Buying Prescription Drugs Online Scam Alert 1
May Be Dangerous
Says Drug Enforcement Administration

DEA Logo - Buying Proscription Drugs

Click Here
National Association of Boards of Pharmacy (NABP)


“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Behind The Online Pharmacy

Today a shadowy, transnational network of illicit drug manufacturers, traders, doctors, Web site operators, spammers and criminals makes up the online pharmacy world.

Buying Medicines Over the Internet

FDA – Consumer Safety Guide

Buying Medication Online Can Be Safe

There are many options out there when it comes to buying medication online. We have looked at websites after websites. Some sites feature offshore pharmacies that do not require a prior prescription. Others feature licensed pharmacies that do require a prescription from your doctor.
Before making a purchase that can effect your health, we strongly recommend that you consult your physician & DO NOT self-medicate. Ordering medication online can be a safe, money-saving experience. When done through licensed online pharmacies that require a prescription, you can be assured that the medication you get is exactly what you need to treat your ailments.

Department of Justice – Ryan Haight Act
Read More Health Canada

For a prescription to be valid under federal and state law, there must be a bona fide doctor patient relationship, which is defined by most state laws to require a physical examination. “Completing a questionnaire that is then reviewed by a doctor hired by the internet pharmacy could not be considered the basis for a doctor/patient relationship.” Vol. 66 Federal Register 82, PP 21181-21184 (April 27, 2001)

Moreover, if the prescription drug is a controlled substance and the drug is being imported into the U.S. from a foreign country and being shipped to anyone other than a DEA-registered importer, such transaction is a felony in violation of Sections 957 and 960 of Title 21, United States Code.

Oh do we have an update to the DNS servers, likely rehacked and using the ZeuS Botnet to switch the DNS servers to make it unaffliated to this listing, http://www.themedshop.com ,

DNS servers,

Answer records
http://www.themedshop.com A 3600s

Authority records
themedshop.com NS ns2.mojohost.com 3600s
themedshop.com NS ns1.mojohost.com 3600s

Additional records
ns1.mojohost.com A 300s
ns2.mojohost.com A 300s

Whois Server: whois.moniker.com
Referral URL: http://www.moniker.com
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 11-apr-2011
Creation Date: 25-nov-2002
Expiration Date: 25-nov-2011


Registrar: MONIKER

Registrant [3618881]:
Moniker Privacy Services THEMEDSHOP.COM@monikerprivacy.net
Moniker Privacy Services
20 SW 27th Ave.
Suite 201
Pompano Beach

Administrative Contact [3618881]:
Moniker Privacy Services THEMEDSHOP.COM@monikerprivacy.net
Moniker Privacy Services
20 SW 27th Ave.
Suite 201
Pompano Beach
Phone: +1.9549848445
Fax: +1.9549699155

Billing Contact [3618881]:
Moniker Privacy Services THEMEDSHOP.COM@monikerprivacy.net
Moniker Privacy Services
20 SW 27th Ave.
Suite 201
Pompano Beach
Phone: +1.9549848445
Fax: +1.9549699155

Technical Contact [3618881]:
Moniker Privacy Services THEMEDSHOP.COM@monikerprivacy.net
Moniker Privacy Services
20 SW 27th Ave.
Suite 201
Pompano Beach
Phone: +1.9549848445
Fax: +1.9549699155

Domain servers in listed order:


Record created on: 2002-11-25 20:16:26.0
Database last updated on: 2011-05-03 13:11:49.393
Domain Expires on: 2011-11-25 20:16:26.0

and last,
NetRange: –
OriginAS: AS27589
NetName: NET-99-192-170-96-28
NetHandle: NET-99-192-170-96-1
Parent: NET-99-192-128-0-1
NetType: Reassigned
RegDate: 2010-02-13
Updated: 2010-02-13
Ref: http://whois.arin.net/rest/net/NET-99-192-170-96-1

CustName: H2 Investments, LLC.
Address: 303 West Loop 281
Address: Suite 110 Number 173
City: Longview
StateProv: TX
PostalCode: 75605
Country: US
RegDate: 2010-02-13
Updated: 2011-03-19
Ref: http://whois.arin.net/rest/customer/C02423558

OrgNOCHandle: NOC11049-ARIN
OrgNOCPhone: +1-248-233-2045
OrgNOCEmail: NOC@mojohost.com
OrgNOCRef: http://whois.arin.net/rest/poc/NOC11049-ARIN

OrgTechHandle: IPADM481-ARIN
OrgTechPhone: +1-248-281-0323
OrgTechEmail: IPADMIN@mojohost.com
OrgTechRef: http://whois.arin.net/rest/poc/IPADM481-ARIN

OrgAbuseHandle: ABUSE2324-ARIN
OrgAbusePhone: +1-248-281-0323
OrgAbuseEmail: ABUSE@mojohost.com
OrgAbuseRef: http://whois.arin.net/rest/poc/ABUSE2324-ARIN

Domain server of this was baught among affliation and to loose track of this Russian Business Network host.

