wastmedic.ru
    anchmedic.ru
    doctorkkie.ru
    medicshopstiv.ru
    namedicshopsq.ru
    womedicshopsw.ru
    medicshopsinw.ru
    eamedicshopsv.ru
    medicshopswdv.ru
    medicshopsavw.ru
    medicshopsalv.ru
    nimedicshopsw.ru
    memedicshopsq.ru
    limedicshopsv.ru
    medicshopsksw.ru
    mimedicshopsv.ru
    medicshopsdwq.ru
    medicshopsanq.ru
    medicshopsnsw.ru
    medicshopsiav.ru
    bemedicshopsv.ru
    medicshopsdnq.ru
    ivmedicshopsv.ru
    medicshopsstw.ru
    medicshopslhv.ru
    pamedicshopsw.ru
    medicshopsabv.ru
    prmedicshopsw.ru
    pemedicshopsq.ru
    famedicshopsv.ru
    afmedicshopsw.ru
    medicshopsewv.ru
    medicshopsldw.ru
    dimedicshopsv.ru
    temedicshopsv.ru
    opmedicshopsv.ru
    stmedicshopsq.ru
    lamedicshopsq.ru
    shmedicshopsv.ru
    medicshopsdiq.ru
    medicshopsdev.ru
    sumedicshopsw.ru
    medicshopshav.ru
    anmedicshopsw.ru
    clmedicshopsv.ru

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  21. User picture
    • SuperHero58 (not verified) on Sat 06 Nov 2010
    • 07:40:28 PM UTC

    `

    Rated!

  22. User picture
    • c۞g on Thu 03 Feb 2011
    • 08:43:11 PM UTC

    RE: Pharmacy Express

    NameServers:
    dogdns.com
    movie4dns.com


    SCAM online pharmacies:

    List of domains/hosts:

    doctoroner.com
    desdoctor.ru
    ascdoctor.ru
    doctoriee.ru
    toradoctor.com
    therdoctor.com
    surdoctor.ru
    reicdoctor.ru
    doctordepl.ru
    scoudoctor.ru
    doctoref.com
    doctoraq.ru
    doctorized.ru
    doctordele.com
    covdoctor.com
    doctorec.com
    doctorfdom.com
    sasdoctor.ru
    medicdour.ru
    pasdoctor.ru
    redoctor.ru
    medicerab.ru
    quetdoctor.ru
    doctorce.ru
    peldoctor.ru
    mediclipp.ru
    shisdoctor.ru
    doctordici.ru
    dodoctor.ru
    akdoctor.ru
    krodoctor.ru
    medicznes.ru
    doctorgyny.ru
    hamdoctor.com
    monsdoctor.ru
    doctorisab.com
    ootadoctor.ru
    doctorlew.ru
    ansndoctor.ru
    combdoctor.ru
    mediciler.ru
    medicllie.ru
    doctorernw.ru
    medicerye.ru
    aqudoctor.ru
    medicneba.ru
    medicelev.ru
    medicdysl.ru
    doctordy.ru
    dimedicz.ru
    inesdoctor.com
    lackamedic.ru
    esmedicz.ru
    simedicz.ru
    inclmedic.ru
    togilmedic.ru
    nihmedic.ru
    doctorenes.com
    medicwnta.ru
    merrmedic.ru
    wrynmedic.ru
    oridoctor.com
    emamedic.ru
    medicuggl.ru
    catmedic.ru
    pomedicz.ru
    wagomedic.ru
    medicrtia.ru
    hitmedic.ru
    medicness.ru
    dgamedic.ru
    aduadmedic.ru
    lacqmedic.ru
    verdoctor.com
    stepmedic.ru
    cheromedic.ru
    citemedic.ru
    nemedicz.ru
    toadoctor.com
    suldoctor.com
    medicsion.ru
    marramedic.ru
    annemedic.ru
    medicreti.ru
    agodoctor.com
    medimedic.ru
    dagmedic.ru
    imidmedic.ru
    strdoctor.com
    javdoctor.com
    ketodoctor.com
    larymmedic.ru
    abimedicz.ru
    calmedic.ru
    prmedicz.ru
    drmedicz.ru
    frmedicz.ru
    desmedicz.ru
    medictesy.ru
    cgomedic.ru
    medmedicz.ru
    inmedicz.ru
    himedicz.ru
    bamedicz.ru
    medicsser.ru
    copamedic.ru

    FAKE payment processor:

    onlinepaymentsite.com

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  23. User picture
    • c۞g on Thu 03 Feb 2011
    • 08:44:05 PM UTC

    RE: Pharmacy Express

    List of domains/hosts:

    didmedic.com
    hadmedic.com
    dadmedic.com
    cidmedic.com
    godmedic.com
    awdmedic.com
    apdmedic.com
    fedmedic.com
    cldmedic.com
    ardmedic.com
    doctorticu.com
    doctorteur.com
    doctorrkin.com
    doctorrfix.com
    doctorlase.com
    doctormist.com
    doctormiso.com
    doctornker.com
    drugstoretr3.com
    pharmacygl23.com
    drugstores17.com
    medicineel18.com
    drugstores23.com
    drugstoretr9.com
    drugstoretr23.com
    pharmacymp3.com
    pharmacymp9.com
    pharmacymp22.com
    drugstoress8.com
    pharmacygl22.com
    medicineel23.com
    pharmacygl8.com
    drugstores22.com
    drugstoretr8.com
    drugstoretr22.com

    Scam payment processor:
    118.192.6.175
    epayonlineservice.com

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  24. User picture
    • Anonymous on Mon 27 Dec 2010
    • 10:42:53 AM UTC

    RE: Pharmacy Express

    Thx. Rated the new ones!

