Eva Pharmacy redirections

Spammers should not profit, so post information here that hits their pockets. There are many ways to fight spammers, and we have automation tools to combat them efficiently. These forums are moderated, but do not reflect the views of the hosting company, domain registrar, etc. By entering any of these forums, you agree that you cannot hold anyone liable for anything related in any way to these forums.

Eva Pharmacy redirections

Postby Red Dwarf » Fri Sep 13, 2013 10:23 pm

Eva Pharmacy has created thousands of domain names. Previous research has shown that they often register with stolen credit cards. Anyone who places an order with these criminals is open to having their credit card abused.

Sometimes the Eva pharmacy crooks try to "fly under the radar" of blacklists, by using these disposable domains in spam, but the domain actually transfers the user to another one, which is never spammed.

Listed below is a set of examples. Some of these domains, shown in red, have been suspended by the compliant registrars, others await their attention.

* RxMedications - see http://spamtrackers.eu/wiki/index.php/RxMeds
b101 b101.walgreentab.at b101.drugstoremagnacca.com b101.prescriptionmedicalgroup.at
o100 o100.healthrxshop.ru
o101 o101.storemedicare.net o101.smartrendviagra.com
o102 o102.rxcarepatient.com o102.drugtorehealthcare.ru
o244 o244.theviagrahealthcare.com o244.nursingmeds.net o244.remediespharm.in * o244.drugtorerxassays.ru
m100 m100.newpharmacycanada.at m100 switched to My Canadian Pharmacy
m102 m102.docmedprescription.com m102.allmedicalquestion.at (NIC.AT) m102.pillopioid.at m102.medicinexus.in m102.drugtorehealthcare.ru -> m102 switched to My Canadian Pharmacy
m105 m105.dietpillcialis.com

* My Canadian Pharmacy
o100 o100.welnessasale.com o100.pertab.com
o102 o102.medicinepillreckitt.com
m100 m100.viagracialec.com m100.dietpillsmedicine.at m100.medsdietpills.com
m102 m102.pharmbiotechnology.at m102.newpharmacymedicine.com m102.apptabletmed.com m102.medicinepillreckitt.com

* Canadian Health&Care Mall
c100 c100.pssviagramedical.com c100.prescriptionhealthcenter.at c100.drugstorepharmaceutics.com c100.medsdrugprescription.net c100.prescriptioncaregroup.com c100.thehealthcareprescription.eu c100.rxhealthprescriptions.com c100.canrxstore.ru
c102 c102.healthcareviagrabiotech.net c102.pillsciaslis.com c102.rxhealthcarejobs.com c102.myviagragenerics.com c102.dietpillmed.at c102.thepillsmedicine.eu c102.healthpharmacists.eu c102.pharmacyalberta.com c102.rxdrugprescriptions.com * c102.tabletsrx.ru

* RxExpressOnline
e100 e100.thelevitrarx.com e100.mypillgenerics.in e100.rxcaregroup.be
e101 e101.viagrafood.com
e102 e102.healthrxpharmacycare.ru e102.torontotab.in e102.carcareprescription.net e102.rxhealthremedies.com
e105 e105.kickedmedia.in e105.walgreenspills.com e105.thetabdrugstore.net
e244 e244.autocarepharmacy.com e244.medicarepillpatients.eu e244.caretabletspills.ru
private private.prescriptionspills.com

Note: Red means that the domain has been suspended by the registrar for breaking their terms of service
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Fri Dec 27, 2013 3:53 pm

