Fraud Reports Wiki


ED Pill Store previously was associated with the "Exquisite Replica" scam replica sites. Now it shares nameservers and IP addresses with penile enlargement brands linked to SanCash.

Version 1

Version 2

Version 3

Version 4

Version 5

Version 6

Samples of the spam[]

ED Pill Store spammers are famous for their inability to include in their spams the URL they want you to visit. About half the time they do manage to do it, and since they send massive bursts of similar spams, it's usually possible to see what they were trying to do with the ones that failed.

From: "FreeViagra" <>
Subject: Always be ready to perform in bed

Tireed of peying ridic{|oous prices for Viagra & Cialis?

How about a 100% free Viagra & Cialis?
From: "FreeViagra" <>
Subject: This is what she REALLY wants

Tired of paying ridiculuus ~rices for Viagraa & Cialiis?

How about a 100% frej Viiagra & Cialis?

Analysis of the spam[]

The domain is one of hundreds for ED Pill Store. Scam brands aren't trying to build customer loyalty; they're trying to avoid being found by previous dissatisfied customers. In addition, they need to have new sites to spam as fast as others are shut down.

Currently, ED Pill Store domains are registered with a country code top level domain, ".cn" (China). TLD's other than the common .com, .net, .org etc. ones managed by ICANN don't require much information identifying the registrant. It hardly makes a difference when the registrant is imaginary:

Domain Name:
Registrant Organization: ???
Registrant Name: ???
Administrative Email:
Sponsoring Registrar: ??????????????
Registration Date: 2008-12-31 16:04
Expiration Date: 2009-12-31 16:04

For name servers and, you do get registrant information because of the .com TLD. The address information is a bit improbable, though:

Domain Name:
Whois Server:
Status: clientHold
Expiration Date: 2010-02-15
Creation Date: 2009-02-15
Last Update Date: 2009-03-02
Name Servers:

Registrant Name ................. CHEN XIN
Registrant Organization ......... CHENXIN
Registrant Address .............. PUDONGBEILU27
Registrant City ................. sh
Registrant Province/State ....... sh
Registrant Postal Code .......... 200019
Registrant Country Code ......... CN
Registrant Phone Number ......... +86.13770561847 -
Registrant Fax .................. +86.13770561847 -
Registrant Email ................ CHENXIN@SOGOU.CN

This points up two important things to understand: One is that domain registrations are automated. Even though this was registered with a Chinese registrar, this fake Chinese address slipped through because no human being actually looks at most registrations. That's the case with most registrars -- the volume they handle is very high.

The second point is that although this domain is listed as Status: clientHold and can't function as a website, it is still able to function as a nameserver. To inactivate a nameserver, you have to either completely delete the domain name (not a good way to do it -- the spammer can then re-register it with another registrar) or else set the nameservers' "glue records" (IP addresses) to ones not under control of the spammers ("black hole" addresses). Then the nameserver is set to clientUpdateProhibited, clientTransferProhibited, clientDeleteProhibited, and finally clientHold to prevent the spammer from changing anything back.


First reported sightings Dec 2006.

Second version of the web site layout appeared in May, 2007.


The site (version 1 and version 2) claims to be secure, with a "Secure Server" logo at the bottom of the page: EDPillStore secserver.jpg.

But when you go to the checkout page, you are asked to provide your ID and credit card details over a non secure http page, not a secure https page. In a transparent attempt to defraud customers into believing they are on a secure page, the banner at the top portrays a padlock image, simulating a secure page. EDPillStore secure.jpg.

Version 3 is a different case. It runs on a secure site, with https. This version has an SSL certificate from GeoTrust. EDPillStore GeoTrust.jpg
EDPillStore SSL.jpg
EDPillStore SSL2.jpg

Sample site for analysis:

Looking up the registrant details at we find

Registrant Contact

Name:		paul    gregoire
Address:	175 Montreal Road
                vanier, on  K1L 6E4 
Email Address:
Phone Number:	(613)255-2162 

Spamhaus lists Paul Gregoire as a known alias for Alex Polyakov at

Looking up the registrant details for the Name Servers for at we find

Registrant [1649]:
       Gregory William
       1808 Bowen road
       British Columbia
       V9S 5W4

Spamhaus lists as a domain registered by Alex Polyakov at

Gregory William is another frequent alias for Alex Polyakov, and he has used the same Montreal Rd address:

Domain Name: HOROSCOPEFORCAATS.COM Administrative Contact:
Gregory William
Protected Domains Inc.
175 Montreal Road 304
Vanier ON K1L 6E4
Phone: 1-613-482-5333

The building at that address is actually a Playmate strip club.

In the March 2009 "Free Today" site setup, there is no secure ordering, only a prominent banner falsely claiming to have it:


Looking at the address in the browser shows it is "http," not "https:"


So every computer this order passes through on its way across the internet can record who is ordering these pills, what they're ordering, and what their credit card numbers are.

How to Report this Spam[]

The Complainterator is configured to report this spam to the registrars. It automates the process described here.

Do a whois lookup on the domain name spamvertized, to discover the registrar of the web site. Email a complaint requesting that the illegal site be removed.

Do a whois lookup on the domain names used by the name servers that resolve access to the web site. Again, discover the registrar(s) that are sponsoring the access to the web site. Email a complaint to the sponsoring registrar.

Removal instructions

To remove them as name servers, the Address records for ns1 and ns2 need to be changed to a non-routable address, such as or a blackhole address within their own address space.

The registrar then needs to set the status of each of these domains to

  • clientUpdateProhibited
  • clientDeleteProhibited
  • clientTransferProhibited
  • clientHold

For evidence, you can simply provide this page's URL

Related spam operations[]

Most closely related scam sites are the Herbal King clones Dr. Maxman, Max Gentleman, and Power Gain+.

They share the exact same set of name servers, and are registered at the same time. See for example the most recent registrations at the spam tracking site for


SanCash (in early 2008 known as "Etranzmu", the underground sponsor affiliate program related to Genbucks) was shut down by law enforcement agencies in the US, Australia and New Zealand in late 2008, but their brands soon reappeared in defiance of that. Obviously, there is a sponsor paying all those affiliates to spam for these sites. The successor to Sancash is the sponsor organization behind this type of site. They pay spammers to promote it, and they don't shut down illegal spammers.