"Canadian Pharmacy" domains

Post Reply
User avatar
alphacentauri
Posts: 1670
Joined: Mon Nov 02, 2009 12:52 pm

"Canadian Pharmacy" domains

Post by alphacentauri » Fri Sep 03, 2010 1:23 am

This brand definitely deserves its own thread. They register thousands of domains, and only MyWOT can rate them fast enough to make a difference. They already get lots of ratings for spamming. But their websites are dangerously fraudulent -- they automatically put free tabs of :"viagra" in with every order, even orders for drugs that have potentially lethal interactions with viagra. While it's possible none of their drugs are ever real, it's also possible they're sometimes real and sometimes placebos.

Most of their domains are rated as "spam" from Joe Wein's lists, but they're much worse than that.

[red]mightysuch.com[/red]

isn't spammed. They hacked a legitimate website and inserted a file redirecting to mightysuch.com, then spammed that URL. The particular link I got was to a site whose registration information say the domain is available, so I guess I was seeing a cached copy and the domain owner has already lost his website.

The Canadian Pharmacy spammers do a lot of hacking websites to insert pages with redirections to their sites. They often insert copies of malware on the same sites and use phishing to try to get people to download them. They were heavily into Storm Worm when that was popular.

Here's some more that use the same nameservers:
[red]devoutpaint.com
shorttangy.com
ownequate.com
hugeduring.com
finestslip.com
scoreput.com[/red]

And some a little older
[massrate][red]catchtell.ru
casesecond.ru
wordbegan.ru
palatetell.ru
yardpull.ru
linehow.ru
steadwide.ru
secondhuge.ru
circleshoe.ru
lifewealth.ru
rollhouse.ru
heavybe.ru
croplowly.ru
runspeed.ru
goodmajor.ru
leadfamous.ru
daringthree.ru
alivethink.ru
huntchaste.ru
tieback.ru
lostshell.ru
yeshour.ru
toogroup.ru
helpobject.ru
figtoo.ru
shellmind.ru
creamytangy.ru
fruitfigure.ru
fruitcloud.ru
ranunique.ru
hatloving.ru
serenefriend.ru
hurryso.ru
appearhome.ru
winghope.ru
birdfor.ru
longdevout.ru
overselect.ru
whilemeek.ru
voiceride.ru
devoutslip.ru
rockraise.ru
dressnew.ru
downpearl.ru
sliptrue.ru
onlysubtle.ru
offerpound.ru
prefersudden.ru
speechsettle.ru
spreadfrom.ru
mustpress.ru
cottonsingle.ru
liftstar.ru
behindlarge.ru
littleliquid.ru
cellpush.ru
ropesoft.ru
iscase.ru
palatethey.ru
poserather.ru
seemlystring.ru
mosttall.ru
starcent.ru
finalideal.ru
tradecreate.ru
wishseat.ru
nameleave.ru
soilas.ru
spicydepend.ru
drinkpoem.ru
givinglaugh.ru
magnetalert.ru
placehard.ru
spicespruce.ru
chordgame.ru
mightyhow.ru
tallwhose.ru
mixtruck.ru
duckquick.ru
exactbeats.ru
juicyanimal.ru
landcreamy.ru
leasttoward.ru
weightover.ru
treebits.ru
fourcrowd.ru
birdpaper.ru
lotvary.ru
frontmiddle.ru
beginand.ru
finishhim.ru
driveold.ru
exoticdo.ru
soilactive.ru
northapple.ru
figtell.ru
searchagree.ru
centersuperb.ru
piousdivine.ru
colonyrow.ru
singlebut.ru
pairlaugh.ru
iflarge.ru
dropdreamy.ru
tastysmile.ru
trustneed.ru
endbottom.ru
waitthem.ru
neckrose.ru
losthe.ru
marketplane.ru
onceagain.ru
zoomwealth.ru
sittube.ru
suffixlittle.ru
inventuse.ru
drawmunchy.ru
sontender.com
lostwhy.com
dearspoke.com
answeryard.com
sweetslick.com
boughtstream.com
zipchords.com
eitherzest.com
skinsalt.com
plumform.com
helpsweet.com
gavegame.com
fruitear.com
[/red][/massrate]

