Check out our new Mobile App

Форум

  1. Изображение пользователя
    • alphacentauri on Вск 22 Авг 2010
    • 12:53:31

    Pharmacy Express

    These are domains for the "Pharmacy Express" Russian scam pharma affiliate program (not to be confused with the actual pharmacy called Pharmacy Express, located at the address these sites put on their forged pharmacy license).

    Despite the head of their affiliate program, Leo Kuvayev, being in prison charge with 50 counts of raping children lured from a Russian orphanage, the affiliate program is going strong. I noticed that some of these domains were rated as "spam" by other reviewers, though many had no other ratings than mine from what I could see. (I haven't rated all of them; I'm not qualified for bulk posting here yet.)

    I think a stronger designation than "spam" is called for. Gevalia Coffee spams, but I wouldn't be afraid they will steal my credit card number or send me arsenic-laced gravel and call it coffee. These sites do much worse than just "spam."

    List of domains/hosts:

    edit: removed 5 year old stale domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

Комментарии:

  1. Изображение пользователя
    • Bob Zenith (Не проверено) on Вск 22 Авг 2010
    • 13:11:17

    reference link

    Here's the Spam Wiki reference link:
    http://www.spamtrackers.eu/wiki/index.php/Pharmacy...

  2. Изображение пользователя
    • SuperHero58 (Не проверено) on Вск 22 Авг 2010
    • 14:26:43

    @ AlphaCentauri

    thank you RED> with a strong comment

  3. Изображение пользователя
    • SuperHero58 (Не проверено) on Вск 22 Авг 2010
    • 14:30:53

    @ Bob Zenith

    thank you for such a great article link ===== I have learned quite a lot by articles like this one , and at the same time it worries me this Russian mafia ======

  4. Изображение пользователя
    • c۞g on Вск 22 Авг 2010
    • 16:45:08

    re: Pharmacy Express

    I see these domains use a different site template compared to my last screen capture

    A few servers [Fedora] not listed:
    breavdns.com
    daftdns.com
    gruedns.com
    bagwdns.com

    FAKE pharmacies not listed:
    vapharmacye.com

    The shopping cart is courtesy of:
    cartinternetsite.com - whois created: 30 June 2010
    notice the lack of SSL
    and the phone number: +1-888-738-9650 - spamhaus.org
    It's also viewable on this fake Generic ED site: paymeddirect.com where at the bottom left you'll see reference back to: Fortex Investments LTD aka: fortexltd.com

    Oh!
    Rated and thanks!

    [EDIT]
    minor edit nothing changed

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

    • Изображение пользователя
      • alphacentauri on Вск 22 Авг 2010
      • 17:36:36

      @g7w

      > I see these domains use a different site template compared to my last screen capture

      I haven't tried loading through a proxy, so I don't know if the American flag image is presented to visitors from other countries.

      There is some uproar in Russia right now, not only because Kuvayev has been jailed (and presumably every computer that can be traced to him has been seized), but because someone hacked or claims to have hacked Chronopay, a major online payment processor in Russia ( http://www.chronopay.com/en/ ). Chronopay handles lots of legitimate companies, but also pornography sites (allegedly including child pornography) and many other blackhat activities. Supposedly, they handled payments for all the scam pharma affiliate programs other than Glavmed (Canadian Pharmacy). The hackers have been posting blogs on livejournal (that get taken down as fast as they are posted) that appear to indicate the breach was real and was significant -- they have recordings of telephone calls, including one in which one of their officers is talking to his lawyer about suing Brian Krebs, the reporter who tied Chronopay to a rogue antivirus software operation.

      The scammers have operated with impunity only because they did not appear to be scamming Russians -- some of the trojans they use to create their botnets will abort installation if they detect Cyrillic keyboards, for instance. But they have no idea how much data was taken from Chronopay, and the hackers say they will only reveal password to the data to law enforcement agencies. So bottom line, they're nervous, and they've got reason to want to emphasize the fact that they're targeting Americans, not Russians.

      > FAKE pharmacies not listed:
      > vapharmacye.com

      Thanks. There are actually lots more, so everybody: have at 'em. (I'm so looking forward to being able to bulk post and spend time finding them instead of posting reviews one at a time :) )

      > The shopping cart is courtesy of:
      > cartinternetsite.com - whois
      >
      > created: 30 June 2010
      > notice the lack of SSL

      Thanks for that, too. I'm not confident enough to enable javascript on a site like this yet.

      > and the phone number: +1-888-738-9650 - spamhaus.org

      LOL!