LIVE at March 3, 2014

* c100.canrxstore.ruCanadian Health&Care MallNAUNET-REG-RIPN
* c100.rxhealthprescriptions.comCanadian Health&Care MallPSI-USA, INC. DBA DOMAIN ROBOT
* c102.mypharmcare.beCanadian Health&Care MallKey-Systems GmbH
* c102.tabletsrx.ruCanadian Health&Care MallNAUNET-REG-RIPN
* e100.easyrxpharmacy.ruRxExpressOnlineNAUNET-REG-RIPN
* e100.mypillgenerics.inRxExpressOnlineNETLYNX, INC
* e101.viagrafood.comRxExpressOnlinePSI-USA, INC. DBA DOMAIN ROBOT
* e102.bestpharmacydirect.ruMy Canadian PharmacyNAUNET-REG-RIPN
* e105.thetabdrugstore.netRxExpressOnlinePSI-USA, INC. DBA DOMAIN ROBOT
* e244.caretabletspills.ruRxExpressOnlineNAUNET-REG-RIPN
* m100.medsdietpills.comMy Canadian PharmacyHTTP.NET INTERNET GMBH
* m102.drugtorehealthcare.ruRxMedicationsNAUNET-REG-RIPN
* m102.healthpharmacyinc.comRxExpressOnlineNETLYNX, INC.
* m105.canadaspharm.be?NETLYNX, INC
* m105.superrxstore.ruRxMedicationsNAUNET-REG-RIPN
* o100.healthrxshop.ruRxMedicationsNAUNET-REG-RIPN
* o102.drugtorehealthcare.ruRxMedicationsNAUNET-REG-RIPN
* o244.drugtorerxassays.ruRxMedicationsNAUNET-REG-RIPN
* private.prescriptionspills.comRxExpressOnlineNETLYNX, INC.




Nov 21, 2013. Each has address 109.163.234.73 on Voxility.net, Libertyville, IL 60048. abuse.1@vps6.net
Nov 22, 27, 29 and Dec 1, 2013. Each has address 91.198.137.39 in Froendenberg, Germany . . . server@host1.eu
Nov 25, 28 and Dec 3, 2013. Each has address 193.107.89.251 in Poland . . . abuse@kylos.pl
Dec 6, 11, 19, 26, 27 Each has address 141.255.190.93 in Sweden . . . abuse@citynetwork.se
Dec 10, 20, Jan 6 to 12 Each has address 212.83.140.187 in France . . . abuse@iliad-entreprises.fr
Jan 23 Each has address 192.95.20.120 in Canada . . . abuse@ovh.ca
Jan 30 Each has address 62.210.123.61 in France . . . abuse@online.net
Jan 31 Each has address 62.210.131.192 in France . . . abuse@online.net
Feb 2 -11 Each has address 193.105.245.9 in Russia . . . Goryachev Evgeniy Alexandrovich +7987 12 655
Feb 12 Each has address 195.154.117.178 in France . . . abuse@online.net
Feb 22 Each has address 109.236.85.242 in the Netherlands . . . abuse@worldstream.nl
Mar 3 Each has address 84.200.77.180 in Germany . . . Stephan Roeder +49 2632 9891513
Mar 25 Most have address 178.21.20.130 in the Netherlands - abuse@serverius.com
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sat Dec 28, 2013 8:05 pm

Another redirection scam is based on the abuse of registrars EvoPlus / EvoNames in Canada, and PSI-USA / InterNetX in Germany.

The name serversare often suspended, but the miscreants move on to others. In December 2013, the current name servers were on NVIKO87.com (PSI-USA / InterNetX). In January 2014, nsvilero.com sponsored by InterNetX in Germany

Examples of the redirector domains registered on EvoPlus Ltd. (R589-LRMS) subsequently suspended, were
amicroshetochkaprokrashi.com
auholopovshatntreshat.com
avoobshemndedofonaryaskoka.com
dapribudetsilakvakisnami.com
gonitkolegatebesdolikedfop.com

These in turn perform a redirection, thus:
> Location: http://ddw.bigrxdiscountmedstore.com

This is another Canadian Health&Care Mall fraud out of Russia, registered with sponsor PSI-USA / InterNetX in Germany
Location: http://ddw.bigrxdiscountmedstore.com (subsequently suspended)

In January the Name server was on nglns12.com (PSI-USA / InterNetX) with redirectors sponsored by EvoPlus and Domain Context registrars. Sample redirectors:

bandakolpikedasoi.com . . . DOMAINCONTEXT, INC.
bobbarbikoled.com . . . DOMAINCONTEXT, INC.
densvobodiisobornosti.com . . . EVOPLUS LTD
dilizansprohoditmimo.com . . . DOMAINCONTEXT, INC.
etapievrochempionafu.com . . . EVOPLUS LTD
etootlichniyvariantikolep.com . . . DOMAINCONTEXT, INC.
etovesmastarayainformaciu.com . . . EVOPLUS LTD
glazaotkrilspacibonoci.com . . . EVOPLUS LTD
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Thu Jan 23, 2014 3:38 pm

