"Canadian Pharmacy" domains

[alphacentauri]

This brand definitely deserves its own thread. They register thousands of domains, and only MyWOT can rate them fast enough to make a difference. They already get lots of ratings for spamming. But their websites are dangerously fraudulent -- they automatically put free tabs of :"viagra" in with every order, even orders for drugs that have potentially lethal interactions with viagra. While it's possible none of their drugs are ever real, it's also possible they're sometimes real and sometimes placebos.

Most of their domains are rated as "spam" from Joe Wein's lists, but they're much worse than that.

[red]mightysuch.com[/red]

isn't spammed. They hacked a legitimate website and inserted a file redirecting to mightysuch.com, then spammed that URL. The particular link I got was to a site whose registration information say the domain is available, so I guess I was seeing a cached copy and the domain owner has already lost his website.

The Canadian Pharmacy spammers do a lot of hacking websites to insert pages with redirections to their sites. They often insert copies of malware on the same sites and use phishing to try to get people to download them. They were heavily into Storm Worm when that was popular.

Here's some more that use the same nameservers:
[red]devoutpaint.com
shorttangy.com
ownequate.com
hugeduring.com
finestslip.com
scoreput.com[/red]

And some a little older
[massrate][red]catchtell.ru
casesecond.ru
wordbegan.ru
palatetell.ru
yardpull.ru
linehow.ru
steadwide.ru
secondhuge.ru
circleshoe.ru
lifewealth.ru
rollhouse.ru
heavybe.ru
croplowly.ru
runspeed.ru
goodmajor.ru
leadfamous.ru
daringthree.ru
alivethink.ru
huntchaste.ru
tieback.ru
lostshell.ru
yeshour.ru
toogroup.ru
helpobject.ru
figtoo.ru
shellmind.ru
creamytangy.ru
fruitfigure.ru
fruitcloud.ru
ranunique.ru
hatloving.ru
serenefriend.ru
hurryso.ru
appearhome.ru
winghope.ru
birdfor.ru
longdevout.ru
overselect.ru
whilemeek.ru
voiceride.ru
devoutslip.ru
rockraise.ru
dressnew.ru
downpearl.ru
sliptrue.ru
onlysubtle.ru
offerpound.ru
prefersudden.ru
speechsettle.ru
spreadfrom.ru
mustpress.ru
cottonsingle.ru
liftstar.ru
behindlarge.ru
littleliquid.ru
cellpush.ru
ropesoft.ru
iscase.ru
palatethey.ru
poserather.ru
seemlystring.ru
mosttall.ru
starcent.ru
finalideal.ru
tradecreate.ru
wishseat.ru
nameleave.ru
soilas.ru
spicydepend.ru
drinkpoem.ru
givinglaugh.ru
magnetalert.ru
placehard.ru
spicespruce.ru
chordgame.ru
mightyhow.ru
tallwhose.ru
mixtruck.ru
duckquick.ru
exactbeats.ru
juicyanimal.ru
landcreamy.ru
leasttoward.ru
weightover.ru
treebits.ru
fourcrowd.ru
birdpaper.ru
lotvary.ru
frontmiddle.ru
beginand.ru
finishhim.ru
driveold.ru
exoticdo.ru
soilactive.ru
northapple.ru
figtell.ru
searchagree.ru
centersuperb.ru
piousdivine.ru
colonyrow.ru
singlebut.ru
pairlaugh.ru
iflarge.ru
dropdreamy.ru
tastysmile.ru
trustneed.ru
endbottom.ru
waitthem.ru
neckrose.ru
losthe.ru
marketplane.ru
onceagain.ru
zoomwealth.ru
sittube.ru
suffixlittle.ru
inventuse.ru
drawmunchy.ru
sontender.com
lostwhy.com
dearspoke.com
answeryard.com
sweetslick.com
boughtstream.com
zipchords.com
eitherzest.com
skinsalt.com
plumform.com
helpsweet.com
gavegame.com
fruitear.com
[/red][/massrate]

[alphacentauri]

[red]onlinepharmacygot.com
activeplum.ru
alwayswhich.ru
appearabove.ru
arrivethere.ru
beold.ru
bluepaper.ru
carebottom.ru
chancejob.ru
circleplanet.ru
citypower.ru
closebefore.ru
colonyready.ru
countrise.ru
dimpleif.ru
duckour.ru
eitherwealth.ru
eventseven.ru
everegg.ru
eyemount.ru
facebought.ru
factwent.ru
fairyes.ru
feelat.ru
findhardy.ru
fineclear.ru
giftedcorner.ru
gifteddirect.ru
guessflower.ru
heatfact.ru
himspeed.ru
ifdrool.ru
jewelswim.ru
joinspace.ru
knowwhile.ru
legacybeat.ru
lengthwant.ru
lightscores.ru
maxistream.ru
mixrail.ru
northsame.ru
oceanmade.ru
outfollow.ru
palatedollar.ru
passnine.ru
peopleexact.ru
picklong.ru
planettheir.ru
potentrange.ru
rootfig.ru
rosynext.ru
sharpnight.ru
someown.ru
standcreate.ru
storyhurry.ru
suffixfun.ru
twosheet.ru
vanishperiod.ru
whizthere.ru
wishroot.ru
yulepitch.ru
zoomfeed.ru [/red]

[Guest]

AlphaCentauri - Awesome job , and I do hope these sites become deep red . thank you .

[c۞g]

mightysuch.com shopping cart uses: secure-order-gate.com sitting on IP: 62.141.43.159 - DNS | whois [privacy protected; created 03 Sept 2010] - that has an SSL issued by Comodo (most likely the 30 day free trial) - check Both the domain and the IP can be used to load the shopping cart.

[red]62.141.43.159
secure-order-gate.com[/red]

Screen capture:

[c۞g]

Fake pharmacy:- whois | DNS sitting on IP: 195.14.113.3 (Ukraine) CentralOps Dossier

[red]smartdrugsown.com[/red]

[Guest]

[red]wholesalemedicalbook.com[/red]

[c۞g]

Associated IP's - all are listed at: http://www.surbl.org/

[red]109.168.126.54
195.2.139.31
88.191.96.7
88.208.234.222
94.23.202.33[/red]

[alphacentauri]

I'm not having much luck with finding other domains on the same IPs. I found these, but I'm getting 404's and an occasional parked domain. Are they just blocking my IP -- can anyone else load these?

beauteetconseil.com
bluepaper.ru
comparetesamis.com
comparfacile.com
countrise.ru
cowah.com
cropmoon.ru
fatking.ru
ideedefemmes.com
monthhair.ru
moondad.ru
netwebinternet.ru
opinionfemmes.com
sunlocate.ru
voyagetranquille.com
bluesrockcafe.com
hatchamplace.com
priestfield.com
southeastsurveying.com
nuttypiano.com
waxyshell.com
hkhalil.com

I did find these through nameservers sharing an IP
[red]activeplum.ru
alwayswhich.ru
appearabove.ru
appearask.ru
arrivethere.ru
bandthrow.ru
beatspass.ru
beatssoon.ru
beold.ru
bluepaper.ru
bottomtwo.ru
breadtruck.ru
brownsingle.ru
buysearch.ru
bymaxi.ru
carebottom.ru
caringself.ru
chancejob.ru
circleplanet.ru
citypower.ru
closebefore.ru
colonyready.ru
countrise.ru
dimpleif.ru
duckour.ru
eitherwealth.ru
eventseven.ru
everegg.ru
eyemount.ru
facebought.ru
factwent.ru
fairyes.ru
feedtalk.ru
feelat.ru
findhardy.ru
fineclear.ru
firstport.ru
gatherfast.ru
giftedcorner.ru
gifteddirect.ru
giftedenergy.ru
guessflower.ru
hearbold.ru
heatfact.ru
himspeed.ru
huntgiggle.com
ifdrool.ru
jewelswim.ru
joinspace.ru
knowwhile.ru
legacybeat.ru
lengthwant.ru
lightscores.ru
livelygrand.ru
maxistream.ru
mightfoot.ru
mixrail.ru
modestbusy.ru
moneyperiod.ru
moondad.ru
northsame.ru
oceanmade.ru
outfollow.ru
palatedollar.ru
pamperserve.ru
passnine.ru
peakreach.ru
peopleexact.ru
pharmtopclear.com
pharmultimatebell.com
picklong.ru
planettheir.ru
potentrange.ru
rollthe.ru
rootfig.ru
rosynext.ru
rxstockstudy.com
saildown.ru
seatan.ru
seekeror.ru
sentthough.com
sharpnight.ru
sheetplump.ru
smartdrugsown.com
someown.ru
steampast.ru
storydrive.ru
storyhurry.ru
suffixfun.ru
superrxspicy.com
twentyshare.ru
twosheet.ru
vanishperiod.ru
whizthere.ru
wishroot.ru
yulepitch.ru
zoomfeed.ru[/red]

Interestingly, the IP of the nameserver 208.67.222.222 was shared with
http://collectivestrategies.com
ns2.cstrat.com
an email marketing page which claims to be a subsidiary of Hearst media.

[alphacentauri]

I don't have a way to de-dupe these. This is the list I'm currently finding:
[red]activepalate.ru
addor.ru
alwaysclothe.ru
answerpound.ru
appearbase.ru
applebird.ru
applepull.ru
aromainvent.ru
artabout.ru
awarespread.ru
b7t.ru
basicmodel.ru
beforecoast.ru
birdpaper.ru
boldsudden.ru
borncool.ru
breakrenown.ru
calmprefer.ru
camehad.ru
canheavy.ru
canplural.ru
cellpush.ru
checkvaried.ru
chicbusy.ru
chordcover.ru
clearmodest.ru
copykind.ru
cowvanish.ru
coyblock.ru
coyperson.ru
degreeobject.ru
deluxerun.ru
divinesure.ru
doorbig.ru
doublemulti.ru
drawheart.ru
drawrelax.ru
dreamsuffix.ru
dreamyloud.ru
driveold.ru
drivewinter.ru
easethick.ru
endbottom.ru
equalease.ru
fastleft.ru
fewscores.ru
finalaroma.ru
finalneck.ru
findas.ru
finestlady.ru
firmteach.ru
flairdress.ru
flowerplant.ru
flywide.ru
followclose.ru
forestmodel.ru
freshmodest.ru
fruitprove.ru
gasnorth.ru
gigglevictor.ru
gladheat.ru
glasswatch.ru
gopure.ru
greenrenown.ru
groundlow.ru
handloyal.ru
happyswell.ru
hardyalways.ru
hearhill.ru
heavydecent.ru
heldsmile.ru
hemonth.ru
holdam.ru
homerow.ru
hotcross.ru
howamong.ru
hugeallow.ru
humorlog.ru
huntsoil.ru
jewelopen.ru
ladyyour.ru
landcreamy.ru
ledfeet.ru
legendresult.ru
liftmatter.ru
lighteach.ru
longsettle.ru
lookbeen.ru
lucidtrain.ru
magnetpair.ru
mainagree.ru
marketseed.ru
meatexcept.ru
mightson.ru
mightyphrase.ru
mixafter.ru
moneylake.ru
mylaugh.ru
numbercook.ru
oceancoast.ru
onceagain.ru
oxygenterm.ru
palateseeker.ru
passplus.ru
periodboard.ru
periodpoem.ru
personplay.ru
pharmultimatebell.com
piecemean.ru
pleaseresult.ru
plentyspell.ru
plumpsimple.ru
preferwood.ru
printby.ru
proudcotton.ru
quarthuge.ru
raceneck.ru
racerepeat.ru
readplace.ru
readystood.ru
replycost.ru
restmeet.ru
richport.ru
rosyfair.ru
roundstreet.ru
royalbest.ru
saidelse.ru
secondmusic.ru
secondparty.ru
sereneflip.ru
settleforest.ru
sexydivide.ru
sheetfigure.ru
shellduring.ru
shesky.ru
shopopen.ru
shypaint.ru
sidefavor.ru
silentanimal.ru
singlebut.ru
singlesaid.ru
sittube.ru
skinthose.ru
smileshardy.ru
snowfour.ru
softoh.ru
soilfamous.ru
speedfish.ru
squaretouch.ru
standground.ru
startdirect.ru
stringtire.ru
suffixlittle.ru
swellring.ru
teambetter.ru
tellbreezy.ru
termtangy.ru
thankbuy.ru
themcount.ru
thereabout.ru
thoughwindow.ru
tingleparty.ru
toldboard.ru
toldgarden.ru
toldsong.ru
toldworthy.ru
treeread.ru
truckvaried.ru
trustready.ru
wallraise.ru
weekwin.ru
whereawake.ru
whilefelt.ru
wholesalemedicalbook.com
wholeultra.ru
wildburn.ru
winnerequal.ru
wishof.ru
withsing.ru
witroll.ru
wonderfab.ru
wouldmuch.ru
wrotework.ru
yellowenough.ru
yellowheard.ru
yulecell.ru
yulefield.ru
yulenine.ru
zealvalued.ru
[/red]

[alphacentauri]

[red]artplain.ru
bettercommon.com
callchick.ru
cheapcialiss.com
cialis-sales.com
climbsister.com
cornactive.com
cornthing.com
cottonsummer.com
decidefigure.com
decidetone.ru
directword.ru
divineshall.ru
easegame.ru
eatfair.ru
eggmajor.com
enoughnine.com
firstlate.ru
fiveatom.com
flyabout.ru
forcegrow.com
forestmilk.com
gardenprefer.com
helpmetal.ru
iskey.ru
joyfulfollow.com
letterthen.com
listensuit.ru
listentwenty.com
longgive.ru
meangather.ru
moverfood.ru
neckquiet.ru
noseselect.com
officegold.ru
orjoin.ru
orkept.com
ownbits.com
partyhear.com
provemuch.com
putpalate.com
sawbring.ru
scoreslook.com
scoretruck.com
seemlymatch.ru
selectspruce.com
senselike.com
serenestory.com
setfloor.ru
shelltree.ru
shinelocate.com
slickwisdom.ru
snowstory.ru
sonyellow.com
sooncatch.ru
speakdesire.com
staycow.ru
supplyflat.com
throwtender.com
truckmiddle.ru
undercorn.com
vitalhis.ru
wantfinger.com
weesaw.ru
whomilk.ru
wisheager.com
withmunchy.ru
woodwrote.com
worldcuddly.ru
yourviagrapills.com
[/red]