      > It's also viewable on this fake Generic ED site: paymeddirect.com where at the bottom left you'll see reference back to:
      > Fortex Investments LTD aka: fortexltd.com

      That's a famous address, too: Harley Street 29, Suite B London, UK
      I guess it's the equivalent of Mailboxes Etc., because all kinds of companies use that suite number, including numerous scammers.

      One of the best known:

      Domain: spamit.com - Domain History
      Cache Date: 2008-01-17
      Registrar: INTERCOSMOS MEDIA GROUP, INC. D/B/A DIRECTNIC.COM

      Registrant:
      MEDIA CAPITAL LTD
      Suite B, 29 Harley street
      London, NA W1G 9QR
      GB
      4402070604540

      Domain Name: SPAMIT.COM

      Administrative Contact:
      Smirnov, Andrey admin@spamit.com
      Suite B, 29 Harley street
      London, NA W1G 9QR
      GB
      4402070604540

      Spamit is the evil twin of Glavmed -- both have "Canadian Pharmacy" sites, but Glavmed claims not to spam. Andrey Smirnov, however, is employed by Glavmed and is an admin on their affiliate forum. He claims Glavmed is unrelated to Spamit. I think the claim is pretty ludicrous, as the Spamit site templates change in response to information given to Andrey. If Spamit affiliates were stealing their templates, as he claims, it would be trivial to find out which Glavmed affiliate was giving it to them by concealing minor differences in the code of a site that large. And if they used his name to register their domain name, he could take possession of the name whenever he chose -- it would be an incredibly stupid move if Spamit were just trying to annoy a competitor.

      Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  5. Изображение пользователя
    • TheBonobo4 on Вск 22 Авг 2010
    • 16:32:52

    Rated accordingly.

    Rated accordingly.

    Platinum Level Member of the WOT Community. If you see an incorrect rating of mine please feel free to point it out so I can amend it. However, if you don't state the URL(s) of the site(s) you wish me to fix, or if you spam my board, your message will in

  6. Изображение пользователя
    • -Saad- on Пнд 23 Авг 2010
    • 03:17:54

    Thanks. Rated.

    Thanks. Rated.

  7. Изображение пользователя
    • alphacentauri on Срд 01 Сен 2010
    • 02:26:28

    here are some more

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  8. Изображение пользователя
    • SuperHero58 (Не проверено) on Пнд 30 Авг 2010
    • 06:57:23

    -

    AlphaCentaur = thank you ------ RATED!

  9. Изображение пользователя
    • alphacentauri on Срд 01 Сен 2010
    • 02:25:00

    more Pharmacy Express

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  10. Изображение пользователя
    • Anonymous on Срд 01 Сен 2010
    • 17:59:41

    more

    mediclu.com
    medicfi.com
    wafmedic.com
    etemedic.com

  11. Изображение пользователя
    • alphacentauri on Чтв 02 Сен 2010
    • 08:20:27

    well that was a waste

    I just noticed there are "noindex" tags on the scorecards. No point putting links here, as the search engines will never pick them up.

    Too bad. The SiteAdvisor pages are often the number one result when someone googles the name of a bad domain, but they don't always have accurate ratings, especially for sites that are fraudulent rather than phish or malware. I guess there is a concern about google caching ratings and comments that the users have subsequently changed. But I should think there would be a way to have enough of the page crawled to allow people to find it, even if the ratings aren't cached.

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  12. Изображение пользователя
    • Anonymous on Чтв 02 Сен 2010
    • 08:42:02

    I think

    I think the problem could be solved if wot would enable profile viewing without having to register.

  13. Изображение пользователя
    • alphacentauri on Чтв 02 Сен 2010
    • 12:12:50

    They're actively blocking search engines

    It's not just that the links in the profiles aren't visible without registration. Although this forum is indexed by search engines, the html code in the scorecards has a command telling search engines not to index those pages. My live links to scorecards here still won't get them indexed.

    Here are some more links. These are not pharmacies, and I don't recommend visiting them. I noticed that one of the domains above looked different in the blurred picture on the scorecard and checked it again. They're using pages of zoo and lolita porn to link to Pharmacy Express sites. These pages all share the same IP:

    edit: removed old domain list

    (Reported to cybertipline)

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  14. Изображение пользователя
    • alphacentauri on Сбт 04 Сен 2010
    • 06:18:15

    More

    I don't think these have been listed above. Most of these are thanks to Nodus, a member at InboxRevenge.com:

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  15. Изображение пользователя
    • alphacentauri on Сбт 04 Сен 2010
    • 06:30:14

    a few more

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  16. Изображение пользователя
    • c۞g on Чтв 03 Фев 2011
    • 20:40:56

    also

    List of domains/hosts:

    ovmedic.com
    growtmed.ru
    druglith.ru
    caumedic.com
    bromedic.com
    diximedic.com
    pharmacyog.com
    highdoctor.com
    ableo.in
    autho.in
    revdrug.ru
    uppermedworld.com

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  17. Изображение пользователя
    • c۞g on Сбт 04 Сен 2010
    • 16:37:18

    payment gateway

    shopping cart at: paycartservice.com - whois | DNS - created 28 August 2010 sitting on IP: 95.169.187.91

    paycartservice.com

    Screen capture

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  18. Изображение пользователя
    • alphacentauri on Вск 19 Сен 2010
    • 20:32:01

    These are the currently

    These are the currently active domains I can find (sorry, unable to dedupe with lists already posted)

    edit: removed old domain list

    Yes, WOT has a wiki. Check there first for fast answers to many questions like "Why is my site rated red, and how do I fix that?"

  19. Изображение пользователя
    • Anonymous on Пнд 20 Сен 2010
    • 01:43:12

    This list is just mind

    This list is just mind boggling.
    Been trying to rate a few now and then, may take awhile.

  20. Изображение пользователя
    • c۞g on Чтв 03 Фев 2011
    • 20:42:04

    flukpills.com

    SCAM online pharmacy: flukpills.com - whois - DNS sitting on IP: 200.160.238.187
    200.160.238.187
    flukpills.com

    FAKE payment processor: payquickonline.com - whois - DNS sitting on IP: 88.255.78.22
    88.255.78.22
    payquickonline.com

    Spamvertised domains that redirect to flukpills.com
    (normally used in spam email links)

    List of domains/hosts:

    usuamedic.ru
    medictuni.ru
    cavmedic.ru
    abelymedic.ru
    medicryop.ru
    medicpboa.ru
    enmmedic.ru
    medicfusi.ru
    medicmili.ru
    medicotry.ru
    capmedic.ru
    medicbeck.ru
    ramemedic.ru
    merbmedic.ru
    medicshot.ru
    busbmedic.ru
    wastwmedic.ru
    medichand.ru
    mediccoll.ru
    sondmedic.ru
    orumedic.ru
    medicnate.ru
    nonsmedic.ru
    karamedic.ru
    medicosed.ru
    litwmedic.ru
    pushbmedic.ru
    datmedic.ru
    consmedic.ru
    panmedic.ru
    permedic.ru
    auramedic.ru
    sweamedic.ru
    medicersi.ru
    medicized.ru
    minwmedic.ru
    petiomedic.ru
    carrimedic.ru
    cytmedic.ru
    medicperm.ru
    medicnect.ru
    medicopti.ru
    wingtmedic.ru
    medicnctu.ru
    midrmedic.ru
    janemedic.ru
    medicwcyst.ru
    doctoresta.ru
    essinmedic.ru
    doctordema.ru
    utmedic.ru
    doctorlc.ru
    doctorip.ru
    bidoctor.ru
    lindoctor.ru
    medicoist.ru
    medicraul.ru
    doctorft.ru
    doctorlase.ru
    mondoctor.ru
    doctordr.ru
    medicllyw.ru
    spedoctor.ru
    bivedoctor.ru
    gramedic.ru
    doctorypan.ru
    bodoctor.ru
    doctorimil.ru
    doctorinny.ru
    wastmedic.ru
    anchmedic.ru
    doctorkkie.ru
    medicshopstiv.ru
    namedicshopsq.ru
    womedicshopsw.ru
    medicshopsinw.ru
    eamedicshopsv.ru
    medicshopswdv.ru
    medicshopsavw.ru
    medicshopsalv.ru
    nimedicshopsw.ru
    memedicshopsq.ru
    limedicshopsv.ru
    medicshopsksw.ru
    mimedicshopsv.ru
    medicshopsdwq.ru
    medicshopsanq.ru
    medicshopsnsw.ru
    medicshopsiav.ru
    bemedicshopsv.ru
    medicshopsdnq.ru
    ivmedicshopsv.ru
    medicshopsstw.ru
    medicshopslhv.ru
    pamedicshopsw.ru
    medicshopsabv.ru
    prmedicshopsw.ru
    pemedicshopsq.ru
    famedicshopsv.ru
    afmedicshopsw.ru
    medicshopsewv.ru
    medicshopsldw.ru
    dimedicshopsv.ru
    temedicshopsv.ru
    opmedicshopsv.ru
    stmedicshopsq.ru
    lamedicshopsq.ru
    shmedicshopsv.ru
    medicshopsdiq.ru
    medicshopsdev.ru
    sumedicshopsw.ru
    medicshopshav.ru
    anmedicshopsw.ru
    clmedicshopsv.ru

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  21. Изображение пользователя
    • SuperHero58 (Не проверено) on Сбт 06 Ноя 2010
    • 19:40:28

    `

    Rated!

