logo.png

Fraudulent Sites -
Money Grabber - Product Worthless - Stincts - Scam Artists
MyCanadianPharmacy Bogus Domains Loop
#1 Search Results for "steropud.net"
#2 www.turnpoetry.info
#3 www.globren.info
#4 www.tunesheath.info
#5 disovit.com
#6 www.steropud.info
#7 www.cougets.info
#8 www.vicelio.info
#9 www.atmst.net

About Us
1999:
Jack Poppins meets Carl Rose, a young IT-specialist, who recently graduated from university. Together they conceive an internet pharmacy that would be able to compete with traditional brick-and-mortar pharmacies. Carl becomes the IT director of the company.

2000:
Paul Newman, psychiatrist, joins the team. He proceeds to work on logistics, the wholesale trade of drugs, and Page Ranking for the company.

2001:
The company is officially registered as 'Pharmacy' and soon after, receives its drug-selling license. The first office was established in approximately 60 meters of space!

2002:
Turnover in 2001 reaches CAD$90,000. A secretary and a courier are added to the growing staff.

2003:
Pharmacy's growth soars in tandem with the growth of the internet. The turnover in 2002 reaches CAD$500,000. Outgrowing its tiny office space, the company moves to the new specially-built office quarters comprising 2000 meters in an area space. The company now has a staff of 30 people.

2004:
The Dotcom crisis shakes many e-commerce sites, but Pharmacy remains stable. The turnover reaches CAD$2,000,000 and the staff continues to grow.

2005:
Our website undergoes a revamping process to fulfill all the needs of the modern internet user.

disovit.com

BBB Issues International Alert: Online Pharmacy Seller Using BBB Trademarks to Market Drugs
For Immediate Release
[Arlington, VA, July 29, 2005] -- The Better Business Bureau system today issued an alert about online pharmacy sites that are displaying the BBB's trademarks to market drugs on the Internet. People from every region of the United States are contacting the BBB to inquire about the legitimacy of a "business" that is targeting consumers through spamming. The e-mail messages contain claims that the company is "Verified by the BBB" and include a hyperlink to different web sites all using the same name MyCanadianPharmacy, Ltd. (not to be confused with Canada Drugs, Ltd. that owns Canadian Pharmacy Online - Canada Pharmacy Offers Discount Prescription Drugs Canada Drugstore - CanadaDrugs.com and www.mycanadianpharmacy.com).
The web sites involved in this scam use at least the following addresses:

www.newhealth-pill.info
www.loveamericaonline.inf
www.pillsathome.info
OnlinePills4U.info
www.directmedz.biz,
Tabletsforall.info - tablets for all Resources and Information. This website is for sale!
www.exclusivetablets.info
www.pills4life.info.

All of the web sites use the same template, display the BBBOnLine Reliability Logo and an untrue message claiming to be "Listed at Better Business Bureau." This practice misleads consumers and violates United States trademark, counterfeiting and copyright laws.

These sites are in no way affiliated with the Better Business Bureau. The BBB does not recommend visiting these sites, as there is some evidence that the sites may try to download software to visitors' computers.

The Council of Better Business Bureaus is unable to identify precisely who is behind these fraudulent Web sites because whoever registered them submitted phony contact information to the registrar. It does appear, however, that most of the spam messages originate from Korea.

To check if a particular company is a legitimate participant in the BBBOnLine program, go to Search BBBOnLine Seal Participants. A BBBOnLine Seal MUST be clickable; meaning that once one clicks on the seal, a confirmation window opens and explicitly states that the company is a participant in the BBBOnLine program. Also, the address bar on that BBBOnLine confirmation page must show an address including "http://www.bbbonline.org. For example, see the BBBOnLine "confirmation page" for BBBOnLine participant Procter and Gamble at BBBOnLine Seal Verification.

For more information on any aspect of BBBOnLine, please visit BBBOnLine, Inc. -- Promoting Trust and Confidence on the Internet.

Better Business Bureau
# # #

Submitted: 8/1/2006 8:08:43 PM
Modified: 8/1/2006 8:09:00 PM

MyCanadianPharmacy Ripoff and a Fraud Sells Generic Medication From India Advertises Name Brand Toronto Ontario

Company
MyCanadianPharmacy
Address:
1592 Wilson Avenue
Toronto Ontario M3L 1A6
Canada
Phone Number:

Fax:


This company is a fraud. They may use an address in Canada, but their medication comes from India. On their website they advertise "name brand" Viagra and Cialis, however, what they send is loose packaged (not even factory sealed) by hand, generic pills.
I called the 1-800 number many times...and left emails for them at support@mypharmacyportal.com and they never responded.
Don't waste your time with these frauds.

Steve
Overland Park, Kansas
U.S.A.


Ripoffreport.com

We Know Our Botnet Master
Is Part of The Russian Business Network (RBN)

From Wikipedia, the free encyclopedia
The Russian Business Network (commonly abbreviated as RBN) is a Russian Internet Service Provider based in St. Petersburg which is notorious for its hosting of illegal and dubious businesses, including; child pornography, phishing and malware distribution sites.

Physical Location.jpeg
Activities

The RBN has been described as "the baddest of the bad". It offers web hosting services and internet access to all kinds of criminal and immoral activities, with individual activities earning up to $150m in one year. Businesses that take active stands against such attacks are sometimes targeted by denial of service attacks originating in the RBN network.[2] RBN sells its services to these operations for $600 per month.[1]

The business is difficult to trace. It is not a registered company, and its domains are registered to anonymous addresses. Its owners are known only by nicknames. It does not advertise, and trades only in untraceable electronic transactions.[2]

There is one increasingly known activity of the RBN which is an exploit delivery method by applying fake anti-spyware and anti-malware for the purpose of PC hijacking and personal identity (ID) theft.[1] According to McAfee’s SiteAdvisor, MalwareAlarm is a dangerous fake anti-spyware software and is an updated version of Malware Wiper. They tested 279 “bad” downloads from this one site.[2] The methodology is to entice the user to use a “free download” to test for spyware or malware on their PC, MalwareAlarm then displays a warning message of problems on the PC to persuade the unwary web site visitor to purchase the paid version. Along with MalwareAlarm, numerous other rogue software are linked to and hosted by the RBN.[3]

According to Spamhaus RBN is “Among the world's worst spammer, child-pornography, malware, phishing and cybercrime hosting networks. Provides "bulletproof hosting", but is probably involved in the crime too”.[4] RBN was the subject of an article in the Washington Post on October 13, 2007, where Symantec and other security firms claim RBN provides hosting for many illegal activities, including identity theft and phishing. The article quotes a spokesman for Kaspersky Labs that the owners of RBN might not have directly violated the law as they primarily provide hosting services; their customers are apparently the ones violating laws.

A Walk On The Dark Side
Aug 30th 2007
From Economist.com

ACCORDING to VeriSign, one of the world’s largest internet security companies, RBN, an internet company based in Russia’s second city, St Petersburg, is “the baddest of the bad”. In a report seen by The Economist, VeriSign’s investigators unpick an extraordinary story of blatant cybercrime that implies high-level political backing.

In one sense, RBN (Russian Business Network) does not exist. It has no legal identity; it is not registered as a company; its senior figures are anonymous, known only by their nicknames. Its web sites are registered at anonymous addresses with dummy e-mails. It does not advertise for customers. Those who want to use its services contact it via internet messaging services and pay with anonymous electronic cash.

But the menace it poses certainly exists. “RBN is a for-hire service catering to large-scale criminal operations,” says the report. It hosts cybercriminals, ranging from spammers to phishers, bot-herders and all manner of other fraudsters and wrongdoers from the venal to the vicious. Just one big scam, called Rock Phish (where gullible internet users were tricked into entering personal financial information such as bank account details) made $150m last year, VeriSign estimates.

Plenty of other internet companies sail close to the wind—hosting unregulated online gambling for example. But according to a VeriSign investigator, “the difference is that RBN is solely criminal”. The pricing depends on the level of complaints. A discreet organisation pays little; one that attracts a lot of unwelcome attention, forcing RBN to take expensive countermeasures, has to pay more.