Here are some sample live sites, with the disposable redirector on the left and the previous and current redirection targets on the right.
    Sept 19 all redirectors shared the same address 24.234.252.189 which can be reported to abuse@cox.net
    Sept 26 all redirectors shared the same address 190.2.4.81 which can be reported to abuse-iplan@IPLAN.COM.AR
    October 10 all redirectors shared the same address 134.60.13.251 which can be reported to abuse@uni-ulm.de
    November 1 all redirectors shared the same address 190.2.4.81 which can be reported to abuse-iplan@IPLAN.COM.AR
    November 7 all redirectors shared the same address 5.134.114.220 which can be reported to abuse@ginernet.com
    November 15 all redirectors shared the same address 95.163.107.212 which can be reported to abuse@msm.ru
    November 22 all redirectors shared the same address 216.27.27.21 which can be reported to abuse@hostedsolutions.com
    December 3 all redirectors shared the same address 5.134.114.220 which can be reported to abuse@ginernet.com
    January 23, 2014 all redirectors shared the same address 192.95.20.120 which can be reported to abuse@ovh.ca
    Jan 30 all redirectors shared the same address 62.210.123.61 which can be reported to abuse@online.net
[Edit - the redirections and IP may change, but they still redirect to Eva frauds]
A snapshot taken in November, with a sample of redirectors
RedirectorFraud typeTargetRegistrar
antonettaalina.comRxExpressOnlinee100.mypillgenerics.inNETLYNX
bernymaude.comMy Canadian Pharmacym102.medicinepillreckitt.comPSI-USA / InterNetX
brigitjennlinn.comCanadian Health&Care Mallc100.prescriptioncaregroup.comBIZCN
brinamaritsa.comRxMedicationso100.healthrxshop.ruTRUNKOZ
juliettaagnola.comCanadian Health&Care Mallc100.prescriptioncaregroup.comNAMESILO


The Sept 26 targets are registered with
    NIC.AT
    NAUNET-REG-RIPN
    HTTP.NET INTERNET GMBH

The November 15 targets are registered with
    HTTP.NET INTERNET GMBH
    NAUNET-REG-RIPN
    NETLYNX, INC.
    TRUNKOZ TECHNOLOGIES PVT LTD.

The December 3 targets are registered with
    HTTP.NET
    Key-Systems
    NAMESILO
    NAUNET-REG-RIPN
    NETLYNX
    PSI-USA / InterNetX

The December 21 - January 21 targets are registered with sponsors
    HTTP.NET
    NAMESILO
    NAUNET-REG-RIPN
    NETLYNX
    PSI-USA / InterNetX
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sun Mar 02, 2014 6:23 pm

A list of the Xn0n. prefix redirection targets
SUSPENDED BY REGISTRAR

mypillgenerics.in - NETLYNX - reinstated Feb 6, web site removed - Client Hold 7 June 2014
dietpillcialis.com - NETLYNX - reinstated Feb 6, web site removed Client Hold 10-apr-2014

