Buying Prescription Drugs Online 
May Be Dangerous
Says Drug Enforcement Administration
Click Here
National Association of Boards of Pharmacy (NABP)
Warning
“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.
Behind The Online Pharmacy
Today a shadowy, transnational network of illicit drug manufacturers, traders, doctors, Web site operators, spammers and criminals makes up the online pharmacy world.
Buying Medicines Over the Internet
FDA – Consumer Safety Guide
Buying Medication Online Can Be Safe
There are many options out there when it comes to buying medication online. We have looked at websites after websites. Some sites feature offshore pharmacies that do not require a prior prescription. Others feature licensed pharmacies that do require a prescription from your doctor.
Before making a purchase that can effect your health, we strongly recommend that you consult your physician & DO NOT self-medicate. Ordering medication online can be a safe, money-saving experience. When done through licensed online pharmacies that require a prescription, you can be assured that the medication you get is exactly what you need to treat your ailments.
Department of Justice – Ryan Haight Act
Read More Health Canada
Address lookup
lookup failed medicineni.com
Could not find an IP address for this domain name.
Domain Whois record
Queried whois.internic.net with “dom medicineni.com”…
Domain Name: WWW.MEDICINENI.COM
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: BLOCKEDDUETOSPAM.PLEASECONTACTSUPPORT.COM
Name Server: DUMMYSECONDARY.PLEASECONTACTSUPPORT.COM
Status: clientTransferProhibited
Updated Date: 05-oct-2010
Creation Date: 22-sep-2010
Expiration Date: 22-sep-2011
>>> Last update of whois database: Fri, 19 Nov 2010 09:21:25 UTC <<<
Queried whois.enom.com with “medicineni.com”…
Visit AboutUs.org for more information about medicineni.com
AboutUs: medicineni.com
Registration Service Provided By: Namecheap.com
Contact: support@namecheap.com
Visit: http://namecheap.com
Domain name: medicineni.com
Registrant Contact:
Hohlunova Nika
Nika Hohlunova ()
Fax:
Komsomolskaya str. 11-43
Salehard, Salehard 629008
RU
Administrative Contact:
Hohlunova Nika
Nika Hohlunova (Hohlunovanika@live.com)
+7.3492253422
Fax:
Komsomolskaya str. 11-43
Salehard, Salehard 629008
RU
Technical Contact:
Hohlunova Nika
Nika Hohlunova (Hohlunovanika@live.com)
+7.3492253422
Fax:
Komsomolskaya str. 11-43
Salehard, Salehard 629008
RU
Status: Locked
Name Servers:
blockedduetospam.pleasecontactsupport.com
dummysecondary.pleasecontactsupport.com
Creation date: 22 Sep 2010 14:52:00
Expiration date: 22 Sep 2011 09:52:00
Get Noticed on the Internet! Increase visibility for this domain name by listing it at http://www.whoisbusinesslistings.com
Network Whois record
Don’t have an IP address for which to get a record
DNS records
DNS query for medicineni.com failed: WouldBlock
No records to display
- acdrugpills.net
- acpharmacy.info
- actmedic.com
- adducdoctor.com
- afmedicine.com
- ainmedic.com
- airllermedic.com
- akemedic.com
- almedlab.com
- alydrugs.com
- ambushadventuresports.com
- amdrugstore.com
- ammedicine.com
- ampuldoctor.com
- anchmedic.com
- andrugpills.net
- andrugstore.com
- apoyergmedic.com
- appamedic.com
- applmedic.com
- arcoirisonline.com
- ardrugpills.net
- artcitrus.ru
- atfdrugs.com
- audoctor.net
- aumedic.com
- bacondoctor.com
- balatmedic.com
- baldrugs.com
- beldoctor.com
- bemedic.info
- best-tur.org
- bidrugstore.com
- bijemedic.com
- billingspecialistmedical.com
- biolmedic.com
- bodrugstore.com
- bogwmedic.com
- botmedic.com
- brgetthepills1.com
- brgetthepills10.com
- brgetthepills11.com
- brgetthepills12.com
- brgetthepills13.com
- brgetthepills14.com
- brgetthepills15.com
- brgetthepills16.com
- brgetthepills17.com
- brgetthepills18.com
- brgetthepills19.com
- brgetthepills2.com
- brgetthepills20.com
- brgetthepills21.com
- brgetthepills22.com
- brgetthepills23.com
- brgetthepills24.com
- brgetthepills25.com
- brgetthepills26.com
- brgetthepills27.com
- brgetthepills28.com
- brgetthepills29.com
- brgetthepills3.com
- brgetthepills30.com
- brgetthepills4.com
- brgetthepills5.com
- brgetthepills6.com
- brgetthepills7.com
- brgetthepills8.com
- brgetthepills9.com
- brudoctor.com
- budrugs.com
- bullmedic.com
- bumedlab.com
- butmomedic.com
- camermedic.com
- cammedic.info
- capomedic.com
- carrmedic.com
- carugmedic.com
- castrmedic.com
- catamedic.com
- celemedic.com
- cepdns.com
- cerumedic.com
- chdrugs.com
- chdrugstore.com
- cheephmedic.com
- chiecmedic.com
- chinemedic.com
- chmedic.info
- chmedicine.com
- cidrugs.com
- cinsaconstructora.com
- cldrugs.com
- clipmedic.com
- coatodns.com
- codoctor.net
- codrugpills.net
- codrugs.com
- cohemedic.com
- comfodoctor.com
- compodmedic.com
- cormedic.net
- crashimedic.com
- crazyfarhad.net
- crmedic.com
- culmedic.com
- cymedlab.com
- cyndfor.info
- dasgtahugajadfi.com
- dasharmedic.com
- deddrugsbargain.com
- deddrugsdiscount.com
- dedrugs.com
- dedrugstore.com
- delderimedic.com
- denimedic.com
- depokey.ru
- deyedoctor.com
- dicmedic.info
- didrugpills.net
- didrugs.com
- didrugstore.com
- digetthepills.com
- dimedic.info
- dimedic.net
- diplatimedic.com
- diplodoctor.com
- displimedic.com
- dissmedic.com
- dlekz.ru
- dns3shop.com
- dnsboxdone.com
- dnsonic.com
- dnsrboy.com
- dnstopbest.com
- dnstravelbest.com
- dnsupport4site.com
- doc2doctor.com
- docmedbill.com
- doctorabse.com
- doctorar.net
- doctoraued.com
- doctorbl.com
- doctordefu.com
- doctoren.net
- doctorerer.com
- doctoresia.com
- doctorgi.net
- doctoric.net
- doctorison.com
- doctoriver.com
- doctorlistic.com
- doctorlolier.com
- doctormedce1.com
- doctormedce10.com
- doctormedce11.com
- doctormedce12.com
- doctormedce13.com
- doctormedce14.com
- doctormedce15.com
- doctormedce16.com
- doctormedce17.com
- doctormedce18.com
- doctormedce19.com
- doctormedce2.com
- doctormedce20.com
- doctormedce21.com
- doctormedce22.com
- doctormedce23.com
- doctormedce24.com
- doctormedce25.com
- doctormedce26.com
- doctormedce27.com
- doctormedce28.com
- doctormedce29.com
- doctormedce3.com
- doctormedce30.com
- doctormedce4.com
- doctormedce5.com
- doctormedce6.com
- doctormedce7.com
- doctormedce8.com
- doctormedce9.com
- doctormininn.com
- doctornarr.com
- doctornavyky.com
- doctornb.com
- doctornter.com
- doctororne.com
- doctorosto.com
- doctorph.com
- doctorrnes.com
- doctorrteeny.com
- doctorsna.com
- doctorsng.com
- doctorsnt.com
- doctorspe.com
- doctorsrq.com
- doctorsterca.com
- doctorstri.com
- doctorsust.com
- doctortcon.com
- doctortelamy.com
- doctortent.com
- doctortfit.com
- doctoruder.com
- doctorusab.com
- doctorwnee.com
- dogedsmedic.com
- drmedicpills.com
- drugsba.com
- drugser.com
- drugses.com
- drugsis.com
- drugsnd.com
- drugsng.com
- drugsod.com
- drugsot.com
- drugspa.com
- drugspr.com
- drugsrc.com
- drugsrk.com
- drugsry.com
- drugssc.com
- drugsst.com
- drugsta.com
- drugsti.com
- drugstoreck.com
- drugstoreda.com
- drugstoreel.com
