Redirections hoping to be unrated

[MarkGiles]

Often I come across spams promoting a fake pharmacy, for example, where the URL does not load the site, but goes via a redirection to the actual target site.

Why do they do this?
It is because they know that WOT members will give the spammed URL a bad rating. But because the redirection goes to the real target site, they hope that we will not notice, and the real site does not get rated.

However, the game is up. This "hide the real site" method has got to take the heat.

This thread has been created so that the target sites that we discover can be put up for others to review, and their subtle attempt to hide will fail.

[MarkGiles]

Targets


toppills.su
bestmeds.su
hotpharm.su
sweetstock.su
shopyourdream.su
topbestweb.su
724pharmonline.at


Two sample redirections

eleanoreterri.ru toppills.su
janeczkadina.ru toppills.su

maryjanejill.ru bestmeds.su
renellblithe.ru bestmeds.su

lannyallsun.eu hotpharm.su
tamerabree.ru hotpharm.su

lennanicole.ru sweetstock.su
romolaaggy.ru sweetstock.su

patricaiolanthe.ru shopyourdream.su
zoedasiepooh.ru shopyourdream.su

nanetegillykial.ru topbestweb.su
teressacorabella.ru topbestweb.su

superrxday.ru www.724pharmonline.at
724pharm.com www.724pharmonline.at

Registrars and fraud type

toppills.su Canadian_Pharmacy_2001 ARDIS-SU
bestmeds.su CANADA-PHARMACY ARDIS-SU
hotpharm.su Canadian Pharmacy ARDIS-SU
sweetstock.su Canadian Pharmacy ARDIS-SU
shopyourdream.su CANADA-PHARMACY ARDIS-SU
topbestweb.su Canadian_Pharmacy_2001 ARDIS-SU

724pharmonline.at Canadian Pharmacy Online EuroDNS SA

The fraud type follows the naming convention of fraud-reports

[Dr-Flay]

redirects and landing pages are used for several reasons. Tracking and injecting malware are most common.
They also change often as they are disposable.
As long as people rate the domain they land on, that is the important domain.