Day: May 31, 2009

Canadian Pharmacy – www.motherany.com

1 Comment

Header Analysis

The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
12.161.202.90 United States (Neffs)* Whois Google DNSStuff Urgentmessage.org
207.115.36.137 United States (Richardson)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

From Brendan Collier Sun May 31 05:31:41 2009
Return-Path:
Authentication-Results: mta143.sbc.mail.mud.yahoo.com from=dck.com.ar; domainkeys=neutral (no sig); from=dck.com.ar; dkim=neutral (no sig)
Received: from 12.161.202.90 (EHLO nlpi123.prodigy.net) (207.115.36.137)
by mta143.sbc.mail.mud.yahoo.com with SMTP; Sat, 30 May 2009 21:31:35 -0700
Received: from 5s9gclp ([12.161.202.90])
by nlpi123.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n4V4VGXY028689;
Sat, 30 May 2009 23:31:33 -0500
Message-ID: <000701c9e1eb$c0242c10$627e2ad2@dck.com.ar>
Reply-To: “Brendan Collier”
From: “Brendan Collier”
To: ,
Subject: great deals goin on
Date: Sun, 31 May 2009 08:31:41 -0400
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 127

An Incredible Canadian Pharmacy is available at your_Fingertips!
N0 Doctor_Needed! Click Here -> http://motherany.com

Header Analysis

The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
66.147.35.66 United States (Davenport)* Whois Google DNSStuff Urgentmessage.org
207.115.20.48 United States (Richardson)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

From Amparo Savage Fri May 29 11:46:23 2009

Return-Path:
Authentication-Results: mta102.sbc.mail.re3.yahoo.com from=blm.co.uk; domainkeys=neutral (no sig); from=blm.co.uk; dkim=neutral (no sig)
Received: from 66.147.35.66 (EHLO flph261.prodigy.net) (207.115.20.48)
by mta102.sbc.mail.re3.yahoo.com with SMTP; Fri, 29 May 2009 22:35:52 -0700
Received: from tcdb592 (nsc66.147.35-66.newsouth.net [66.147.35.66])
by flph261.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n4U5ZbWA013298;
Fri, 29 May 2009 22:35:52 -0700
Message-ID: <000701c9e08d$c3fa2150$627e2c7a@blm.co.uk>
Reply-To: “Amparo Savage”     a.savage_go@blm.co.uk
From: “Amparo Savage”    a.savage_go@blm.co.uk
To: ScamFraudAlert
Subject: Canadian Rx Medications to the rescue
Date: Fri, 29 May 2009 11:46:23 -0700
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 127

An Incredible Canadian Pharmacy is available at your_Fingertips!
N0 Doctor_Needed! Click Here -> http://motherany.com

top-phar-medshop2

Canadian Pharmacy – the worst Internet fraud problem today. These criminals steal identities and credit card details from unsuspecting customers, to use later to pay for tens of thousands of domain name registrations. Don’t be fooled.
Similar sites to this are listed in the spam trap report at
http://rss.uribl.com/ns/plumbold_com.html
Use complainterator.com to generate complaints to the registrars, and include a link to this page for evidence.

Posted at 05/31/2009-12:43:06 AM by pharmalert, Experienced Reviewer

“Canadian Pharmacy” is a flagrant criminal operation that keeps opening thousands and thousands new sites promoting the same old illegal pharmaceuticals. You seldom see greedier scumbags than these criminals. They don’t care how much damage they cause to innocent people as long as they get all they want. No matter if people get seriously ill after taking their fake drugs, or lose their money after giving over their credit card details. This kind of scammers would be happy to sell their own mother for a quick buck (if they only had one).