- drugstoreer.com
- drugstoreet.com
- drugstoreic1.com
- drugstoreic10.com
- drugstoreic11.com
- drugstoreic12.com
- drugstoreic13.com
- drugstoreic14.com
- drugstoreic15.com
- drugstoreic16.com
- drugstoreic17.com
- drugstoreic18.com
- drugstoreic19.com
- drugstoreic2.com
- drugstoreic20.com
- drugstoreic21.com
- drugstoreic22.com
- drugstoreic23.com
- drugstoreic24.com
- drugstoreic25.com
- drugstoreic26.com
- drugstoreic27.com
- drugstoreic28.com
- drugstoreic29.com
- drugstoreic3.com
- drugstoreic30.com
- drugstoreic4.com
- drugstoreic5.com
- drugstoreic6.com
- drugstoreic7.com
- drugstoreic8.com
- drugstoreic9.com
- drugstoreil.com
- drugstoreir.com
- drugstoreis.com
- drugstoreit.com
- drugstoreko.com
- drugstoreli.com
- drugstorelu.com
- drugstorene.com
- drugstorent.com
- drugstoreon.com
- drugstorepo.com
- drugstorere.com
- drugstoreri.com
- drugstorerk.com
- drugstorero.com
- drugstorert.com
- drugstorese.com
- drugstoress.com
- drugstoreth.com
- drugstorett.com
- drugstorety.com
- drugstoreuc.com
- drugsve.com
- drugswb.com
- dumedicpills.com
- durzmedic.com
- dvmedicpills.com
- dydrugstore.com
- dymedic.net
- eadrugpills.net
- eadrugstore.com
- ealmedic.com
- efmedicshop.com
- elitkids.com
- elmedicgrugs.com
- encyclopedic-intelligence.com
- engagdoctor.com
- epwmedic.com
- equdoctor.com
- equmedic.com
- esgetthepills.com
- estmedic.com
- etemedic.com
- eugetthepills.com
- eumedlab.com
- evdrugstore.com
- evemedic.net
- evnmedic.com
- exdrugstore.com
- exmedlab.com
- eyeshaddow.net
- eyomedic.com
- fadoctor.net
- familmedic.com
- farhadrad.net
- fedoctor.net
- fedrugstore.com
- feeds-online.net
- felliadoctor.com
- fildrugs.com
- filedns.com
- fivespeedmaster.com
- fldoctor.net
- flormedic.com
- flueliamedic.com
- fodoctor.net
- forbeak.info
- forceli.info
- forethu.info
- fowlemedic.com
- frdrugpills.net
- gagetthepills.com
- gardmedic.com
- garidoctor.com
- gegetthepills.com
- generic-pillsrx-online.com
- giddindoctor.com
- gladynmedic.com
- gn-asphalt.com
- goldsdoctor.com
- grdoctor.net
- grdrugpills.net
- guadoctor.com
- gumedlab.com
- hadoctor.net
- hadrugpills.net
- hadrugstore.com
- hamannmedic.com
- hapharmacy.com
- heamedic.com
- hecaptdoctor.com
- helmedic.com
- herysfor.info
- hodrugstore.com
- hogetthepills.com
- hostw0rk.com
- hostzlink.com
- hotboikmedic.com
- hudoctor.net
- hydrugpills.net
- hypondoctor.com
- idmedic.net
- im-host.net
- imdrugstore.com
- immydoctor.com
- inamedic.net
- infimedic.com
- infohost8.com
- ingetthepills.com
- intendmedic.com
- iptarydoctor.com
- jedrugstore.com
- jodrugs.com
- jodrugstore.com
- jollmedic.com
- jolynbmedic.com
- jomedic.info
- jwsc2007.com
- kadrugpills.net
- kaimedic.com
- kamaliya.ru
- kanapedoctor.com
- keystdoctor.com
- kidrugstore.com
- kipharmacy.com
- kndoctor.net
- knmedic.com
- kramedic.com
- kwdoctor.net
- kymedic.net
- latitud34.net
- legdrugs.com
- lesmedic.com
- letmedic.com
- levalmedic.com
- litdoctor.com
- lodoctor.com
- loismedic.com
- lomedic.info
- longedoctor.com
- lordoctor.com
- lowdoctor.com
- lutmedic.com
- mabeldoctor.com
- madoctor.net
- madrugstore.com
- magetthepills.com
- makdrugs.com
- mamedic.info
- mamedlab.com
- manamedic.com
- marshal-shina.com
- martydoctor.com
- matmedic.info
- matmedic.net
- maxifor.info
- meamedic.com
- medalaxop.com
- medecinesci.com
- medecinescl.com
- medecinesct.com
- medecinescu.com
- medecinesdo.com
- medecinesei.com
- medecinesel.com
- medecinesep.com
- medecinesfa.com
- medecinesho.com
- medecinesia.com
