Read All About This at Symantec Corp.

Fraudulent Sites - Money Grabber - Product Worthless - Stincts
HerbalKing http://a1herbals.com/

a1herbals.com would like to thank John from FL, USA for sending us his before and after photos and also letting us show them on our site.

Did you know... That ManXL is the worlds NO.1 choice for penis enlargement as rated by leading mens magazines and that the results are permanent!

A breakthrough in herbal Science has created a pill that has been designed specifically for penis enlargement. The tests that took place over a 6 month period showed that out of the 5,000 Males from around the world who participated, the average gain after 5 months of taking ManXL pills was 3.02 Inches! Amazing, PERMANENT RESULTS that will last.

Gain Up to 3+ Inches In Length.
Increase Your Penis Width (Girth) By upto 20%.
Help Stop Premature Ejaculation!
Produce Stronger, Rock Hard Erections.
100% Safe To Take, With NO Side Effects.
Fast Shipping WorldWide.
Doctor Approved And Recommended.
No Pumps! No Surgery! No Exercises!
100% Money Back Guarantee.
3 FREE Bottles Of ManXL !!

http://a1herbals.com/

The Character Behind HerbalKing - Ursula Nilsen - TOLMEN STAR ENTERPRISES LTD

Whois Record

domain: www.a1herbals.com
owner: Eduardo Macias
organization: TOLMEN STAR ENTERPRISES LTD
email: Whois Privacy and Spam Prevention by DomainTools.com
address: Querenda No. 353, Fracc. Bosque Camelinas
city: Michoacan
postal-code: 58290
country: MX
phone: +52.443655187
fax: +52.443655187
admin-c: CCOM-477954 Whois Privacy and Spam Prevention by DomainTools.com
tech-c: CCOM-477954 Whois Privacy and Spam Prevention by DomainTools.com
billing-c: CCOM-477954 Whois Privacy and Spam Prevention by DomainTools.com
nserver: ns1.mdns55.com 221.7.193.184
nserver: ns2.mdns55.com 218.189.224.6
nserver: ns3.mdns55.com 211.155.132.58
nserver: ns4.mdns55.com 210.52.216.185
status: lock
created: 2006-12-16 20:19:11 UTC
modified: 2006-12-16 20:19:11 UTC
expires: 2007-12-16 20:19:11 UTC

contact-hdl: CCOM-477954
person: Eduardo Macias
organization: TOLMEN STAR ENTERPRISES LTD
email: Whois Privacy and Spam Prevention by DomainTools.com
address: Querenda No. 353, Fracc. Bosque Camelinas
city: Michoacan
postal-code: 58290
country: MX
phone: +52.443655187

source: joker.com live whois service
query-time: 0.018391
db-updated: 2006-12-17 21:40:18
NOTE: By submitting a WHOIS query, you agree to abide by the following

[size="4"]
Other sites listed under aliases:

#1 www.aeroget.com Sun, 17 Dec 2006 20:07:31 +0000
#2 www.adyam.com Sun, 17 Dec 2006 16:20:52 +0000
#3 www.mybiznewb.com Sat, 16 Dec 2006 23:50:48 +0000
#4 www.tripling.net Sat, 16 Dec 2006 21:50:27 +0000
#5 www.crbrc.com Sat, 16 Dec 2006 18:16:10 +0000
#6 www.storeyed.net Sat, 16 Dec 2006 15:54:13 +0000
#7 www.brilliantsecrets.com Sat, 16 Dec 2006 14:46:42
#8 www.goafoa.com Sat, 16 Dec 2006 14:44:39 +0000
#9 www.casinoseuro.net Sat, 16 Dec 2006 09:22:08 +0000
#10 www.gmgn.net Sat, 16 Dec 2006 04:41:38 +0000
#11 www.mydreamsrx-site.com Sat, 16 Dec 2006 04:29:01
#12 www.cflie.com Sat, 16 Dec 2006 00:04:37 +0000
#13 www.hypoluxo-site.com Fri, 15 Dec 2006 23:42:30
#14 www.eftb.net Fri, 15 Dec 2006 22:19:07 +0000
#15 www.montste.net Fri, 15 Dec 2006 20:39:09 +0000
#16 www.crask.net Fri, 15 Dec 2006 20:15:25 +0000
#17 www.crurl.com Fri, 15 Dec 2006 20:01:37 +0000
#18 www.cachs.net Fri, 15 Dec 2006 16:54:20 +0000
#19 www.dadca.com Fri, 15 Dec 2006 03:53:01 +0000
#20 www.bdmsstak.com Fri, 15 Dec 2006 02:50:41 +0000

[/quote]

WhoIs Lookup performed by Karen's WhoIs
http://www.karenware.com/

Domain Name: WWW.EHERBALWORLD.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.MAIN-DNS3.COM
Name Server: NS2.MAIN-DNS3.COM
Name Server: NS3.MAIN-DNS3.COM
Status: clientRenewProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Status: clientDeleteProhibited
Updated Date: 08-feb-2007
Creation Date: 08-feb-2007
Expiration Date: 08-feb-2008


Last update of whois database: Sun, 11 Feb 2007 16:26:56 EST

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
domain: www.eherbalworld.net
owner: Eduardo Macias
organization: TOLMEN STAR ENTERPRISES LTD
email: admin@querendamx.com
address: Querenda No. 353, Fracc. Bosque Camelinas
city: Michoacan
postal-code: 58290
country: MX
phone: +52.443655187
fax: +52.443655187
admin-c: CNET-477954 admin@querendamx.com
tech-c: CNET-477954 admin@querendamx.com
billing-c: CNET-477954 admin@querendamx.com
nserver: ns1.main-dns3.com
nserver: ns2.main-dns3.com
nserver: ns3.main-dns3.com
status: lock
created: 2007-02-08 06:46:32 UTC
modified: 2007-02-08 06:46:32 UTC
expires: 2008-02-08 06:46:32 UTC

contact-hdl: CNET-477954
person: Eduardo Macias
organization: TOLMEN STAR ENTERPRISES LTD
email: admin@querendamx.com
address: Querenda No. 353, Fracc. Bosque Camelinas
city: Michoacan
postal-code: 58290
country: MX
phone: +52.443655187

source: joker.com live whois service
query-time: 0.01914
db-updated: 2007-02-12 03:32:23

Pharmacy Express- Ed Pharmacy Canadian Pharmacy Sites (Online Pharmacy-Generic Viagra,Soma,Tramadol, Etc-for sale - generic1pharmacy.com)
Pharmacy Express (referred to in this document as PE) is a very large and sophisticated spamming operation believed to be operated by the Russian criminal spammer Leo Kuvayev, Alex Polyakov, Vincent Chan and several of his colleagues and affiliates. These sites have been spamvertised relentlessly to several million email addresses since at least 2004, possibly even longer. Mr. Kuvayev is wanted for several international charges which he has never answered for, including money laundering, child porn and of course illegal spamming. This spam operation has numerous ties to several large-scale Windows viruses and Trojan infections dating back numerous years. The botnets alleged to be behind this operation handle everything from domain registration to zombie infection to probably website hosting and "order" processing. Nobody has ever claimed to have received anything upon ordering, so this series of websites is actually considered a credit card fraud operation very similar to Alex Polyakov's My Canadian Pharmacy.

As is the case with My Canadian Pharmacy, numerous pharmacy oversight organizations have fielded several thousand complaints per year regarding this illegal operation. They and numerous law enforcement agencies continue to investigate as much as possible regarding the spamming, website setup, DNS setup and (alleged) order processing of this spam gang. This investigation is ongoing.

Pharmacy Express sites stopped being spam during the middle portion of 2007, but resurfaced with a completely new design in Feb. 2008.

Current Discussion
The newer version of Pharmacy Express sites started to be spammed in late-February of 2008 and as mentioned above they feature a totally different design.

2008 spam runs relied on Yahoo search redirects to penetrate spam whitelists.

Spamming in 2007 for domains like lodrx.com, tedrx.com and similar, targeted Google's Gmail customers. Most were trapped by Gmail's spam detection and diverted to the spam folder.

You may follow a discussion on Pharmacy Express at the Fight Back forum.

Read More - SpamTrackers.eu

The SpamHaus Project

Vxpl, King Replica, Canadian Healthcare
<pre>
[TRIPLETS! Pharmacy, Replicas, Herbal]
======================================
There are several triplet operations consisting of a pharmacy site,
a counterfeit luxury goods site and an herbal products site.

Two of these are the World Pharmacy, Diamond Replicas, Hoodia Maxx
and Target Pharmacy/Canadian HealthCare, King Replica, VPXL Herbal.

TARGET PHARMACY - CANADIAN HEALTHCARE

-------------------------------------
Target Pharmacy seems to have changed its name to Canadian HealthCare,

On 28 February 2008 it was:

GET / HTTP/1.1
Host: www.remblung.com

HTTP/1.1 200 OK
[title]Target Pharmacy[/title]

but by 17 April it was

GET / HTTP/1.1
Host: www.remblung.com

HTTP/1.1 200 OK
[title]Canadian Healthcare[/title]
-------------------------------------

VPXL - MAXHERBAL - MAXGAIN+
---------------------------
There are at least three formats for the site (the data submissions
at each "type" are identical) with three different email contacts,

At "VPXL - Penis Enlargement Made Easy"
the contact is support@vpxlherbalgrowth.com.

At "MaxHerbal is NO.1 For Penis Enlargement"
the contact is support@maxherbalpills.com.

At "MaxGain+ ... No.1 for Penis Enlargement"
the contact is support@maxgainplus.com.
---------------------------


The sites used to look very similar until Target Pharmacy/Canadian Healthcare
remodeled its site whose order form now looks quite similar to that at the
more successful Canadian Pharmacy sites. It expanded its drug list but that
list is *not* the same at Canadian Pharmacy (my most recent checks show
Canadian Pharmacy having 548 products since they added 35 pet products while
Canadian Healthcare has 286 - not counting different dosages). The order data
changed somewhat at Target Pharmacy but does not duplicate that at Canadian
Pharmacy, retaining some of the old name/value pairs. While the data submitted
for orders at Target Pharmacy used to be *very* similar to that at World
Pharmacy, now it is a mixture of its old data and that at Canadian Pharmacy
sites. The Target Pharmacy sites have not changed the overall structure,
however, as their starting page still has URLs of the form,
[a href="brand.php?...] such as [a href="brand.php?act=search]
(which will get the listing of products, if one sends the require cookies),
[a href="brand.php?br_x=11], etc.
These are just the type of links one finds at World Pharmacy. The Target
PHARMACY order page, at one time, had the disclaimer
I have read and agree with the Prestige Replicas
Privacy Policy & Terms and Conditions.
which appears in many places, including the Diamond Replicas order page and,
of course, the Prestige Replicas order form itself (under some hostnames -
under other hostnames, at the Prestige Replicas site you may find
I have read and agree with the Privacy Policy
& Terms and Conditions.
with two spaces in the HTML source between "the Privacy" as if a string, such
as "Prestige Replicas" had been deleted leaving its preceding space).

At any IP address hosting World Pharmacy (found in the "/ph/" directory) one
can find Diamond Replicas in the "/rp/" directory and Hoodia Maxx in the
"/hm/" directory - the hostname is not important, nor are cookies and one can
get the product listing using [a href="brand.php?act=search], as at Target
Pharmacy, Canadian Healthcare, without worrying about cookies.

At any IP address hosting Target Pharmacy, Canadian HealthCare, one can find
King Replica and VPXL sites (and its alternate versions mentioned above) using
the proper hostnames. In this case, the hostname is critical (sites are not
found in different directories). They use the same sort of cookies,

www.poweeuunt.com: (VPXL)
Set-Cookie: OPT=O; path=/
Set-Cookie: DOM=www.poweeuunt.com:1546661384; path=/
Set-Cookie: AFF=3829219893; path=/
Set-Cookie: PAGE=1426447528; path=/

www.remblung.com: (Target Pharmacy and then Canadian Healthcare)
Set-Cookie: OPT=O; path=/
Set-Cookie: DOM=www.remblung.com:1921420182; path=/
Set-Cookie: AFF=2412172648; path=/
Set-Cookie: PAGE=0176095144; path=/
Set-Cookie: PHPSESSID=1a2464b9ce1fb765b7cd96dde8f4a053; path=/

outeplose.com: (King Replica)
Set-Cookie: DOM=outeplose.com:3106237040; path=/
Set-Cookie: AFF=0116444927; path=/
Set-Cookie: PAGE=3884804911; path=/


The World Pharmacy site used to have a very short list of drugs,
Cialis Soft Tabs
Viagra (Sildenafil Citrate 100mg)
Viagra SoftTabs
Viagra Oral Gel
Cialis (Cialis)
Viagra (Sildenafil Citrate 50mg)
Levitra
Propecia
Zoloft (Sertraline HCL)
Zyban (Bupropion Hcl)
Atarax
Prozac (Fluoxetine)
Paxil (Paroxetine Hcl)
Carisoma (carisoprodol)
Ultram
Celebrex
Glucophage
Norvasc
Lipitor (Atorvastatin)
Zocor
Provigil (Modafinil)
Hoodia Maxx (Pure Hoodia)
but, while it has not changed its order form (as has Target Pharmacy), the
drug list now (at my last check) matches that at Target Pharmacy with a small
difference. Target Pharmacy had a drug list from which they removed twelve
items. The listing at World Pharmacy matches the slightly older listing at
Target Pharmacy, including precisely those dozen items.

So there are similarities (the order data used to be more similar at Target
and World Pharmacies before Target remodelled its order page; the quite
similar structure of URLs at the two pharmacy sites and matching product
listings) and those sites mention(ed) Prestige Replicas.

Like Diamond Replicas (associated with World Pharmacy) and King Replica
(associated with Target Pharmacy, Canadian Healthcare) I suspect that Prestige
Replica also has associated sites but am unsure as to what they may be -
Herbal King(?) perhaps. Are these triplets (and let me include Prestige
Replicas) associated, siblings separated at birth or independent clones?

This listing is for the spamvertized site, http://www.poweeuunt.com
(vpxl herbals) at IP addresses
89.248.238.100
116.123.47.67
119.18.197.231 119.18.197.238
119.18.198.205 119.18.198.208
125.46.42.137 125.46.42.142
210.14.131.234 210.14.131.238
211.49.115.50
220.113.33.40
221.123.80.210 221.123.80.211
222.186.12.77

SPAMVERTIZED URL: http://www.poweeuunt.com

'NATURAL HERBAL PRODUCT 100% SATISFACTION GUARANTEE!
[a href="http://www.poweeuunt.com"]http://www.poweeuunt.com[/a]'

=========================================================
For the host:
"www.poweeuunt.com"

NAMESERVERS listed in the root servers for poweeuunt.com:
---------------------------------------------------------
poweeuunt.com NS ns1.wegenage.com
poweeuunt.com NS ns2.wegenage.com
ns1.wegenage.com A 125.46.42.142
ns2.wegenage.com A 210.14.131.222

[extract from dig]
------------------
dig @125.46.42.142
www.poweeuunt.com
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE
www.poweeuunt.com A 125.46.42.142

dig @210.14.131.222
www.poweeuunt.com
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE
www.poweeuunt.com A 210.14.131.222
=========================================================

I will omit the nameserver/host resolutions for other hostnames
and simply note that I have seen this up at other IP addresses
(e.g. one of my ISP's resolvers/nameservers has a cached result,
ns1.wegenage.com. 59233 IN A 221.123.80.210
which resolves the hostname to 221.123.80.210
and in accessing the site I got some material from
210.14.131.222, some from 221.123.80.210 and some from 125.46.42.142)
and in checking them I find:

* Connected to 89.248.238.100
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 116.123.47.67
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 119.18.197.231
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 119.18.197.238
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 119.18.198.205
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 119.18.198.208
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 125.46.42.137
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 125.46.42.142
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 210.14.131.234
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 210.14.131.238
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 211.49.115.50
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 220.113.33.40
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 221.123.80.210
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 221.123.80.211
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]


* Connected to 222.186.12.77
GET / HTTP/1.1
Host: www.poweeuunt.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]

The pages obtained from these IP addresses are byte-for-byte
identical (as are the headers, including the cookie, AFF=3829219893,
except, of course, for the "Date:" header which were:
Date: Fri, 25 Apr 2008 07:55:57 GMT
Date: Fri, 25 Apr 2008 07:56:01 GMT
Date: Fri, 25 Apr 2008 07:56:06 GMT
Date: Fri, 25 Apr 2008 07:56:11 GMT
Date: Fri, 25 Apr 2008 07:56:18 GMT
Date: Fri, 25 Apr 2008 07:56:22 GMT
Date: Fri, 25 Apr 2008 07:56:27 GMT
Date: Fri, 25 Apr 2008 07:56:32 GMT
Date: Fri, 25 Apr 2008 07:56:37 GMT
Date: Fri, 25 Apr 2008 07:56:42 GMT
Date: Fri, 25 Apr 2008 07:56:47 GMT
Date: Fri, 25 Apr 2008 07:56:52 GMT
Date: Fri, 25 Apr 2008 07:56:57 GMT
Date: Fri, 25 Apr 2008 07:57:02 GMT
Date: Fri, 25 Apr 2008 07:57:07 GMT
which, along with the common "Server:" header suggests that
they all may be obtaining the data from the same back end).

The contact email address shown when one submits an order is
support@vpxlherbalgrowth.com.

I will not list them all, just the first,

* Connected to 89.248.238.100
GET / HTTP/1.1
Host: vpxlherbalgrowth.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]VPXL - Penis Enlargement Made Easy[/title]

I checked at each IP address, and the site is up at each address listed
above.

Well, that was VPXL, but let me indicate that Canadian Healthcare is also
up at each site (I will omit the check for each of the IP addresses and
just show the first):

* Connected to 89.248.238.100
GET / HTTP/1.1
Host: www.remblung.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
[title]Canadian Healthcare[/title]

and it, too, is found at each of the IP addresses (yes, I *did* check).

Let me not omit King Replica (showing the result for the first IP address):

* Connected to 89.248.238.100
GET / HTTP/1.1
Host: outeplose.com

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7

KING REPLICA