NameSilo

**NameSilo** is a registrar in Phoenix, Arizona.

# Description of the Registrar

**Founders**

Michael McCallister and Michael Goldfarb in 2009.

NameSilo.com launched in October 2010 in Phoenix with the goal of providing low-cost website purchases.

Goldfarb is a successful entrepreneur who in 2009 sold his web design firm, Contact Designs, to Chris McMurry. McMurry (http://mcmurrytmg.com), owns one of the largest content marketing firms in the United States.

*Contact Designs* co-owners Michael Goldfarb and Michael McCallister serve as senior vice presidents of online services, managing the interactive business unit. The CEO of Contact Designs is Chris McMurry.

**About Us**

We created NameSilo with the goal of offering a new type of registrar that appeals to people looking for a simpler, cheaper and better alternative to the companies already in the industry. As people with domain portfolios of our own, and having used many registrars ourselves, we believed that there was enough room for improvement to throw our hat into the ring.

**Our Approach**

Our fundamental approach is to offer domains and domain-related management for the cheapest prices possible, while not sacrificing quality, customer support or ease-of-use. We maintain an unwavering focus on domains and do not venture out into other verticals such as hosting, email support, web design, search engine marketing, or any other services that could impact our ability to offer the cheapest prices on the Internet.

**Company Officers**

Michael Goldfarb, Managing Member

Michael McCallister, Managing Member

Chris McMurry, Managing Member

# Official Position

From the Terms and Conditions, section 3. b. ii.

You represent and warrant that the statements in your application are true and that no Services are being procured for any unlawful purpose, including but not limited to the infringement of any intellectual property right, the unauthorized transfer to yourself or any other party of any domain name or Services, or the violation of any laws, rules, or regulations (the"Illegal Uses").

From section 4. c. vi.

We reserve the right in our sole judgment to suspend, terminate and/or disclose your personal information in the event that any of the following occur:

a. Any provision of this Agreement is breached

From An interview with Michael Goldfarb

*One of the other big ones is just the sheer volume of potential fraudulent – I shouldn’t say fraudulent, but misuse of domains. People trying to distribute malware. Using them for spam. I mean, so on and so forth. It’s a lot and that’s something we don’t actively monitor as registrations and transfer come in, but as a discount domain provider offering free WhoIS privacy, we’ve definitely been targeted by people using domains for nefarious purposes. So, creating system to keep that at bay. We’ve tried to take a pretty harsh stance that, if somebody has a number of trademark and copyright violations for obvious infringements, we make them leave. And this is one of the things, again, that I’d like to draw a distinction between ourselves and most other registrars is that we don’t welcome these people with open arms. Again, it’s a fine line because we won’t (sic) to advocate for our customers. We don’t want to be overly aggressive, and we’re not, but if there’s a repeated offense, I don’t care if this person spent registering a hundred domains a day to support their spam network. We will either shut the domains down, or, in most cases, we will tell them, ‘you have thirty days to move to a different registrar’*

From the Namesilo Abuse Reporting Procedures

*Finally, please note that if the domain registrant fails to get back to us regarding the alleged Terms violation notification, we take that very seriously. Our Terms specifically require the registrant to get back to us regarding these matters in a timely manner and failure to do so can result in domain suspension. We use all forms of available contact information to contact the registrant and their failure to respond typically results in either revealing the contact information they have provided or domain suspension.*

# Registrar responsiveness

Showing all registrars including R01.RU

Showing all registrars excluding R01.RU

Piechart showing the crime sponsoring contribution by each registrar.

The comparison between this registrar and others can be seen on the graphs.

It shows how many domains have *not* been suspended by various registrars over the past year.
The higher the column, the more domains are sponsored by the registrar.

Currently the most abused registrar is Russia's R01.ru.
This registrar sponsors the vast majority (often over 60%) of the fraud domains used within the Eva Pharmacy group.

The second most abused registrar is Russia's REG.RU REG.RU at over 25%

The next most abused registrar is GKG GKG at 4%.