  25. User picture
    • Arcade™ (not verified) on Mon 27 Dec 2010
    • 04:04:34 PM UTC

    RE: Pharmacy Express

    Rated and commented, thanks

  26. User picture
    • c۞g on Thu 03 Feb 2011
    • 08:45:56 PM UTC

    RE: Pharmacy Express

    Spam wiki reference: http://spamtrackers.eu/wiki/index.php/Pharmacy_Express

    SCAM pharmacies:
    syntmedic.com
    subpmedic.com

    Spamvertised domains:

    List of domains/hosts:

    doctorropo.ru
    doctorndue.com
    sdoctorlands.ru
    ododoctor.ru
    doctorkena.ru
    undedoctor.ru
    doctorcros.ru
    boydoctor.ru
    rosdoctor.com
    offidoctor.ru
    doctorci.com
    ciphdoctor.ru
    turedoctor.ru
    sdoctorlist.ru
    aledoctor.ru
    capidoctor.ru
    doctorrosi.ru
    obedoctor.com
    doctorurei.ru
    doctorsity.ru
    doctorimac.ru
    doctorerab.ru
    susudoctor.ru
    condoctor.ru
    stidoctor.ru
    bendoctor.com
    brosdoctor.ru
    toudoctor.ru
    relldoctor.ru
    lydoctor.com
    doctoremmy.ru
    myrdoctor.ru
    macedoctor.ru
    cladoctor.ru
    kridoctor.ru
    sdoctorlynn.ru
    eendoctor.ru
    sdoctortion.ru
    arwodoctor.ru
    decdoctor.ru
    doctorteer.ru
    gludoctor.ru
    botdoctor.ru
    doctormily.ru
    angedoctor.com
    ealdoctor.ru
    doctorlant.ru
    adrdoctor.ru
    doctorngee.ru
    ingadoctor.com
    twdoctor.com
    sdoctorerin.ru
    medicfita.ru
    voyemedic.com
    apemedic.com
    doremedic.ru
    willmedic.ru
    tunnmedic.com
    flybmedic.ru
    flatmedic.ru
    omemedic.com
    medicdrow.ru
    mediclehi.ru
    totamedic.ru
    sparmedic.ru
    mediceral.ru
    quammedic.ru
    subtmedic.ru
    roxmedic.com
    noctmedic.ru
    medicesta.ru
    warstmedic.ru
    biplmedic.ru
    humpemedic.ru
    grammedic.ru
    jewemedic.com
    erglomedic.ru
    digemedic.ru
    cradmedic.ru
    fletimedic.ru
    mediccust.ru
    pgdmedic.com
    medicnasu.ru
    medicraly.ru
    ereremedic.ru
    ainarmedic.ru
    medicnail.ru
    medicrive.ru
    brilmedic.ru
    medictrat.ru
    blinemedic.ru
    medicxyli.ru
    medicbran.ru
    drilmedic.ru
    medicment.ru
    medicpedl.ru
    medicside.ru
    ostemedic.com
    medicpico.ru
    publmedic.ru
    paulmedic.ru
    octomedic.com
    butamedic.com
    medicckli.ru
    virilmedic.ru

    Utilizes epayonlineservice.com for the "payment processor" - previously posted

    [edit]
    more spamvertised domains:

    List of domains/hosts:

    doctorsse.ru
    doctorude.ru
    shqdoctor.ru
    dirdoctor.ru
    camidoctor.ru
    brtdoctor.ru
    doctormber.ru
    doctorns.ru
    stodoctor.ru
    likdoctor.ru
    mardoctor.ru
    doctormpor.ru
    biedoctor.ru
    phodoctor.ru
    doctorambe.ru
    doctorene.ru
    doctorwnes.ru
    doctorlder.ru
    doctorupla.ru
    doctortler.ru
    suqdoctor.ru
    faudoctor.ru
    pulsdoctor.ru
    lydoctor.ru
    doctorower.ru
    sbodoctor.ru
    kasdoctor.ru
    doctoramah.ru
    wiledoctor.ru
    fandoctor.ru
    doctornie.ru
    doctorsu.ru
    abadoctor.ru
    excdoctor.ru
    doctormoe.ru
    doctornae.ru
    doctorgete.ru
    midoctor.ru
    maadoctor.ru
    godoctor.ru
    pridoctor.ru
    haqdoctor.ru
    doctorminu.ru
    doctormee.ru
    reefdoctor.ru

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I