It’s always better to stay far away from here and similar sites altogether. There’s no one on the face of earth who would gain by this scam but the criminals behind it, and possibly the poor schmucks who send all the spam for them. They think they are safe, but one day the tide will turn…

See evidence of fraud:
http://www.spamtrackers.eu/wiki/index.php/Canadian_Pharmacy
Read about the affiliate program responsible for spamming this brand:
http://www.spamtrackers.eu/wiki/index.php/Glavmed

Posted at 05/30/2009-08:56:12 PM by Nodus, Experienced Reviewer , View profile [ Reputation score: 9 / 9 ]

Address lookup

canonical name www.motherany.com.
aliases
addresses 58.17.3.41
60.191.239.181
61.191.63.150
203.93.208.86

Domain Whois record

Queried whois.internic.net with “dom motherany.com“…

   Domain Name: MOTHERANY.COM
   Registrar: XIN NET TECHNOLOGY CORPORATION
   Whois Server: whois.paycenter.com.cn
   Referral URL: http://www.xinnet.com
   Name Server: NS1.PLUMBOLD.COM
   Name Server: NS2.PLUMBOLD.COM
   Name Server: NS3.MORALFLAIR.COM
   Name Server: NS4.MORALFLAIR.COM
   Status: ok
   Updated Date: 27-may-2009
   Creation Date: 25-may-2009
   Expiration Date: 25-may-2010

>>> Last update of whois database: Sun, 31 May 2009 18:19:27 UTC <<<

Queried whois.paycenter.com.cn with “motherany.com“…

Domain Name      : motherany.com
PunnyCode        : motherany.com

Registrant:
  Organization   : LIUJIARONG
  Name           : LIUJIARONG
  Address        : JIULONGLU256
  City           : shaoyangshi
  Province/State : hunansheng
  Country        : china
  Postal Code    : 422064

Administrative Contact:
  Name           : LIUJIARONG
  Organization   : LIUJIARONG
  Address        : JIULONGLU256
  City           : shaoyangshi
  Province/State : hunansheng
  Country        : china
  Postal Code    : 422064
  Phone Number   : 86-0739-75912657
  Fax            : 86-0739-75912657
  Email          : LIUJIARONG@263.COM

Technical Contact:
  Name           : LIUJIARONG
  Organization   : LIUJIARONG
  Address        : JIULONGLU256
  City           : shaoyangshi
  Province/State : hunansheng
  Country        : china
  Postal Code    : 422064
  Phone Number   : 86-0739-75912657
  Fax            : 86-0739-75912657
  Email          : LIUJIARONG@263.COM

Billing Contact:
  Name           : LIUJIARONG
  Organization   : LIUJIARONG
  Address        : JIULONGLU256
  City           : shaoyangshi
  Province/State : hunansheng
  Country        : china
  Postal Code    : 422064
  Phone Number   : 86-0739-75912657
  Fax            : 86-0739-75912657
  Email          : LIUJIARONG@263.COM

Network Whois record

Queried whois.apnic.net with “58.17.3.41“…

inetnum:      58.17.3.32 - 58.17.3.47
netname:      CHAOREN-CAFE
country:      CN
descr:        Superman Internet Cafe
admin-c:      CH444-AP
tech-c:       CH444-AP
status:       ASSIGNED NON-PORTABLE
changed:      wujiawei@china-netcom.com 20070427
mnt-by:       MAINT-CNCGROUP-JX
source:       APNIC

route:        58.17.0.0/17
descr:        CNC Group CHINA169 Jiangxi Province Network
country:      CN
origin:       AS4837
mnt-by:       MAINT-CNCGROUP-RR
changed:      abuse@cnc-noc.net 20060728
source:       APNIC

route:        58.17.0.0/17
descr:        CNCGroup JiangXi province network
country:      CN
origin:       AS9929
mnt-by:       MAINT-CNCGROUP-RR
changed:      abuse@cnc-noc.net 20050218
changed:      hm-changed@apnic.net 20050331
source:       APNIC

person:       CNCGroup Hostmaster
nic-hdl:      CH444-AP
e-mail:       abuse@cnc-noc.net
address:      No.156,Fu-Xing-Men-Nei Street,
address:      Beijing,100031,P.R.China
phone:        +86-10-82993155
fax-no:       +86-10-82993144
country:      CN
changed:      abuse@cnc-noc.net 20041220
mnt-by:       MAINT-CNCGROUP
source:       APNIC