The next most abused registrar is The Netherlands' Hosting Concepts aka OpenProvider at 3%.

These are followed by Russia's ARDIS, India's PublicDomainRegistry PDR, China's CNOBIN, Canada's Tucows, and Pakistan's PakNIC.

Outside of Russia, most registrars have been quick to terminate the service contracts with these cyber-criminals upon seeing the obvious evidence of fraud.

# Sample illegal domains

These domains listed below are all part of the pharmacy fraud network centered in Russia, known as EvaPharmacy. They were all live at
September 27, 2016. They were all suspended at September 29, 2016

See also NameSilo\_list

## Canadian Health&Care Mall

```
bestsmartreward.com (suspended)
fastcareoutlet.com (suspended)
opalmillisent.com (suspended)

```

## Canadian Neighbor Pharmacy

```
medicalbesttrade.com (suspended)

```

## CanadianPharmacy

```
dprltmhx.com (suspended)
secureremedialgroup.com (suspended)

```

## My Canadian Pharmacy

```
isabellamellisa.com (suspended)
marleahcaralie.com (suspended)

```

## RxExpressOnline

```
ionalanita.com (suspended)
loiseoneida.com (suspended)

```

# Suspended Domains

## Canadian Health&Care Mall

```
herbalfamilyservice.com (suspended)
rcjksdbz.com (suspended)
besthealingcompany.com (suspended)
genericpharmacymart.com (suspended)
jvqjeeqn.com (suspended)
nxmvrkcj.com (suspended)
ohunqyzk.com (suspended)
remedialbestelement.com (suspended)
reportbyglobalindustry.com (suspended)
thepharmacyquality.com (suspended)
viagracaregroup.com (suspended)
vqdcuxfl.com (suspended)
ftwwmkfg.com (suspended)
mymedicationdeal.com (suspended)
qzfiyicb.com (suspended)
safepillssupply.com (suspended)
securepillqualitygroup.com (suspended)

```

## Canadian Neighbor Pharmacy

```
securetabletelement.com (suspended)
theremedyquality.com (suspended)
yourtableteshop.com (suspended)

```

## My Canadian Pharmacy

```
healingdrugshop.comm (suspended)
luckymedicaltrade.comm (suspended)
mymedicativeassist.comm (suspended)
amityatlante.com (suspended)
familygenericsmall.com (suspended)
herbaldrugsmarketresearch.com (suspended)
joiceenrika.com (suspended)
magicmedicamentshop.com (suspended)

```

## RxExpressOnline

```
smartdrugdeal.com (suspended)
aliciaharriott.com (suspended)
alvinialorette.com (suspended)
calleycherise.com (suspended)
chrissyjuliet.com (suspended)
georgeemmaline.com (suspended)
honorialeonelle.com (suspended)
kylealexa.com (suspended)
larisadiannne.com (suspended)
lavenakristyn.com (suspended)
myhealingtrade.com (suspended)
naturalpharmshop.com (suspended)
pureherbalquality.com (suspended)
puretreatmentdeal.com (suspended)
remedialfirsttrade.com (suspended)
shariasheeree.com (suspended)
starlenejobye.com (suspended)

```

## RxMedications

```
dottishela.com (suspended)
excellentpharmvalue.com (suspended)
genericsmartassist.com (suspended)
joelajoyamie.com (suspended)
newbiologicalmarket.com (suspended)

```

# Common IP addresses

A quick way to verify these sites is to examine the hosting addresses. Note that \* items have been removed.
Many compromised hosts used for this operation during September 2020 - May 2021 were located at these IPs.

