- 1 Description
- 2 Variants
- 3 False Pretenses
- 4 Spam Examples
- 5 Redirections
- 6 Sponsoring Registrars
- 7 Typical Fake WHOIS Contact Information
- 8 How to report this spam
- 9 Related spam operations
Description[edit | edit source]
ED Express was first noticed in October 2007. It displays a copyright statement for Canadian Pharmacy.
Variants[edit | edit source]
ED Express sites have a variety of appearances. It also may be called "Pills for Men" or "United ED Meds." All variants load images from a common domain, such as waklazr.net, or a common IP address (188.8.131.52 or 184.108.40.206). They also share a common "monthly special" marketing device.
False Pretenses[edit | edit source]
[edit | edit source]
In a laughable display of ignorance, the spam site developer repeats the same error as seen in other scams including ED Choice. Once again he confuses the US gold repository with the Knott's Berry Farm family entertainment site near Disneyland in Los Angeles, in an attempt to impress people with the site's security.
To make it worse, he refers to "world wide known processor MyPaySystems.com" which is unfortunately known for all the wrong reasons.
- They went out of service in 2004 when they were discovered to be a false front for scammers.
- RipOffReport has this report against sister site ED Choice, and their lack of service or reliable products.
But it gets even worse than that. When you go to their checkout page you are expected to enter your identity details and your full credit card information on a page using non-secure http instead of secure https despite the previous assurances of security - another example of fraud.
False: Claim to be Canadian[edit | edit source]
The copyright notice would lead you to believe that this site is somehow related to Canada. But in the Frequently Asked Questions link there is some conflicting information:
Spam Examples[edit | edit source]
Subject: "Re: ClALnlS - $ 1.45 (arrears superpose) VilAGRA - $ 1.29"
Subject: "RE: CltALlS : $ 2.53; VlAGRtA : $ 1.34 quest"
Spam emails include a footnote promoting a legitimate site. That URL may be picked up by Spamcop.net and reported as a spammed URL if the reporter is not alert when confirming the report.
Redirections[edit | edit source]
Microsoft spaces.live.com[edit | edit source]
In February 2010, spammers began using redirection abuse on Microsoft's free hosting service Spaces.live.com. The redirection target was canadapharmsite.com registered on INTERNET.BS CORP by Registrant
Ksenia Siniceva Kondrikova str. 6-219 620143 Zavoljsk Russia Tel: +7.3912488322
Storm Trojan[edit | edit source]
As at March 21, 2008, Storm Trojan infected machines were found to be redirecting to four different fake pharmacy sites using the format http://xxx.xxx.xxx.xxx/anything/
For ED Express, the redirection sites detected were
Sponsoring Registrars[edit | edit source]
Name Servers[edit | edit source]
- ns2.edutechjournal.com [220.127.116.11] Registrar = Beijing Innovative Linkage Technology
- ns1.edutalkonline.com [18.104.22.168] Registrar = Beijing Innovative Linkage Technology
- ns1.chinadotedu.com = Registrar Beijing Innovative Linkage Technology
- ns2.greateducaton.com = Registrar Beijing Innovative Linkage Technology
Spamvertized Sites[edit | edit source]
- Site = theloglady.com Beijing Innovative Linkage Technology (Uses image server oleoneg.info)
- Site = dovewoodmj.cn Registrar = 厦门华商盛世网络有限公司 = Bizcn
- Site = theregulusesworld.com Registrar = Beijing Innovative Linkage Technology (Uses image server waklazr.net)
Some of the other multiple domains spammed within a three day period:
These examples from March 2009 use two name servers registered with Russian providers
- * ns1.hostpharmacytechnician.com (Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU)
- * ns2.cheapfaxserver.com (Registrar: CENTROHOST CLOSED JOINT STOCK COMPANY)
Web site registrant details:
personname: Aleksandr Belkov organization: street address: Molodezhnaya str. d.9 kv.1 postal code: 152061 city: Sereda country: Russland phone: +74853161263 fax-no: +74853161263 e-mail: firstname.lastname@example.org
Image Servers[edit | edit source]
- Site = waklazr.net Registrar = MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE for Yahoo.com
waklazr.net has address 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168 waklazr.net mail is handled by mx5.biz.mail.yahoo.com and mx1.biz.mail.yahoo.com.
- Site = oleoneg.info Registrar = blog.com Digital Communications Inc.
Typical Fake WHOIS Contact Information[edit | edit source]
Domain Name.......... bestbobleonard.com Creation Date........ 2008-01-27 13:28:05 Registration Date.... 2008-01-27 13:28:05 Expiry Date.......... 2009-01-27 13:28:05 Organisation Name.... Sevila FC Organisation Address. Spain City Organisation Address. Organisation Address. Bulgaria Organisation Address. 45214 Organisation Address. WG Organisation Address. BG
How to report this spam[edit | edit source]
The Complainterator is configured to request removal of these fraudulent sites. Add a link to this page as evidence. Image servers should be reported directly to the responsible registrar.
Evidence to include:
- Any violations of your country's anti-spam laws (such as forged "from" fields or lack of contact information/unsubscribe information in the U.S.)
- Violations of terms of service of registrar (many of the image servers have been on Yahoo servers and are quickly taken down by that company for acceptable use violations)
- Advertising counterfeit generic versions of drugs that are still under patent (patent law violation)
- Use of the name/image of those drugs without authorization from the manufacturers (trademark violations)
- False whois information, if you are able to contact the person listed in the whois info by phone or mail (not email)
- If there is any evidence of botnet activity, as shown by sites with multiple/frequently changing IP addresses (although not observed for this site, it is a common occurrence with the site "Canadian Pharmacy")
Related spam operations[edit | edit source]
The "Fort Knott security" gaffe can be used as a "fingerprint" to locate other spam brands most likely from the same author.
- dovewoodmj.cn Pills for Men
- savssatbc.cn United ED Meds
- 2oqwplqcp8qgllkvpkkv7k22.crevicedin.cn ED Choice
Sharing the same IP Address
No known relation: ED Pill Store
Refer to the captured screen image. In 2011, spammer affiliates who registere with the Mailien spamming program were presented with pharmacy operations to select from. These included