Welcome, Guest. Please login or register.
Tuesday, May 21st, 2013, 8:22am
Home Help Calendar Search Register Login

Forum Login
Username: Create a new Account
Password:     Forgot Password

 Board Index    Spam    The Latest Offenders  ›  Pharmacy express
Users Browsing Forum
MSN Bot and 0 Guests

 Pages: « 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13 » : All
Recommend Print
  Author    Pharmacy express  (currently 13,220 views)
dj
Posted on: Thursday, July 6th, 2006, 10:26am Report to Moderator
Guest User




I have been getting the "new" emails since Tuesday. Sometimes the urls dont work when I first receive them but do later in the day.
I have also written to 'abuse@server4you.de' and 'abuse@plusserver.de', who are the new "hosts" for the images, on Tuesday and forwarded a number of the mails I have received from MyCanadianPharmacy. So far no response from them and the images are still on their server, eg - http://62.75.178.134:8080/p/images/weship.gif as of today.
Logged
e-mail Reply: 30 - 181
comdetroit
Posted on: Friday, July 7th, 2006, 10:02am Report to Moderator
Spam Fighter


Gender: Male
Posts: 52
They have found a new server to hack (intergenia.de). The last server they were on booted them because they had been hacked. I contacted, via email, the people at intergenia.de and haven't received a response yet. I will be emailing them again soon.

Everything Internet
http://www.comdetroit.com
Detroit Area  
http://www.comdetroit.net
Logged Offline
Site Private Message Reply: 31 - 181
comdetroit
Posted on: Friday, July 7th, 2006, 10:16am Report to Moderator
Spam Fighter


Gender: Male
Posts: 52
The images are no longer hosted by Intergenia.de and they have moved.

Everything Internet
http://www.comdetroit.com
Detroit Area  
http://www.comdetroit.net
Logged Offline
Site Private Message Reply: 32 - 181
dj
Posted on: Friday, July 7th, 2006, 12:39pm Report to Moderator
Guest User



You must be getting a new version of MyCanadianPharmacy emails, I have only had 3 mails in the last 24 hours, but the images were all still at the following location - http://62.75.178.134:8080/p/images/weship.gif - which is the intergenia server.

I am still complaining to them.
Logged
e-mail Reply: 33 - 181
dj
Posted on: Friday, July 7th, 2006, 1:35pm Report to Moderator
Guest User



I just checked a Spamhaus report dated 28 May - http://www.spamhaus.org/sbl/sbl.lasso?query=SBL42590

This lists the AndyLambe address 195.141.149.161/32 as listed on the Register Of Known Spam Operations (ROKSO) database as being assigned to, under the control of, or providing service to a known professional spam operation run by Yambo Financials.

Interestingly, it goes on to say -
"As usual, the spammer does not have his images here. They are located at:

MyCanadian IMAGES: http://62.75.178.134:8080/p/[varies]
at the SPAMHAUS listed IP address 62.75.178.134 on plusserver.de,intergenia.de/server4you.de"
so these images have been on the intergenia server at least since 28 may 2006!

Obviously they are not too worried.
Logged
e-mail Reply: 34 - 181
mr_d
Posted on: Saturday, July 8th, 2006, 12:16pm Report to Moderator
New Member


Posts: 3
Here is a compiled list of recent Pharmacy Express sites, all from SPAM.
The IP's change almost daily.  

Pharmacy Express is the same as Premier Pharmacy, which many of you knew.  
Today I observed they are using the same exact spam format used by International Legal RX, and Canadian Pharmacy.   Sometimes they even share DNS servers.  We are dealing with ONE large spam network that goes by many names.  

It's interesting that they attempt to keep these web sites seperate.  For example 30 Pharmacy Express sites all change IP's on the same day, as does Canadian Pharmacy.  But they don't share site IP's.  The share SPAM formats, and even DNS servers sometimes but they keep most of it seperate.

Did you guys notice the Pharmacy Express address is shared by at least 4 other companies?

Pharmacy Express
Palm Grove House
P.O.Box 438 Road Town
Tortola, British Virgin Islands

The same address is also used by:
http://www.northcote.co.uk
http://www.fxuc.com
http://www.equitytrust.com    
http://www.nomuraholdings.com

They all seem to be investment firms of various types.  And there are a dozen more investment firms all located on that same street.  Probably hiding there on purpose.  