Despite the attention it is receiving from Western law enforcement agencies, RBN is not on the run. Its users are becoming more sophisticated, moving for example from simple phishing (using fake e-mails) to malware known as “trojans” that sit inside a victim’s computer collecting passwords and other sensitive information and sending them to their criminal masters.

A favourite trick is to by-pass the security settings of a victim's browser by means of an extra piece of content injected into a legitimate website. An unwary user enters his password or account number into what looks like the usual box on his log-in page, and within minutes a programme such as Corpse’s Nuclear Grabber, OrderGun and Haxdoor has passed it to a criminal who can empty his bank account. When VeriSign managed to hack into the RBN computer running the scam, it found accumulated data representing 30,000 such infections. “Every major trojan in the last year links to RBN” says a VeriSign sleuth.

RBN even fights back. In October 2006, the National Bank of Australia took active measures against Rock Phish, both directly and via a national anti-phishing group to which the bank’s security director belonged. RBN-based cybercriminals replied by crashing the bank’s home-page for three days.

What can be done? VeriSign has tracked down the physical location of RBN’s servers. But Western law enforcement officers have so far tried in vain to get their Russian counterparts to pursue the investigation vigorously. “RBN feel they are strongly politically protected. They pay a huge amount of people. They know they are being watched. They cover their tracks,” says VeriSign. The head of RBN goes under the internet alias “Flyman”; his uncle is thought to be a senior St Petersburg politician. Repeated e-mails to RBN’s purported contact addresses asking for comment have gone unanswered.

Companies can simply block access to any site registered at an RBN IP address. But that will not help most victims, such as those who receive infected e-mails. VeriSign says only strong political pressure on Russia will make the criminal justice system there deal with this glaring example of cyber-illegality.


Economist.com

Obviously the Russian Business Network (RBN) is working overtime during the Christmas and New Year holiday, no doubt planning for many in the ISP security and anti-spam arena to be on skeleton staff.

Many will now have already seen reports of the Storm Botnet outbreak which started on December 24th “MerryChristmasDude” with good write up at ComputerWorld and for technical details at ISC Sans or HolisticInfoSec (links on footer). This picture is changing rapidly and by December 26th there were new web sites “Uhavepostcard” , “HappyCards2008” and no doubt more to come over the next few days.

Three of the key web sites have the following registrant information, all registered via “ANO REGIONAL NETWORK INFORMATION CENTER DBA RU (Russia)” in chronological order:
Domain Name: MERRYCHRISTMASDUDE.COM - Creation Date: Nov 27 2007
Domain Name: UHAVEPOSTCARD.COM - Creation Date: Dec 23 2007
Domain Name: HAPPYCARDS2008.COM - Creation Date: Dec 26 2007

The key objective for the RBN is to rebuild the Storm Botnet which is shown in various reports over the last few months, from a few million enslaved PCs to more recently a few 100,000’s. One can only further guess as to what the RBN’s main goal is to use a rebuilt Storm Botnet for, e.g. earlier DDOS (Denial of Service attack) on Estonia.

There are some interesting elements concerning which make this attack innovative:

# Although much of that detected is conventional spam, however there is also a large amount of spam which is getting through many anti-spam defenses due to the use of “fake” BlogSpot (Blogger) links for example on a small sample;

hxxp://dantipXXXX.blogspot.com/?soapwerzpordeecaspewtkk153trajspeak hxxp://isakovkapitonXXXX.blogspot.com/?harkwerzpordeecaspewtkk153trajfloor

The common part of the suffix is “pewtkk153traj” which redirects to Geocities web sites and then a further redirect to the Storm exploit domains.

# Although most have identified as the Zhelatin Storm email worm or variant, it is also as the more recent fake codec downloads, dependent upon where the unfortunate user has come from. This now shows a “polymorphic” format, i.e. the virus or exploit has the ability to alter its signature in an attempt to combat anti-virus tools.

# The fast-flux technique used to avoid detection in this case is actually “double-flux” characterized by multiple nodes within the network registering and de-registering their addresses (see sample maps below taken within one hour periods and show the fast-flux DNS changes). It is also safe to say this newer Storm Network has now also has improved defense mechanisms, if examined too closely.