Web of Trust Forum

Aliases include V.E.P. Virility Enlarge Pills, Power Gain+, MaxGain+, VPXL, Express Herbals, Elite Herbal, MaxHerbal, and Herbal King, MaxGentleman, Dr.MaXman

Victims are defrauded through sale and delivery (or sometimes nondelivery) of fake drugs, and appropriation of their personal details for use in future fraud
Phish / Scam
actcow.ru
adultsoap.ru
aircake.ru
antdream.ru
arealion.ru
armyearth.ru
babegin.ru
babyblock.ru
bandhat.ru
bankstamp.ru
bathdream.ru
bathelf.ru
bearpose.ru
beastboat.ru
beastsalt.ru
bedocean.ru
blockboy.ru
bogjoke.ru
bogside.ru
bossbelt.ru
boxson.ru
boyshome.ru
brainsolo.ru
bulljazz.ru
cafearms.ru
cakewire.ru
casepit.ru
echopod.ru
enlargepenis4u.com
fightgrain.com
hilldiary.ru
kinggirls.ru
singerspa.ru
wearworld.ru
whilefiction.ru

See Also: http://www.spamtrackers.eu/wiki/index.php/Herbal_King

I shall check these and rate accordingly

new "MaxGentleman" fake herbal remedies/ sexual enhancements pills /promoted though spam


[url=https://www.mywot.com'http://img24.imageshack.us/i/maxshort.jpg/' t='_blank'][/url]


[phishing or other scam] fake herbal remedies / sexual enhancements pills /fake mc afee secure seal /no SSL encyrption

body of the spam message contains different links to hide the real domain
ohk.im/links/?r=1i7
ohk.im/links/?r=1f3

so
ohk.im
[SPAM]


[url=https://www.mywot.com'http://img228.imageshack.us/i/maxgc.jpg/' t='_blank'][/url]

http://whois.domaintools.com/boilingcopy.com

http://whois.domaintools.com/opinionchance.com

RSP: China Springboard Inc.
URL: hxxp://www.namerich.cn

Name Server :NS2.PROTOPSITE.RU
Name Server :NS1.PROTOPSITE.RU

namerich.cn scorecard

http://www.mywot.com/en/scorecard/namerich.cn

some informations more:
http://geo.flagfox.net/?ip=121.127.129. ... ngcopy.com
http://geo.flagfox.net/?ip=121.127.129. ... chance.com

[edit to add]
NS1.PROTOPSITE.RU
ns2.protopsite.ru
http://www.mywot.com/en/scorecard/NS1.PROTOPSITE.RU
http://www.mywot.com/en/scorecard/ns2.protopsite.ru


[edit to add]

foud a new one and added to the list

ryryligora.boilingcopy.com

I've gotten a lot from these guys in the past. The spam link goes to a fake blog landing page that links to the real drug site.
The hosting is either in China or South Korea and KISA never seems to be able to put an end to Hanaro/SKTelecom hosting this crap.

here is another protected shortened url they use

protect.vearchive.net

MaxGain

Warning: websites contain explicit material, not for children

[url=https://www.mywot.com'http://img715.imageshack.us/i/maxgain.jpg/' t='_blank'][/url]

Uploaded with [url=https://www.mywot.com'http://imageshack.us' t='_blank']ImageShack.us[/url]

http://www.spamtrackers.eu/wiki/index.php/MaxGain

tinfemale.ru ( only www.tinfemale.ru loads here)
It is likely there are some more, I listed only the domains I could reach

Whois

http://whois.domaintools.com/tinfemale.ru

domain: TINFEMALE.RU
nserver: ns1.marketcapital.ru.
nserver: ns1.marketdns.ru.
nserver: ns2.marketcapital.ru.
nserver: ns2.marketdns.ru.
state: REGISTERED, DELEGATED, VERIFIED
person: Private Person

http://www.robtex.com/dns/tinfemale.ru.html#result

Max Gentleman

universityoil.ru

http://www.spamtrackers.eu/wiki/index.php/Herbal_King

i am getting this spam on lavabit.com

Max Gentleman