  22. Изображение пользователя
    • c۞g on Чтв 03 Фев 2011
    • 20:43:11

    RE: Pharmacy Express

    NameServers:
    dogdns.com
    movie4dns.com


    SCAM online pharmacies:

    List of domains/hosts:

    doctoroner.com
    desdoctor.ru
    ascdoctor.ru
    doctoriee.ru
    toradoctor.com
    therdoctor.com
    surdoctor.ru
    reicdoctor.ru
    doctordepl.ru
    scoudoctor.ru
    doctoref.com
    doctoraq.ru
    doctorized.ru
    doctordele.com
    covdoctor.com
    doctorec.com
    doctorfdom.com
    sasdoctor.ru
    medicdour.ru
    pasdoctor.ru
    redoctor.ru
    medicerab.ru
    quetdoctor.ru
    doctorce.ru
    peldoctor.ru
    mediclipp.ru
    shisdoctor.ru
    doctordici.ru
    dodoctor.ru
    akdoctor.ru
    krodoctor.ru
    medicznes.ru
    doctorgyny.ru
    hamdoctor.com
    monsdoctor.ru
    doctorisab.com
    ootadoctor.ru
    doctorlew.ru
    ansndoctor.ru
    combdoctor.ru
    mediciler.ru
    medicllie.ru
    doctorernw.ru
    medicerye.ru
    aqudoctor.ru
    medicneba.ru
    medicelev.ru
    medicdysl.ru
    doctordy.ru
    dimedicz.ru
    inesdoctor.com
    lackamedic.ru
    esmedicz.ru
    simedicz.ru
    inclmedic.ru
    togilmedic.ru
    nihmedic.ru
    doctorenes.com
    medicwnta.ru
    merrmedic.ru
    wrynmedic.ru
    oridoctor.com
    emamedic.ru
    medicuggl.ru
    catmedic.ru
    pomedicz.ru
    wagomedic.ru
    medicrtia.ru
    hitmedic.ru
    medicness.ru
    dgamedic.ru
    aduadmedic.ru
    lacqmedic.ru
    verdoctor.com
    stepmedic.ru
    cheromedic.ru
    citemedic.ru
    nemedicz.ru
    toadoctor.com
    suldoctor.com
    medicsion.ru
    marramedic.ru
    annemedic.ru
    medicreti.ru
    agodoctor.com
    medimedic.ru
    dagmedic.ru
    imidmedic.ru
    strdoctor.com
    javdoctor.com
    ketodoctor.com
    larymmedic.ru
    abimedicz.ru
    calmedic.ru
    prmedicz.ru
    drmedicz.ru
    frmedicz.ru
    desmedicz.ru
    medictesy.ru
    cgomedic.ru
    medmedicz.ru
    inmedicz.ru
    himedicz.ru
    bamedicz.ru
    medicsser.ru
    copamedic.ru

    FAKE payment processor:

    onlinepaymentsite.com

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  23. Изображение пользователя
    • c۞g on Чтв 03 Фев 2011
    • 20:44:05

    RE: Pharmacy Express

    List of domains/hosts:

    didmedic.com
    hadmedic.com
    dadmedic.com
    cidmedic.com
    godmedic.com
    awdmedic.com
    apdmedic.com
    fedmedic.com
    cldmedic.com
    ardmedic.com
    doctorticu.com
    doctorteur.com
    doctorrkin.com
    doctorrfix.com
    doctorlase.com
    doctormist.com
    doctormiso.com
    doctornker.com
    drugstoretr3.com
    pharmacygl23.com
    drugstores17.com
    medicineel18.com
    drugstores23.com
    drugstoretr9.com
    drugstoretr23.com
    pharmacymp3.com
    pharmacymp9.com
    pharmacymp22.com
    drugstoress8.com
    pharmacygl22.com
    medicineel23.com
    pharmacygl8.com
    drugstores22.com
    drugstoretr8.com
    drugstoretr22.com

    Scam payment processor:
    118.192.6.175
    epayonlineservice.com

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I

  24. Изображение пользователя
    • Anonymous on Пнд 27 Дек 2010
    • 10:42:53

    RE: Pharmacy Express

    Thx. Rated the new ones!