User avatar
alphacentauri
Posts: 1670
Joined: Mon Nov 02, 2009 12:52 pm

more

Post by alphacentauri » Sat Sep 04, 2010 6:50 am

[red]onlinepharmacygot.com
activeplum.ru
alwayswhich.ru
appearabove.ru
arrivethere.ru
beold.ru
bluepaper.ru
carebottom.ru
chancejob.ru
circleplanet.ru
citypower.ru
closebefore.ru
colonyready.ru
countrise.ru
dimpleif.ru
duckour.ru
eitherwealth.ru
eventseven.ru
everegg.ru
eyemount.ru
facebought.ru
factwent.ru
fairyes.ru
feelat.ru
findhardy.ru
fineclear.ru
giftedcorner.ru
gifteddirect.ru
guessflower.ru
heatfact.ru
himspeed.ru
ifdrool.ru
jewelswim.ru
joinspace.ru
knowwhile.ru
legacybeat.ru
lengthwant.ru
lightscores.ru
maxistream.ru
mixrail.ru
northsame.ru
oceanmade.ru
outfollow.ru
palatedollar.ru
passnine.ru
peopleexact.ru
picklong.ru
planettheir.ru
potentrange.ru
rootfig.ru
rosynext.ru
sharpnight.ru
someown.ru
standcreate.ru
storyhurry.ru
suffixfun.ru
twosheet.ru
vanishperiod.ru
whizthere.ru
wishroot.ru
yulepitch.ru
zoomfeed.ru [/red]

Guest

more -

Post by Guest » Sat Sep 04, 2010 11:55 am

AlphaCentauri - Awesome job , and I do hope these sites become deep red . thank you .

User avatar
c۞g
Posts: 10927
Joined: Mon Jan 05, 2009 4:02 am

payment gateway

Post by c۞g » Sat Sep 04, 2010 2:20 pm

mightysuch.com shopping cart uses: secure-order-gate.com sitting on IP: 62.141.43.159 - DNS | whois [privacy protected; created 03 Sept 2010] - that has an SSL issued by Comodo (most likely the 30 day free trial) - check Both the domain and the IP can be used to load the shopping cart.

[red]62.141.43.159
secure-order-gate.com[/red]

Screen capture:

Image

User avatar
c۞g
Posts: 10927
Joined: Mon Jan 05, 2009 4:02 am

smartdrugsown.com

Post by c۞g » Mon Sep 06, 2010 3:00 am

Fake pharmacy:- whois | DNS sitting on IP: 195.14.113.3 (Ukraine) CentralOps Dossier

[red]smartdrugsown.com[/red]

Guest

Canadian Pharmacy Domain

Post by Guest » Tue Sep 07, 2010 10:13 pm

[red]wholesalemedicalbook.com[/red]

User avatar
c۞g
Posts: 10927
Joined: Mon Jan 05, 2009 4:02 am

re: wholesalemedicalbook.com

Post by c۞g » Wed Sep 08, 2010 2:12 am

Associated IP's - all are listed at: http://www.surbl.org/

[red]109.168.126.54
195.2.139.31
88.191.96.7
88.208.234.222
94.23.202.33[/red]

User avatar
alphacentauri
Posts: 1670
Joined: Mon Nov 02, 2009 12:52 pm

domains sharing those IPs

Post by alphacentauri » Wed Sep 08, 2010 6:46 am

I'm not having much luck with finding other domains on the same IPs. I found these, but I'm getting 404's and an occasional parked domain. Are they just blocking my IP -- can anyone else load these?

beauteetconseil.com
bluepaper.ru
comparetesamis.com
comparfacile.com
countrise.ru
cowah.com
cropmoon.ru
fatking.ru
ideedefemmes.com
monthhair.ru
moondad.ru
netwebinternet.ru
opinionfemmes.com
sunlocate.ru
voyagetranquille.com
bluesrockcafe.com
hatchamplace.com
priestfield.com
southeastsurveying.com
nuttypiano.com
waxyshell.com
hkhalil.com