allmedicalquestion.at - NIC.AT
apptabletmed.com - BIZCN.COM, INC.
autocarepharmacy.com - TRUNKOZ
canadatabletsurface.at - NIC.AT (CFP)
canadiancanadaviagra.com - TRUNKOZ TECHNOLOGIES PVT LTD.
carcareprescription.net - PSI-USA / InterNetX
dietpillmed.at - NIC.AT
dietpillsmedicine.at - NIC.AT
discountrxmedications.com - HTTP.NET INTERNET GMBH
docmedprescription.com - NETLYNX, INC.
druggenericsmeds.com - PSI-USA / InterNetX
drugstoremagnacca.com - TRUNKOZ TECHNOLOGIES PVT LTD.
drugstorepharmaceutics.com - PSI-USA / InterNetX
thelevitrarx.com - PSI-USA / InterNetX
healthcareviagrabiotech.net - PSI-USA / InterNetX
healthpharmacists.eu - Key-Systems GmbH
homemedicalrx.net - PSI-USA / InterNetX
kickedmedia.in - NETLYNX
kylalindsay.com - PSI-USA / InterNetX
medicarepillpatients.eu - Key-Systems GmbH
medicinexus.in - NETLYNX, INC.
medicinepillreckitt.com - HTTP.NET INTERNET GMBH
medsdrugprescription.net - PSI-USA / InterNetX
mymedicinerx.in - NETLYNX, INC.
myviagragenerics.com - NAMESILO, LLC
newpharmacycanada.at - NIC.AT
newpharmacymedicine.com - TRUNKOZ TECHNOLOGIES PVT LTD.
nursingmeds.net - PSI-USA / InterNetX
pertab.com - TRUNKOZ TECHNOLOGIES PVT LTD.
pharmacyalberta.com - PSI-USA / InterNetX
pharmbiotechnology.at - NIC.AT
pillopioid.at - NIC.AT
pillsciaslis.com - TRUNKOZ
prescriptioncarehome.in - NETLYNX, INC.
prescriptioncaregroup.com - TRUNKOZ
prescriptionhealthcenter.at - NIC.AT
prescriptionmedicalgroup.at - NIC.AT
pssviagramedical.com - NETLYNX, INC.
rxdrugprescriptions.com - PSI-USA, INC. DBA DOMAIN ROBOT
rxcaregroup.be - Key-Systems GmbH
rxhealthmedications.com -HTTP.NET INTERNET GMBH
rxhealthremedies.com - HTTP.NET INTERNET GMBH > TRUNKOZ TECHNOLOGIES PVT LTD
rxcarepatient.com - TRUNKOZ TECHNOLOGIES PVT LTD.
rxhealthcarejobs.com - NAMESILO, LLC
salesprescription.com - PSI-USA / InterNetX
smartrendviagra.com - TRUNKOZ
storemedicare.net - PSI-USA / InterNetX
thegenericsmeds.com - PSI-USA / InterNetX
thehealthcareprescription.eu - Key-Systems GmbH
thelevitrarx.com - PSI-USA / InterNetX
thepillsmedicine.eu - Key-Systems GmbH
theviagrahealthcare.com - TRUNKOZ TECHNOLOGIES PVT LTD.
torontotab.in - NETLYNX
viagracialec.com - NETLYNX, INC.
walgreentab.at - NIC.AT
walgreenspills.com - NETLYNX, INC
remediespharm.in - NETLYNX
healthrxpharmacycare.ru - NAUNET-REG-RIPN
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sun Mar 02, 2014 6:26 pm

List of current redirection targets
LIVE at June 16, 2014

* c100.canrxstore.ruCanadian Health&Care MallNAUNET-REG-RIPN
* c100.rxhealthprescriptions.comCanadian Health&Care MallPSI-USA, INC. DBA DOMAIN ROBOT
* c102.mypharmcare.beCanadian Health&Care MallKey-Systems GmbH
* c102.tabletsrx.ruCanadian Health&Care MallNAUNET-REG-RIPN
* e100.easyrxpharmacy.ruRxExpressOnlineNAUNET-REG-RIPN
* e100.mypillgenerics.inRxExpressOnlineNETLYNX, INC
* e101.viagrafood.comRxExpressOnlinePSI-USA, INC. DBA DOMAIN ROBOT
* e102.bestpharmacydirect.ruMy Canadian PharmacyNAUNET-REG-RIPN
* e105.thetabdrugstore.netRxExpressOnlinePSI-USA, INC. DBA DOMAIN ROBOT
* e244.caretabletspills.ruRxExpressOnlineNAUNET-REG-RIPN
* m100.medsdietpills.comMy Canadian PharmacyHTTP.NET INTERNET GMBH
* m102.drugtorehealthcare.ruRxMedicationsNAUNET-REG-RIPN
* m102.healthpharmacyinc.comRxExpressOnlineNETLYNX, INC.
* m105.canadaspharm.benot loading?NETLYNX, INC
* m105.superrxstore.ruRxMedicationsNAUNET-REG-RIPN
* o100.healthrxshop.ruRxMedicationsNAUNET-REG-RIPN
* o102.drugtorehealthcare.ruRxMedicationsNAUNET-REG-RIPN
* o244.drugtorerxassays.ruRxMedicationsNAUNET-REG-RIPN
* private.prescriptionspills.comRxExpressOnlineNETLYNX, INC.
* refills.therxmed.comRxExpressOnlinePSI-USA, INC. DBA DOMAIN ROBOT