DNS records

DNS query for 41.3.17.58.in-addr.arpa returned an error from the server: NameError

name class type data time to live
http://www.motherany.com IN A 60.191.239.181 3600s (01:00:00)
http://www.motherany.com IN A 61.191.63.150 3600s (01:00:00)
http://www.motherany.com IN A 203.93.208.86 3600s (01:00:00)
http://www.motherany.com IN A 58.17.3.41 3600s (01:00:00)
motherany.com IN A 58.17.3.41 3600s (01:00:00)
motherany.com IN A 61.191.63.150 3600s (01:00:00)
motherany.com IN A 203.93.208.86 3600s (01:00:00)
motherany.com IN A 60.191.239.181 3600s (01:00:00)

— end —

Canadian Pharmacy – Rxpayouts.com Complaint

1 Comment

RxPayouts.com Online Pharmacy Fraud Internet

RxPayouts.com                                                                                                                           logo
http://www.rxpayouts.com 
Internet,
U.S.A.

I am a member of the affiliate program of RxPayouts.com, which is an online pharmacy.

On Oct 24, I was shocked to learn that my account was suspended due to inactivity when my store have been consistently operating for more than a month now. I immediately tried to contact their affiliate support through phone and email but to no avail, until on Oct 27 when one of my employees was able to reach an affiliate support personnel by phone by the name of allen.

Allen basically said that my store does not exist. How can my store not exist when Rxpayouts own customer support knows us and we are still able to process orders.

Rxpayouts faked a suspension then removed my account when we are about to receive our USD 4000 commission. Rxpayouts stole my commissions! This company is scamming people and affiliates should know!

To prove that my store still operates here is a shipped out transaction, note that sensitive info have been removed:
——————————————————————
This email is to notify you that an order for your store
greensafemeds.com has been shipped, all the details
are shown below.

Order ID: #2852237
Order Date: 2008-10-23 15:27:25

You are receiving this email because your email address is registered in the
back office (((Redacted)))
If you do not wish to receive these notification emails you can leave
Notify email blank for this store. All notification emails arrive with the
subject prefix ‘Admin:’ allowing you to easily filter these messages if you
have a high volume store.

If you have any questions please contact us at any time, but not by using this
email as this email was sent to you by our systems.

Thanks — (((Redacted)))

Phillip yao
Manila
Philippines

 

Rxpayouts payment fraud

Well they paid me for the USD 4000 a few weeks back. So I thought that the issue, whatever it was, was finally resolved.

Now three (3) weeks later and I have an unpaid commission of USD 8000+ and they won’t pay again.

They say I am under fraud investigation. They neglected to say what fraudulent act I supposedly did or that I was under investigation to begin with. If they want to put me under investigation, at the very least tell me so that I wouldn’t have wasted time selling their products.

It seems I am not the first to encounter this problem with Rxpayouts. It seems this is standard operation in our local industry. They have duped many affiliates.

Canadian Pharmacy – www.simple-op.net

Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

warning1

National Association of Boards of Pharmacy (NABP)

top-phar-medshop2

Address lookup

canonical name simple-op.net.
aliases http://www.simple-op.net
addresses 195.95.155.3

Domain Whois record

Queried whois.internic.net with “dom simple-op.net“…

   Domain Name: SIMPLE-OP.NET
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.NSCONTROL.COM
   Name Server: NS2.NSCONTROL.COM
   Name Server: NS3.NSCONTROL.COM
   Name Server: NS4.NSCONTROL.COM
   Name Server: NS5.NSCONTROL.COM
   Status: clientTransferProhibited
   Updated Date: 31-jul-2008
   Creation Date: 06-jun-2008
   Expiration Date: 06-jun-2011

>>> Last update of whois database: Sun, 31 May 2009 12:11:56 UTC <<<

Queried whois.enom.com with “simple-op.net“…

Visit AboutUs.org for more information about simple-op.net
<a href="http://www.aboutus.org/simple-op.net">AboutUs: simple-op.net</a>

