RXProfits - Identifying 866-2140125 386-2437714

Spammers should not profit, so post information here that hits their pockets. There are many ways to fight spammers, and we have automation tools to combat them efficiently. These forums are moderated, but do not reflect the views of the hosting company, domain registrar, etc. By entering any of these forums, you agree that you cannot hold anyone liable for anything related in any way to these forums.

Re: Identifying 866-2140125 386-2437714

Postby Red Dwarf » Tue Apr 09, 2013 4:51 pm

buycialisonlinepharmacys.com

Contact numbers however are 1-888-8244591 1-402-8190950

Affiliates link goes to rxprofits.com

Domain Name: BUYCIALISONLINEPHARMACYS.COM
Registrar: EVOPLUS LTD

Registrar for evoplus.com? [Creation Date: 16-mar-2005]
Registrant:
Evo Names office@evonames.com
EvoPlus Limited
5285 Decarie Boulevard #100
Montreal, qc H3W3C2
Canada
+1.5144959001, Fax:+1.5144953105
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10453
Joined: Tue Jun 27, 2006 2:01 am

Re: Identifying 866-2140125 386-2437714

Postby Red Dwarf » Wed Apr 10, 2013 8:21 pm

Complainterator wrote:INTERNET.BS
This is a compliance request for you to suspend the domain snowbold.net
and to remove its name server Address record
ns1.snowbold.net [185.9.18.78]
ns2.snowbold.net [185.9.18.78]
and any www. address record

CRIMINAL EVIDENCE
http://www.mywot.com/en/scorecard/snowbold.net/msgpage


ACTION TAKEN
Host ns1.snowbold.net.Belkin not found: 3(NXDOMAIN)
Host ns2.snowbold.net.Belkin not found: 3(NXDOMAIN)

Domain Name: SNOWBOLD.NET
Registrar: INTERNET.BS CORP.
Status: clientHold
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 10-apr-2013

Collateral Damage
1stmeds.net
buy-pill.net
buy-rx.net
buyrxmeds.net
directrxpills.net
genericrxpills.net
medicalorders.net
net-pharmacy.net
orderpharmacy.net
pharm-orders.net
pill-sales.net
pills-net.net
prime-pills.net
prime-rx.net
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10453
Joined: Tue Jun 27, 2006 2:01 am

Re: Identifying 866-2140125 386-2437714

Postby Red Dwarf » Wed Apr 10, 2013 8:50 pm

Domain Name: LIFESTYLE-SOURCE.COM
Registrar: EKADOS, INC. D/B/A GROUNDREGISTRY.COM
Name Server: NS1.TECKBEANS.COM
Name Server: NS2.TECKBEANS.COM
Registration Date: 18-Feb-2013
Code: Select all
<img src="cache/1361195631.inv_logo_12369_phone_87_8244591.png" alt="Phone Banner" class="phone_banner transparent" >


1 888 8244591
1 402 8190950

Domain Name: RXBOUTIQUE.COM
Registrar: DOMAIN.COM, LLC
Name Server: NS1.TECKBEANS.COM
Name Server: NS2.TECKBEANS.COM
Creation Date: 17-feb-2013

Same phone as above, plus a link to the Affiliate program, RXProfits.com

Domain Name: WORLD-PILLS.COM
Registrar: DOMAIN.COM, LLC
Name Server: NS1.TECKBEANS.COM
Name Server: NS2.TECKBEANS.COM
Creation Date: 10-feb-2013

Code: Select all
<img src="cache/1360583686.inv_logo_12344_phone_7_8244591.png" class="phone-banner" alt="" />

Plus a link to the Affiliate program, RXProfits.com
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10453
Joined: Tue Jun 27, 2006 2:01 am

Re: RXProfits - Identifying 866-2140125 386-2437714

Postby Red Dwarf » Thu Apr 18, 2013 4:35 pm

TUTORIAL How to track down this RXProfits scam

Take just one example - pills-net.net
Look up the IP address using a tool like DNSstuff.com -
pills-net.net has address 185.9.18.130

Use that information to look up the members of the same family
1.
http://bgp.he.net/ip/185.9.18.130#_dns gives us
The following A records are set to 185.9.18.130:
cheap-pills.net, prime-meds.net, primerx.net, super-rx.net

2.
http://www.bfk.de/bfk_dnslogger.html?query=185.9.18.130 gives us
ns1.pinginjapan.com A 185.9.18.130
ns2.pinginjapan.com A 185.9.18.130
buy-pill.net A 185.9.18.130
www.buy-pill.net CNAME buy-pill.net
directrxpills.net A 185.9.18.130
www.directrxpills.net CNAME directrxpills.net
buy-rx.net A 185.9.18.130
www.buy-rx.net CNAME buy-rx.net

3.
http://ip.robtex.com/185.9.18.130.html#shared gives us
buy-pill.net
buy-rx.net
cheap-pills.net
directrxpills.net
pills-net.net
prime-meds.net
primerx.net
super-rx.net


From this simple example, you can see that a few good data mining tools can quickly bring a lot of additional domain names to the surface, ready for reporting. In every case for the resulting list -
Registrar: NETLYNX, INC.

Note: Some if not all of these were transferred out from the previous list under suspended name server snowbold.net
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10453
Joined: Tue Jun 27, 2006 2:01 am

Re: RXProfits - Identifying 866-2140125 386-2437714

Postby Red Dwarf » Sat Apr 20, 2013 6:11 am

Registrar: NETLYNX
Status: Client Hold

1stmeds.net
buy-pill.net
buy-rx.net
buyrxmeds.net
directrxpills.net
genericrxpills.net
medicalorders.net
net-pharmacy.net
orderpharmacy.net
pharm-orders.net
pill-sales.net
pills-net.net
prime-pills.net
prime-rx.net

Still alive -

cheap-pills.net
prime-meds.net
primerx.net
super-rx.net
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10453
Joined: Tue Jun 27, 2006 2:01 am

Re: RXProfits - Identifying 866-2140125 386-2437714

Postby g7w » Thu Jan 22, 2015 6:04 pm

Used the search and could not find a topic dedicated to
RXProfits

rxprofits.com
aka:
rxprofits.biz
Opto, ergo sum
User avatar
g7w
Spam Reporter
 
Posts: 136
Joined: Thu May 20, 2010 12:29 am

Re: RXProfits - Identifying 866-2140125 386-2437714

Postby Red Dwarf » Wed Apr 08, 2015 12:56 am

BIZCN.COM supports these

leading-pharmacy.net
megarxshop.net
pillorders.net
pillsdiscounts.net
super-pills.net
ultra-meds.net


All have a checkout with an SSL certificate issued to leading-pharmacy.net

All have the same help line numbers +1 855 306 9027 and +1 773 270 2818

They are hosted on 94.229.66.66 and 46.17.95.26
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10453
Joined: Tue Jun 27, 2006 2:01 am

Previous

Return to Fight Spammers

Who is online

Users browsing this forum: No registered users and 1 guest

cron