Pharma Hack

Any research, news or information regarding the wide variety of techniques criminals use to take over your computers or web servers.

Re: Pharma Hack

Postby David166 » Thu Mar 27, 2014 9:26 pm

site: sharkfriendly.com viagra or medication, Brings up links that result in 404. The site seems to have been cleaned. sharkfriendly.com Is Hosted by Moonview Marketing

hollywooddesignpro.com has the pharma hack hosted by catalog.com
mgpweddings.com has the pharma hack hosted by catalog.com
justgamerz.com is hosted on hostgator and has been suspended.
mauriciolopez.info is hosted on cloudflare. it has the pharma hack
books-about-california.com is an inactive site on catalog.com but it has wordpress on it with the pharma hack
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:14 pm

This is what the hidden links looked like before the hacker pruned the dead wood:

backstageentertainment.net hosting provider is IX Web Hosting

‘www.trinitiybrdcount.com/tbcblog/hydrochlorothiazide.html Hydrochlorothiazide (MIA)
‘www.nwrems.org/hydrochlorothiazide.html Order Generic Medicine (404) Hosting provider: Catalog.com
‘www.turnerforte.com/wp/baclofen.html No Prescription (404) Hosting provider: Catalog.com
‘www.internationalsentinel.com/aldactone.html (Pharma Hack) Aldactone Hosting provider: Catalog.com
‘www.elephanteater.com/lipitor.html Visit Website (404) Hosting provider: Catalog.com
‘www.orthodontics.org/blog/zithromax.html article source (MIA)
‘www.reddirtemporium.com/blog/glucophage.html Glucophage (404) Hosting provider: Catalog.com
‘www.burnellreports.com/wp/fluoxetine.html Order (404) Hosting provider: Catalog.com
‘www.womendirectorsinhollywood.com/paroxetine.html Generic (404) Hosting provider: Catalog.com
‘www.tbiwa.org/paxil.html Buy Pills Without Prescription (404) Hosting provider: Catalog.com
‘www.ucmjdefense.com/singulair.html Full Article (404) Hosting provider: Catalog.com
‘lvgmc.org/accutane.html Canada Usa Pharmacy (404) Hosting provider: Catalog.com
‘www.screms.org/synthroid.html Go Here (hack) Hosting provider: Catalog.com
‘www.thomascray.com/viagra.html explained here (404) Hosting provider: Catalog.com
‘www.bucksmc.org/indocin.html Buy Generic Drugs (404) Hosting provider: Catalog.com
‘www.swems.org/neurontin.html Purchase Now (hack)Hosting provider: Catalog.com
‘www.elephanteater.com/topamax.html (404) Learn More Here Hosting provider: Catalog.com
‘www.familybusinessgallery.com/wp-content/zocor.html here (Pharma Hack) Hosting provider: Catalog.com
‘www.cafekolache.com/mobic.html source (Pharma Hack) Hosting provider: Catalog.com
‘www.dinottelighting.com/blog/singulair.html (404) Singulair Hosting provider: Catalog.com
‘www.pottstownpost.com/tenormin.html Check Out Your URL (404) Hosting provider: Catalog.com
‘www.trona-ca.com/valtrex.html Valtrex (redirected) Hosting provider: was Catalog.com
‘computerplusdc.com/inderal.html website here Hosting provider: HostWay
‘www.mightyfolio.com/zocor.html resource Hosting provider: (Pharma Hack) Catalog.com *
‘jennbartell.com/blog/wp-content/pharmacy/nexium.html (Pharma Hack) Hosting provider: Catalog.com *
‘www.thomascray.com/wp-content/pharmacy/revia.html (Garbage) Hosting provider: Catalog.com
‘learninc.org/backup/catalog/pharmacy/propecia.html (Pharma Hack) Hosting provider: Catalog.com
‘www.cosmiccowgirlsuniversity.com/wp-content/store/accutane.html (Pharma Hack) Hosting provider: Catalog.com
‘webchileconsultores.com/activa/store/clomid.html (Pharma Hack) Hosting provider: Catalog.com
‘www.ctsnowsnakes.org/wp-content/store/aldactone.html (Pharma Hack) Hosting provider: Catalog.com
‘actorsintensive.com/wp-content/store/diflucan.html (Pharma Hack) Hosting provider: Catalog.com
‘back2africa.com/livezilla/discountstore/cialis.html (Pharma Hack) hosted by Site5 (Monitored by sucuri)
‘www.tedngai.net/wp-content/rxstore/cytotec.html (Pharma Hack) Hosting provider: Catalog.com
‘www.peterconrad.com/blog/rxstore/topamax.html (Pharma Hack) Hosting provider: Catalog.com *
‘tbiwa.org/wp-content/rxstore/prednisone.html (Pharma Hack) Hosting provider: Catalog.com *
‘www.mcgrewgroup.com/blog/wp-content/pharmacy/doxycycline.html (Pharma Hack) Hosting provider: Catalog.com *
‘www.sanantoniobankruptcyattorneylawyerinformation.com/faq/wp-content/store/nolvadex.html (Pharma Hack) Hosting provider: Catalog.com *
‘www.leafdays.com/wp-content/store/doxycycline.html (Pharma Hack) Hosting provider: Catalog.com *
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:16 pm

site: martin-lim.com viagra seems to indicate that this is or was also a pharma hack site.

Update: I’m no longer seeing the hidden links but sitecheck still sees one.

I found the following list of hidden links on martin-lim.com:

“www.planetetheria.com/fluoxetine.html Learn More Here (404) hosted by Catalog.com
“www.geographicalsociety.org/cms/albendazole.html No Prescription (pharma hack) hosted by Catalog.com
“www.waterfrontalehouse.com/prilosec.html site (404) hosted by Catalog.com
“www.sanantoniobankruptcyattorneylawyerinformation.com/op/cephalexin.html source (pharma hack) hosted by Catalog.com
“www.black-iris.com/wporg/celebrex.html Celebrex (404) hosted by Catalog.com
“www.sanantoniobankruptcyattorneylawyerinformation.com/op/levaquin.html Related Site (pharma hack) hosted by Catalog.com
“www.rooftopconcertseries.com/albendazole.html Find Out More (500 error catalog.com)
“www.unitedministries-earlsplace.org/wp/mobic.html Read More (404) hosted by Catalog.com
“beverlyhillsmanners.com/zithromax.html Visit Your URL (pharma hack) hosted by Catalog.com
“www.limerickpost.net/prevacid.html Shop (pharma hack) hosted by Catalog.com
“www.turnerforte.com/wp/prilosec.html Add To Cart (404) hosted by Catalog.com
“www.exoticalimo.com/limousine-services/synthroid.html Visit This Link (404) hosted by Catalog.com
“www.cmdprensa.com/mx2012/dir/norvasc.html This Site (pharma hack) hosted by Catalog.com
“www.thomascray.com/clomid.html Pharmacy (404) hosted by Catalog.com
“www.screms.org/celebrex.html Celebrex (404) hosted by Catalog.com
“www.clayalliance.org/wp-includes/text/aciclovir.html found here (404) hosted by Catalog.com
“www.montesdowntown.com/wp/strattera.html homepage here (404) hosted by godaddy.com
“www.turnerforte.com/wp/aciclovir.html Low Cost Generic Medicine (404) hosted by Catalog.com
“www.brownstonepr.com/lantus.html Clicking Here (404) hosted by Catalog.com
“www.peterconrad.com/blarg/viagra.html Medication At Low Price (404) hosted by Catalog.com
“www.nwrems.org/paxil.html Recommended Reading (404) hosted by Catalog.com
“www.americansteamaway.com/wp-content/antabuse.html No Prescription (404) hosted by godaddy.com
“educatorsofbeauty.com/metformin.html Recommended Site (404) Hosted by Amazon.com
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:18 pm

mecalfab.com site contains a list of hidden links. It is hosted on server neptune-162.catalog.com

The registrar contact email bounced. I contacted webhero/catalog.com and was ignored.

“www.mahaniteave.com/news/hydrochlorothiazide.html Generic Medicine for Sale (404) hosted by catalog.com
“www.lovetwenty.com/cialis.html More about the author (pharma hack) hosted by catalog.com
“www.familybusinessgallery.com/wp-content/plavix.html our website (pharma hack) hosted by catalog.com
“www.viewtific.com/levitra.html Shop (pharma hack) hosted by catalog.com
“www.montesdowntown.com/wp/lexapro.html Lexaproc (404) hosted by catalog.com
“www.lovetwenty.com/xenical.html example here (pharma hack) hosted by catalog.com
“www.rooftopconcertseries.com/vermox.html Extra resources (500 error webhero server)
“www.arcdallas.org/antabuse.html Pharmacy (404) hosted by catalog.com
“www.screms.org/doxycycline.html Generic (404) hosted by catalog.com
“www.uglykidjoe.net/zoloft.html Buy Pills (404) hosted by catalog.com
“www.bucksmc.org/atarax.html Visit This Link (404) hosted by catalog.com
“www.nearlycivilized.com/rss/revia.html Find Out More (pharma hack) hosted by catalog.com
“twisterssportscenter.com/wp/wp-content/nizoral.html Click Here (404) hosted by catalog.com
“www.sfaccess.org/wpress/tenormin.html This Site (404) hosted by catalog.com
“www.jobomax.com/valtrex.html as an example (pharma hack) hosted by catalog.com
“www.mightyfolio.com/mobic.html view (pharma hack) hosted by catalog.com
“www.stephenspeople.com/protonix.html next page (pharma hack) hosted by catalog.com
“www.tbiwa.org/prilosec.html Prilosec (404) hosted by catalog.com
“www.sfaccess.org/wpress/diflucan.html Home Page (404) hosted by catalog.com
“www.nervline.com/burkhardt/aldactone.html Pharmacy (404) hosted by catalog.com
“www.motorcitycomic.com/blog/fluoxetine.html Generic (404) hosted by catalog.com
“www.hpmnd.com/vermox.html Going Here (404) hosted by catalog.com
“www.polkstreetboxinggym.com/singulair.html Click Here (404) hosted by catalog.com
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:19 pm

bobabbott.com is hosted by catalog.com

The contact was notified by email and contact form on 3/12/2014

The code on this site has the following hidden links:

“www.ucmjdefense.com/capoten.html” Capoten (Not found) hosted by catalog.com
“www.sacfssp.com/lipitor.html” Read Full Article (404) hosted by godadday.com
“www.mariocantone.com/baclofen.html” example here (Not found) hosted by catalog.com
“www.mccallumdesign.com/glucophage.html” site here (404) hosted by catalog.com
“www.sanantoniobankruptcyattorneylawyerinformation.com/op/capoten.html” more helpful hints (404) hosted by catalog.com
“www.black-iris.com/wporg/cipro.html” resource (Not found) hosted by catalog.com
“www.jobomax.com/aldactone.html” Low Cost Pills (Pharma Hack) hosted by catalog.com *
“www.jobshopsf.com/wp/levitra.html” website here (404) hosted by catalog.com
“www.sfaccess.org/wpress/albendazole.html” Canada Usa Pharmacy (404) hosted by catalog.com
“computerplusdc.com/cephalexin.html” Cephalexin (Redirects to home page) hosted by HostWay
“www.mightyfolio.com/albenza.html” Low Price (Pharma Hack) hosted by catalog.com
“www.jobomax.com/xenical.html” Additional Info (Pharma Hack) hosted by Catalog.com *
“www.montesdowntown.com/wp/inderal.html” Drugs.com (404) hosted by GoDaddy.com
“www.peterconrad.com/blarg/capoten.html” homepage (404) hosted by Catalog.com
“www.juliacray.com/levitra.html” Levitra (Pharma Hack) hosted by Catalog.com *
“www.pathfindersystems.com/protonix.html” Resources (Pharma Hack) hosted by Catalog.com
“www.swems.org/lipitor.html” additional reading (Pharma Hack) hosted by Catalog.com
“www.duluthpottery.com/cafergot.html” Order (Home) hosted by Catalog.com
“educatorsofbeauty.com/paxil.html” Resources (404) hosted by Amazon.com
“www.oceanlegends.com/prednisolone.html” Generic Medicine For Sale (404) hosted by Catalog.com
“www.trisilver.com/proscar.html” Clicking Here (Pharma Hack) hosted by Catalog.com
“www.thomascray.com/accutane.html” more info (404) hosted by Catalog.com
“www.brownstonepr.com/levitra.html” Visit This Link (404) hosted by Catalog.com
“www.pilvaxmag.com/lasix.html” Lasix (404) hosted by Catalog.com
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:24 pm

actionlanka.com hosted by SoftLayer Technologies

3/15/14 Update: The hidden links are still there. http://sitecheck3.sucuri.net/results/actionlanka.com missed them.

The source code has the following list of hacked sites:

”www.leighmerrill.com/portfolio/accutane.html Get the facts ISP: Catalog.com
”cleanburnmediaroom.com/glucophage.html Generic Drugs for Sale ISP: Catalog.com
”www.unicornprowebsites.com/clomid.html Canada Usa Pharmacy ISP: Catalog.com
”www.limerickpost.net/revia.html site here ISP: Catalog.com
”www.wwfairfields.com/januvia.html Your Domain Name ISP: Catalog.com
”www.learnanddance.com/capoten.html Visit Website ISP: Catalog.com
”www.internationalsentinel.com/singulair.html Singulair
”www.brewsville.com/wp-includes/text/cialis.html example here
”www.exoticalimo.com/limousine-services/revia.html Web Site
”www.sunrisealternativeenergy.com/private/doxycycline.html explained here
”www.jobshopsf.com/wp/premarin.html Read This
”www.limerickpost.net/celebrex.html Get More Info
”www.joseraposo.com/blog/synthroid.html view
”www.paratactic.net/blog/synthroid.html Extra resources
”www.exoticalimo.com/limousine-services/cafergot.html Our site
”www.simcoehall.com/mobic.html website here
”www.nwfoodnews.com/guyhand/furosemide.html Buy At Pharmacy
”www.brewsville.com/wp-includes/text/plavix.html Buy Generic Pills
”www.pilvaxmag.com/synthroid.html Synthroid
”www.peterconrad.com/blarg/nizoral.html Bonuses
”www.stephenspeople.com/amoxi-tabs.html Generic Equivalent
”www.viewtific.com/zyprexa.html click here
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:25 pm

This site has been hacked I emailed the contact on 3/11/2014.

3/15/14 http://sitecheck3.sucuri.net/results/canedysign.com Status: Infected With SEO Spam.

It has the following hidden links to sites that are or were hacked:

“www.tedngai.net/nexium.html Canada Usa Pharmacy
“www.familybusinessgallery.com/wp-content/vermox.html Vermox
“www.wwfairfields.com/paroxetine.html Purchase Medication Online
“www.elephanteater.com/seroquel.html Canada Usa Pharmacy
“www.dinottelighting.com/blog/lasix.html Read More
“www.pathfindersystems.com/lantus.html Drugs for Sale
“www.newcultures.org/propecia.html Average Price
“www.silvercreekdentistry.com/finpecia.html Drugstore
“www.motorcitycomic.com/blog/levaquin.html Check Out Your URL
“www.sfaccess.org/wpress/diflucan.html more info
“www.thomascray.com/lantus.html explained here
“www.mainstreetpa.com/zoloft.html Zoloft
“www.newcultures.org/baclofen.html Go Here
“www.mahaniteave.com/news/prednisone.html click for source
“www.mccallumdesign.com/doxycycline.html This Site
“www.ericksonranch.com/celebrex.html homepage here
“ianmorrison.com/singulair.html Add To Cart
“www.taxonomyoftrash.com/baclofen.html homepage
“www.ericksonranch.com/antabuse.html Buy Generic Drugs
“www.learntodance.us/paroxetine.html Paroxetine
“www.familybusinessgallery.com/wp-content/prednisolone.html Generic Medicine for Sale
“www.bigarrowup.com/panik80s/prednisone.html Order Generic Medicine
“www.thisistimeads.com/relafen.html Order Now
“www.oceanlegends.com/plavix.html homepage here
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:29 pm

tigerbd.com hosting provider: Catalog.com

http://siteexplorer.info says this site has the following link: http://www.xx#xx.com/nexium.html

I did not find external hidden links on this site. But I did find a bunch of internal links to a folder called "onlinestore" Someone smarter than me will have figure that out.


i-med-inc.com hosting provider: Catalog.com

http://sitecheck3.sucuri.net/results/i-med-inc.com did not find the hidden links.


Looking at the source code I found hidden links to the following sites:

"www.sanantoniobankruptcyattorneylawyerinformation.com/op/celebrex.html citation
"www.xx#*xx.com/indocin.html Generic
"www.mainstreetpa.com/levaquin.html Order Generic Medicine
"www.geographicalsociety.org/cms/atarax.html found it for you
"www.jobomax.com/aldactone.html site
"www.municipalbankruptcychapter9.com/glucophage.html Get More Info
"kathleenbolduc.com/wp/paroxetine.html Extra resources
"www.skyline-ranch.com/risperdal.html more helpful hints
"www.ericksonranch.com/capoten.html Visit Website
"www.taxonomyoftrash.com/metformin.html Metformin
"www.peterconrad.com/blarg/amoxil.html Find Out More
"www.reddirtemporium.com/blog/levitra.html Levitra
"www.motorcitycomic.com/blog/lipitor.html helpful resources
"www.ericksonranch.com/protonix.html Pharmacy
"www.mariocantone.com/zithromax.html Zithromax
"www.unitedministries-earlsplace.org/wp/doxycycline.html Order
"www.brassrootstrio.com/wp-content/amoxi-tabs.html Discover More
"www.trinitiybrdcount.com/tbcblog/protonix.html Drug Store
"www.tilakpyle.com/antabuse.html Drug Store
"www.unitedministries-earlsplace.org/wp/zoloft.html Your Domain Name
"www.americansteamaway.com/wp-content/prednisolone.html Buy
"ouroboros-press.bookarts.org/neurontin.html source
"www.skyline-ranch.com/cialis.html Low Price
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:31 pm

lepetitcafebonjour.com name servers are on seanic.net


The site has the following URLs in hidden links:

"www.xx#xx.com/hydrochlorothiazide.html Purchase
"www.montesdowntown.com/wp/relafen.html Visit This Link
"www.familybusinessgallery.com/wp-content/relafen.html Tablets for Sale
"www.brkichdesign.com/wp-content/lantus.html Get More Information
"www.nwfoodnews.com/guyhand/singulair.html Look At This
"www.leighmerrill.com/portfolio/amoxil.html info
"www.learntodance.us/cephalexin.html Go Here
"cleanburnmediaroom.com/januvia.html Find Out More
"www.mccallumdesign.com/tenormin.html Tenormin
"www.swisshistoricalsociety.org/test/zocor.html view website
"www.uglykidjoe.net/singulair.html view
"www.brkichdesign.com/wp-content/celebrex.html site here
"www.learnballroomlatin.com/mobile/januvia.html Order Now
"www.nearlycivilized.com/rss/finpecia.html as example
"www.waterfrontalehouse.com/plavix.html More about the author
"www.nwfoodnews.com/guyhand/clomid.html Pharmacy Shop
"www.dinottelighting.com/blog/cafergot.html Cafergot
"www.dinottelighting.com/blog/fluoxetine.html Get More Info
"ouroboros-press.bookarts.org/amoxil.html Get More Information
"www.kellycrowsonlaw.com/cialis.html found it
"www.ucmjdefense.com/cytotec.html Purchase Generic Medication Online
"www.exoticalimo.com/limousine-services/albendazole.html Albendazole
"twisterssportscenter.com/wp/wp-content/lipitor.html Lipitor
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:34 pm

mikaylamackaness.com hosting provider: Catalog.com

Looking at the source code I found the following sites in links:

"www.brewsville.com/wp-includes/text/zocor.html Cheap Pills
"www.sfaccess.org/wpress/valtrex.html Bonuses
"www.musicismybusiness.net/plavix.html Plavix
"lvgmc.org/levaquin.html Full Article
"www.turnerforte.com/wp/relafen.html Additional Info
"www.swisshistoricalsociety.org/test/vermox.html website here
"www.screms.org/albenza.html No Rx
"www.mainstreetpa.com/prilosec.html Find Out More
"www.codenameinsight.com/lexapro.html Order
"www.tbiwa.org/viagra.html Recommended Reading
"www.burnellreports.com/wp/antabuse.html example
"www.swems.org/viagra.html view website
"lvgmc.org/topamax.html more helpful hints
"www.reddirtemporium.com/blog/nexium.html Sales Online
"www.learntodance.us/xenical.html found here
"www.ironguides.net/inderal.html Tablets for Sale
"www.waterfrontalehouse.com/amoxi-tabs.html explained here
"www.natebibaud.org/wp-images/plavix.html More Bonuses
"www.brightcard.net/wp-includes/text/valtrex.html For Sale
"www.musicismybusiness.net/risperdal.html Risperdal
"www.silvercreekdentistry.com/accutane.html Accutane
"www.nervline.com/burkhardt/hydrochlorothiazide.html for more info
"www.limerickpost.net/plavix.html Sale Medicaiton
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Re: Pharma Hack

Postby David166 » Fri Mar 28, 2014 10:38 pm

johndmcdonald.com name server is on seanic.net. I found 2 other bad sites with the same IP address.

Using siteexplorer.info I found hidden links but I did not find them in the source code.

I did find a lot of internal links that seem strange considering the nature of the the site. If the owner of this site wants to have an online store I guess that is OK but I am betting that he doesn't even know that this site contains the following hidden link:

"www.johndmcdonald.com/left-bar/onlinestore/naturalproducts/superbeta/super-beta-prostrate-supplement.html

This is just an example of about 25 URLs that were like this.

Since the links do not seem to work it is going to take someone smarter than me to figure out what is going on.
David166
Getting started
 
Posts: 19
Joined: Sun Mar 23, 2014 5:06 pm

Previous

Return to Botnets, Hijacks and Hacking

Who is online

Users browsing this forum: Baidu [Spider] and 1 guest

cron