Sites on IP

Sites on IP

Displaying items 1 to 10, out of a total of 10

  1. http://adderallinformation.com/
  2. http://adderallonline.net/
  3. http://buyritalinonline.net/
  4. http://oxycontininformation.com/
  5. http://themedshop.com/
  6. http://www.adderallinformation.com/
  7. http://www.adderallonline.net/
  8. http://www.buyritalinonline.net/
  9. http://www.oxycontininformation.com/
  10. http://www.themedshop.com/

Anchor text pointing to this site:

buy adderall
buy hydrocodone online
click here to buy hydrocodone
click here to buy phentermine
click here to buy soma
click here to buy valium
click here to buy xanax
click the link below
pain management / no rx

Referers directly linking to pages on this site:

9 thoughts on “WhoIs TheMed Shop – THEMEDSHOP.COM

  1. themedshop.com says:

    they r a bunch of crooks, the way they r set up u automaticly get sign up and ripped of for $29.95, they never answer ur questions and ingore u i wish the FDA would file a nation law suit against them

    • cn says:

      EXACTLY!!! THEY do not sell you what they say – you think you are paying for a medicine but then you are only paying for a “membership”!! I have canceled – and they better not draft again!

      • ScrewedByTHEMEDSHOP says:

        I too was given a membership instead of the medication I was trying to buy. They not only refused to reverse the charge, they warned that if I contested the charge with my credit card company they would send it to collections! Anyone smart enough to be researching them before making the mistake of giving them your business, AVOID THEM LIKE THE PLAGUE.

        Note that the domain is registered to Kevin Hill in Longview Texas, not to some mysterious Russian etc. overseas, and it was certainly an American who made it clear on the phone that this was a scam site out to keep my money.

  2. Brian Stafford says:

    Thank God for the other people who took the time to post.
    I have had these people, (I now know they are themedshop) drawing money every month from my credit card. I did’nt even know who they were. The debits gave no clue as to their name or which country they were operating from.

    After months the Bank that issued the CC told me the money was being taken by ‘themedshop’. I hope I have now been able to put a stop to this for myself. How is this not a fraud that UA authorities have to examine?

  3. animejeffrey228 says:

    Well apparently lets say that countries like UA and RU that tend to host these pharma domains many things attached to it,

    One of them of course they frauds and Scams,

    #2 is that they host domains in these countries,

    United States,
    United Kingdom(GB),
    and sometimes China,
    and Luxembourg,

    #3, they try to make the pharma sites look like the real thing and nothing that seem like a scam, thus 10 times more difficult to blacklist because they can’t determined which seems like a scam, something the spammer scammers get away with

    #4, They use such crimeware programs like Xrumer and it’s related programs to spew this stuff on Forums and mostly target that, most admins on those forums don’t even report the IPs and Emails of this spam, something that needs to be done if these Xrumer bots keep going, and also they can use a Xrumer built-in system with also such malware rootkits as ZeuS and SpyEye to also infiltrate and hijack new hosts as well, and speaking on that,

    Scrub, looks like Russia has appointed another version of Xrumer based on a new site link called http://xrumerblasts.org , you might want to investigate this URL and likely report it since someone managed to break through another free version of SMF and a bot managed to post this on that forum with this new link, please take notes on this URL Scrub.

    and #5, the Ultimate of all spam problems based in the UA and RU regions, a Gang known to be the original Pharma Spam Scam groups named “Russian Business Network”(RBN for short), have had the HIGHEST impact in these forum spam posts and Malware driven gangs who want nothing more than to take most of our internet access away from most countries and only ment for Russia, as of the old days of the Soviet Union back in the 60s that started the Cold War, most of these gangs are probably involved with such activities today and still do their crime, and so far the governments of both the UA and RU have made little or no effort to stop this because it is supposedly under the excuse of a “Partnerka” or is “Part of their Economy” is the excuse they see why they allow this spamming to happen,

    wendy carso themedshop, and Brian Stafford, I hope you 3 that are reading this will get the idea and research I have been reading up about why this problem is even WORSE than even Email recently, basically use Xrumer as an add-on to both the ZeuS and SpyEye Rootkits can use to accelerate their spam operations.

    Thank you.