There is not much point reporting IP's since they move almost every day.
07/08/2006 all sites on 211.144.68.67
07/07/2006 sites on 60.191.254.119
07/06/2006 sites on 218.104.136.237
07/05/2006 sites on 218.104.136.243
07/04/2006 sites on 222.170.2.246


Pharmacy Express site list from SPAM:
7/8/06     http://www.rubakodaf.com    
7/7/06     resoritbe.com
7/5/06     landetungertanka.com
7/5/06     catemis.com
7/4/06     uadesaxecoin.com
7/4/06     anpulicar.com
7/3/06     nijanderuynhaewa.com
7/3/06     uadesaxecoin.com
7/2/06     rohadesfunvers.com
7/1/06     lanvertunjased.com
7/1/06     aturalabur.com
6/30/06     penofarsan.com
6/29/06     omiambell.com
6/28/06     vicesandani.com
6/28/06     zanekesdona.com
6/27/06     vasezoceoms.com
6/26/06     stedatlan.com
6/25/06     http://www.kimanuhetunade.com
6/24/06     http://www.assansit.com
6/23/06     doforeval.com
6/23/06     voyskojasa.com
6/22/06     poureole.com
6/21/06     baderunhertuna.com
6/21/06     dasetunhandecas.com
6/20/06     http://lumunherfans.com
6/14/06     http://www.waleokanfeun.com
6/13/06     http://www.janwertanqa.com
6/13/06     http://www.kangeoutex.com
6/12/06     http://www.loiangande.com
6/11/06     http://www.becogantunx.com  
6/10/06     http://www.pinandesca.com
6/9/06     http://www.neateton.com
6/9/06     http://www.sasonerita.com
6/8/06     http://www.votundasterc.com
6/6/06     http://www.lovedottop.com
6/5/06     http://www.awerod.com/n1
6/5/06     http://www.whileheto.com
6/3/06     http://www.notalokasug.com
5/30/06     http://www.ontthemap.com
5/29/06     http://www.melisaduron.com
5/28/06     http://www.yunmounbertu.com
5/27/06     http://www.fitingack.com
5/26/06     http://www.dikintansderfun.com
5/25/06     http://www.sekisometi.com
5/25/06     http://www.numzaisundes.com
5/24/06     http://www.arcothene.com
5/23/06     http://www.bullkelaidesion.com
5/23/06     http://www.geocities.com/ImkstBaezComb
5/22/06     http://www.wozawukelans.com
5/21/06     http://www.bexiahekess.com
5/19/06     http://www.balerutezalod.com
5/19/06     http://www.eveyearo.com
5/19/06     http://www.zaxuleqinsertu.com
5/17/06     http://www.didothikes.com
5/17/06     http://www.balasintersver.com
5/16/06     http://www.jernifersactis.com
5/15/06     http://www.foroverear.com
5/15/06     http://www.sututerfuins.com
5/13/06     http://www.heltefenskalls.com
5/13/06     http://www.mubuiterfu.com
5/12/06     http://www.upomeres.com
5/11/06     http://www.devalusaare.com
5/10/06     kolafahrovan.com
5/9/06     dopalokusar.com
5/8/06     http://www.kilutasso.com
5/6/06     http://www.nesparizapen.com
5/5/06     http://www.temaferte.com
5/4/06     http://www.embasarokal.com

DNS Servers:
NS0.WITHOMM.COM     211.144.68.59
NS0.MORANAPPY.COM     221.231.139.31
NS0.ANGAMLACE.COM     211.144.68.59
NS0.VESARHOTTO.COM     218.104.136.232
NS2.BLOWIFOM.COM
NS2.MASKELIBASON.COM
NS0.LINESORETE.COM
NS0.HOTEAREKET.COM
NS9.INDIAHOST.BIZ
NS10.INDIAHOST.BIZ
NS0.STROTICCUTU.COM
NS0.ORINALUCH.COM
NS0.THOUMAYBE.COM
NS0.SINACESSI.COM
NS0.MAOMAREGI.COM
NS0.MANOTHAVE.COM
NS0.ANOTHEGISA.COM
NS0.SIGUMEBERSI.COM
NS0.TORESINATO.COM
NS0.RAPIEXANSI.COM
NS0.LASROMTEA.COM
NS0.POLTRAINI.COM
NS0.RESTANRELTI.COM
NS0.SETORELLE.COM
NS0.WINGELA.COM
NS0.TIMOPOTED.COM
NS1.FREESERVERS.COM
NS2.FREESERVERS.COM
NS4.TRISLUCAT.COM
NS2.TONOBEARO.COM
NS0.ANLINHOLI.COM
NS0.HETRIEDIS.COM
DNS2.ASETANTIC.COM
DNS1.ASETANTIC.COM
DNS1.EIGHOURI.COM
NS0.FESTIVAINURO.COM
NS0.AIRALLON.COM
NS0.TREATENSON.COM
NS0.ATTEPONTAI.COM
NS0.THAPICURESE.COM
NS0.TIVICENE.COM
NS1.AREVERE.COM
NS2.AREVERE.COM
NS3.AREVERE.COM
NS6.AREVERE.COM
NS0.ALROMALVI.COM
NS0.TANISIGER.COM
NS0.TONCEREAN.COM
NS0.NEVEPOSTE.COM
ns0.chapithiso.com
NS0.FEEGATIONS.COM
NS0.FEREGULATI.COM
NS0.PROXIMOSAN.COM
NS0.CENTRANDAN.COM
NS0.BASTENNI.COM
NS0.COURTANPA.COM
Logged Offline
Private Message Reply: 35 - 181
dj
Posted on: Saturday, July 8th, 2006, 2:55pm Report to Moderator
Guest User



I got another email today which I thought was going to be a MyCanadianPharmacy email.
The title was - "Your money, mint julep" which is the format I have been getting from MyCanadianPharmacy , and the text reads - "Even if you have no erectin problems SOFT CIAzLIS would help you to make BETTER SE  X MORE OFTEN!
and to bring  unimagnable plesure to her.

Just disolve half a pil under your tongue and get ready for action in 15 minutes.

The tests showed that the majority of men after taking this medic ation were able to have PERFECT ER ECTI ON during 36 hours!

VISIT US, AND GET OUR SPECIAL 70% DISC OUNT OFER!"

Then a url and the piece of text that looks as if it has been extracted from a book.

But when I looked at the site it is now headed "HealthSuite Certified Online Pharmacy" but is presumably still our old friends at MyCanadianPharmacy.

Interestingly, the images (not so many now) are hosted at the same location as the website!
Logged
e-mail Reply: 36 - 181
g4zilla
Posted on: Wednesday, July 12th, 2006, 10:54am Report to Moderator
New Member


Posts: 1
Pharmacy Express...from outta nowhere, I get 48 spam in 30 minutes. As of today they're at ortuncaze.com.

Lock me in a room with 'em, and they'll *need* a pharmacy! Somebody must live near these guys...
Logged Offline
Private Message Reply: 37 - 181
lava
Posted on: Friday, July 14th, 2006, 1:29pm Report to Moderator
Guest User



For months I've been sending copies of this spam with its Internet headers to the originating Internet providers.  It doesn't seem to do any good.  So many of these have gone out that my own IP will block my own abuse emails from being sent.  I guess a person just can't win!

These same fraud artists are not limited to trying to scam people with fake drug outlets, but they also have email scams linking to websites that deal with software, watches, and other things.

I think that perhaps we should flood these idiots with fake orders, fake names, and fake VISA card numbers.

This problem will likely continue as these scamers can safely operate unscathed from the recesses of their own backwoods country.  It seems as if we are impotent in this matter, and that our government officials need a little Viagra before they are able to do anything.


