United States of America

---

The Ryan Haight Act Known as
Online Pharmacy Consumer Protection Act of 2008
Sec. 2. Requirement of a valid prescription for
controlled substances dispensed by means of the Internet.

SUMMARY: The Ryan Haight Online Pharmacy Consumer Protection Act,
which was enacted on October 15, 2008,amended the Controlled Substances Act and Controlled Substances Import and Export Act by adding several new provisions to prevent the illegal distribution and dispensing of controlled substances by means of the Internet.

---

DEA Warning–Buying drugs online may be illegal and dangerous!

Federal law prohibits buying controlled substances such as narcotic pain relievers (e.g., OxyContin®, Vicodin®), sedatives (e.g., Valium®, Xanax®, Ambien®), stimulants (e.g., phentermine, phendimetrazine, Adderall®, Ritalin®) and anabolic steroids (e.g., Winstrol®, Equipoise®) without a valid prescription from your doctor.

This means there must be a real doctor-patient relationship, which by most state laws requires a physical examination. Prescriptions written by “cyber doctors” relying on online questionnaires are not legitimate under the law.

---

EVA Pharmacy & FIDELITY-NET.COM / Tripac International Ltd.

---

Spam for:
http://gacdehmfl.yourpils24.info/?bijkflxwwvygzctacdehm

Yet another EVA Pharmacy spam. The image at the bottom of the page say:
“Copyright EVA Pharmacy, 2000 – 2004, all rights reserved.”

Searching for unique text strings within the page yields the following:

==========

“I am truly enjoying my sexual rebirth. No more excuses, no more
frustration”

viagrastories.com/personal.shtml
setco.com/Viagra-for-low-sex-life.htm
fljkabh.pilsforhealth.info/ct/ index.php?page=testimonials&pid=_668
viagra-cialis-online.co.uk/ivf_viagra.html
orderviagra.biz/viagra/ english/wielangehltviagra.html
ineedpills.com/viagra-stories.htm

—–

“Cialis Soft Tabs enables you to respond spontaneously due to its longer
lasting effect up to 36 hours”

m-pharmacy.net/cialis-soft-tabs.htm
fljkabh.pilsforhealth.info/ ct/index.php?page=questions&pid=_668

—–

“Any our affiliate who SPAMS will have their account immediately
terminated and all monies earned will be suspended.”

efgmjacdhk.greatsekshealth.info/ hg/index.php?page=antispam&pid=_345
bfgikdhlm.pils4everyday.info/ vp/index.php?page=antispan&pid=_386
sexforlust.com/?page=antispam&pid=eph7382
fidelity-net.com/spam.htm
evameds.com/sm/index.php?page=antispan&pid=eph8620
masterjoy.biz/pp/index. php?page=antispam&pid=eph5653
evameds.biz/supergv/index. php?page=antispam&pid=eph3890
shop.evapharmacy.com/sm/?page=antispan&pid=
drbest.info/ct/index.php?page=antispan&pid=eph5616
dr-info.info/mm/index.php?page=antispan&pid=eph5653
powergra.com/antispampolicy.html

Note the weird phrasing “Any our affiliate who”… it comes up again later
in this post.

==========

dns yourpils24.info
Canonical name: yourpils24.info
Addresses:
222.47.183.120

==========

whois -h whois.completewhois.com yourpils24.info …
[DOMAIN whois information for YOURPILS24.INFO ]

Domain Name: YOURPILS24.INFO
Namespace: ICANN Unsponsored Generic TLD – http://www.icann.org
TLD Info: See IANA Whois – http://www.iana.org/root-whois/info.htm
Registry: Afilias LLC – http://www.afilias.info
Registrar: Tucows Inc. – http://domainhelp.tucows.com
Whois Server: whois.afilias.info
Name Server[from whois+dns, whois ip]: NS1.YOURPILS24.INFO
69.228.160.52
Name Server[from whois+dns, dns ip]: NS1.YOURPILS24.INFO 222.47.183.120
Name Server[whois+dns with ip] NS2.YOURPILS24.INFO 222.47.183.120
Status: ACTIVE
Status: OK
Creation Date: 28-Apr-2005 16:35:51 UTC
Updated Date: 18-May-2005 14:38:24 UTC
Expiration Date: 28-Apr-2006 16:35:51 UTC

[whois.afilias.info]
Domain ID: D10119209-LRMS
Domain Name: YOURPILS24.INFO
Created On: 28-Apr-2005 16:35:51 UTC
Last Updated On: 18-May-2005 14:38:24 UTC
Expiration Date: 28-Apr-2006 16:35:51 UTC
Sponsoring Registrar: R139-LRMS
Status: ACTIVE
Status: OK

Registrant ID: C9773590-LRMS
Registrant Name: Anna Nowicka
Registrant Organization: private
Registrant Street1: ul.Warszawska 2
Registrant City: Stare Babice
Registrant State/Province: na
Registrant Postal Code: 05082
Registrant Country: PL
Registrant Phone: +4.8227220622
Registrant Email: donstern47@yahoo.com

==========

IP Addresses:

222.47.183.120 (YOURPILS24.INFO, NS1.YOURPILS24.INFO)
http://www.spews.org/ask.cgi?x=222.47.183.120
http://www.spews.org/html/S1422.html

http://www.spamhaus.org/query/bl?ip=222.47.183.120
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL21980
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL24912
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL25609

—–

69.228.160.52 (NS1.YOURPILS24.INFO)
Not listed in SPEWS.

http://www.spamhaus.org/query/bl?ip=69.228.160.52
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL24129
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL25911

SBL24129:
“69.228.160.0/20 is listed on the Register Of Known Spam Operations
(ROKSO) database as being assigned to, under the control of, or providing
service to a known professional spam operation run by Michael Lindsay /
iMedia Networks.”

SBL25911:
“69.228.160.52/32 is listed on the Register Of Known Spam Operations
(ROKSO) database as being assigned to, under the control of, or providing
service to a known professional spam operation run by Michael Lindsay /
iMedia Networks.”

==========

QUESTIONS:
1) Who is FIDELITY-NET.COM?

From their website (http://www.fidelity-net.com/):
“Fidelity is an Internet Retailer for tangible and digital products and
services. Web businesses (suppliers/vendors) agree to sell their goods and
services to Fidelity for immediate resale to online customers. Fidelity
collects the proceeds from the sale, delivers the product and provides
online support to the customer.”

Also, from their website (http://www.fidelity-net.com/aboutus.htm):
“Suppliers continue to market and supply their products and content as
before. Fidelity uses its relationships with a number of financial
Institutions to provide a long term solution for suppliers who provide
adult entertainment, and distribute software, and other products through
the Internet.”

2) Why does FIDELITY-NET.COM have the exact same wording on their
anti-spam page as the Cialis spammer?

From http://www.fidelity-net.com/spam.htm:

==========

Got SPAM?
Report here

What is SPAM?
Any form of unsolicited advertising through email, newsgroups, IRC posts,
and/or instant messaging clients. Any SPAM complaint regarding a our
Affiliate is cause for immediate termination. This is a very serious
matter. DO NOT send email to anyone who has not made a specific request
for information.

What types of advertising are considered SPAM?
Bulk emailing (sending an email advertisement to persons listed on an
email address lead list). Advertising with bulk email services (companies
who will send an email advertisement to persons listed on an email address
lead list for you) will be grounds for immediate account termination.

Newsgroup Posting. Posting commercial messages is spam and any complaints
from newsgroup moderators about an affiliate will be grounds for immediate
account termination.

IRC/IM Clients Unsolicited messages through any media, including chat
rooms and instant messages is considered SPAM and will be grounds for
immediate account termination.

FAQ
Can I use a bulk email list from a company that sells the email addresses
of people who have previously agreed to join a mailing list?

No. The people on these lists may have forgotten that they joined, or
didn’t know what type of content that they were requesting when they
submitted their email address.

Can I avoid bulk emailing by sending my advertisements one at a time?

No, it’s not “bulk emailing,” but it will be received by people who have
not asked you for it, and that is considered SPAM.

What forms of advertising can your webmasters use?

Any form of advertising which targets legal sources of traffic are more
than welcome so long as they are not done via unsolicited means.

Are sales from Opt-in and/or Double Opt-in mailing lists acceptable?

Sales generated through the traffic sent from both single and double
opt-in mailing lists are UNacceptable.

Single Opt-in – With a single opt-in mailing list, an address is
automatically added to an email distribution list as soon as it’s
submitted.

Double Opt-in – With double opt-in, the submitted address is not
immediately added to this list. Instead, an email is first sent to the
address, requesting confirmation that this address should indeed be added
to the list.

What happens to your affiliates who choose to SPAM?
Any our affiliate who SPAMS will have their account immediately terminated
and all monies earned will be suspended.

==========

From http://gacdehmfl.yourpils24.info/ct/index.php?page=antispan&pid=:

==========

Got SPAM?
Report here

What is SPAM?
Any form of unsolicited advertising through email, newsgroups, IRC posts,
and/or instant messaging clients. Any SPAM complaint regarding a our
Affiliate is cause for immediate termination. This is a very serious
matter. DO NOT send email to anyone who has not made a specific request
for information.

What types of advertising are considered SPAM?

* Bulk emailing (sending an email advertisement to persons listed on
an email address lead list). Advertising with bulk email services
(companies who will send an email advertisement to persons listed on an
email address lead list for you) will be grounds for immediate account
termination.

* Newsgroup Posting. Posting commercial messages is spam and any
complaints from newsgroup moderators about an affiliate will be grounds
for immediate account termination.

* IRC/IM Clients Unsolicited messages through any media, including
chat rooms and instant messages is considered SPAM and will be grounds for
immediate account termination.

FAQ
Can I use a bulk email list from a company that sells the email addresses
of people who have previously agreed to join a mailing list?
No. The people on these lists may have forgotten that they joined, or
didn’t know what type of content that they were requesting when they
submitted their email address.

Can I avoid bulk emailing by sending my advertisements one at a time?
No, it’s not “bulk emailing,” but it will be received by people who have
not asked you for it, and that is considered SPAM.

What forms of advertising can your webmasters use?
Any form of advertising which targets legal sources of traffic are more
than welcome so long as they are not done via unsolicited means.

Are sales from Opt-in and/or Double Opt-in mailing lists acceptable?
Sales generated through the traffic sent from both single and double
opt-in mailing lists are UNacceptable.

Single Opt-in – With a single opt-in mailing list, an address is
automatically added to an email distribution list as soon as it’s
submitted.

Double Opt-in – With double opt-in, the submitted address is not
immediately added to this list. Instead, an email is first sent to the
address, requesting confirmation that this address should indeed be added
to the list.

What happens to your affiliates who choose to SPAM?
Any our affiliate who SPAMS will have their account immediately terminated
and all monies earned will be suspended.

==========

dns FIDELITY-NET.COM
Mail for FIDELITY-NET.COM is handled by mx.fidelity-net.com
Canonical name: fidelity-net.com
Addresses:
205.214.216.110

whois -h whois.completewhois.com fidelity-net.com …
[DOMAIN whois information for FIDELITY-NET.COM ]

Domain Name: FIDELITY-NET.COM
Namespace: ICANN Unsponsored Generic TLD – http://www.icann.org
TLD Info: See IANA Whois – http://www.iana.org/root-whois/com.htm
Registry: VeriSign, Inc. – http://www.verisign-grs.com
Registrar: TUCOWS INC. – http://domainhelp.tucows.com
Whois Server: whois.opensrs.net
Name Server[whois+dns with ip] NS1.FIDELITY-NET.COM 205.214.216.110
Name Server[whois+dns with ip] NS2.FIDELITY-NET.COM 205.214.216.110
Status: ACTIVE
Updated Date: 30-jan-2005
Creation Date: 15-mar-2004
Expiration Date: 15-mar-2006

[whois.opensrs.net]
Registrant:
dns services
32 Altona Cr
Hornsby
Sydney, Nsw 2000
AU

Domain name: FIDELITY-NET.COM
Administrative Contact:
frankston, sam humpyhumpy@hotmail.com
32 Altona Cr
Hornsby
Sydney, Nsw 2000
AU
617363876389

==========

IP addresses:

205.214.216.110 (FIDELITY-NET.COM, NS1.FIDELITY-NET.COM,
NS2.FIDELITY-NET.COM)
Not listed in SPEWS.

http://www.spamhaus.org/query/bl?ip=205.214.216.110
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL19959

SBL19959:
“205.214.216.110/32 is listed on the Register Of Known Spam Operations
(ROKSO) database as being assigned to, under the control of, or providing
service to a known professional spam operation run by Tripac International
Limited.”

http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Tripac%20International%20Limited
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3565
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3566
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3571
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3572
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3977
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4085
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4188
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4189
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4196

==========

—
When will the stalker kook SuN Tsu / BananaNanae / theBanana(tm) apologize
for his false accusations and spam-friendly behavior?
http://www.hillscapital.com/StalkerKookSuNTsu/
NANAE newbies: For your own protection you should kill-file Sun Tsu.

If you want to get the pages more quickly, you might guess that
the home base is at the IP address of the other nameserver. After
all of the spammer is using one nameserver as webhost, he may well
be doing the same for the other … so, let’s check.

Either add an entry to one’s hosts file forcing gacdehmfl.yourpils24.info
to resolve to IP address 69.228.160.52 or use a programme like curl
which permits one to specifiy the “Host:” header (hostname) and
go to a particular address or use telnet and do things manually or …
(e.g. curl -H “Host: gacdehmfl.yourpils24.info” “http://69.228.160.52/?bijkflxwwvygzctacdehm”)

* Connected to 69.228.160.52
Host: gacdehmfl.yourpils24.info

and one finds the site up there (it redirects to
“ct/index.php?pid=_110 so one can get to the
content page directly using
curl -H “Host: gacdehmfl.yourpils24.info” “http://69.228.160.52/ct/index.php?pid=_110”
for example)

OrgName: Pac Bell Internet Services
OrgID: PACB
CIDR: 69.224.0.0/12
CustName: Mini VOIP Systems
CIDR: 69.228.160.0/20
69.228.160.52 is found in sbl.spamhaus.org
Lists “known spammers, spam gangs or spam support services.”
Ref: SBL25911

69.228.160.52/32 is listed on the Register Of Known Spam Operations (ROKSO)
database as being assigned to, under the control of, or providing service to a
known professional spam operation run by Michael Lindsay / iMedia Networks.

It has been here for awhile (at one time, he lost his China hosted
web site and had the nameserver resolve his spamvertized sites
actually to IP address 69.228.160.52 if I recall correctly).
The Spamvertized URL has varied in location, different china sites,
e.g. 202.99.172.156, 210.51.2.148 and others, but the “home base” seems
“protected” on Pac Bell.