  4. Sean says:

    To cancel this scam subscription:

    Call 661-705-8487 (which is the number which appears on your credit card bill, referencing a company called H2 Investments). It’s a United States number (despite it saying St Kitts & Nevis on my card statement) so add the international dialing code for US if calling from a different country. Say you want to cancel the payment and you’ll be asked for the last 6 digits of your credit card and then payment will be cancelled immediately. Make sure you ask for email confirmation on the cancellation.


    Address lookup
    canonical name secure.netbilling.com

    Domain Whois record

    Queried whois.internic.net with “dom netbilling.com”…

    Domain Name: NETBILLING.COM
    Whois Server: whois.networksolutions.com
    Referral URL: http://www.networksolutions.com
    Name Server: NS10.DNSMADEEASY.COM
    Name Server: NS11.DNSMADEEASY.COM
    Name Server: NS12.DNSMADEEASY.COM
    Name Server: NS13.DNSMADEEASY.COM
    Name Server: NS14.DNSMADEEASY.COM
    Name Server: NS15.DNSMADEEASY.COM
    Status: clientTransferProhibited
    Updated Date: 12-jul-2011
    Creation Date: 07-jul-1998
    Expiration Date: 06-jul-2020

    Last update of whois database: Sat, 20 Aug 2011 02:23:29 UTC
    Queried whois.networksolutions.com with “netbilling.com”…

    Netbilling, Inc.
    care of Network Solutions
    PO Box 459
    Drums, PA. US 18222

    Domain Name: NETBILLING.COM

    Promote your business to millions of viewers for only $1 a month
    Learn how you can get an Enhanced Business Listing here for your domain name.
    Learn more at http://www.NetworkSolutions.com/

    Administrative Contact, Technical Contact:
    Farber, Mitch tn5ge2af79y@networksolutionsprivateregistration.com
    NETbilling, Inc.
    care of Network Solutions
    PO Box 459
    Drums, PA 18222

    Record expires on 06-Jul-2020.
    Record created on 07-Jul-1998.
    Database last updated on 19-Aug-2011 22:14:32 EDT.

    Domain servers in listed order:


    Queried whois.arin.net with “n ! NET-216-33-71-64-1″…

    NetRange: –
    NetName: SAVV-S231708-2
    NetHandle: NET-216-33-71-64-1
    Parent: NET-216-32-0-0-1
    NetType: Reallocated
    RegDate: 2006-11-02
    Updated: 2006-11-02
    Ref: http://whois.arin.net/rest/net/NET-216-33-71-64-1

    OrgName: Ezic, Inc.
    OrgId: EZICI
    Address: 3 E Hawthorn Pkwy
    Address: STE 160,
    StateProv: IL
    PostalCode: 60061
    Country: US
    RegDate: 2006-11-02
    Updated: 2006-11-02
    Ref: http://whois.arin.net/rest/org/EZICI

    OrgTechHandle: RBU70-ARIN
    OrgTechName: Burdell, Robert
    OrgTechPhone: +1-847-327-9870
    OrgTechEmail: robert.burdell@ezic.com
    OrgTechRef: http://whois.arin.net/rest/poc/RBU70-ARIN

    RTechHandle: RBU70-ARIN
    RTechName: Burdell, Robert
    RTechPhone: +1-847-327-9870
    RTechEmail: robert.burdell@ezic.com
    RTechRef: http://whois.arin.net/rest/poc/RBU70-ARIN
    DNS records

    name class type data time to live
    secure.netbilling.com IN A 86400s (1.00:00:00)
    netbilling.com IN SOA
    server: ns10.dnsmadeeasy.com
    email: dns.dnsmadeeasy.com
    serial: 2009010117
    refresh: 43200
    retry: 3600
    expire: 1209600
    minimum ttl: 180
    86400s (1.00:00:00)
    netbilling.com IN NS ns12.dnsmadeeasy.com 86400s (1.00:00:00)
    netbilling.com IN NS ns10.dnsmadeeasy.com 86400s (1.00:00:00)
    netbilling.com IN NS ns13.dnsmadeeasy.com 86400s (1.00:00:00)
    netbilling.com IN NS ns14.dnsmadeeasy.com 86400s (1.00:00:00)
    netbilling.com IN NS ns11.dnsmadeeasy.com 86400s (1.00:00:00)
    netbilling.com IN NS ns15.dnsmadeeasy.com 86400s (1.00:00:00)
    netbilling.com IN A 86400s (1.00:00:00)
    netbilling.com IN TXT v=spf1 a mx a:secure.netbilling.com ~all 86400s (1.00:00:00)
    netbilling.com IN MX
    preference: 10
    exchange: mail.netbilling.com
    86400s (1.00:00:00) IN CNAME 81.64/ 3600s (01:00:00)
    81.64/ IN PTR secure.netbilling.com 86400s (1.00:00:00)
    — end —

Leave a Comment

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.