Where to contact the compromised hosting ISP:

```
Abuse contact for '5.2.88.0 - 5.2.89.255' is 'alvaro.montero@ipcore.com'
Abuse contact for '5.45.80.0 - 5.45.83.255' is 'abuse@ispiria.net'
Abuse contact for '5.101.140.64 - 5.101.140.95' is 'abuse@ukservers.com'
Abuse contact for '5.181.158.0 - 5.181.158.255' is 'abuse@mivocloud.com'
Abuse contact for '5.133.8.0 - 5.133.15.255' is 'abuse@artnet.pl'
Abuse contact for '5.187.48.0 - 5.187.55.255' is 'abuse@artnet.pl'
Abuse contact for '5.188.211.0 - 5.188.211.255' is 'abuse@pindc.ru'
Abuse contact for '5.253.60.0 - 5.253.63.255' is 'abuseto@adminvps.ru' (Removed)
Abuse contact for '27.124.80.0 - 27.124.95.255' is 'abuse@medialink.net.id'
Abuse contact for '31.200.247.0 - 31.200.247.255' is 'ripe@unelink.com'
Abuse contact for '37.46.132.0 - 37.46.135.255' is 'abuse@abusehost.ru'
Abuse contact for '45.67.116.0 - 45.67.116.255' is 'abuse@itns.md'
Abuse contact for '45.86.163.0 - 45.86.163.255' is 'support@crowncloud.net'
Abuse contact for '45.125.65.0 - 45.125.65.255' is 'abuse@tele-asia.net'
Abuse contact for '45.131.83.0 - 45.131.83.255' is 'abuse@sered.net'
Abuse contact for '51.89.148.0 - 51.89.151.255' is 'abuse@ovh.net'
Abuse contact for '79.172.193.0 - 79.172.193.255' is 'abuse@deninet.hu' (Removed)
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '82.199.104.0 - 82.199.107.254' is 'abuse@seven-sky.net'
Abuse contact for '84.15.136.0 - 84.15.143.255' is 'abuse@bi.lt'
Abuse contact for '84.200.77.0 - 84.200.77.255' is 'abuse@accelerated.de' (Removed)
Abuse contact for '85.254.72.0 - 85.254.72.255' is 'support@serveria.com'
Abuse contact for '87.120.253.0 - 87.120.253.255' is 'abuse@neterra.net'
Abuse contact for '89.105.192.0 - 89.105.223.255' is 'abusedesk@novoserve.com'
Abuse contact for '89.222.128.0 - 89.222.131.255' is 'abuse@netorn.net' 'abuse@netorn.ru'
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '93.119.104.0 - 93.119.105.255' is 'abuse@virtono.com'
Abuse contact for '94.152.0.0 - 94.152.255.255' is 'abuse@kei.pl'
Abuse contact for '94.156.175.0 - 94.156.175.255' is 'abuse@iws.co'
Abuse contact for '95.24.0.0 - 95.31.255.255' is 'abuse-b2b@beeline.ru'
Abuse contact for '95.84.128.0 - 95.84.159.255' is 'abuse@rt.ru'
Abuse contact for '95.165.128.0 - 95.165.255.255' is 'abuse@spd-mgts.ru'
Abuse contact for '103.6.204.0 - 103.6.207.255' is 'yogie@redwhite.co.id'
Abuse contact for '103.9.156.0 - 103.9.159.255' is 'cuong.trinh@vnso.vn'
Abuse contact for '103.28.148.0 - 103.28.149.255' is 'support@easyway.co.id'
Abuse contact for '103.56.148.0 - 103.56.149.255' is 'abuse@jagoanhosting.com'
Abuse contact for '103.86.48.0 - 103.86.48.255' is 'abuse@bangmodhosting.com'
Abuse contact for '103.92.24.0 - 103.92.27.255' is 'hm-changed@vnnic.vn' 'system@tlsoft.vn'
Abuse contact for '103.117.141.0 - 103.117.141.255' is 'abuse@casbay.com'
Abuse contact for '103.121.88.0 - 103.121.91.255' is 'tampd@bkns.vn'
Abuse contact for '103.126.6.0 - 103.126.7.255' is 'shazim@serverstack.in'
Abuse contact for '103.138.96.0 - 103.138.96.255' is 'hello@hostitsmart.in'
Abuse contact for '103.146.22.0 - 103.146.23.255' is 'duc@lanit.com.vn'
Abuse contact for '103.147.152.0 - 103.147.153.255' is 'abuse@shineservers.com'
Abuse contact for '103.221.220.0 - 103.221.223.255' is 'hoanglong@azdigi.com'
Abuse contact for '103.236.201.0 - 103.236.201.255' is 'admin@idcloudhost.com'
Abuse contact for '111.90.128.0 - 111.90.159.255' is 'abuse@shinjiru.com.my'
Abuse contact for '112.78.0.0 - 112.78.15.255' is 'vanht@ods.vn'
Abuse contact for '130.185.72.0 - 130.185.72.255' is 'report@parspack.com'
Abuse contact for '119.59.96.0 - 119.59.127.255' is 'abuse@metrabyte.cloud'
Abuse contact for '141.98.10.0 - 141.98.10.255' is 'admin@serveroffer.lt'
Abuse contact for '146.247.49.0 - 146.247.49.255' is 'abuse@netcetera.co.uk'
Abuse contact for '159.148.186.0 - 159.148.186.255' is 'support@serveria.com'
Abuse contact for '159.148.0.0 - 159.148.255.255' is 'abuse@latnet.eu'
Abuse contact for '171.224.0.0 - 171.255.255.255' is 'hm-changed@vnnic.vn' 'soc@viettel.com.vn'
Abuse contact for '176.123.0.0 - 176.123.11.255' is 'abuse@alexhost.com'
Abuse contact for '178.239.176.0 - 178.239.177.255' is 'abuse@irideos.it'
Abuse contact for '178.255.40.232 - 178.255.40.235' is 'abuse@artnet.pl'
Abuse contact for '179.43.149.0/26' is 'support@privatelayer.com'
Abuse contact for '180.131.144.0 - 180.131.147.255' is 'abuse@nawala.org'
Abuse contact for '185.24.232.0 - 185.24.232.255' is 'abuse@servebyte.com'
Abuse contact for '185.128.40.0 - 185.128.43.255' is 'abuse@rackend.net'
Abuse contact for '185.130.206.0 - 185.130.207.255' is 'abuse@as61317.net'
Abuse contact for '185.140.248.0 - 185.140.249.255' is 'contact@buzinessware.com'
Abuse contact for '185.183.104.0 - 185.183.104.255' is 'abuse@m247.ro'
Abuse contact for '194.5.176.0 - 194.5.179.255' is 'berbid238@gmail.com'
Abuse contact for '200.55.243.166'  is 'radhios*@*gmail.com' syt.com web page
Abuse contact for '202.145.0.0 - 202.145.3.255' is 'abuse@uninet.net.id'
Abuse contact for '209.127.0.0 - 209.127.138.255' is 'abuse@servermania.com'

```

Example of the highest used IP addresses from November 2020

# Where to send abuse complaints

```
abuse*@*namesilo*.*com but domain names would need to be obfuscated
http://www.namesilo.com/contact\_us.php

```

# Additional Contact Information

## Postal address

McMURRY/TMG

1010 E. Missouri Avenue

Phoenix, AZ 85014

# Telephone and FAX

Phone Support:
We can be reached during normal business hours at 602-492-8198.

# Related information

Pharmacy fraud operations

* Canadian\_Health&Care\_Mall
* Canadian\_Neighbor\_Pharmacy
* My\_Canadian\_Pharmacy
* Toronto\_Drug\_Store
* Canadian\_Family\_Pharmacy
* WikiPharmacy
* International\_Legal\_RX
* US\_Drugs
* Men Health
* RxMedications
* RxExpressOnline
* OEM Software

Affiliate program coordinator employing spammers

* EvaPharmacy

# Sources for this article

## Independent

InBoxRevenge Eva Pharmacy campaign

Rogues and Champions report

All The Secrets of Domain Name Registrars – With Michael Goldfarb July 2, 2012

Phoenix Business Journal Articles on Michael Goldsmith

Chris McMurry on LinkedIn

## Corporate

* https://www.namesilo.com/contact\_us.php
* https://www.namesilo.com/Support/General-Terms-and-Conditions
* https://www.namesilo.com/Support/Abuse-Reporting-Procedures