I did find these through nameservers sharing an IP
[red]activeplum.ru
alwayswhich.ru
appearabove.ru
appearask.ru
arrivethere.ru
bandthrow.ru
beatspass.ru
beatssoon.ru
beold.ru
bluepaper.ru
bottomtwo.ru
breadtruck.ru
brownsingle.ru
buysearch.ru
bymaxi.ru
carebottom.ru
caringself.ru
chancejob.ru
circleplanet.ru
citypower.ru
closebefore.ru
colonyready.ru
countrise.ru
dimpleif.ru
duckour.ru
eitherwealth.ru
eventseven.ru
everegg.ru
eyemount.ru
facebought.ru
factwent.ru
fairyes.ru
feedtalk.ru
feelat.ru
findhardy.ru
fineclear.ru
firstport.ru
gatherfast.ru
giftedcorner.ru
gifteddirect.ru
giftedenergy.ru
guessflower.ru
hearbold.ru
heatfact.ru
himspeed.ru
huntgiggle.com
ifdrool.ru
jewelswim.ru
joinspace.ru
knowwhile.ru
legacybeat.ru
lengthwant.ru
lightscores.ru
livelygrand.ru
maxistream.ru
mightfoot.ru
mixrail.ru
modestbusy.ru
moneyperiod.ru
moondad.ru
northsame.ru
oceanmade.ru
outfollow.ru
palatedollar.ru
pamperserve.ru
passnine.ru
peakreach.ru
peopleexact.ru
pharmtopclear.com
pharmultimatebell.com
picklong.ru
planettheir.ru
potentrange.ru
rollthe.ru
rootfig.ru
rosynext.ru
rxstockstudy.com
saildown.ru
seatan.ru
seekeror.ru
sentthough.com
sharpnight.ru
sheetplump.ru
smartdrugsown.com
someown.ru
steampast.ru
storydrive.ru
storyhurry.ru
suffixfun.ru
superrxspicy.com
twentyshare.ru
twosheet.ru
vanishperiod.ru
whizthere.ru
wishroot.ru
yulepitch.ru
zoomfeed.ru[/red]

Interestingly, the IP of the nameserver 208.67.222.222 was shared with
http://collectivestrategies.com
ns2.cstrat.com
an email marketing page which claims to be a subsidiary of Hearst media.