- medecinesie.com
- medecinesif.com
- medecinesin.com
- medecineske.com
- medecineskh.com
- medecinesli.com
- medecinesll.com
- medecineslo.com
- medecinesme.com
- medecinesmk.com
- medecinesne.com
- medecinesng.com
- medecinesnu.com
- medecinesoc.com
- medecinesom.com
- medecineson.com
- medecinesor.com
- medecinesos.com
- medecinesow.com
- medecinespl.com
- medecinesra.com
- medecinesri.com
- medecinesrm.com
- medecinesrn.com
- medecinessm.com
- medecinesst.com
- medecinesta.com
- medecinesti.com
- medecinestr.com
- mediamouse.ru
- medicba.com
- medicboll.com
- mediccide.com
- medicda.net
- medicdedn.com
- medicdesima.com
- medicdl.com
- medicds.com
- medicedso.com
- medicei.com
- medicellatu.com
- mediceman.com
- medicenfa.com
- medicerer.com
- medicetop.com
- medicewed.com
- medicey.com
- medicfeti.com
- medicfi.com
- medicicle.com
- medicif.com
- medicinels.com
- medicinemi.com
- medicinemp.com
- medicinena.com
- medicinend.com
- medicineni.com
- medicineoi.com
- medicineot.com
- medicineow.com
- medicinerd.com
- medicinesc.com
- medicinesi.com
- medicistr.com
- medickeride.com
- medickhat.com
- medickyatta.com
- medicldwa.com
- mediclg.com
- mediclity.com
- medicllow.com
- mediclnes.com
- mediclu.com
- medicmast.com
- medicmstr.com
- medicmyelon.com
- medicndeese.com
- medicnderer.com
- medicneryme.com
- medicnger.com
- medicni.com
- medicnsif.com
- medicntiant.com
- medicoe1.com
- medicoe10.com
- medicoe11.com
- medicoe12.com
- medicoe13.com
- medicoe14.com
- medicoe15.com
- medicoe16.com
- medicoe17.com
- medicoe18.com
- medicoe19.com
- medicoe2.com
- medicoe20.com
- medicoe21.com
- medicoe22.com
- medicoe23.com
- medicoe24.com
- medicoe25.com
- medicoe26.com
- medicoe27.com
- medicoe28.com
- medicoe29.com
- medicoe3.com
- medicoe30.com
- medicoe4.com
- medicoe5.com
- medicoe6.com
- medicoe7.com
- medicoe8.com
- medicoe9.com
- medicoi.com
- mediconlo.com
- medicpillsch1.com
- medicpillsch10.com
- medicpillsch11.com
- medicpillsch12.com
- medicpillsch13.com
- medicpillsch14.com
- medicpillsch15.com
- medicpillsch16.com
- medicpillsch17.com
- medicpillsch18.com
- medicpillsch19.com
- medicpillsch2.com
- medicpillsch20.com
- medicpillsch21.com
- medicpillsch24.com
- medicpillsch25.com
- medicpillsch26.com
- medicpillsch27.com
- medicpillsch28.com
- medicpillsch29.com
- medicpillsch3.com
- medicpillsch30.com
- medicpillsch31.com
- medicpillsch32.com
- medicpillsch4.com
- medicpillsch5.com
- medicpillsch6.com
- medicpillsch7.com
- medicpillsch8.com
- medicpillsch9.com
- medicps.com
- medicrach.com
- medicrb.com
- medicreop.com
- medicrgum.com
- medicrism.com
- medicritati.com
- medicrmin.com
- medicrnespe.com
- medicrobene.com
- medicrt.com
- medicshopan.net
- medicshopbe.net
- medicshopch.net
- medicshopct.net
- medicshopel.net
- medicshopge.net
- medicshopgi1.com
- medicshopgi10.com
- medicshopgi11.com
- medicshopgi12.com
- medicshopgi13.com
- medicshopgi14.com
- medicshopgi15.com
- medicshopgi16.com
- medicshopgi17.com
- medicshopgi18.com
- medicshopgi19.com
- medicshopgi2.com
- medicshopgi20.com
- medicshopgi21.com
- medicshopgi22.com
- medicshopgi23.com
- medicshopgi24.com
- medicshopgi25.com
- medicshopgi26.com
- medicshopgi27.com
- medicshopgi28.com
- medicshopgi29.com
- medicshopgi3.com
- medicshopgi30.com
- medicshopgi5.com
- medicshopgi7.com
- medicshopgi8.com
- medicshopgi9.com
- medicshopgu.net
- medicshopit1.com
- medicshopit10.com
- medicshopit11.com
- medicshopit12.com
- medicshopit13.com
- medicshopit14.com
- medicshopit15.com
- medicshopit16.com
- medicshopit17.com
- medicshopit18.com
- medicshopit19.com
- medicshopit2.com
- medicshopit20.com
- medicshopit21.com
- medicshopit22.com
- medicshopit23.com
- medicshopit24.com
- medicshopit25.com
- medicshopit26.com
- medicshopit27.com
- medicshopit28.com
- medicshopit29.com
- medicshopit3.com
- medicshopit30.com
- medicshopit4.com
- medicshopit5.com
- medicshopit6.com
- medicshopit7.com
- medicshopit8.com
- medicshopit9.com
- medicshopll1.com
- medicshopll10.com
- medicshopll11.com
- medicshopll12.com
- medicshopll13.com
- medicshopll14.com
- medicshopll15.com
- medicshopll16.com
- medicshopll17.com
- medicshopll18.com
- medicshopll19.com
- medicshopll2.com
- medicshopll20.com
- medicshopll21.com
- medicshopll22.com
- medicshopll23.com
- medicshopll24.com
- medicshopll25.com
- medicshopll26.com
- medicshopll27.com
- medicshopll28.com
- medicshopll29.com
- medicshopll3.com
- medicshopll30.com
- medicshopll4.com
- medicshopll5.com
- medicshopll6.com
- medicshopll7.com
- medicshopll8.com
- medicshopll9.com
- medicshotsi.com
- medicsmuded.com
- medicso.com
- medicstrysa.com
- medictand.com
- medicteac.com
- medicteor.com
- medicterymb.com
- medictins.com
- medictt.com
- medictz.com
- medicucid.com
- medicuctu.com
- medicutinda.com
- medicutoint.com
- medicux.com
- medicyang.com
- medicyi.com
- medicysical.com
- meditha.com
- medlabde.com
- medlaben.com
- medlabep.com
- medlabet.com
- medlabga.com
- medlabhe.com
- medlabho.com
- medlabie.com
- medlabin.com
- medlabli.com
- medlabns.com
- meduled.com
- memedlab.com
- mendykara.ru
- menthmedic.com
- mentimedic.com
- michelin-shina.com
- middayramblers.com
- midsudoctor.com
- mikescott.net
- mimedlab.com
- miramedic.com
- mishdoctor.com
- momedic.net
- musicrecord.ru
- myhitekz.com
- namedlab.com
- natrajbuildwell.com
- naturalmenopauseaid.net
- nemedic.com
- neurmedic.com
- newnshome.com
- nicepmedic.com
- nudrugstore.com
- oardrugs.com
- oasisgroup.ru
- onlineshoppingal1.com
- onlineshoppingal10.com
- onlineshoppingal11.com
- onlineshoppingal12.com
- onlineshoppingal13.com
- onlineshoppingal14.com
- onlineshoppingal15.com
- onlineshoppingal16.com
- onlineshoppingal17.com
- onlineshoppingal18.com
- onlineshoppingal19.com
- onlineshoppingal2.com
- onlineshoppingal20.com
- onlineshoppingal21.com
- onlineshoppingal22.com
- onlineshoppingal23.com
- onlineshoppingal24.com
- onlineshoppingal25.com
- onlineshoppingal26.com
- onlineshoppingal27.com
- onlineshoppingal28.com
- onlineshoppingal29.com
- onlineshoppingal3.com
- onlineshoppingal30.com
- onlineshoppingal4.com
- onlineshoppingal5.com
- onlineshoppingal6.com
- onlineshoppingal7.com
- onlineshoppingal8.com
- onlineshoppingal9.com
- onlinestoremopg-1.com
- onlinestoremopg-10.com
- onlinestoremopg-11.com
- onlinestoremopg-12.com
- onlinestoremopg-13.com
- onlinestoremopg-14.com
- onlinestoremopg-15.com
- onlinestoremopg-16.com
- onlinestoremopg-17.com
- onlinestoremopg-18.com
- onlinestoremopg-19.com
- onlinestoremopg-2.com
- onlinestoremopg-20.com
- onlinestoremopg-21.com
- onlinestoremopg-22.com
- onlinestoremopg-23.com
- onlinestoremopg-24.com
- onlinestoremopg-25.com
- onlinestoremopg-26.com
- onlinestoremopg-27.com
- onlinestoremopg-28.com
- onlinestoremopg-29.com
- onlinestoremopg-3.com
- onlinestoremopg-30.com
- onlinestoremopg-4.com
- onlinestoremopg-5.com
- onlinestoremopg-6.com
- onlinestoremopg-7.com
- onlinestoremopg-8.com
- onlinestoremopg-9.com
- orebaremedic.com
- ourapmedic.com