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: simple-op.net

Registrant Contact:
   WhoisGuard
   WhoisGuard Protected ()

   Fax:
   8939 S. Sepulveda Blvd. #110 - 732
   Westchester, CA 90045
   US

Administrative Contact:
   WhoisGuard
   WhoisGuard Protected (81f0be3c32124e4a997ff56ef97e5155.protect@whoisguard.com)
   +1.6613102107
   Fax:
   8939 S. Sepulveda Blvd. #110 - 732
   Westchester, CA 90045
   US

Technical Contact:
   WhoisGuard
   WhoisGuard Protected (81f0be3c32124e4a997ff56ef97e5155.protect@whoisguard.com)
   +1.6613102107
   Fax:
   8939 S. Sepulveda Blvd. #110 - 732
   Westchester, CA 90045
   US

Status: Locked

Name Servers:
   ns1.nscontrol.com
   ns2.nscontrol.com
   ns3.nscontrol.com
   ns4.nscontrol.com
   ns5.nscontrol.com

Creation date: 06 Jun 2008 09:43:55
Expiration date: 06 Jun 2011 09:43:55

Get Noticed on the Internet!  Increase visibility for this domain name by listing it at www.whoisbusinesslistings.com

Network Whois record

Queried whois.ripe.net with “-B 195.95.155.3“…

% Information related to '195.95.155.0 - 195.95.155.255'

inetnum:        195.95.155.0 - 195.95.155.255
netname:        MSKCOM-NET
descr:          MoskvaCom Ltd
country:        RU
org:            ORG-ML114-RIPE
admin-c:        PG5690-RIPE
tech-c:         PG5690-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-HM-PI-MNT
mnt-lower:      RIPE-NCC-HM-PI-MNT
mnt-by:         MSKCOM-MNT
mnt-routes:     MSKCOM-MNT
mnt-routes:     AS2118-MNT
mnt-domains:    MSKCOM-MNT
changed:        dilotto@gmail.com 20090224
source:         RIPE

organisation:   ORG-ML114-RIPE
org-name:       MoskvaCom Ltd
org-type:       OTHER
address:        Parusnyj pr. 49/2
address:        Moscow, Russia
phone:          +7 910 4311272
e-mail:         dilotto@gmail.com
mnt-ref:        MSKCOM-MNT
mnt-by:         MSKCOM-MNT
changed:        hostmaster@ripe.net 20090224
source:         RIPE

person:         Pavel Gorbunov
address:        Parusnyj pr. 49/2
address:        Moscow, Russia
phone:          +7 910 4311272
e-mail:         dilotto@gmail.com
nic-hdl:        PG5690-RIPE
mnt-by:         MSKCOM-MNT
changed:        hostmaster@ripe.net 20090224
source:         RIPE

% Information related to '195.95.155.0/24AS2118'

route:          195.95.155.0/24
descr:          RusDesign Autonomous System
origin:         AS2118
notify:         noc@relcom.net
mnt-by:         AS2118-MNT
changed:        andreyss@relcom.net 20090303
source:         RIPE

DNS records

DNS query for 3.155.95.195.in-addr.arpa returned an error from the server: NameError

name class type data time to live
http://www.simple-op.net IN CNAME simple-op.net 60s (00:01:00)
simple-op.net IN SOA
server: ns1.adverdomain.com
email: root.simple-op.net
serial: 2009030829
refresh: 28800
retry: 7200
expire: 604800
minimum ttl: 30
60s (00:01:00)
simple-op.net IN NS ns4.nscontrol.com 60s (00:01:00)
simple-op.net IN NS ns2.nscontrol.com 60s (00:01:00)
simple-op.net IN NS ns5.nscontrol.com 60s (00:01:00)
simple-op.net IN NS ns1.nscontrol.com 60s (00:01:00)
simple-op.net IN NS ns3.nscontrol.com 60s (00:01:00)
simple-op.net IN A 195.95.155.3 60s (00:01:00)