User avatar
alphacentauri
Posts: 1670
Joined: Mon Nov 02, 2009 12:52 pm

more, probably

Post by alphacentauri » Sat Sep 11, 2010 6:23 pm

I don't have a way to de-dupe these. This is the list I'm currently finding:
[red]activepalate.ru
addor.ru
alwaysclothe.ru
answerpound.ru
appearbase.ru
applebird.ru
applepull.ru
aromainvent.ru
artabout.ru
awarespread.ru
b7t.ru
basicmodel.ru
beforecoast.ru
birdpaper.ru
boldsudden.ru
borncool.ru
breakrenown.ru
calmprefer.ru
camehad.ru
canheavy.ru
canplural.ru
cellpush.ru
checkvaried.ru
chicbusy.ru
chordcover.ru
clearmodest.ru
copykind.ru
cowvanish.ru
coyblock.ru
coyperson.ru
degreeobject.ru
deluxerun.ru
divinesure.ru
doorbig.ru
doublemulti.ru
drawheart.ru
drawrelax.ru
dreamsuffix.ru
dreamyloud.ru
driveold.ru
drivewinter.ru
easethick.ru
endbottom.ru
equalease.ru
fastleft.ru
fewscores.ru
finalaroma.ru
finalneck.ru
findas.ru
finestlady.ru
firmteach.ru
flairdress.ru
flowerplant.ru
flywide.ru
followclose.ru
forestmodel.ru
freshmodest.ru
fruitprove.ru
gasnorth.ru
gigglevictor.ru
gladheat.ru
glasswatch.ru
gopure.ru
greenrenown.ru
groundlow.ru
handloyal.ru
happyswell.ru
hardyalways.ru
hearhill.ru
heavydecent.ru
heldsmile.ru
hemonth.ru
holdam.ru
homerow.ru
hotcross.ru
howamong.ru
hugeallow.ru
humorlog.ru
huntsoil.ru
jewelopen.ru
ladyyour.ru
landcreamy.ru
ledfeet.ru
legendresult.ru
liftmatter.ru
lighteach.ru
longsettle.ru
lookbeen.ru
lucidtrain.ru
magnetpair.ru
mainagree.ru
marketseed.ru
meatexcept.ru
mightson.ru
mightyphrase.ru
mixafter.ru
moneylake.ru
mylaugh.ru
numbercook.ru
oceancoast.ru
onceagain.ru
oxygenterm.ru
palateseeker.ru
passplus.ru
periodboard.ru
periodpoem.ru
personplay.ru
pharmultimatebell.com
piecemean.ru
pleaseresult.ru
plentyspell.ru
plumpsimple.ru
preferwood.ru
printby.ru
proudcotton.ru
quarthuge.ru
raceneck.ru
racerepeat.ru
readplace.ru
readystood.ru
replycost.ru
restmeet.ru
richport.ru
rosyfair.ru
roundstreet.ru
royalbest.ru
saidelse.ru
secondmusic.ru
secondparty.ru
sereneflip.ru
settleforest.ru
sexydivide.ru
sheetfigure.ru
shellduring.ru
shesky.ru
shopopen.ru
shypaint.ru
sidefavor.ru
silentanimal.ru
singlebut.ru
singlesaid.ru
sittube.ru
skinthose.ru
smileshardy.ru
snowfour.ru
softoh.ru
soilfamous.ru
speedfish.ru
squaretouch.ru
standground.ru
startdirect.ru
stringtire.ru
suffixlittle.ru
swellring.ru
teambetter.ru
tellbreezy.ru
termtangy.ru
thankbuy.ru
themcount.ru
thereabout.ru
thoughwindow.ru
tingleparty.ru
toldboard.ru
toldgarden.ru
toldsong.ru
toldworthy.ru
treeread.ru
truckvaried.ru
trustready.ru
wallraise.ru
weekwin.ru
whereawake.ru
whilefelt.ru
wholesalemedicalbook.com
wholeultra.ru
wildburn.ru
winnerequal.ru
wishof.ru
withsing.ru
witroll.ru
wonderfab.ru
wouldmuch.ru
wrotework.ru
yellowenough.ru
yellowheard.ru
yulecell.ru
yulefield.ru
yulenine.ru
zealvalued.ru
[/red]

User avatar
alphacentauri
Posts: 1670
Joined: Mon Nov 02, 2009 12:52 pm

more "Canadian Pharmacy" and "Canadian Healthcare"

Post by alphacentauri » Sun Sep 19, 2010 9:30 pm

[red]artplain.ru
bettercommon.com
callchick.ru
cheapcialiss.com
cialis-sales.com
climbsister.com
cornactive.com
cornthing.com
cottonsummer.com
decidefigure.com
decidetone.ru
directword.ru
divineshall.ru
easegame.ru
eatfair.ru
eggmajor.com
enoughnine.com
firstlate.ru
fiveatom.com
flyabout.ru
forcegrow.com
forestmilk.com
gardenprefer.com
helpmetal.ru
iskey.ru
joyfulfollow.com
letterthen.com
listensuit.ru
listentwenty.com
longgive.ru
meangather.ru
moverfood.ru
neckquiet.ru
noseselect.com
officegold.ru
orjoin.ru
orkept.com
ownbits.com
partyhear.com
provemuch.com
putpalate.com
sawbring.ru
scoreslook.com
scoretruck.com
seemlymatch.ru
selectspruce.com
senselike.com
serenestory.com
setfloor.ru
shelltree.ru
shinelocate.com
slickwisdom.ru
snowstory.ru
sonyellow.com
sooncatch.ru
speakdesire.com
staycow.ru
supplyflat.com
throwtender.com
truckmiddle.ru
undercorn.com
vitalhis.ru
wantfinger.com
weesaw.ru
whomilk.ru
wisheager.com
withmunchy.ru
woodwrote.com
worldcuddly.ru
yourviagrapills.com
[/red]

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests