Who Put The "Canadian" in Canadian Health&Care Mall"?

It's alarming just how many lies a single spam message can have. Join me as I dissect just one botnet-delivered spam message on behalf of "Canadian Health&Care Mall", a well known bulker.biz property (aka bulkerbiz.com, currently in transition as previously mentioned.)

******* 0nline Canadian Pharmacy Mall *******
NoPrescription needed for CialisLevitrvViagra, Hairloss treatment, WieghtLoss & all
others..

Right out of the gate: lies.

The domain, which they carefully placed at the end, is:

http://gipg.vbjeozwe.cn

That's ".cn" as in "China." Not Canada. Hosted on IP address: 89.134.141.124. That's in Budapest, Hungary.

That in turn redirects to:

http://canadapharmacymall.com/

A domain which has been especially difficult to shut down, thanks to the deaf ears of ename.com, registrar of choice to many illegal spam operations.

Hosted on ip address: 200.206.237.78

That's in Brasil. And guess what? It's a hijacked unix server. The actual owner of that server has either abandoned it or is otherwise not using it for web hosting purposes.

So: "Canadian"? Lies!

ViagraFrom $1.85
CialiFrom $2.40
SomaFrom $1.06
TramadolFrom $1.39
LevitrvFrom $2.5
& ....

The site says "as low as". I guess this is the first non-lie. But it's all downhill from here.

** How to buy Canada Drugs:

Again: nowhere near Canada.

0rdering Canada drugs from a Canadian Pharmacy Mall, and finding relief, has never been easier! You can place your 0rder online as easy as 1-2-3. Regardless of how you order, your needed drugs will arrive quickly and safely - in about 7 days.

Bait orders were received in a matter of weeks, not days. It sure is easy, though. With no secure server, and no confirmation as to when your order ships, or anything else regarding the use of your personal data or credit card information, I guess that is "easy." It's just that it isn't particularly safe.

Oh and of course: the pills contained only trace amounts of the alleged "active ingredient". The rest was "filler material". You are wasting your money by purchasing from these criminals. But you knew that already, right?

You can also find, view and track your order, or make changes to your personal medical file at any time, from the comfort of your own home.

More lies. "Personal medical file"? They create no such thing. They capture your order using zero security, and throw that information to an as-yet unknown third party host where the order is processed. This is usually a server in Russia, and the fulfillment of the order takes place usually in India. (Again: How close are we to Canada now?)

Order tracking is, at best, spotty. You are only told one of three things:

1) Your order has been received.
2) Your order has been processed.
3) Your order has been denied.

No individualized order tracking in the way that a legitimate company would do. They only use international postal mail (which, by the way, since they sell controlled substances, is a violation of international law, and violates several DEA and FTC guidelines.) As a result: the consumer is left completely in the dark regarding whether the order has shipped, or when it can be expected to be delivered.

Lies!

Why not go shopping on our site and see the wide selection of top Canadian prescriptionDrugs and available discount prices for yourself? We think you'll agree that family values are alive and well at Pharmacy Online!

"Family values"? So far we're up to:

- Lies about where they claim to be located.
- Hosting on hijacked unix servers
- Fake and / or dangerous drugs.
- Lies about how long the order takes to ship
- No security whatsoever.

I don't see any "family values" in any of that. Didn't their mothers ever teach them that lying is wrong?

** Canadian Pharmacy 0nline Testimonials:
Here's what some satisfied customers had to say:

Oh this should be good.

"I reviewed an AARP bulletin online (Sites to See: Getting Prescription Drugs Safely From Canada)... This article suggested checking with the following organizations when buying meds from Canada (Canadian Pharmacies):

1. CIPA: Canadian International Pharmacy Association
2. IMPAC: Internet and Mailorder Pharmacy Accreditation Commission
3. Pharmacy Checker

I highly recommend Pharmacy 0nline for all meds purchased from Canada... Most important, I ordered on the 20th of January and received them on the 27th of January... Thank you again for being there..."

Wow. They just don't know when to quit.

Bait purchases had Indian postal stamps on them. That's some 6,902 miles or 11,108 kilometres from Canada. Nice try, though, "I".

AARP: That's the American Association of Retired People. There is a report, as mentioned, and it lists each of the three organizations listed above (article available here). No representatives from the AARP responded to a request for comments on this claim, but try and find a single report that mentions "Canadian Health&Care Mall", or bulker.biz in a positive light. Go ahead I'll wait... :)

CIPA, if you contact them, are very much aware of this illegal online pharmacy and do not endorse or support this group, or any of the sites that they promote via illegal spam or otherwise. They're also well aware of the abuse of their logos and organization name within these illegally sent spam messages, and on the websites they drive to.
In reviewing all the above, I could only find two Pharmacies that were recommended
by all three... and one was Pharmacy Online.

IMPAC (Internet and Mail-Order Pharmacy Accreditation Commission) also is aware and (hey guess what!) also deny any endorsement for this site, or this affiliate program. Their site also features a list of actual IMPAC accredited pharmacies (located here) and (hey guess what!!) "Canadian Health&Care Mall" is nowhere to be found. There are only three online pharmacies on that list, so it doesn't take much time to figure out that this group is telling outright lies.

Pharmacy Checker, as you might expect, also says that they do not at all endorse this group, and further that their logos and organization name are being used illegally by this group.

By the way: who is this quotation from? Who is this "I" they refer to? And why do they suddenly refer to this site as "Pharmacy Online"?

Lies.

"I got on the Internet looking for (Canadian 0nline Pharmacy) alternatives and most of the companies were either not registered with the Better Business Bureau or had bad reports. Yours was registered and had a very good report..."

Really? (Again with this nondescript "I" person.)

If you do a simple, non-strategic search for "Better Business Bureau Canadian Health&Care Mall" the first link you get has a headline of "Online Pharmacy Questionable: Canadian Health&Care Mall" (here.) Separately, correspondence I and many others have had with the Better Business Bureau in numerous states has resulted in statements from their representatives stating outright that they do not recommend these sites, that they lie, that they pose a genuine risk to the public, and that they are notoriously difficult to shut down. They also state that their logos and organization name are being used by this group without any authorization or consent.

But hey: so is their hosting. So is their domain registration, which uses stolen identities and credit cards. So why stop there?

If I were to write a testimonial with some truth in it, it might sound more like this:

All of the research I could find on this shady "pharmacy" indicated that they were lying to me, but I purchased from them anyway. I know it sounds silly, since the only way I ever heard about this company was via hundreds of unwanted spam messages which I never asked to receive. I guess I figured "why not"? They certainly weren't going to remove me from their lists. After weeks of waiting I did finally get some pills but they weren't packaged very safely, and when I brought them to my doctor he said that these were essentially fake pills.

But people generally don't do this type of research before they hand over their credit card information. They should.

Please visit our Big Discount Canada Pharmacy Mall via below links
http://gipg.vbjeozwe.cn
http://gzts.vbjeozwe.cn

How about: please don't.

The days of this criminal group must be numbered. If this were a legitimat company with a head office and a CEO, they would be hauled into court for publishing lies like this. Because they are illegal spammers, and have operatives located in numerous offshore locations: they get away with it.

It is time for international law enforcement to recognize this group and others like it as more than a mere "nuisance" for spamming. They are commiting numerous serious crimes without spamming even entering into the picture, and most of all, they are filthy liars.

Please tell anyone you know who has a requirement for pharmaceuticals that they should never, ever, buy from organized criminals, which is essentially what this group is.

SiL / IKS / concerned citizen

What Is Going On At Bulker.biz?

As many of you who follow my blog know, Bulker.biz (more recently known as "bulkerbiz.com" due to coincidental shutdown of their previous domain in November 2008) is a spam-friendly affiliate I've talked about quite a bit.

The list of illegal acts they routinely take part in is available in the spamtrackers wiki entry devoted to their most popular spammable illegal online pharmacy My Canadian Pharmacy.

I noticed that rather suddenly, they have decided to secure their current affiliate portal, replacing it with an authorization setup, and a default message indicating they are changing their name yet again.

Site is closed. Please contact ICQ 333192431 for new address.

To see what it used to look like, even a mere four days ago, check out the Spamtrackers wiki entry here.



Isn't that interesting?

That ICQ address belongs to an individual who used to post on a variety of forums, notably Russian ones, using the username "ebulker". He specifically mentions in most of these postings that bulker.biz "doesn't care where your traffic comes from", indicating that they're very much aware that they spam illegally. But really, spamming is just the tip of the iceberg. These guys break so many laws on a daily basis that it's hard to believe nobody's gone after them. It would literally be like shooting fish in a barrel.

More as it happens, I suppose...

SiL / IKS / concerned citizen

An open letter to new US FTC Chairman Jon Leibowitz

The following is a letter which has been drafted by many of the members of the Fight Spammers Forum at InBoxRevenge.com to Jon Leibowitz, who was appointed as the new chairman for the Federal Trade Commission. I think it deserves some exposure.

---

We very much support the efforts the FTC is taking to educate consumers about internet fraud and identity theft, and we recommend that everyone view the excellent materials online at ftc.gov. However, those types of problems require a level of coordinated effort beyond what any one individual or business can accomplish. We urge the next head of the FTC to see the big picture. And one obvious part of the picture is spam.

Spam is like a flashing light alerting us to far more serious criminal activity beneath the surface. By minimizing the severity of spammers' offenses, you lose the ability to expose and investigate much deeper risks to the US, even impacting on national security.

Spam -- unsolicited commercial email -- is a nuisance. Because it is so inexpensive to advertise through email, spam volume has ballooned to comprise the vast majority of email messages. And the majority of the spam being mailed advertises products that are fraudulent or illegal, whose sponsors do not care about building a positive brand image. Most users have little idea how much spam would be arriving in their inboxes if their internet service providers were not using strategies to block the worst of it.

This is obviously a problem in terms of time/money spent on spam filtering systems and in deleting spams that pass through filters. More importantly, the loss of valid emails due to spam filtering is making some types of email communication extremely difficult. Legitimate commercial email is lost in the deluge of spam messages.

But the problem in the inbox pales by comparison to the multiple layers of illegal activity spammers employ to circumvent users' attempts to avoid their garbage. Spammers are hijacking the computers of innocent users to send their email and host their web sites. They are using stolen identities to register their website domain names, and using stolen credit/debit/PayPal accounts to pay for them. Their websites flagrantly violate trademarks, fraudulently claim approval from agencies like the FDA and Better Business Bureau, use stock photos of buildings and people to create imaginary locations and corporate officers for themselves, display forged pharmacy licenses, and sell counterfeit copies of drugs still protected by patents within the US. They abuse voice-over-internet phone service, using US local phone numbers to give unwitting consumers the impression they are located within the US. They transmit protected health information and credit card numbers via insecure connections, and use fake images of SSL icons to deceive consumers about that fact. They require no prescription for drugs that require one in the US, often including controlled narcotics. They ship pills of questionable content into the US, competing with those produced under FDA oversight, and they smuggle them through customs via fraudulent declarations. They use spam emails to lure additional people to websites where their computers will become infected with malicious programs like computer viruses and Trojan horses, allowing the spammers to continue to expand their power to abuse the internet.

While CAN-SPAM attempted to provide a safe haven for legitimate emailers, it is totally ignored by the criminal spammers whose products would still be illegal no matter how "compliant" their emails might be. Enforcement is hampered because spammers can maintain anonymity by using other people's hijacked computers, and because many of the most prolific spammers operate in countries which tolerate or even condone their activities.

But the situation is not as hopeless as it would appear. Not all reasonable measures are being taken to control the problem. Spammers could not continue at this level of activity without the passive cooperation of legitimate businesses. For instance, there are multiple systems in existence to identify the hijacked computers and illegally registered domain names that spammers rely on to conduct their business. Spam filtering products rely on them to obtain the necessary information to identify spam. Yet that information is often ignored by the otherwise legitimate registrars, hosting companies and telecommunications services which have the power to do something about it.

Does anyone really believe the spammer smuggling counterfeit Viagra into the US is sitting at home at the address provided in the domain registration, waiting for law enforcement to drop by? Then why is there unwillingness to investigate and suspend these domains? Do internet service providers think their customers would rather not know their computers are controlled by strangers in foreign countries, sending spam and helping themselves to users' personal information? Then why are they so unreceptive to reports of hijacked servers within their own networks? Do banks consider it acceptable for their clients' credit card numbers to be stolen to register illegal domains? Then why is there no effort to identify and close the credit card merchant accounts being used to process orders at those same sites? And when it would be simple to block all traffic from rogue countries which allow these criminals to operate, why are US internet companies so lax at shutting down bots on their own networks, making it impractical for American companies to block traffic from the worst spam-spewing IP address ranges?

The other issue is that these armies of zombie computers, called "botnets," do more than just send spam or host websites. They are also used to conduct Distributed Denial of Service attacks. In such attacks, large numbers of computers access the resources of an internet target simultaneously, making it impossible for that web site to continue to operate without spending large sums of money for mitigation.

We in the antispam community saw an extreme example of such an attack in 2006 when angry spammers attacked the company Blue Security, whose product submitted automated unsubscribe request for its members. The high volume of that DDoS attack not only shut down Blue Security, it knocked many other innocent firms off-line as well. Yet this was apparently dismissed as a private matter between Blue Security and the spammers, and there was no notice given of the potential risk to national security posed by criminals with control of such a powerful botnet. A year later, a DDoS was used to attack government agencies in the nation of Estonia. While our government expressed concern, there was little evidence of action. Now similar attacks on the nations of Georgia and Kyrgyzstan have been in the news, and non-governmental targets continue to be attacked for the purpose of extortion or harassment. This is more than merely a commercial or consumer nuisance; it is a threat to national security.

These botnets are in fact being purchased and maintained by the spam economy. That's the "military budget" keeping those "standing armies" available for rental by any terrorists who might wish to attack the US. There is serious potential for cyberterrorism to cripple significant parts of the US government and private sector, and spam is just one particularly visible part of the problem. The silly messages and sexually oriented products should not deceive anyone about the danger. We ask you to work to coordinate the various companies whose actions and inaction enable spammers to operate, so that the current state of extreme lawlessness can be brought under control.

-- from the spam and
internet security investigators
at InboxRevenge.com.

SiL / IKS / concerned citizen

Glavmed responds - re: my Open Letter.

Welcome Glavmed affiliates who are linking here directly from the Glavmed site. :)

For a very brief period of time yesterday (Feb. 4th, 2009) the following claims were posted on many pages of the glavmed portal site, and it makes it clear that they are seeing some negative attention as a result of my open letter:

We've received a few links from our partners, containing an open letter. This letter was published at http://ikillspammers.blogspot.com/2009/02/glavmed-open-letter-to-law-enforcement.html. This is far from the last time, when apparently our business rivals try to defame our partnership programme. But this is the first time, when they appeal to The FTC, The FDA and other law organisations.

We, Glavmed, want to make a statement, that all the allegations of this letter are absolutely false and incorrect. They denigrate the honour, dignity and business reputation of our company.

We'd like to answer this open letter item by item:

1.Glavmed don't sell, have never sold and will never sell any pills. Glavmed are CEO partnership programme, which run a network of online-shops. Its main task is accepting of buyers' order und data. We have a few commission contracts with well-known, absolutely licensed drug stores. We transfer this order to them for its execution. Glavmed's task is attracting of new customers and transferring their orders to these drug stores. After receiving the commission from these drug stores we share it with our partners. We don't sell pills. That makes a great difference.

2.Glavmed have clear rules against spam and viral spreaders. We've never accepted such traffic. All such accounts have been instantly banned or cancelled. It's very easy to check. Just register and try to spread spam!

3.Glavmed are really well-known long existing partnership programme. Unfortunately we have some problems. The schemes and designs of our sites are being constantly copied and stolen. A lot of our dishonest business rivals give their sites to be ours, copying everything - graphic designs, file names and product descriptions.

4.Our rivals allege that our drug stores' products have low quality. This is totally lie and defamation. We can show hundreds of feedbacks, proving high quality of our products. We also have independent test results. They prove that our products are being produced by indinan laboratories and up to claimed quality.

Unfortunately we can foresee the further organized pressure against our partnership programme, because normal business competition can't be provided by them. We really take care of our partners and our customers.

This message was removed sometime between yesterday and today. It is unclear why, although I would guess that they didn't want their own affiliates reading my posting. I and other researchers have also noticed that they are now blocking very specific IP addresses from viewing the Glavmed website.

A couple of obvious corrections need to be made right off the bat:

a) The letter was not written to you, Glavmed representatives. It was written to law and drug enforcement agencies, as well as the media who has been researching this.

b) I am absolutely not a "business rival".

c) I am not the only one who has been researching your organization. My letter is a an account of the known, researched, verifiable facts regarding the scourge of unwanted Canadian Pharmacy websites. If I were trying to defame you, I wouldn't have nearly as much factual evidence in my letter.

So in response, I'll counter their bogus response point by point.

1. Glavmed claims on their front page (and I'm of course not altering their horrendous spelling and grammatical mistakes):

GlavMed is a BEST way to convert your pharmacy traffic into real money. Forget about miserable sums you're getting sending your visitors to PPC pharmacy results.

You're loosing at least half of YOUR money converting traffic like this. GlavMed offers you a possibility to eliminate any agents and sell most popular pharmacy products directly. It means 30-40% revenue share. features & benefits

Note: sell most popular pharmacy products directly. Which is it? Are they selling them or not?

Whether they sell the drugs themselves or not is ultimately irrelevant. They are part of a long chain that gets illegally-produced FAKE and harmful versions of these products into the hands of unwitting members of the public. There is copious amounts of evidence to support this, and they know it.

Glavmed is an affiliate program. They get their affiliates (aka: spammers) to promote (aka: spam) the websites (hosted via rampant viral PC infections) to sell fake drugs to unwitting victim customers. Who do they send that order data to? They don't say. But they know who that is, and they know that they are taking these orders without any consultation with any pharmacist. They also do all of this with absolutely ZERO security or encryption, so you can imagine how they're treating the rest of your personal data.

2. Sure, they state on their website that they don't allow spamming, but as I mentioned: they removed any of the postings which made it clear that very actve spammers are indeed a part of their program. Nowhere do we find ANY postings within their forum about any actual action taken against spammers. Literally everyone with an email address will know that Canadian Pharmacy is THE most spammed property on the Internet today, and has been for three years and counting. If they don't allow spammers, why is it still the most commonly found spam in the world today? You can have rules all you like. If you're not enforcing them: what does it matter?

As an aside, I and many other individuals have been complaining to Glavmed under numerous identities starting in May of 2008. I have personally sent, using numerous of my accounts, at least 25 very detailed complaints regarding spam messages I have received between May 2008 and January 2009. Guess how many responses I've gotten? Guess how much "action" I've seen on behalf of Glavmed, or anyone else claiming to represent this operation? ZERO! Guess where their abuse-reporting pages are on their site? THEY DON'T HAVE ANY!

This claim is utterly false. They take zero action regarding their KNOWN spamming affiliates, and they never will.

3. If Glavmed has been aware all this time that so-called third parties were ripping off their site designs, functionality and everything else: why haven't they drastically changed their entire design, branding, etc., or made ANY public statement regarding any of this? Why did they wait until someone like me exposes the whole setup for the obviously fraudulent operation that it is? This is an outright lie.

4. Again I will link to actual evidence (source), on behalf of a reputable company -- Ironport -- who placed orders from one of these sites, and gave the pills they received to a lab for analysis:

False Drugs Purchased

IronPort researchers followed the trail they uncovered and ordered sample pills from a pharmacy source in India. They then had an independent lab analyze the contents. The pills IronPort ordered contained sugar and some inert filler, Bhandari said.

A second test sampling from another online pharmacy purchase contained high metal content. The substances could be very harmful to unsuspecting consumers, he said.

IronPort-sponsored pharmacological testing revealed that two-thirds of the shipments contained the active ingredient but were not the correct dosage, while the others were placebos. As a result, consumers take a significant risk of ingesting an uncontrolled substance from overseas distributors, according to IronPort.

So in light of this report: I don't believe a single word Glavmed says, and I don't think anyone else should either.

Keep in mind: this is only one such report. There are others.

I notice that they completely ignore any mention of concern over the rampant illegal spamming which continues on behalf of Canadian Pharmacy, nor do they even broach the subject that as recently as October 2008 their site templates still contained bogus "sponsorship logos" on behalf of the Better Business Bureau, Verified By Visa, and Pharma Checker, nor do they mention that they were making very public statements that they knew full well that all of these logos were not being used appropriately.

The Spamtrackers wiki entry for Glavmed contains a screenshot of the Glavmed sites page dating from July 2008 which shows the Canadian Pharmacy layout still featuring the bogus sponsor logos. (source.)

In addition: this howler of a claim:

"We can show hundreds of feedbacks, proving high quality of our products. We also have independent test results. They prove that our products are being produced by indinan laboratories and up to claimed quality."

Their claim that they have all kinds of feedback saying how great they are is meaningless.

Which "indinan laboratories"? Which "independent test results"? On behalf of whom? Published where, exactly?

Of course they will never say.

What about third-party, verified claims and lab tests that your products are genuine? What about third-party reports that your servers actually are secure? If I'm selling you a car and you ask me for verification that the car is in road-ready shape and is safe to drive, I can't just start typing you a recommendation myself. I would need a third party inspector to verify that my claims that this vehicle was safe were in fact true. Glavmed doesn't do this, nor have they ever.

"We really take care of our partners and our customers."

Really? I know for a fact that numerous of your customers would very much beg to differ.

Clearly my letter has hit a nerve. As usual, their response, as with many obvious spam operations, is more concerned with damage to their profits than anything to do with public safety, or the security of your personal data.

Glavmed's claims are theirs alone, verifiable by nobody, and easily countered point by point as being verifiably false.

I stand behind every word of my posting. This is not defamation. Again: I am only one individual, but my posting links to research performed by literally dozens of others, from a very wide variety of technical, medical, security and other backgrounds.

Use your own judgement: Glavmed, and the entire operation they support, are liars and part of a criminal operation. The proof isn't just in my open letter. It's all over the place.

SiL / IKS / concerned citizen

Canadian Pharmacy and Glavmed: An Open Letter To Law Enforcement, The FTC And The FDA

To whom it may concern (and ultimately it concerns all of you.)

I write today to petition your attention towards a large-scale international illegal pharmacy operation known as Glavmed.

Glavmed are the sponsor program promoting the very-widely-spammed property known as "Canadian Pharmacy". (Hereinafter referred to as "CPh".) If you have an email address of any sort, it is very likely that you're at least mildly aware of Canadian Pharmacy. It's the most commonly spammed property on the Internet today, and shows no signs of slowing down whatsoever. CPh has been relentlessly spammed to millions of recipients for the past three years. Here is a screenshot of a currently spammed domain, dadsymbol.com:



Please note that depending on your geographic location, this same domain will appear as "Canadian Pharmacy", "European Pharmacy", and a variety of other variations on that brand name. They do this by using geographic sensing of inbound IP addresses to the site. The overall layout and functionality remains the same.

The Websites

On the surface this appears to be a fairly innocuous website selling what appear to be legitimate pharmaceutical products. However a little further examination proves that this is a site selling fake, knock-off, imitation versions of some fairly widely-sold pharmaceutical products such as Viagra and Cialis. The clue that this is not legitimate is that they also sell the following products:

• Viagra Professional


• Cialis Professional


• Viagra Super Active


• Cialis Super Active


• Viagra Soft Tabs


• Cialis Soft Tabs


• VPXL


• Levitra Professional


• Levitra Super Active

None of these products have ever been produced by the actual originators of the original Viagra or Cialis. These products have only been sold from shady, illegitimate online pharmacies.

Add to this that they have creatively spelled the names of one or more dangerously addictive and harmful products such as "Phentrimine", and offer another bogus version of this same product named "Herbal Phentermine", and it becomes clear that this is a company which is distributing products of dubious origin and manufacture.

All of these products are sold without the need for any prescription, whcih violates several FDA regulations, especially for the sale of controlled substances such as phentermine.

Further (although technically speaking this is less of an issue than the risk to public health and safety): these sites' continued use of the brand name "Viagra" is in violation of the trademark and intellectual property rights of Pfizer, who owns the Viagra name and the patent on its particular medicinal formula. There is no such thing as "generic" Viagra, nor has there ever been. It is not legal to make -- or claim to make -- Viagra while Pfizer still holds the patent. The same is true of Cialis and Levitra.

Sales of these alleged "generic" pharmaceuticals violates the law in most countries around the world. Sale of these products in their legitimate form without consultation with a physician or a registered pharmacist is also illegal, and violates several sections of the FDA act.

Finally: sale of controlled substances - phentermine definitely qualifies, but again: who knows what's actually in the pills this "company" is selling to you? - is also against the law when done so without any registered pharmacist or a valid, authorized prescription.

This organization breaks several international laws, but more importantly it poses a very serious threat to the public's health.

Promotion Via Illegal Spam

The only way that perhaps 70% or more of the world has heard of Canadian Pharmacy is via the unrelenting, large-scale receipt of illegally-sent spam email messages. By "illegally-sent", I refer specifically to the fact that they (or someone or some group working on their behalf) send these emails using very large scale "botnets" (definition) comprising several thousand of exploited public computers. Over the past three years, no fewer than six (6) IT security organizations have performed research on a variety of these botnets, most notably the Storm botnet, and discovered that one of the primary uses of this botnet was to send spam email messages promoting these CPh websites.

I myself have written on this blog and on numerous spam- and cybercrime-related forums regarding Canadian Pharmacy, and I've specifically been researching their operations starting in mid-2006. (previous posting) However I am far from the only individual researching this organization.

Finnish Security Company "F-Secure" posted research tying spam messages promoting spamvertised websites for CPh on November 11th, 2006. (source) In this research they discovered that a PC exploit then known as "Warezov" was capable of sending spam. That spam contained urls for websites promoting what was then known as "Pharmacy Express." Pharmacy Express turned into Canadian Pharmacy in early 2007. The spam runs promoting these websites would often send tens of millions of messages to addresses around the world. The domain names for the Pharmacy Express sites were virtually identical in naming structure to those used as name servers for other sites which were being used as infection points for the Warezov virus, as well as domains used as name servers for both the warezov infection sites and the CPh websites. More on Warezov and it's functionality later.

Fast-Flux Hosting Via Hijacked Public Computers (Storm Worm)

Focusing again on the abovementioned domain, we can see that some unique hosting solution is being used for the "dadsymbol.com" domain by running a "dig" command against that domain:



As you can see from this simple check, the website itself is hosted on rotating IP addresses. This is a technique known as "fast flux" hosting (definition), and it's used by these CPh sites to hide their true location. Research has shown that these IP addresses are, invariably, infected household PC's owned by individuals who are unaware that their computer has been taken over to be used in support of these illegally-operating websites.

The IP addresses in this particular example are all located in Beijing, China, hosted at three distinct companies:

China Network Communications Group Corporation
CHINANET hebei province network / China Telecom
Beijing Zhongbangyatong Telecom Technology Co.,Ltd

This is not often the case. Several researchers have discovered some CPh sites using household dsl connections in the US Midwest, cable internet connections in Poland, and numerous other types of always-on cable or dsl connections around the world. All of this is believe to be provided by the Storm worm.

100% False Claims

Canadian Pharmacy has made numerous completely false claims throughout nearly every word they say in every spam message sent, and on every page of their websites. Among these are claims that they offer security when processing credit cards (they do not, and never have, and this is something you can see by investigating any of the domains spammed to promote this operation,) that their products are safe (numerous researchers have found that they either contain no active ingredient, or that they contain only trace amounts of the active ingredient, or that they actually contain harmful elements or materials,) and they often listed contact information which was actually for the College of Pharmacists of British Columbia, who strenuously denied having anything to do with this operation or its continued illegal spamming practices. They also listed icons for the Better Business Bureau, Verified by Visa and an organization known as "Pharma Checker", none of whom actually supported or endorsed any of these sites. (And in all cases, representatives from all three expressed frustration in being able to get this group to remove their icons from their sites.) Only in the past four months have they removed these icons. It is unclear why, although one could surmise that the increased investigations into their operations are to blame.

In fact even the very name of these sites, Canadian Pharmacy, is a lie. They aren't located anywhere near Canada, the products often ship from India, and the domains and name servers are hosted around the world. There isn't any Canadian source for any of these websites.

Further: the contact information used to register websites and nameserver domains routinely feature 100% fake information. This is true for literally every single website registered for the promotion of Canadian Pharmacy.

These websites represent a very serious risk to the public's health, no matter which country the unwitting customers of these malicious websites happen to live in.

But I encourage you to join me in digging deeper into what other illicit activities this series of illegal websites is tied to.

Glavmed's Connection to Storm / Warezov Infections

I mentioned Warezov in an earlier paragraph.

Over the past 2 years, Warezov has come to be known alternately as Storm or Asprox. There are other names for this type of PC infection. It has continued to grow in size, and has continued to be used for all manner of illicit online activity ranging from the aforementioned spamming, through to plainly illegal activity such as performing large-scale Distributed Denial Of Service attacks (aka: DDOS attacks) against any site the botnet operator chooses (source), performing SQL injection attacks (source,) and most importantly for providing hosting and infrastructure for these Canadian Pharmacy websites, including name servers. Storm worm has also occasionally been used in phishing attempts. (source)

As far back as Jan. 31, 2008, tech news stories abounded that law enforcement authorities knew who had created and continued to operate the Storm worm (source), yet nearly a full year later absolutely no action has been taken against them. Further research by a variety of individuals as well as Wired Magazine tied Storm worm to a shadowy criminal organization known as the Russian Business Network, or "RBN". (source)

No less a source than the Washington Post's Brian Krebs has previously posted in great detail about who is behind the Storm Worm, and boldly declared he had connected all the dots in a story dating from January 29th, 2008. (source, with extensive background research.)

Glavmed Affiliate Program

In the past year, after monitoring numerous spam-friendly forums, many of which now no longer exist, I discovered one website which was responsible for acquiring new affiliates to promote the Canadian Pharmacy brand: a site called Glavmed.com. This is not immediately obvious from just visiting their main website, glavmed.com. (Although they do of course mention that the sites being promoted are pharmacy websites.) Their sites page features no mention of the brand "Canadian Pharmacy", only vague descriptions of what the sites sell, and that anyone can join this program. Their sign up form features no section where anyone needs to disclose whether they are a medical professional or a pharmacist at all, or whether they are retaining one for the purposes of fulfilling prescriptions for the pharmaceuticals these sites sell.

So how did I discover the link between Glavmed's affiliate program and Canadian Pharmacy? I joined their affiliate program. I will not disclose the details of my affiliate account other than to say that I have never used it for any promotional purposes on behalf of glavmed or Canadian pharmacy. Once I was approved, I was sent a link to their site templates which made it very clear that this was a very large-scale, highly organized operation, and that they are indeed 100% responsible for Canadian Pharmacy, and therefore responsible for the relentless spamming which occurs on their behalf.

As it turns out, apparently one of their supporters or affiliates posted a very Glavmed-friendly piece on a website known as atlantea.com (source), which alleges to rate the various online pharmacies promoted by Glavmed. They of course make absolutely no mention of the fact that these sites are easily the most prolifically-spammed properties on the Internet today. That entire domain appears to be a very spam-friendly site, and it links to a known base-domain which glavmed sites have been using for payment processing for three years now, rx-partners.biz.

Some interesting additional notes: They have modified several threads in their forums. These threads previously contained postings by several members which made it very clear that not only were Glavmed and their affiliates aware that many of their ranks were involved in large-scale spamming, but that they also knew they were lying about the use of logos such as that of Pharma Checker.

This thread previously had a posting (following posting #4, which is now the final posting in that thread) which stated that there was no valid Pharma Checker account for the Canadian Pharmacy websites. (A valid Pharma Checker is required in order to place a link to any pharmaceutical sites within a Google Adsense campaign, among many others. One affiliate was refused. I feel certain that many others must have been refused as well.) Another thread regarding spamming (source) had several pro-spam postings dating back to late 2007. These were removed sometime between December 2008 and January 2009. That was previously located after posting #3. Clearly someone is removing any expository evidence. (I and many others have archives of this forum however.)

Glavmed / Spamit / Storm / Canadian Pharmacy / RBN

Further, no less an authority than Ironport, a major spam-fighting corporation, made direct connections between Storm worm, Canadian Pharmacy, Glavmed, and their underground affiliate portal (and likely the real smoking gun) known as Spamit.com. (source) Ironport also placed several orders to verify what would happen with their bait credit card information, and to see whether they would actually receive anything from the order. They did receive a package containing pills which contained sugar and what was referred to as "inert filler". Another contained "high metal content". This is clearly a very high risk to the public's health.

I and many other researchers and security professionals believe it is time for someone to take decisive action against this operation, which has profited for at least four years now and is only continuing to grow. Research and evidence abounds regarding the connections between Canadian Pharmacy, Glavmed, The Storm Worm and the Russian Business Network. All of these are known by numerous security and law enforcement agencies to be operating in flagrant violation of international law. I and the citizens of my country and those of pretty much every other country are fed up with continual bombardment of these spam messages, promoting websites which lie in every word of their content, which sell fake and harmful products, and which endanger the lives of the general public. We are fed up with the complete lack of action on behalf of anyone in Law Enforcement to go after Glavmed, their affiliates, their site operators, their payment processors, their hosting providers and their domain registrars. The time for action is now, especially with the abundance of available research into this organization and their practices.

Please take this appeal very seriously. I welcome your feedback.

Very sincerely,

SiL / IKS / concerned citizen

Further research into Canadian Pharmacy

Spam Wiki: Canadian Pharmacy
http://spamtrackers.eu/wiki/index.php?title=Canadian_Pharmacy

Further research into the Storm Worm

Storm Worm Botnet Cracked Wide Open
http://www.heise-online.co.uk/security/Storm-Worm-botnet-cracked-wide-open--/news/112385

Russian Business Network (RBN): Georgia Cyberwarfare - Attribution & Spam Botnets
http://rbnexploit.blogspot.com/2008/08/rbn-georgia-cyberwarfare-attribution.html

Full-disclosure: It's time to get serious about Storm Worm / RBN
http://seclists.org/fulldisclosure/2008/Mar/0300.html

Slashdot: We Know Who's Behind Storm Worm
http://it.slashdot.org/article.pl?sid=08/01/29/1823242

Welcome, Inboxrevenge.com

As some of you may know, I was a regular contributor for the past three years to a forum previously known as "KillSpammers" (thus the naming of this blog.)

In 2007 that forum suffered a massive, unrelenting DDOS, likely due to the sheer volume of accurate researching the members of that forum undertook. CastleCops at the time also fell victim to a very large-scale attack at that time. I and the other administrators of that forum pulled it offline and congregated elsewhere.

In the past week, we finally got the forum back in shape and it was unveiled under a new name, InBoxRevenge. If, like me, you are interested in the continued legal and other actions against illegal spammers trying to sell you fake products or otherwise trying to rip you off or steal your identity, you can join the forum at ksforum.inboxrevenge.com.

And if you're one of the illegal spammers, be aware that this forum is being very closely monitored and maintained.

More as I get it. Thanks for continuing to read this blog.

SiL / IKS / concerned citizen

2008: A Significant Year In The Fight Against Illegal Spammers

Note: Edits and corrections have been made to this posting. Thank you to those with sharp editorial eyes who responded with small fixes and updates. Also note that, sadly, all links to CastleCops as of this writing are non-functioning. I am keeping them in place in the hope that the site is re-started sometime in the next year.

The year of 2008 represented the highest strings of arrests, prosecutions, sentencings and imprisonments of illegal spammers in the history of illegal spamming. 2007 was already a very bad year for spammers. 2008 continued this trend, all of which underscores the fact that people really are fed up with hearing from spammers, and that spammers will go to jail if they continue to spam illegally or engage in identity theft or fraud.

Here is the basic run-down of 2008. Enjoy!

January:

• We begin the year still revelling in the arrest of Robert Soloway, and the investigation into the computers and properties of Shane Atkinson, known spammer and sponsor representative for SanCash and VPXL. Intensive investigations are ongoing into both of these cases as the year begins.


• Alan Ralsky, and several of his colleagues (notably one James E. Fite, aka "buba" on bulkerforum.biz), are indicted. The indictment carries 41 counts including Fraud, Wire Fraud and Money Laundering. He faces a sentence of 26 years in jail for the tax evasion charge alone.


• SpamInMyInbox continues his investigation into what is now known to be SanCash.

February:

• Several colleagues commence an intensive communications campaign between ICANN and XIN NET (also known as "paycentre") in the hopes of waking them up to the mass amount of illegal abuse they are supporting by allowing domains to be registered using 100% fictitious contact information, in violation of ICANN accreditation policies. It sounds dry, but this is a huge achilles heel for spammers, and more importantly the sponsors who pay them. Without a large supply of illicitly-registered domains, spammers have nothing to promote, and sponsors lose money. This campaign would turn out to take many weeks and months. Red Dwarf, AlphaCentauri and (most notably) trobbins file literally hundreds of thousands of complaints using Red's "Complainterator."

March:

• 
  Renowned unrepentant criminal spammer Robert Soloway pleaded guilty to charges of felony mail fraud, fraud in connection with electronic mail and failing to file a tax return in 2005.

April:

• SpamInMyInbox's investigation into SanCash, GenBucks, Tulip Lab and "VPXL / Express Herbal" continues. Tulip Lab serves him no notice while launching a lawsuit claiming (we think) libel. He later removes several references to Tulip Lab. Meanwhile New Zealand law enforcement firm up their plans to charge Shane and Lance Atkinson for illegal spamming pending their continuing investigation into several computers they seized in December, 2007 following the BBC4 investigation into the same operation.

May:

• SpamInMyInbox is placed under a temporary injunction thanks to the Tulip Lab complaint. He removes all mention of Tulip Lab from his blog.


• The criminal charges keep on coming! On May 19th, 2008, US Attorney General Michael B. Mukasey holds a press conference in Bucharest, Romania announcing the indictment of 38 individuals, from numerous countries, all of whom were involved in phishing scams based out of California and Connecticut. This is fairly big news since it involved the cooperation of Romanian law enforcement officials, and communication between several international law enforcement agencies including the FBI.
  
  Other links to this story: New Haven FBI Press Release, Overview of the Law Enforcement Strategy to Combat International Organized Crime [pdf], US DOJ Indictment, and coverage by GarWarner's blog.


• SiL's Blog (the very one you are reading now, ikillspammerz.blogspot.com) gets listed in The Industry Standard's Top 25 B-to-Z List Blogs.


• SiL creates a new entry in the Spam Wiki which outlines in relatively good detail the perceived infrastructure and hierarchy of a typical pharmacy or replica email spam operation. He also firms up quite a bit of evidence regarding each of the known sponsors of illegal spam, including Spamit, Bulker.biz and SanCash (also known as AffKing.)


• TodayNIC, long a haven for the registration of thousands of spamvertised domains per year, suddenly take decisive action and shut down a very large list of domains which have been registered using completely fake contact information, and which are used in spam campaigns for properties such as Canadian Pharmacy, ED Pill Store, Downloadable Software, Prestige Replica, Exquisite Replica, etc. etc. etc. They even go so far as to automate the verification and shutdown process against any domains listed in the uribl list under their registration. This is a huge blow to spammers and their sponsors as it slam a door shut on a previous aider and abetter of illegal spammers. [Original link to the archive of takedowns was here.]

June:

• More criminal charges! Robert Matthew Bentley of Panama City is sentenced to three and a half years (41 months) in jail and fined $65,000USD for hijacking hundreds of PC's for use in a botnet which was used in attacks and popup ad fraud. This is the result of nearly two full years of investigation as part of "Operation Bot Roast II"


• Paul Laudanski leaves castlecops to become a full time Internet Safety Investigator for Microsoft's Live Consumer Services.


• Greg King, renowned for DDOS'ing Castlecops in February 2007, pleads guilty to two felony counts of transmitting code to cause damage to protected computers. He faces a maximum of 20 years in prison and a fine of $500,000USD.


• XIN NET finally (FINALLY!) takes action on not just a few, not just a few dozen, not just a few hundred, but several tens of thousands of illicitly-registered domains. This has a devastating effect on several spam sponsors, notably Spamit and SanCash. None of the spammers or sponsors dares complain publicy, but the effect is obvious and we notice several mailers suddenly switch 100% from mailing PowerEnlarge, Prestige Replicas, MaxGain+, VPXL and Canadian Pharmacy, to instead spamming long-in-the-tooth pump and dump stock symbols. (CYHD, then AGSM.)


• Almost overnight, sponsors and domain registration mules switch from XIN NET and Todaynic to otherwise unknown domain registrar "Xiamen Chinasource Internet Service Co., Ltd." Red Dwarf and trobbins lead the charge to informing them of this shift in the spammer's (or their sponsor's) activity and they immediately also begin shutting down and nullrouting several hundreds of new domains per day, all of which feature verifiably fake contact information and are used, of course, in illegal spam campaigns supporting bogus or dangerous products.


• Research by Ironport correctly identifies the operators of the Storm Worm as the same group responsible for the rampant spamming on behalf of "Canadian Pharmacy". Most domains used for Canadian Pharmacy are also hosted on fast-flux botnet hosting, further digging the hole for that operation. The Register reports on it, further expanding the audience for this important research.


• Martin Heller receives a memo from Garth Bruen of KnujOn detailing why XIN NET should be issued a breach notice from ICANN. His timing is a little late, but it further raises the lingering issues with XIN NET in the public eye. Heller also draws a direct relationship between XIN NET and several well-known SanCash spamvertised properties including Wondercum and Diamond Replica.


• Between June and July, a very large spate of Storm worm spam attempts to convince unwitting Internet users to click on links leading to hijacked websites with the hopes of greatly increasing the number of usable bots in the Storm botnet. Spam messages initially take the form of winsome (if illiterate) love letters with subject lines like "Always with you" or "Always in my heart". Shortly thereafter, they exploit breaking news of the earthquake that hit China in late June, claiming "Millions dead in China Quake". Then still later, they take on a variety of totally fake "news headlines" such as "The beginning of World War III", "Angelina Jolie dies during childbirth" and "USA declares war on Iran." For whatever reason, recipients appear to click on the links anyway and the Storm worm gains in numbers. [source]
  
• SanCash debuts their "Exquisite Footwear" brand of fake designer goods. SiL creates the Exquisite FootWearErator to counteract these spam messages. Later on, in July, spam for this brand diminishes significantly. :) (Coincidence?)

July:

• The CastleCops Bulk Spam Reporting Wiki Entry is created and swiftly becomes a valuable evidentiary tool for domain registrars, hosting providers and law enforcement. Within a very short time, several domain registrars begin to take notice and investigate the fraudulent registration of thousands of domains used in the spamming of all manner of bogus or illegal sites. The wiki entries are regularly updated by numerous CastleCops staff members.


• Sentencing begins for Robert Allen Soloway, who is (at the time) expected to get from 14 to 20 years behind bars after pleading guilty to mail fraud, e-mail fraud, and tax evasion.
  
  

  "The government asks for nine years in prison, three years probation, complete forfeiture of everything Soloway ever made from spamming, 624 hours of community service, and that Soloway be barred from the internet until his sentence is complete."



• Romanian authorities, again in cooperation with the FBI and other international law enforcement agencies, arrest an additional 22 Romanian citizens in connection with eBay fraud.


• On or around July 14th, literally all Chinese domain registrars cooperate fully with takedown notices from Knujon, Spamcop, and numerous independent recipients of illegal spam, impacting virtually every spamvertised brand from all known spam Sponsors. Following this, the influx of Storm worm spam grows exponentially, becoming the primary topic of most inbound spam for most recipients.


• More spammer convictions continue to pour in. After pleading guilty to to breaking anti-spam laws a year previously, Adam Vitale is sentenced on July 19th in a New York federal court to two and a half years in prison and ordered to pay $180,000 to AOL in restitution.


• On July 22nd, the Denver Post reports that former stock spammer Eddie Davidson "walked away from a minium security prison camp in Florence". Discussion on several anti-spam forums indicate that this is among the stupidest moves Mr. Davidson could have made, since (if captured) he would face more severe jail time in at least a medium-security prison. (But then: see spammer rule #3.) In a very tragic turn of events, two days later he, his wife and his daughter are found dead of an apparent murder-suicide. Davidson, it turns out, was also an informant in cases relating to Alan Ralsky, among many others.


• Yet another conviction, and this one is a big fish: On July 22nd, Robert Alan Soloway was sentenced to 47 month (3 years, 11 months) in prison, following his aforementioned guilty plea on charges of felony mail fraud, fraud in connection with electronic mail and failing to file a tax return in 2005. In a Seattle Times story he apologized to the court:
  
  

  "I built my entire life around a facade," Soloway told the court. "I'm very embarrassed and I'm ashamed."

  
  
  And in a PCWorld story, assistant U.S. attorney Kathryn Warma was quoted as saying:
  
  

  "None of those cases, not one, comes close to this case in terms of the duration of the maliciousness, the harassment techniques, the high level of spamming activity that we have in this case..."

  
  
  Following his prison term, Soloway is expected to serve three years of probation and has been ordered to do 200 hours of community service.
  
  Although the sentence is considered mild in comparison to what he was eligible for, it still sends a significant message to illegal spammers everywhere: you can get caught, and you will do time. See also the US DOJ Press Release.

August

• It's interesting to note that by August of 2008, virtually no stock spam is seen by anyone. Obviously the legal ramifications have finally hit home to the remaining spammers stupid enough to bother doing it anymore.



• More arrests! On August 2nd, the FBI arrested two individuals in relation to the illegal sale of identities from the subprime databases of Countrywide Financial.
  
  

  Rene Rebollo, a 36 year old former Countrywide employee from Pasadena, has been charged by the FBI and taken into custody with a co-conspirator Wahid Siddiqi, a 25 year old from Thousand Oaks. Its alleged that Rebollo would come into the office every Sunday and download data from Countrywide's subprime mortgage system, Full Spectrum Lending.

  
  
  There's also a great recap of the whole bust, plus further digging over at the GarWarner blog.



• Even more arrests! On August 5th, Albert Gonzalez of Miami, known by his nickname "Segvec", was charged along with a total of 10 others in relation to the TJ Maxx identity theft case from 2007 in which millions of credit and debit card numbers were stolen. See also the Wired news coverage.



• During the widely-reported Russian invasion of Georgia, several byline stories start to crop up regarding the cyberwarfare tactics also employed by Russia against Georgia. Very large-scale DDOS attacks against government websites and the website of Georgia President Mikheil Saakashvili's are reported even in mainstream news outlets. This would mark the second time that Russia has been directly linked to a DDOS attack against a country's websites and infrastructure, and the second time that the shadowy "Russian Business Network" (RBN) has been fingered as the possible group behind the attacks, under direct orders either from Russian government officials or Russian military personnel.
  
  Further reading: here, here, here and here.
  
  Later research, however, (especially that of Gary Warner) makes it clear that this was largely a "populist" attack, since several Russian forums and message boards encourage ordinary citizens to run a batch script on their Windows pc's, resulting in a sustained DDOS attack, run manually, by ordinary citizens (in addition to using a botnet, which was borne out by subsequent research.)


• More arrests! On August 13th, the US Dept. of Justice announced the indictment by a federal grand jury of seven residents of Pulaski County, MO. involved in an illegal online pharmacy. Anthony D. Holman is the alleged ringleader of the group, and also designed the templates for the sites his affiliates would use to promote the online pharmacy. The seven individuals allegedly made $3.4 million (USD) of profit via their "PersonalizedRx, LLC" online pharmacy, which sold many controlled pharmaceuticals. Holman and his partner Arcelia Holman were also charged with five counts of money laundering.
  
  

  "Narcotics sold over the Internet have led to deaths, overdoses, and addiction nationwide. We are determined to shut down these dangerous and illegal Web sites and prosecute those who profit from them."
  
  The federal indictment alleges that, beginning sometime in 2005 and continuing to Oct. 16, 2007, all seven co-defendants participated in a conspiracy to distribute such prescription drugs as hydrocodone, alprazolam and zolpidem by using fraudulent prescriptions obtained through the Web sites they operated.



• August 14th, 2008 sees the sentencing of renowned AOL spammer Michael Dolan to seven years in prison on charges of fraud and aggravated identity theft related to repeated harvesting of AOL accounts who he would then send malware to steal account details and other personal information. He also participated in numerous phishing exploits on AOL members. Following his seven year sentence he will face three years of supervised release. Dolan appears to have followed in the footsteps of the likes of Chris "Rizler" Smith, engaging in witness tampering and other extremely illegal practices.


• August 22nd, 2008: Still more arrests!
  
  

  Leni de Abreu Neto, from Taubate, Brazil, faces up to five years in prison and a fine of more than $250,000 for allegedly running and leasing access to a botnet of 100,000 compromised computers around the world for the purposes of sending spam.

  
  
  This has to be some kind of record. :)

September:

• In a scathing post on his Security Fix blog on Sept 3rd, Brian Krebs exposes Atrivo and Intercage, a pair of US-based hosting providers, as what he refers to as "a major source of spyware, adware, viruses and fake anti-virus products."
  
  He then exposes ESTDomains as being one of the major providers of domain registration for all manner of illegally-spammed porn, casino and (of course) illegally-operated pharmacy websites.
  
  This leads to some very swift and widespread action on a variety of fronts, all of which Mr. Krebs reports on.


• In related news, and on the same day, The Register posts a story about domain registrar Directi, referring to a June 17th, 2008 story on the Security Fix blog) alleging their ties to controversial malware domain registrar ESTDomains. The story alleges that Directi, using several alias company names, was responsible for tens of thousands of illicitly-registered domains, used for all sorts of criminal and spamming activity.


• In a stunning show of action related to the above media activity, Directi severs all ties with ESTDomains, and immediately goes on a media offensive, taking abuse reports from anyone who cares to send them, and acting upon them immediately. Further feedback from a number of sources to Directi leads to the shuttering of several thousand domains, many of which had been listed by the likes of Spamhaus and Knujon (who raised this issue in the first place) since June of 2008. This is a very good response and it makes Directi a bad place to register domains if you're a spammer. I and several of my colleagues also provided a great deal of historical data and research to guide them in preventing further new registrations for domains specific to any known illegal spam sponsor. We eventually see many thousands of domains get cancelled or suspended.


• Still more bad news for cybercriminals and spammers: further investigation and media exposure leads ultimately to hosting provider Atrivo [aka: Intercage] losing all of their upstream network providers, shuttering tens of thousands of illegally-operated sites related to cybercrime, identity theft, fraud, porn and illegal online pharmacies. [also see coverage here and here.]


• In late September, a Kentucky judge (Franklin County Circuit Judge Thomas Wingate) orders the seizure of 141 domain names tied to online gambling. This is perhaps marginally related to spamming, but it's another blow against cybercriminals as well. Domains included FullTiltPoker.com, Doylesroom.com, Bodoglife.com, and Microgaming.com. Bodog is a renowned shady operation with ties to offshore gambling and the music industry.A few weeks later on Oct. 21st, that same judge upheld the domain seizures.


• On September 22nd, Robert L. Soloway was scheduled to begin his 47 month (3.9 year) prison sentence.


• Among the domains which get shut down during the Directi actions earlier in the month is the affiliate portal bulker.biz, which later returns as bulkerbiz.com. As anyone who reads this blog is aware, bulker.biz is the program responsible for My Canadian Pharmacy, Canadian Health&Care Mall, Men+Drugs and International Legal Rx, all illegally-operating pharmacies selling completely bogus products which harm the general public. They regroup quickly and continue to spam, setting up new domains at a variety of other less diligent domain registrars.


• In a similar vein, several diligent reporters of spamvertised websites finally make solid and fruitful contact at TodayNIC, another domain registrar commonly used by spammers. This results in still further shutdown of tens of thousands of domains used in spam runs on behalf of Canadian Pharmacy and numerous others.

October:

• On or around Oct. 4th, bulkerforum.biz goes offline without any notice. Several spam investigators assume that a new, invitation-only forum must have been set up in its wake. No mention of this forum's demise is made on any of the other known spammer-friendly forums.


• On Oct. 7th, two European men are indicted in the US for allegedly orchestrating DDOS attacks against two websites. (Axel Gembe of Germany, and Lee Graham Walker of England.) Axel Gembe is alleged to be the creator of the Agobot exploit. They were hired by Jay R. Echouafni to carry out these attacks for two weeks in 2003. See also the US Dept. of Justice press release.


• The same day, a federal court judge orders Henry Perez and his wife Suzanne Bartok "to pay more than US$236 million for sending millions of spam messages to a small Iowa ISP (Internet service provider)." [source] This case dates back to 2001. These were some particularly obtuse spammers, who thought they were spamming Compuserve servers when in fact they spammed a much smaller domain.


• Oct. 13th, The shadowy forum known as "Darkmarket.ws" turns out to have been an FBI sting operation.
  
  

  Reports from the German national police obtained by the Südwestrundfunk, Southwest Germany public radio, blow the lid off the long running sting by revealing its role in nabbing a German credit card forger active on DarkMarket. The FBI agent is identified in the documents as J. Keith Mularski, a senior cybercrime agent based at the National Cyber Forensics Training Alliance in Pittsburgh, who ran the site under the hacker handle Master Splynter.

  
  
  [Note: Master Splynter was known as "Master Splyntr" on the assumedly defunct bulkerforum.biz, which has by this time been down for several months.] He was previously assumed to be "Pavel Kaminski" on Spamhaus, information which was removed once this report came to light. There's further reading here, including mention of 56 arrests resulting from the shutdown.


• Oct. 14, 2008: Fantastic news regarding the nearly year-long investigation into Shane Atkinson, SanCash, AffKing, GenBucks and Tulip Lab.
  
  New Zealand law enforcement ask the NZ High Court to "impose financial penalties of $200,000 on each of three New Zealanders involved in a major international spamming operation."
  
  

  Its Statement of Claim alleges that company directors, Shane Atkinson of Christchurch, his brother Lance Atkinson of Pelican Waters in Queensland and Roland Smits, a courier of Christchurch, were involved in sending over 2 million emails to New Zealand addresses alone between September 5 and December 31 2007. The trio allegedly earned sales commissions of more than $US2 million from their global operation.
  
  The emails marketed Herbal King, Elite Herbal and Express Herbal-branded pharmaceutical products, manufactured and shipped by Tulip Lab of India, through a business known as the Genbucks Affiliate Programme. This business was operated by Genbucks Ltd, a company incorporated in the Republic of Mauritius.
  
  The Department says that Shane Atkinson was co-manager of the Genbucks Affiliate Programme; Lance Atkinson, trading under the name of Sancash, recruited and paid spammers to market Genbucks products, adult sex toys and replica watches...

  
  
  This is very bad news for Tulip Lab, who widely claimed that they had nothing to do with illegal spamming, and who threatened a well-known blogger with a defamation lawsuit for making precisely these claims, based on his own diligent investigative work. It turns out that he was exactly right. [Further coverage here, here and here.]
  
  It gets worse for SanCash affiliates however, because moments after that press release hit the wires, the FTC also made a press release of their own:
  
  

  A U.S. district court has ordered a halt to the operations of a vast international spam network that peddled prescription drugs and bogus male-enhancement products. The network has been identified as the largest "spam gang" in the world by the anti-spam organization Spamhaus. The Federal Trade Commission has received more than three million complaints about spam messages connected to this operation, and estimates that it may be responsible for sending billions of illegal spam messages. At the request of the FTC, the court has issued a temporary injunction prohibiting defendants from spamming and making false product claims, and has frozen the defendants' assets to preserve them for consumer redress pending trial. Authorities in New Zealand also have taken legal action, working in tandem with the FTC.

  
  
  There are some really damning statements in this press release. More exerpts:
  
  

  One product called "VPXL" was touted as an herbal male-enhancement pill. Advertised as "100% herbal and safe," it supposedly caused a permanent increase in the size of a user's penis. The agency alleged that not only did the pills not work, but they were neither "100% herbal" nor "safe," because they contained sildenafil – the active ingredient in Viagra. At the FTC's request, the pills were tested by the FDA. According to medical experts, men taking nitrate-containing drugs – which are commonly prescribed to treat diabetes, high blood pressure, high cholesterol, or heart disease – can experience an unsafe drop in their blood pressure when they also take sildenafil.

  
  
  This is of course great news for anyone with an email address, since something approaching 40% of inbound spam was promoting these "products".
  
  Court documents outline numerous chat transcripts between Lance Atkinson and his cohorts which made it extremely clear that he was well aware that what he was doing was illegal, and violated FTC statutes, among other things.
  
  Did I mention that it's a bad time to be an illegal spammer?



• More legal activity in Alan Ralsky's case. On Oct. 15th, Judy Devenow, an accomplice in Alan Ralsky's stock spamming operation, pleads guilty and agrees to assist law enforcement investigators. At the time she faces from 33 to 41 years in prison related to charges of assisting in Ralsky's stock manipulation, money laundering and wire fraud operation. Her sentence could be reduced based on how much she assists prosecutors.



• On October 23rd, a Dutch newspaper releases a story claiming that three hackers from Russia and Ukraine were arrested. [Image of English translation available here.]
  
  Google translated:
  
  

  International cooperation of the High Tech Crime Team of the National Forensic police and security forces has led to the arrest of three hackers in Russia and Ukraine, which presumably involved in digital attacks on bank accounts in Western Europe.
  
  The operation announced yesterday in Ukraine and Russia stems from an investigation by the High Tech Crime Team to a virus attack on account of ABN AMRO Bank in 2007. Customers of the bank in March 2007 received a SPAMmail with a virus. Account holders were then no longer on the real website of the bank, but were redirected to a very similar spoof abroad.

  
  
  Assuming the investigation is ongoing, this is explosive news, and marks one of the extremely few times that Russian cybercriminal entities have ever been prosecuted.


• On Oct. 28th, several media outlets pick up the story that EST Domains lost their ICANN accreditation. (And Gar Warner's blog features a concise breakdown of what happened.) This loss of accreditation is a result of the company's owner, Vladimir Tsastsin, was convicted of money laundering and credit card fraud in February, 2008. (Shouldn't it have been because of the fact that most of the 281,000 domains registered at EST were used for illegal purposes?) Either way: good riddance.


• Starting on Oct. 27th, numerous email users begin receiving spam pointing to phishing sites which are posing as the login page of enom.com, a well-known domain registrar. This is an obvious attempt to steal people's domains and use them for, we assume, "very bad things." This starts (or in some cases, continues) a series of large-scale investigations into who is behind these domains, and indicates that whoever it is is also involved in the registration of several domains used in child porn websites and forums. This individual is not new to those of us in the cybercrime investigative community. He was previously using several email addresses on the "cocainmail.com" domain for his domain registrations, but since that domain got shut down, he now uses a safe-mail.net account. The investigation continues..."
  

November:

• Nov. 12th, the Washington Post's Brian Krebs reports that McColo has lost their upstream connectivity. This after providing boatloads of evidence to several providers. This allegedly knocks out 75% of illicit or illegal online activity, since McColo was providing hosting for several domains used as the command and control centre (C&C) for several large-scale botnets, notably the Srizby botnet.
  
  

  Multiple security researchers have recently published data naming McColo as a mother ship for all of the top robot networks or "botnets," which are vast collections of hacked computers that are networked together to blast out spam or attack others online.
  
  Joe Stewart, director of malware research for Atlanta based SecureWorks, said that these known criminal botnets: "Mega-D," "Srizbi," "Pushdo,"Rustock" and "Warezov," have their master servers hosted at McColo.
  
  Collectively, these botnets are responsible for sending roughly 75 percent of all spam each day, according to the latest stats from Marshal, a security company in the United Kingdom that tracks botnet activity.



• Nov. 14th, ESTdomains loses their accreditation.


• On Nov. 15th (a Saturday), McColo regains network connectivity for approximately 12 to 24 hours, allowing them to update several infected members of the Rustock botnet with new command and control location information, located in (where else?) Russia. Several media outlets report on this development. Spam levels remain down at least 60 - 70% in the meantime.


• The respite from mass amounts of spam of course turned out to be shortlived, and on Nov. 26th several hundreds of thousands of bots began coming back online again. Researchers at many security groups, but especially at FireEye, monitored the reconnection and hinted that there was a reason that they didn't take more decisive action (such as commanding all the bots to uninstall themselves, something they were in a position to do.) Almost immediately, spam levels begin to rise again — though it's important to note that they still remain lower, generally-speaking, than they were prior to the media attention and subsequent shut downs.


• On Nov. 17th or so, everybody begins receiving hundreds of new spam messages promoting sites for what were previously SanCash properties. (Notably Prestige Replica and King Replica.) Several new properties also appear, using identical website design to previous VPXL and PowerEnlarge sites. (Now named V.E.P. [Virility Enlarge Pills] and PowerGain+ respectively.) If this is SanCash returning to business as usual, it is a profoundly stupid move, since the FTC and numerous law enforcement agencies are watching every move they make.


• Later in November, SiL starts an experiment to see how many "lotteries" he will "win" via illegally sent Nigerian scam messages. [Hint: these are not genuine lotteries, especially a "Microsoft / Yahoo Lottery", which SiL "wins" at least four times a week.] His first 2-day total is over $56 million USD. Within less than two weeks, that total is nearly $400 million USD, from a total of 65 "lottery" messages. Within less than a month, the "total" is $700 million. The likelihood of anyone winning so many lotteries, so close together, in such a short space of time, are virtually zero. Apparently the Nigerian scammers out there don't seem to care how stupid they appear to be.


• Beginning in late November and continuing throughout December, several anti-spam activists begin methodically reporting every Google docs and MSN Live Spaces domain they receive via spam. Following months of inaction on behalf of MSN, several spam blocklists begin adding MSN Live Spaces to the ranks of domains to block. Very slowly, MSN abuse team members begin finally removing these offending links, but not at a rate fast enough to deter the spammers who continue to abuse them. Google docs will remove entries if enough individuals flag them as abusive. In a mere two weeks, several Google docs links used in spam runs are rendered useless. (400 at last count, with reporting still continuing.)

December:

• Ecatel, the latest network provider to take over connectivity for the botnet C&C servers previously hosted at McColo, also has its network shut down, enraging several of its otherwise legitimate customers. This leads to the very public outing of the rogue individual who was brokering the deal, one Ganesh Rao, who is very well known to spam fighting organizations. Rao is among the operators of infinitetech.in, a "bulletproof hosting" provider.


• In what appears to be a potential reflection of the harmful impact of illegal spammers on consumers at large, numerous news outlets report that deaths due to overdoses of addictive painkillers are on the rise. This should hardly be surprising when all of us, every day of the past several years, have been receiving relentless amounts of spam promoting precisely these products, with no need to ever get a prescription. [See also this story.]



• On Dec. 10th, the FTC orders a pair of companies related to a series of bogus antivirus products to shut down and freezes their assets. (The companies were known as Innovative Marketing, Inc. and ByteHosting Internet Services, LLC but operated under numerous aliases.) For many months this company and its affiliate program had been duping unsuspecting consumers into believing their computer had become infected with hundreds of viruses, trojans, and other malware, encouraging them to download and install their alleged antivirus product, which went by a variety of names such as "WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus". Of course installing that software led to no genuine protection against any malware, and the company profited massively from this frauduelent activity. One such operation was dissected in October 2008 by the SecureWorks team. [source.


• In a related story, on Dec. 10th, Microsoft releases Security Intelligence Report 5, in which they detail a rather large list of infections which the Microsoft security updates had removed over the past several months. Gar Warners blog delves into the data and explains how massive a removal this really is, numbering in the millions of removals of the Zlob infection, among many others. Looks like it's a bad time to be in the fake antivirus business.


• Dec. 17th, How Wai John Hui pleads guilty to federal fraud and money laundering charges related directly to the Alan Ralsky case. Hui stands to benefit greatly by cooperating with investigators. Even if Hui significantly cooperates with the ongoing investigation into Ralsky and his "business" dealings, he stands to serve from 32 to 39 months (just over ~2 - 3 years) in federal prison, and must "forfeit $500,000 in illegal earnings." This, in addition to October's news of accomplice Judy Devenow cooperating with police, is extremely bad news for Ralsky.


• On Dec. 19th, SiL's "winnings tally" surpasses One Billion Dollars US. It has only been 33 days since he started keeping track of the monetary totals he was allegedly "winning" or "inheriting" via fake Nigerian scam letters.


• On Dec. 22nd, New Zealand court documents are unsealed stating that Lance Atkinson has "admitted his part in a major international spamming operation and will pay a financial penalty of $100,000 plus costs of $7666." [source] His fine is reduced from the $200,000 maximum due to his cooperation with law enforcement and the fact that when he began SanCash, spamming itself was not illegal in New Zealand. Shane Atkinson and Roland Smits have instead chosen to defend themselves against these charges. No word on a court date at this time, and no word on the still-pending FTC charges.See also this press release, which goes into further detail and specifically mentions Tulip Labs as being directly involved with this illegal operation.


• In some additional followup, the author of SpamInMyInBox.com writes a year-end roundup regarding his investigation into SanCash, GenBucks, and Tulip Lab, indicating he is interested in pursuing the charges against him on behalf of Tulip Lab:
  
  

  Regarding the case against me in Delhi High Court, India, then currently all of my research is being evaluated by NASSCOM (because of the techincal dept of parts of it) who will report back to Delhi High Court, and the next hearing will be in the end of february 2009, which can be read in the following court document: http://courtnic.nic.in/dhcorder/dhcqrydisp_o.asp?pn=171295&yr=2008

  
  
  He further states that apparently Tulip Lab is currently "interested" in withdrawing their charges against him. (I just bet they are.) This indicates that there will likely be a lot more interesting stuff in 2009 regarding this case.


• In some very disappointing news, at midnight on the morning of Dec. 24th, 2008, revered Anti-spam and Anti-cybercrime site CastleCops.com, which for several years had been instrumental in collating and organizing criminal evidence related to illegal spamming, cybercrime, malware and phishing, closed up indefinitely. As of this writing it is unknown whether the site will ever reappear. The operators of the site had been struggling to maintain it even under crushing workloads at other jobs. That coupled with further complications ultimately led to its demise. Members of the site had to discover or create other means of connecting to each other, and in its wake several wikis, forums and blogs started up, with more very likely to start up in the new year.


• From Dec. 4th through Dec. 26th, "trobbins", a long time collector and mass-reporter of illegally registered domain names, successfully shuts down just over 12,000 domains used in spam campaigns for the usual variety of bogus "products" promoted via illegal spammers and their sponsors. Much of these domains were registered via domain providers located in China (35 Technology, BizCN, Xin Net, etc.) trobbins is by no means the only individual reporting these domains to registrars around the world, but he has a striking ability to convince even previously non-responsive domain registrars to take action on large numbers of illicit domains, registered using 100% fake contact information. Most of these registrars were previously considered bullet-proof by spammers and their sponsoring companies.

Phew! That's a lot of activity! Way more than occured in 2007. Mostly all of it good news for people who hate spam and the people who profit from it. A very great deal of it completely bad news for most operators within distributed spam operations.

Clearly we're entering a more mature phase with regards to legislation of illegal activities and how they relate to online means of execution. To see the sheer breadth of international cooperation between disparate law enforcement agencies is a very encouraging sign, and one that points to even more arrests and other legal action against illegal spammers.

I'll still say it, since it's always worth repeating:

DO NOT PURCHASE ANYTHING FROM A WEBSITE YOU RECEIVED IN A SPAM MESSAGE OF ANY TYPE!

To do so is to basically give away your personal data to criminals, to risk having your identity stolen, and to risk personal harm to yourself, or even death.

Happy Holidays everyone. Stay safe!

SiL / IKS / concerned citizen