- 1 Description
- 2 False Pretenses
- 3 Hijacked servers
- 4 Sample sites and registrars sponsoring them
- 5 How to Report this Spam
- 6 Sponsor Organizations
- 7 Related spam operations
- 8 Further Reading
Description[edit | edit source]
Toronto Drug Store (TDS) is cvvvvbvbvBulker.biz/EvaPharmacy property, observed in August 2010. More complete discussion of the fraudulent nature of these sites is on the pages for their other brands. Control of this organization has been attributed to the spammer using the pseudonym Alex Polyakov. The same group of scam pharmacy brands is referred to as "Yambo Financials" by Spamhaus.
TDS uses a secure payment system at checkout, on https://checkoutpharamcysafe.com
Domain Name: CHECKOUTPHARAMCYSAFE.COM Registrar: KEY-SYSTEMS GMBH owner-fname: Andrey owner-lname: Polev owner-street: ul. Krasnaya d.117 kv.119 owner-city: Solnechnogorsk owner-state: Moskovskaya oblast owner-zip: 199538 owner-country: RU owner-phone: 7.4963612199 owner-fax: 7.4963612199 owner-email: firstname.lastname@example.org
The checkout site uses an SSL certificate issued by
PositiveSSL CA Comodo CA Limited
Like other Bulker.biz/EvaPharmacy sites, just about every claim made on CNP sites is a lie.
False Pretenses[edit | edit source]
Fake Staff[edit | edit source]
As usual with Bulker.biz/EvaPharmacy sites, their supposed staff physicians are actually models whose photos are available from Getty Images.
Fake Locations[edit | edit source]
The address given for their supposed main office is 155 Front Street West, Toronto, Ontario. The clumsy English on the page makes one immediately suspicious about whether these people have ever set foot in Canada:
We have decided to move the general stream of information to our online Support Department, so 90% of all inquiries are processed online. A special contact ticket system would be a helping hand for our clients while trying to contact us by any reason. Still if you want a face to face audience with one of our managers, you may visit our main Headquarters or secondary offices from 10 a.m. till 6 p.m. local time. We are always glad to meet you!
And sure enough, Google street view shows the data centre at 151 Front Street West extends the length of the block. There is certainly nothing resembling the building in the TDS website photo.
Fake License[edit | edit source]
The pharmacy has no real location and no real pharmacists. But like other EvaPharmacy/Bulker.biz pharmacies, they have forged an imaginary license for their pharmacy. It's obviously fake, since it is displaying the same imaginary address.
The Ontario College of Pharmacy has a website that allows you to look up their licensees. Not surprisingly, Toronto Drug Store isn't listed.
Fake American Pharmacists Association Certificate[edit | edit source]
This task apparently fell to one of the non-native English speakers, because it is quite clumsily worded:
All the drugs sold at Toronto Drug Store are considered to be approved by the American Pharmacists Association (APhA). This bulletin certifies that Toronto Drug Store (License Number 05671274) sells high-quality medications that are presented by certified online shop. We ensure that Toronto Drug Store team has the highest standards of practice carried out by its members. The American Pharmacists Association (APhA) is the organization whose members are recognized in society as essential in all patient care settings for optimal medication use that improves health, wellness, and quality of life. Date: 07/04/10 Signature: Harold N. Godwin
This certificate appears to be dated on July 4, 2010. July 4 is one of the most popular public holidays in the U.S. -- nobody would come in to work to do routine bureaucratic functions like issuing certificates. Actually, whoever did the forgery was unfamiliar with the fact that in the U.S., dates are in month-day-year format, rather than day-month-year. They were trying to make it look like an April 7, 2010 date. They've simply used the same certificate they forged for Canadian Neighbor Pharmacy and changed the name and number.
The license number is the same one used on the Ontario College of Pharmacy forgery. Anyone who has to get licensed by multiple agencies will tell you it's never going to be that easy -- you get a different number from each one. When asked if this certificate was fake, the reply from the American Pharmacists Association was
Yes, this is a fake. Thanks for passing along to us. Sharon Corbitt External Communications Director American Pharmacists Association 2215 Constitution Ave. Washington, DC 20037-2895
The APhA does not license pharmacies or approve the quality of medications. The logo they display is wrong as well, resembling the Glavmed logo instead.
|CNP vesion of APhA logo||/APhA logo from their website|
Hijacked servers[edit | edit source]
See the discussion at Canadian Neighbor Pharmacy. TDS sites load images from hijacked servers in the same way.
Sample sites and registrars sponsoring them[edit | edit source]
ADVANCED INTERNET TECHNOLOGIES, INC.[edit | edit source]
R01-RU[edit | edit source]
airweavesupplies.ru (expired) biologicalaidshop.ru
curingaidpurchase.ru curingcareoutlet.ru familyrxstore.ru firsthealingservice.ru goodcurativeinc.ru goodgenericsshop.ru healingherbsservice.ru healingonlinestore.ru hotorganicassist.ru hotpharmmart.ru mymedicalservice.ru newbiologicalvalue.ru newcanadianmart.ru newgenericassist.ru newmedicinaldeal.ru onlineremedyreward.ru remedialhotgroup.ru safepillsshop.ru thecuringmarket.ru themedicamentoutlet.ru trustedpillmarket.ru yourmedicamentinc.ru yoursmartsupply.ru
TUCOWS DOMAINS INC.[edit | edit source]
firstmedsgroup.com suspended healinghotsale.com magicherbshop.com
How to Report this Spam[edit | edit source]
The Complainterator is configured to report this spam to the registrars. It performs a "whois" lookup on the domain names used by the name servers that resolve access to the web site. It discovers the registrars that are sponsoring the access to the web site. It prepares a complaint to the sponsoring registrars.
web site domains
- the registrar needs to set the status of the domain to
name server domains
- the registrar needs to set the status of each of the name server domains to
In addition, to remove them as name servers, the subdomain address records (eg for ns1 and ns2) need to be changed to a non-routable address, such as 0.0.0.0 or a blackhole address within their own address space.
Sponsor Organizations[edit | edit source]
Related spam operations[edit | edit source]
The product list, the pricing and the product descriptions for Toronto Drug Store are identical with that of My Canadian Pharmacy