Historical record of IP addresses and contacts
Nov 21, 2013. 109.163.234.73 on Voxility.net, Libertyville, IL 60048. abuse.1@vps6.net
Nov 22, 27, 29 and Dec 1, 2013. 91.198.137.39 in Froendenberg, Germany . . . server@host1.eu
Nov 25, 28 and Dec 3, 2013. 193.107.89.251 in Poland . . . abuse@kylos.pl
Dec 6, 11, 19, 26, 27 141.255.190.93 in Sweden . . . abuse@citynetwork.se
Dec 10, 20, Jan 6 to 12 212.83.140.187 in France . . . abuse@iliad-entreprises.fr
Jan 23 192.95.20.120 in Canada . . . abuse@ovh.ca
Jan 30 62.210.123.61 in France . . . abuse@online.net
Jan 31 62.210.131.192 in France . . . abuse@online.net
Feb 2 -11 193.105.245.9 in Russia . . . Goryachev Evgeniy Alexandrovich +7987 12 655
Feb 12 195.154.117.178 in France . . . abuse@online.net
Feb 22 109.236.85.242 in the Netherlands . . . abuse@worldstream.nl
Mar 3 84.200.77.180 in Germany . . . Stephan Roeder +49 2632 9891513
Mar 7 91.218.125.210 . . . misbruik@serveo.nl
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sat Jun 14, 2014 5:51 pm

Redirection targets from thousands of disposable spammed domains are always a delight to remove.

Recent examples

c102.thecanadameds.in
e100.dietpilldrugstore.com
e100.mypillgenerics.in
e102.thepillsmed.com
m100.thedietpharm.com
m102.thecanadameds.com
home.dietpillmed.com
private.healthsrx.com
refills.thedietrx.com
rx.viagrahealthplans.com
c102.tabletsrx.ru
m105.superrxstore.ru
o101.fitnesspharmacyrx.ru
pfizermedsrx.ru
private.mytablethealth.be
refilling.pillhealthgroup.net
refills.therxmed.com
rx.newpharmacysale.eu
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Mon Jun 16, 2014 9:54 pm

Here are the host IP addresses commonly used by this Eva Pharmacy redirection method during June 2014. They are rotated regularly.

IP ADDRESS / COUNTRY / ABUSE COMPLAINT
46.165.219.14 / BE / abuse@leaseweb.de
81.0.124.75 / RU / abuse@invitel.net
84.200.77.180 / BE / abuse@accelerated.de
93.115.210.16 / RO / abuse@ip.ro
94.185.84.80 / SE / abuse@netrouting.com


Common live redirection targets, now all suspended (EDIT: JAN 2015)

* c100.canrxstore.ru
* c102.canadianmedsquality.com
* e100.dietpilldrugstore.com
* e102.bestpharmacydirect.ru
* e102.storerxpills.com
* e105.thecialispharmacy.com
* e244.caretabletspills.ru
* m100.canadiansmarttrade.com
* m100.canadianfaststore.com
* m100.thedietpharm.com
* m102.drugtorehealthcare.ru
* m102.mylevitrapill.com
* m102.perfectwelnessinc.com
* o100.healthrxshop.ru
* o101.pillhealthcaretenet.ru
* o102.drugtorehealthcare.ru
* o244.drugtorerxassays.ru
* refills.netpillstore.com
* rxpharmacysite.ru
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby NotBuyingIt » Tue Jun 17, 2014 12:24 pm

Red Dwarf wrote:Here are the host IP addresses commonly used by this Eva Pharmacy redirection method during June 2014. They are rotated regularly.

IP ADDRESS / COUNTRY / ABUSE COMPLAINT
46.165.219.14 / BE / abuse@leaseweb.de
81.0.124.75 / RU / abuse@invitel.net
84.200.77.180 / BE / abuse@accelerated.de
93.115.210.16 / RO / abuse@ip.ro
94.185.84.80 / SE / abuse@netrouting.com


By using cachecheck.opendns.com, I notice additional IP addresses reported by the sites' DNS. I don't know if the following addresses are actually involved in the redirection or are only diversions (so I've only listed a few of them below).

37.110.1.94 / RU / abuse@ncnet.ru
173.237.198.32 / US / abuse@bos.netriplex.com
178.216.96.106 / UA /
221.13.79.26 / CN / abuse@cnc-noc.net
NotBuyingIt
Spammer Killing Machine
 
Posts: 612
Joined: Sun Jun 13, 2010 5:22 pm

Re: Eva Pharmacy redirections

Postby spamislame » Fri Jul 04, 2014 10:38 am

Red Dwarf wrote:Here are the host IP addresses commonly used by this Eva Pharmacy redirection method during June 2014. They are rotated regularly.

Just to confirm:

Are these IP addresses used specifically for the hosting of the *actual* Eva sites? Or the redirections?

Just checking. I'm assuming the former.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5058
Joined: Tue May 09, 2006 9:18 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sun Jul 06, 2014 4:13 am

Those are the IPs of the redirector sites, not the targets.

For example, at this point in time the redirector address is 178.239.55.123

* c100.canrxstore.ru has address 178.239.55.123
* c102.pillsalejobs.com has address 178.239.55.123
* e102.bestpharmacydirect.ru has address 178.239.55.123
* e105.thecialispharmacy.com has address 178.239.55.123
* e244.caretabletspills.ru has address 178.239.55.123
* m102.drugtorehealthcare.ru has address 178.239.55.123
* m102.mylevitrapill.com has address 178.239.55.123
* o100.healthrxshop.ru has address 178.239.55.123
*o101.pillhealthcaretenet.ru has address 178.239.55.123
* o102.drugtorehealthcare.ru has address 178.239.55.123
* o244.drugtorerxassays.ru has address 178.239.55.123
* refills.netpillstore.com has address 178.239.55.123
* private.medicalsafesale.com has address 178.239.55.123
* refills.smartrxsupply.com has address 178.239.55.123
* rxpharmacysite.ru has address 178.239.55.123

Complain to abuse@host4offshore.com with a link to this page
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Thu Jul 10, 2014 6:11 pm

Next IP in the redirection hosting rotation is 81.0.124.75

* c100.canrxstore.ru has address 81.0.124.75
* c102.pillsalejobs.com has address 81.0.124.75
* c102.homegenericsupply.com has address 81.0.124.75
* drugpillsmedical.ru has address 81.0.124.75
* e100.cialisrxgroup.com has address 81.0.124.75
* e101.pilldrugstablets.ru has address 81.0.124.75
* e102.canadapillgroup.ru has address 81.0.124.75
* m100.canadiansmarttrade.com has address 81.0.124.75
* m102.mylevitrapill.com has address 81.0.124.75
* m100.firstmedicarevalue.com has address 81.0.124.75
* m102.organicpharmshop.com has address 81.0.124.75
* m100.luckytabsshop.com has address 81.0.124.75
* m102.luckymedseshop.com has address 81.0.124.75
* m102.perfectwelnessinc.com has address 81.0.124.75
* o100.healthrxshop.ru has address 81.0.124.75
* o101.pillhealthcaretenet.ru has address 81.0.124.75
* o102.drugtorehealthcare.ru has address 81.0.124.75
* drugtorerxassays.ru has address 81.0.124.75
* private.thecanadianmart.com has address 81.0.124.75
* refills.netpillstore.com has address 81.0.124.75
* private.medicalsafesale.com has address 81.0.124.75
* refills.smartrxsupply.com has address 81.0.124.75
* mail.puremedicareinc.com has address 81.0.124.75
* mail.salepillsdrug.ru has address 81.0.124.75
* mail.yourrxpills.com has address 81.0.124.75
* home.cialisrx.com has address 81.0.124.75
* orders.fastmedicationmall.com has address 81.0.124.75

Complaints to abuse@invitel.net

And another new IP for the rotation is 130.255.170.107
Rocco Neri
CORAEL S.r.l., Via Monte Nero, 8, I-10154 Torino, Italy
+39 0112422734
supporto [at] corael.it
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sun Aug 03, 2014 8:16 pm