- oxmedlab.com
- pamedic.com
- pamedicshop.net
- parccentralpark.net
- pasdrugs.com
- pasmedic.com
- peamedic.com
- pedoctor.net
- pemedicshop.net
- perifor.info
- persefor.info
- pharcat.com
- pharmacych.com
- pharmacyeo.com
- pharmacyfo.com
- pharmacyfy.com
- pharmacyho.com
- pharmacyht.com
- pharmacykb.com
- pharmacyle.com
- pharmacylf.com
- pharmacyli.com
- pharmacylv.com
- pharmacyly.com
- pharmacymu.com
- pharmacynd.com
- pharmacyoc.com
- pharmacyog.com
- pharmacyom.com
- pharmacype.com
- pharmacypo.com
- pharmacyro.com
- pharmacysh.com
- pharmacyve.com
- pharmacyvi.com
- pharmacyzo.com
- phdrugpills.net
- picmedic.info
- pikmedic.com
- pimedicshop.net
- pindrugs.com
- playdmedic.com
- pledmedic.com
- plgetthepills.com
- plmedic.com
- podoctor.net
- podrugpills.net
- pokerplaybiz.com
- pomedic.info
- pomedic.net
- posdrugs.com
- prmedic.net
- progmedic.com
- protimedic.com
- prudycmedic.com
- puddoctor.com
- pudrugstore.com
- pugetthepills.com
- puldrugs.com
- pumedlab.com
- purmedic.com
- pyrimedic.com
- qumedic.com
- r-assoc.com
- recdoctor.com
- redoctor.net
- reinsomedic.com
- remedicshop.net
- remedlab.com
- retermedic.com
- robimedic.com
- rodoctor.com
- rodrugstore.com
- romedicshop.net
- ronevmedic.com
- roomedic.net
- rotmedic.com
- rozentmedic.com
- rugdrugs.com
- rx-pillss.com
- rxgenerics-supplier.com
- rxpill-cheap.com
- sadrugpills.net
- saimedic.com
- santhmedic.com
- sardemedic.com
- sardrugs.com
- sarmedic.net
- scadrugs.com
- schmmedic.com
- secredoctor.com
- sedoctor.com
- sedoctor.net
- septmedic.com
- shacmedic.com
- shdrugstore.com
- shimedic.net
- shmedic.net
- shoponlinehb1.com
- shoponlinehb10.com
- shoponlinehb11.com
- shoponlinehb12.com
- shoponlinehb13.com
- shoponlinehb14.com
- shoponlinehb15.com
- shoponlinehb16.com
- shoponlinehb17.com
- shoponlinehb18.com
- shoponlinehb19.com
- shoponlinehb2.com
- shoponlinehb21.com
- shoponlinehb22.com
- shoponlinehb23.com
- shoponlinehb24.com
- shoponlinehb25.com
- shoponlinehb26.com
- shoponlinehb27.com
- shoponlinehb28.com
- shoponlinehb29.com
- shoponlinehb3.com
- shoponlinehb30.com
- shoponlinehb4.com
- shoponlinehb5.com
- shoponlinehb6.com
- shoponlinehb7.com
- shoponlinehb8.com
- shoponlinehb9.com
- shoponlineis1.com
- shoponlineis10.com
- shoponlineis11.com
- shoponlineis12.com
- shoponlineis13.com
- shoponlineis14.com
- shoponlineis15.com
- shoponlineis16.com
- shoponlineis17.com
- shoponlineis18.com
- shoponlineis19.com
- shoponlineis2.com
- shoponlineis20.com
- shoponlineis21.com
- shoponlineis22.com
- shoponlineis23.com
- shoponlineis24.com
- shoponlineis25.com
- shoponlineis26.com
- shoponlineis27.com
- shoponlineis28.com
- shoponlineis29.com
- shoponlineis3.com
- shoponlineis30.com
- shoponlineis4.com
- shoponlineis5.com
- shoponlineis6.com
- shoponlineis7.com
- shoponlineis8.com
- shoponlineis9.com
- sigdoctor.com
- silvershaddow.net
- simimedic.com
- sinumedic.com
- skmedicshop.net
- sludedbmedic.com
- socmdoctor.com
- soomedic.com
- spearemedic.com
- spikimedic.com
- spliff-music.com
- spramedic.com
- stdrugpills.net
- stdrugstore.com
- stipmedic.com
- sudrugstore.com
- sumedic.net
- sumedicshop.net
- supemedic.com
- swdrugstore.com
- tabdoctor.com
- tadrugstore.com
- tapharmacy.com
- tectomedic.com
- teidrugs.com
- tennitmedic.com
- theeds.net
- tildoctor.com
- tinemedic.com
- tionymamedic.com
- tolmedic.com
- tomedic.com
- tomedlab.com
- tophostss.com
- totemedic.com
- training-video-production.com
- travemedic.com
- tripmedic.com