  25. Изображение пользователя
    • Arcade™ (Не проверено) on Пнд 27 Дек 2010
    • 16:04:34

    RE: Pharmacy Express

    Rated and commented, thanks

  26. Изображение пользователя
    • c۞g on Чтв 03 Фев 2011
    • 20:45:56

    RE: Pharmacy Express

    Spam wiki reference: http://spamtrackers.eu/wiki/index.php/Pharmacy_Express

    SCAM pharmacies:
    syntmedic.com
    subpmedic.com

    Spamvertised domains:

    List of domains/hosts:

    doctorropo.ru
    doctorndue.com
    sdoctorlands.ru
    ododoctor.ru
    doctorkena.ru
    undedoctor.ru
    doctorcros.ru
    boydoctor.ru
    rosdoctor.com
    offidoctor.ru
    doctorci.com
    ciphdoctor.ru
    turedoctor.ru
    sdoctorlist.ru
    aledoctor.ru
    capidoctor.ru
    doctorrosi.ru
    obedoctor.com
    doctorurei.ru
    doctorsity.ru
    doctorimac.ru
    doctorerab.ru
    susudoctor.ru
    condoctor.ru
    stidoctor.ru
    bendoctor.com
    brosdoctor.ru
    toudoctor.ru
    relldoctor.ru
    lydoctor.com
    doctoremmy.ru
    myrdoctor.ru
    macedoctor.ru
    cladoctor.ru
    kridoctor.ru
    sdoctorlynn.ru
    eendoctor.ru
    sdoctortion.ru
    arwodoctor.ru
    decdoctor.ru
    doctorteer.ru
    gludoctor.ru
    botdoctor.ru
    doctormily.ru
    angedoctor.com
    ealdoctor.ru
    doctorlant.ru
    adrdoctor.ru
    doctorngee.ru
    ingadoctor.com
    twdoctor.com
    sdoctorerin.ru
    medicfita.ru
    voyemedic.com
    apemedic.com
    doremedic.ru
    willmedic.ru
    tunnmedic.com
    flybmedic.ru
    flatmedic.ru
    omemedic.com
    medicdrow.ru
    mediclehi.ru
    totamedic.ru
    sparmedic.ru
    mediceral.ru
    quammedic.ru
    subtmedic.ru
    roxmedic.com
    noctmedic.ru
    medicesta.ru
    warstmedic.ru
    biplmedic.ru
    humpemedic.ru
    grammedic.ru
    jewemedic.com
    erglomedic.ru
    digemedic.ru
    cradmedic.ru
    fletimedic.ru
    mediccust.ru
    pgdmedic.com
    medicnasu.ru
    medicraly.ru
    ereremedic.ru
    ainarmedic.ru
    medicnail.ru
    medicrive.ru
    brilmedic.ru
    medictrat.ru
    blinemedic.ru
    medicxyli.ru
    medicbran.ru
    drilmedic.ru
    medicment.ru
    medicpedl.ru
    medicside.ru
    ostemedic.com
    medicpico.ru
    publmedic.ru
    paulmedic.ru
    octomedic.com
    butamedic.com
    medicckli.ru
    virilmedic.ru

    Utilizes epayonlineservice.com for the "payment processor" - previously posted

    [edit]
    more spamvertised domains:

    List of domains/hosts:

    doctorsse.ru
    doctorude.ru
    shqdoctor.ru
    dirdoctor.ru
    camidoctor.ru
    brtdoctor.ru
    doctormber.ru
    doctorns.ru
    stodoctor.ru
    likdoctor.ru
    mardoctor.ru
    doctormpor.ru
    biedoctor.ru
    phodoctor.ru
    doctorambe.ru
    doctorene.ru
    doctorwnes.ru
    doctorlder.ru
    doctorupla.ru
    doctortler.ru
    suqdoctor.ru
    faudoctor.ru
    pulsdoctor.ru
    lydoctor.ru
    doctorower.ru
    sbodoctor.ru
    kasdoctor.ru
    doctoramah.ru
    wiledoctor.ru
    fandoctor.ru
    doctornie.ru
    doctorsu.ru
    abadoctor.ru
    excdoctor.ru
    doctormoe.ru
    doctornae.ru
    doctorgete.ru
    midoctor.ru
    maadoctor.ru
    godoctor.ru
    pridoctor.ru
    haqdoctor.ru
    doctorminu.ru
    doctormee.ru
    reefdoctor.ru

    ∞ Opto, ergo sum _https://en.wikipedia.org/wiki/And_You_and_I