August 3 - Current live redirection examples:

c100.canadianaidvalue.com has address 81.0.124.75 (suspended, NAMESILO)
c100.canrxstore.ru has address 81.0.124.75 (suspended, NAUNET, BIZCN)
e100.cialisrxgroup.com has address 81.0.124.75 (suspended, NAUNET, BIZCN)
e101.pilldrugstablets.ru has address 81.0.124.75 (suspended R01.RU)
e102.canadapillgroup.ru has address 81.0.124.75 (suspended R01.RU)
e244.caretabletspills.ru has address 81.0.124.75 (suspended R01.RU)
e244.luckyherbcompany.com has address 81.0.124.75 (suspended, NAMESILO)
m100.canadianfastvalue.com has address 81.0.124.75 (suspended, NAMESILO)
o100.healthrxshop.ru has address 81.0.124.75 (suspended, NAUNET)
o101.pillhealthcaretenet.ru has address 81.0.124.75 (suspended R01.RU)
o102.drugtorehealthcare.ru has address 81.0.124.75 (suspended, NAUNET)
o244.drugtorerxassays.ru has address 81.0.124.75 (suspended, NAUNET)
home.thetabletbargain.com has address 81.0.124.75 (suspended, NAMESILO)
mail.salepillsdrug.ru has address 81.0.124.755 (suspended R01.RU)
orders.fastmedicationmall.com has address 81.0.124.75 (suspended, NAMESILO)
private.medicalsafesale.com has address 81.0.124.75 (suspended, NAMESILO)
refills.themedicalstore.ru has address 81.0.124.75 (suspended R01.RU)
rx.canadianprivateinc.ru has address 81.0.124.75 (suspended R01.RU)

[Edit: All suspended by end of year]
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sun Dec 28, 2014 6:31 pm

Redirections live at Jan 10, 2015

* c100.besthealingcompany.com NAMESILO Dec 28
* c102.genericpharmacymart.com NAMESILO Dec 28
* c100.goodherbalservice.com JOGJACAMP Dec 29
* c102.purecurativeservice.com JOGJACAMP Dec 29
* e100.fasthealingeshop.com Jan 9
* e102.yourherbalmarket.com JOGJACAMP Dec 29
* e102.bestpharmacydirect.ru Expired NAUNET Jan 19
* m100.curingonlineshop.com TRUNKOZ Dec 30
* o244.privateherbvalue.com Jan 9
* rx.securetabsinc.com TRUNKOZ Dec 28
* private.myhealingtrade.com JOGJACAMP Jan 17
* refills.canadiandrugserve.com TRUNKOZ Dec 17

c100.mypharmservice.ru
c102.canadianpilleshop.ru
e100.mymedicareinc.ru
e100.familymedsvalue.ru
e102.leadingcanadian.ru
e244.puretreatmentdeal.com
m100.smartmedspurchase.ru
m102.magicmedicamentshop.com
o100.excellentpharmvalue.com
o102.newbiologicalmarket.com
orders.naturalpharmshop.com


rx.remedialfirsttrade.com

Jan 10 IP address 91.185.215.149
Jan 17 IP address 93.115.210.16
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy redirections

Postby Red Dwarf » Sun Mar 29, 2015 6:10 pm

This is the current list of live redirections, as seen at the end of March 2015. They are now all registered with R01 in Russia, the home of this fraud.

Code: Select all
    c100.mypharmservice.ru  =  dead 1/2016
    c102.canadianpilleshop.ru  =  dead 1/2016
    e100.familymedsvalue.ru  =  dead 1/2016
    e100.mymedicareinc.ru
    e102.leadingcanadian.ru
    e244.safepharmquality.ru
    m100.smartmedspurchase.ru  =  dead 1/2016
    m102.bestdrugpurchase.ru
    o100.assistancesystem.ru  =  dead 1/2016
    o102.naturalfastoutlet.ru
    o244.fastmedicationshop.ru  =  dead 1/2016
  orders.yourdrugsquality.ru
 private.globalpillservices.ru
 refills.familyrxwebmart.ru
      rx.bestrxbargain.ru
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10537
Joined: Tue Jun 27, 2006 2:01 am

Next

Return to Fight Spammers

Who is online

Users browsing this forum: Yandex [Bot] and 1 guest

cron