- tumedic.net
- unmedic.net
- unpapmedic.com
- unpharmacy.com
- up31.com
- up57.com
- up73.com
- up84.com
- up96.com
- vefmedic.com
- vemedic.com
- vomedlab.com
- vsymphony.com
- vvymedic.com
- wamedlab.com
- whgaofa.com
- whohadme.net
- woomedic.com
- wrmedic.net
- yemedicshop.net
- youngirshad.net
- zanyinmedic.com
The Storm domain names I have that are still active or more accurately maintain a domain status of “ok”:
nationwide2u.cn
worldpostcardart.com
superlettercard.com
yourlettercard.com
freepostcardonline.com
digitalaudiopostcard.com
lettercardadvertising.com
bestlettercard.com
audiopostcardmail.com
supergreetingcard.com
oldpostcardshop.com
None of these domains are resolving right now since their name servers are not answering A record requests at this time. The name servers I could identify are:
ns.brprbgok6.com 62.33.224.26
ns2.brprbgok6.com 124.121.82.50
ns3.brprbgok6.com 201.212.95.89
ns4.brprbgok6.com 89.109.28.87
ns5.brprbgok6.com 193.238.128.177
ns6.brprbgok6.com 74.129.81.83
Interesting enough the brprbgok6.com domain is in a “clienthold” status, so action has been taken against this domain, but that wouldn’t stop the above name servers from answering requests. Another interesting finding is that these name servers have a ttl of 172800, so they are not following the normal double fast flux structure in which the storm worm is famous for. This is not abnormal for the Storm Worm either though as this type of behavior seems to occur at the end of each campaign and can be thought of as a final stage in the limitless transformations of themes that occur. Once the name servers stop participating in the fast flux design you can almost bet on seeing a new theme within a few days. These new themes also seem to start either on Monday or Tuesday mornings, so we will just have to wait and see if this holds true one more time.
I also found that all of the domains listed at the top of this posting except for the older “nationwide2u.cn” were all registered on the same day using the same registrar and registrant information. Here is a copy of the whois record for one of the domains:
Registrar: RegTime.net Limited
Creation date: 2008-08-03
Expiration date: 2009-08-02
Registrant:
Alexey Vasiliev
Email: alexvasiliev1987@gmail.com
Organization: Alexey Vasiliev
Address: Ol. Duducha 21/2 58
City: Novosibirsk
State: NSK
ZIP: 630000
Country: RU
Phone: +7.3834427722
Fax: +7.3834427722
Administrative Contact:
Alexey Vasiliev
Email: alexvasiliev1987@gmail.com
Organization: Alexey Vasiliev
Address: Ol. Duducha 21/2 58
City: Novosibirsk
State: NSK
ZIP: 630000
Country: RU
Phone: +7.3834427722
Fax: +7.3834427722
Technical Contact:
Alexey Vasiliev
Email: alexvasiliev1987@gmail.com
Organization: Alexey Vasiliev
Address: Ol. Duducha 21/2 58
City: Novosibirsk
State: NSK
ZIP: 630000
Country: RU
Phone: +7.3834427722
Fax: +7.3834427722
Billing Contact:
Alexey Vasiliev
Email: alexvasiliev1987@gmail.com
Organization: Alexey Vasiliev
Address: Ol. Duducha 21/2 58
City: Novosibirsk
State: NSK
ZIP: 630000
Country: RU
Phone: +7.3834427722
Fax: +7.3834427722
The registrar is Regtime.net Limited a Russian ICANN accredited registrar that has been in business since 2001. This is also the first time I have seen the Storm authors use Regtime.net Limited for registering their domains. Hopefully Regtime.net will take action against these domain names soon as the “love/postcard” theme seems to be the fall back theme for Storm when new themes begin to lose effectiveness.
