Eva Pharmacy adds new brands

Spammers should not profit, so post information here that hits their pockets. There are many ways to fight spammers, and we have automation tools to combat them efficiently. These forums are moderated, but do not reflect the views of the hosting company, domain registrar, etc. By entering any of these forums, you agree that you cannot hold anyone liable for anything related in any way to these forums.

Eva Pharmacy adds new brands

Postby Red Dwarf » Tue Jun 28, 2016 11:44 pm

Since May 2016 there has been a newcomer to the ranks of Eva Pharmacy frauds. It calls itself "Healthy Life"

It has all the usual hallmarks of other Eva sites. A preliminary write-up is at

http://fraud-reports.wikia.com/wiki/Healthy_Life

A sample domain name, registered with Tucows in Canada, is

smartmedsmarket.com
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10478
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy adds new brands

Postby AlphaCentauri » Thu Jun 30, 2016 4:18 am

They don't give up on the fake buildings, do they?
User avatar
AlphaCentauri
You are kiillllling-a my bizinisss!
 
Posts: 5989
Joined: Thu Mar 01, 2007 3:01 am

Re: Eva Pharmacy adds new brands

Postby NotBuyingIt » Sat Apr 15, 2017 10:39 am

By any chance, is TOPPHARM.CN a (new) member of the Eva Pharmacy syndicate?

MyWoT.com is begin repeatedly hit today (15-April-2017) by a spambot that promotes a TOPPHARM.CN site. The spambot posts gibberish comments containing links to webpages planted on presumably hacked sites. These webpages redirect to topp.statisticdomain.com which, in turn, redirects to an "anabolic steroids shop" at medstoreline.com (IP 92.240.237.219).

On 07-April-2017, I saw a similar spambot attack which used stream.statisticdomain.com (IP 92.240.237.219) to redirect to a "Canadian Pharmacy" online pharmacy scam at rxpharmline.com (still active).
NotBuyingIt
Spammer Killing Machine
 
Posts: 611
Joined: Sun Jun 13, 2010 5:22 pm

Re: Eva Pharmacy adds new brands

Postby Red Dwarf » Sun Apr 16, 2017 10:21 pm

NotBuyingIt wrote:By any chance, is TOPPHARM.CN a (new) member of the Eva Pharmacy syndicate?

MyWoT.com is begin repeatedly hit today (15-April-2017) by a spambot that promotes a TOPPHARM.CN site. The spambot posts gibberish comments containing links to webpages planted on presumably hacked sites. These webpages redirect to topp.statisticdomain.com which, in turn, redirects to an "anabolic steroids shop" at medstoreline.com (IP 92.240.237.219).

On 07-April-2017, I saw a similar spambot attack which used stream.statisticdomain.com (IP 92.240.237.219) to redirect to a "Canadian Pharmacy" online pharmacy scam at rxpharmline.com (still active).


rxpharmline.com has address 92.240.237.219
rxpharmline.com has address 92.240.237.220

None of the Eva name servers are authoritative for it, so it is not part of their family. Residing on two host IPs also rules it out.

toppharm.cn likewise does not have the Eva fingerprint, and shares the same hosting IP 91.218.247.105 as these scammy sites:
Code: Select all
fauxdiplomes.org
fedexcenter.net
fedexearth.com
paybalinvest.com
payeerinvest.com
paypalearn.com
paypalforex.com
petrusportal.com
rapidfinanceag.com
ringbuzz.net
secure-online-bq.com
steeldns.com
supportnumber.uk
theachieversclub.net
tienda24.eu
toppharm.cn
tradeskrill.com
yahoosupportnumber.us
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10478
Joined: Tue Jun 27, 2006 2:01 am


Return to Fight Spammers

Who is online

Users browsing this forum: Ahrefs and 1 guest

cron