RXProfits - Identifying 866-2140125 386-2437714

This is transferred to the new board at http://fraudreports.prophpbb.com
Spammers should not profit, so post information here that hits their pockets.

Re: Identifying 866-2140125 386-2437714

Postby Red Dwarf » Tue Apr 09, 2013 4:51 pm

buycialisonlinepharmacys.com

Contact numbers however are 1-888-8244591 1-402-8190950

Affiliates link goes to rxprofits.com

Domain Name: BUYCIALISONLINEPHARMACYS.COM
Registrar: EVOPLUS LTD

Registrar for evoplus.com? [Creation Date: 16-mar-2005]
Registrant:
Evo Names office@evonames.com
EvoPlus Limited
5285 Decarie Boulevard #100
Montreal, qc H3W3C2
Canada
+1.5144959001, Fax:+1.5144953105
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Identifying 866-2140125 386-2437714

Postby Red Dwarf » Wed Apr 10, 2013 8:21 pm

Complainterator wrote:INTERNET.BS
This is a compliance request for you to suspend the domain snowbold.net
and to remove its name server Address record
ns1.snowbold.net [185.9.18.78]
ns2.snowbold.net [185.9.18.78]
and any www. address record

CRIMINAL EVIDENCE
http://www.mywot.com/en/scorecard/snowbold.net/msgpage


ACTION TAKEN
Host ns1.snowbold.net.Belkin not found: 3(NXDOMAIN)
Host ns2.snowbold.net.Belkin not found: 3(NXDOMAIN)

Domain Name: SNOWBOLD.NET
Registrar: INTERNET.BS CORP.
Status: clientHold
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 10-apr-2013

Collateral Damage
1stmeds.net
buy-pill.net
buy-rx.net
buyrxmeds.net
directrxpills.net
genericrxpills.net
medicalorders.net
net-pharmacy.net
orderpharmacy.net
pharm-orders.net
pill-sales.net
pills-net.net
prime-pills.net
prime-rx.net
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Identifying 866-2140125 386-2437714

Postby Red Dwarf » Wed Apr 10, 2013 8:50 pm

Domain Name: LIFESTYLE-SOURCE.COM
Registrar: EKADOS, INC. D/B/A GROUNDREGISTRY.COM
Name Server: NS1.TECKBEANS.COM
Name Server: NS2.TECKBEANS.COM
Registration Date: 18-Feb-2013
Code: Select all
<img src="cache/1361195631.inv_logo_12369_phone_87_8244591.png" alt="Phone Banner" class="phone_banner transparent" >


1 888 8244591
1 402 8190950

Domain Name: RXBOUTIQUE.COM
Registrar: DOMAIN.COM, LLC
Name Server: NS1.TECKBEANS.COM
Name Server: NS2.TECKBEANS.COM
Creation Date: 17-feb-2013

Same phone as above, plus a link to the Affiliate program, RXProfits.com

Domain Name: WORLD-PILLS.COM
Registrar: DOMAIN.COM, LLC
Name Server: NS1.TECKBEANS.COM
Name Server: NS2.TECKBEANS.COM
Creation Date: 10-feb-2013

Code: Select all
<img src="cache/1360583686.inv_logo_12344_phone_7_8244591.png" class="phone-banner" alt="" />

Plus a link to the Affiliate program, RXProfits.com
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: RXProfits - Identifying 866-2140125 386-2437714

Postby Red Dwarf » Thu Apr 18, 2013 4:35 pm

TUTORIAL How to track down this RXProfits scam

Take just one example - pills-net.net
Look up the IP address using a tool like DNSstuff.com -
pills-net.net has address 185.9.18.130

Use that information to look up the members of the same family
1.
http://bgp.he.net/ip/185.9.18.130#_dns gives us
The following A records are set to 185.9.18.130:
cheap-pills.net, prime-meds.net, primerx.net, super-rx.net

2.
http://www.bfk.de/bfk_dnslogger.html?query=185.9.18.130 gives us
ns1.pinginjapan.com A 185.9.18.130
ns2.pinginjapan.com A 185.9.18.130
buy-pill.net A 185.9.18.130
www.buy-pill.net CNAME buy-pill.net
directrxpills.net A 185.9.18.130
www.directrxpills.net CNAME directrxpills.net
buy-rx.net A 185.9.18.130
www.buy-rx.net CNAME buy-rx.net

3.
http://ip.robtex.com/185.9.18.130.html#shared gives us
buy-pill.net
buy-rx.net
cheap-pills.net
directrxpills.net
pills-net.net
prime-meds.net
primerx.net
super-rx.net


From this simple example, you can see that a few good data mining tools can quickly bring a lot of additional domain names to the surface, ready for reporting. In every case for the resulting list -
Registrar: NETLYNX, INC.

Note: Some if not all of these were transferred out from the previous list under suspended name server snowbold.net
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: RXProfits - Identifying 866-2140125 386-2437714

Postby Red Dwarf » Sat Apr 20, 2013 6:11 am

Registrar: NETLYNX
Status: Client Hold

1stmeds.net
buy-pill.net
buy-rx.net
buyrxmeds.net
directrxpills.net
genericrxpills.net
medicalorders.net
net-pharmacy.net
orderpharmacy.net
pharm-orders.net
pill-sales.net
pills-net.net
prime-pills.net
prime-rx.net

Still alive -

cheap-pills.net
prime-meds.net
primerx.net
super-rx.net
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: RXProfits - Identifying 866-2140125 386-2437714

Postby g7w » Thu Jan 22, 2015 6:04 pm

Used the search and could not find a topic dedicated to
RXProfits

rxprofits.com
aka:
rxprofits.biz
Opto, ergo sum
User avatar
g7w
Spam Reporter
 
Posts: 135
Joined: Thu May 20, 2010 12:29 am

Re: RXProfits - Identifying 866-2140125 386-2437714

Postby Red Dwarf » Wed Apr 08, 2015 12:56 am

BIZCN.COM supports these

leading-pharmacy.net
megarxshop.net
pillorders.net
pillsdiscounts.net
super-pills.net
ultra-meds.net


All have a checkout with an SSL certificate issued to leading-pharmacy.net

All have the same help line numbers +1 855 306 9027 and +1 773 270 2818

They are hosted on 94.229.66.66 and 46.17.95.26
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Previous

Return to Fight Spammers

Who is online

Users browsing this forum: Ahrefs and 1 guest