Logged
e-mail Reply: 38 - 181
Unfortunate Bystander
Posted on: Monday, July 17th, 2006, 12:44pm Report to Moderator
Guest User



I've got the opposite problem.  I have my own domain and run my own (small) mailserver.  The folks spamming for Pharmacy Express are using my domain name with random user names as the return address for a good portion of the spam that they send.  My poor little server has to cope with thousands of bounce messages, out-of-the-office messages, MAILER-DAEMON replies, anti-spam reports, etc, etc, to the tune of many thousands a day.  Is there any hope in stopping these guys?
Logged
e-mail Reply: 39 - 181
compinst
Posted on: Tuesday, July 18th, 2006, 5:18pm Report to Moderator
New Member


Posts: 1
This same company has been using some sort of email blasting majordomo program and using MY email name as the sender. I am not only getting junk emails from them under different names but also "returns" from IP's that these names no longer exist. So my research came up with all the names listed here plus a new one. http://www.xolertandefaceda.com with all the same junk being emailed. I notice when I use properties on the email I see the xolertandefaceda.com embedded into this majordomo crap. It burns me up that my site name is being used as a return address. As Im writing this here is another spam same crap from agripi@joelsteed.com This is amazing 10 a day plus the illegal name returns come to me. Rick@allkindstravel.com
Logged Offline
Private Message Reply: 40 - 181
dj
Posted on: Thursday, July 20th, 2006, 4:37am Report to Moderator
Guest User



If anyone on this board is in Canada, keep an eye on the "Globe and Mail". One of their reporters, Scott Roberts, is researching a story on rogue internet pharmacies. I have pointed him to this board and various other sources. Will be interesting to see what he comes up with.

He was looking for "victims", so perhaps some of you who have had your mail addresses used for sending out this junk might want to contact them about the effect this has. It is the "invisible" side of spamming that must really affect small businesses, but is not seen by the majority.
Logged
e-mail Reply: 41 - 181
guest
Posted on: Friday, July 21st, 2006, 11:50pm Report to Moderator
Guest User



my girlfriend has been getting text messages on her cell phone tonight advertising "cashmeds net", which leads you to MyCanadianPharmacy.  Three text messages in ten minutes !
Logged
e-mail Reply: 42 - 181
admin
Posted on: Saturday, July 22nd, 2006, 12:08am Report to Moderator
Administrator Group



Posts: 15
Here's one thing that might be worth a try.  This is from the Federal Drug Administration's Website:  http://www.fda.gov

Reporting Unlawful Sales of Medical Products on the Internet
Last Revised: Jan. 12, 2005

If you find a Website you think is illegally selling human drugs, animal drugs, medical devices, biological products, foods, dietary supplements or cosmetics over the Web, please select one of the three options below to report to FDA.

If your report:

involves a life-threatening situation due to an FDA-regulated product you purchased from a Website, call 301-443-1240 immediately. (Also contact your health professional for medical advice.)
involves a serious reaction or problem with an FDA-regulated product, fill out FDA's MedWatch reporting form. (Also contact your health professional for medical advice.)
for problem Websites that DO NOT involve a life-threatening or otherwise serious reaction, fill out the form below. To report e-mails promoting medical products that you think might be illegal, forward the email to webcomplaints@ora.fda.gov.


I think I'll forward each one of the spams from Pharmacy Express/MyCanadianPhar/LegalRX/Discount Pharmacy etc. etc. etc. to webcomplaints@ora.fda.gov

Maybe if they see a huge influx of complaints, they might want to take some steps to put them out of business.   Remember, these guys aren't just "annoying" people through continuous spam, hijacking servers, etc; they are breaking federal laws by illegally dispensing prescription drugs.  
Logged Offline
Private Message Reply: 43 - 181
Dave
Posted on: Sunday, July 23rd, 2006, 6:21am Report to Moderator
Guest User




Quoted from dj (Guest)
I hadnt received any MyCanadianPharmacy mails since 26 June and even then the urls were already dead.  

Then today I received 4 of them again!  

Sorry make that 7, another three just came in. >

Images all hosted at -
http://62.75.178.134:8080/p/images/weship.gif




Hi
I originally advised the above  site for image posting (1 July) but have now
revisited the  http://plumageruby.info    /link and the accreditation
pics are now at  http://194.146.226.209:8080/p/images/cipa.gif

I have emailed them to see if they can block them
Logged
e-mail Reply: 44 - 181
 Pages: « 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13 » : All
Recommend Print

Locked Board Board Index    The Latest Offenders  [ previous | next ] Switch to:

Thread Rating

There have been 1 votes for this thread.
 
Forum Rules
You may not post new threads
You may not post new threads
You may not post polls
You may not post attachments
HTML is off
Blah Code is on
Smilies are on

Powered by E-Blah Platinum 9 © 2001-2005