The Storm spam seems to be right inline with the norm with one small exception. This exception is a phishing email that is going out concerning money laundering. Here is a copy of the email message I captured:
Subject: JOB $1800/WEEK – CANADIANS WANTED!
Date: Fri, 15 Aug 2008 16:27:29 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”Windows-1252″;
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2499
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2499
We are looking for canadians who would like to work from home
in an administrative support function for businesses.
Many of our clients are small businesses and executives
who are busy and on the go.
Administrative Assistants can work full or part time.
PART TIME ASSISTANTS must work a minimum of 10 hours per week.
Salary varies between $5,000 to $10,000 per month!
If interested,
get back to me at
hxxp://www.vik-budget.com
thank you
.
QUIT
Following the link in the email message will bring you to a phpBB forum posting dated Thu Dec 02, 2004 8:30 pm with a subject line of “Getting Started!” by the moderator of the forum going by alias “Supplier” with a total of 34 posts on this message board. This all seemed really odd to me as I have suggested in the past that individuals were paying for spam, but why would someone pay for spam on such an old outdated posting? Interesting enough the vik-budget.com domain seems to be utilizing a fast flux design as well rotating out A records every 180 seconds serving up 17 individual IP addresses at a time. Here is a sample dig output just to clarify what I am trying to say:
;; QUESTION SECTION:
;vik-budget.com. IN A
;; ANSWER SECTION:
vik-budget.com. 180 IN A 86.104.87.45
vik-budget.com. 180 IN A 89.33.209.220
vik-budget.com. 180 IN A 93.81.55.7
vik-budget.com. 180 IN A 89.112.76.91
vik-budget.com. 180 IN A 89.47.118.38
vik-budget.com. 180 IN A 91.124.247.62
vik-budget.com. 180 IN A 93.80.234.159
vik-budget.com. 180 IN A 82.179.235.165
vik-budget.com. 180 IN A 79.112.24.125
vik-budget.com. 180 IN A 190.20.206.241
vik-budget.com. 180 IN A 92.100.98.229
vik-budget.com. 180 IN A 89.45.24.174
vik-budget.com. 180 IN A 92.100.21.65
vik-budget.com. 180 IN A 89.178.231.167
vik-budget.com. 180 IN A 81.181.112.38
vik-budget.com. 180 IN A 69.144.198.226
I went ahead and searched all of these IP addresses against ~180,000 archived IP addresses I have identified in the last six months that may have been associated with the Storm worm at some point in the past. The only one that returned a match against my database was “69.144.198.226″, so I don’t think this phishing phpBB site is operating on the Storm fast flux network, but I could be wrong. The name servers are also different for this phishing domain, so again I don’t think it is operating on the Storm fast flux network. Here is a list of the name servers for vik-budget.com:
NS1.VIPSAM.COM
NS2.VIPSAM.COM
NS3.VIPSAM.COM
NS4.VIPSAM.COM
One really cool discovery I had concerning these name servers is they seem to be riding a fast flux network using a ttl of 180 seconds at first, but when that initial ttl expires a new ttl of 172800 is seen and the A record changes to a new IP address. Very odd stuff here, so I dug into the VIPSAM.COM domain and found it no longer resolves, but was used back in July to point to another online pharmaceutical site titled: “Online Pharmacy”. This seems to be another very active and large pharmaceutical spam participant with 70 other domain names currently resolving to this host and at least 63 other hosts sharing it’s name servers. Here is a screen shot of this pharmaceutical company website to give you an idea of what it currently looks like: