BigPRX

## Description

This rogue spam should be considered separate and dictinct from an otherwise legitimate affiliate program for the site "bigprx.com", which is run by a company called Cloud Nine Lifestyle [www.c9network.com.]
Sites promoting **BigPRX** claim it to be a "100% herbal" male enhancement pill. As with all other spamvertised products such as these, the sites make numerous claims which have previously been proven to be 100% false.
Please note that whoever is building these sites routinely changes the name of the products ("Big XXX" for example.) As with the previous SanCash properties, these spammers don't really care what they call it, as long as they can spam it to millions of individuals who don't want to receive it.

## Sample Spam Messages

```
From: Carey Navarro  <NolanburgSchroeder@l...>
Date: 2008/11/6
Subject: Gaining inches the easy way

As advertised on TV and FHM. Rediscover your male verve and
virility, with the same product as seen on TV and FHm.
Results indicate 97% of men report rapid growth within
weeks.

http://mediccarworld.cn/

>> Gain 3 + inches in just weeks
>> Thicker, more muscular manhood
>> Massive amount of ejaculate.
Studies show that women find intense pleasure and come more
easily when their partners have larger tools.

```

```
You BiggerDick Dream

* ROCK SOLID hardness that feels bigger, wider and fuller (to you and to HER)
* THROBBING powerful blood flow to thePenis
* ALL-NIGHT staying power

You can't go wrong. It's doctor and herbalist endorsed
It's used and recommended bySex industry professionals

http://vwqs.ulthe.cn

```

## False Claims

### Secure Sockets Layer

From the "Privacy Policy" page

```
We work to protect the security of your information during transmission by using the software, which
encrypts information you input.

```

When you take an order to check-out, however, the page requesting your credit card details is clearly using **http**, not **https**. But the images on the page pretend that it is secure.

```

```

### Other Claims

As with literally every other type of "male enhancement" website promoted by illegally-sent spam messages, this one also makes a series of utterly false and erroneous claims, and features the same fractured English throughout the site that we've all come to expect from illegal spammers and their sponsors.

```
Benefits of having big and handsome Penis

As it is seen in world researches, nearly 65 % of all women
believe that big penis is significant benefit of man. Almost
every woman dreams about the medicine which can make their
man's penis bigger. Women confess that big penis is a
grandiose guarantee on wonderful love making and multiple
orgasms.

If a man has big penis he will have self-assertion. His eyes
are full of sexual energy and passion. Women see it and draw
their attention to such kind of man. Man with big penis has
big success among female sex. Some of you can say that big
manhood is not enough to catch and awake her interest. Yes,
you are right but big penis involves commutability,
positiveness, sense of humor, confidence and other traits of
man's man.

Let's imagine... Woman lies on the sunny beach and gets a
tan. Suddenly she notices the man who comes out of the ocean
in tight-fitting swimming trunks and something interesting
bulges out of these wonderful trunks. She thinks khow it
would be grateful to make the acquaintance. She even can
imagine his naked body and big penis. So, if he comes she
will surely agree to meet.

Nowadays science is full of improvements in all possible
fields including medicine. Today medicine can provide
safety, top quality and effective medications. If you are a
men who suffers from little penis it will be easy to fix
such problem. You needn't a surgery. You need BigPRX,
miracle capsules with miracle enlargement effect.

```

It's only on sites promoting such bogus products that we see the word "miracle" thrown around so freely. Nowhere on the site is their any mention of the actual research and development of this "product", nor is there any mention of clinical trials, manufacturing process, or other elements which would lend even a hint of credibility to these claims.

Their testimonials, as we've seen with other sites of this caliber, also seem to have been written by the same person:

```
I just want to write down and share my feelings. BigPRX is
my solution! First of all, it is herbal preparation and
safety in all means. Not only my penis was increased but
also my self-appraisal. Don't miss your chance and good
luck! Scott

```

It is important to note that there is an otherwise legitimately marketed product named "Big PrX" available at http://www.bigprx.com. That site features links to Cloud Nine Lifestyle, an affiliate program which has a very strict anti-spam policy. Inbound spam sent on their behalf was immediately responded to when reported.

Any of the illegally-spammed sites this wiki entry references tend to feature Chinese-registered domains, hosted in China, whose order forms feature no security of any sort.

By comparison, the bigprx.com site *does* have valid Secure Sockets Layer (https) processing at checkout, using secure.cloudninelifestyle.com, which has a security certificate issued by Godaddy.

Searching for "Cloud Nine Lifestyle" [c9network.com] does lead to a site which provides information and ordering for "Premium Herbal Supplements". "Products include Super Strength 800mg Hoodia, HGH Releaser, and bigPRX" as shown in the thumbnail image.

The sites which we've seen promoted using illegal spam and the Chinese domains and hosting feature a variety of icons which claim "World Shipping", "Live Support Online" and "As See On TV" *(sic)*. The so-called "live" support is in fact an email contact form which apparently doesn't do anything with the information posted. (Although, as usual, it's highly likely that this information is used in further spam campaigns, or sold to fellow spammers..)

The "genuine" BigPRX site features easy-to-verify contact information, an extensive customer support section, and even a blog. Cloud Nine Lifestyle has been very forthcoming with information about their company, and appear to be very proactive in shutting down affiliates who spam. Their brand is still being damaged by the work of these other rogue spammers with their knock-off versions of these sites.

The majority of this wiki entry will primarily deal with details of the Rogue spam operation, whose source is unknown. It is not wise to report these spamvertised domains to Cloud Nine Lifestyle as this spam is separate from their affiliate program, however if you *do* receive spam which references Cloud Nine or bigprx.com directly, those should indeed be reported to Cloud Nine.

## Hosting and Domain Registration

As of this writing (Nov. 11, 2008) yourbiggerpenis.com is hosted on ip address 200.206.183.147, located in Sao Paulo, Brasil.

```
Domain Name: YOURBIGGERPENIS.COM
Registrar: HICHINA ZHICHENG TECHNOLOGY LTD.
Whois Server: grs.hichina.com
Referral URL: http://www.net.cn
Name Server: NS1.DOMAINWEBNET.COM
Name Server: NS2.SENIORDOMAINWORLD.COM
Status: ok
Updated Date: 29-oct-2008
Creation Date: 29-oct-2008
Expiration Date: 29-oct-2009

```

The domain was registered using fake contact information:

```
Domain Name ..................... yourbiggerpenis.com
Name Server ..................... ns1.domainwebnet.com
                                  ns2.seniordomainworld.com
Registrant ID ................... hc123364543-cn
Registrant Name ................. Donita Santos
Registrant Organization ......... Donita Santos
Registrant Address .............. 4724 Mulberry Lane
Registrant City ................. Fort Lauderdale
Registrant Province/State ....... FL
Registrant Postal Code .......... 33301
Registrant Country Code ......... US
Registrant Phone Number ......... +1.5618194206 -
Registrant Fax .................. +1.5618194206 -
Registrant Email ................ DonitaJSantos@missiongossip.com

```

Spammed domain is a throwaway chinese-hosted bp domain:

http://vwqs.ulthe.cn/

Which redirects to the target website:

http://yourbiggerpenis.com/

Which loads the site as a frame

http://yourbiggerpenis.com/www/vtshl/?cmpid=734&affid=5659

This exposes the spam campaign id and affiliate id.

Images, css and other items are hosted on an illegally hijacked public host:

http://67.215.231.212/Om5quaey/76/images/logo.gif

Credit cards are validated in real time, in shocking contrast to most spamvertised websites. However (unsurprisingly) absolutely no secure server is in place.

This resembles a lot of what we've seen in use by two other sponsors of this type of bogus product: Bulker.biz and Glavmed. However the actual sponsor is, as of this writing, unknown.

## Sponsor Organization

At this time it is unknown who the sponsor affiliate program is behind this type of spam. However the form layout on the spamvertised websites resembles those found on many Gang Productions websites such as International Rx. Further investigation is ongoing.

A list of typical BigPRX sites registered with **TODAYNIC.COM** in the PRC (removed in November 2008)

businessdoctorglobal.cn
cappadocworld.cn
carbankautocenter.cn
cardoctorautorepair.cn
carvantageauto.cn
chinanewmedical.cn
clowndoctorworld.cn
computerdocworld.cn
computermediccar.cn
docoglobal.cn
doctorcarbot.cn
doctorcarfix.cn
doctorcaronline.cn
doctorcarroen.cn
doctorcarvinstein.cn
doctordictateworld.cn
doctoritplanet.cn
doctorofworld.cn
doctorpatientplanet.cn
doctorplanetclinic.cn
doctorworldmarkets.cn
doctorworldweb.cn
edocglobal.cn
edocworld.cn
enewdoctor.cn
enewmed.cn
finefreshmed.cn
firemedinternational.cn
freshmedat.cn
freshmedguide.cn
freshmedservice.cn
furnituremediccar.cn
greatburnmed.cn
greatmediccar.cn
greatnewmed.cn
greatworldwar.cn
greenvillefiremed.cn
happycarautosales.cn
idocworld.cn
latestdirect.cn
latestmedsite.cn
latestmedworld.cn
latestmedinfo.cn
lawrencefiremed.cn
legaldocworld.cn
madocinternational.cn
martincarauto.cn
medic-activ-international.cn
medicalertonline.cn
medicalsupdirect.cn
medicauto.cn
mediccaraccident.cn
mediccarinsurance.cn
mediccarrentals.cn
mediccarsite.cn
mediccarworld.cn

The name servers that provide access to these sites are on domains signature-dns-server.com and domainwebcity.com, where

* signature-dns-server.com is sponsored by ICANN accredited registrar **ONLINENIC.COM** in PRC
* domainwebcity.com is sponsored by ICANN accredited registrar **HICHINA ZHICHENG TECHNOLOGY LTD** in the PRC

The IP address of the spammed BigPRX sites was recorded in November 2008 as 192.117.252.140. This address is administered from a company in Israel with the following publicly listed contact details

```
person:         Meytal Mizrahi
address:        **Smile Internet Gold - LTD.**
address:        Alexander Yanai 1
address:        Petah-Tikva
address:        Israel
phone:          +972-3-9398005
fax-no:         +972-57-7975005
abuse-mailbox:  abuse@smile.net.il

```

Another hosting IP address recorded in November was 200.206.216.84 which is administered from Brazil:

```
owner:       TELECOMUNICACOES DE SAO PAULO S.A. - TELESP
ownerid:     002.558.157/0001-62
responsible: Administraçao Rede IP TELESP
e-mail:      gestaoip@telefonica.com.br
person:      Alicia Bernarda Contreras Lamas
e-mail:      security@telesp.net.br

```

Newer sites found in spam on November 16, hosted on an IP 200.206.183.147 in Brazil:

```
thepainmedication.com.es
theoriginalfeeling.com.es

```

```
Domain:   	thepainmedication.com.es
Reg. date:   	2008-11-11
Exp. date:   	2009-11-11

Owner:   	Alexey Avdeev
Admin contact:   	wedge AA75225-ESNIC-F4

Name: Alexey Avdeev
Organization:
Email: avdeev@interlayer.net
Telephone: +7.4957822901
Address: 2nd Novorublevskaya str. d.4 kv.29
City: Moscow
Province: MSK
Postal Code: 112315
Country: Russian federation
Tech contact:   	wedge GL2760-ESNIC-F4

Name: gTec Ltd
Organization:
Email: support@gtec.ru
Telephone: +1.7025208138
Address: Akademika Semenova street d.21
City: Moscow
Province: Moscow
Postal Code: 117042
Country: Russian federation
Billing contact:   	wedge GL2760-ESNIC-F4

Nameserver 1:   	ns1.yourdomainplanet.com
Nameserver 2:   	ns2.dnsspringnet.com

Registrar:   	Arsys

```

## How to report this spam

The Complainterator is configured to send removal requests to the registrars who sponsor these fraudulent sites. Add a link to this page as evidence.

If you receive any spam which directly references the bigprx.com domain, complain to the Affiliate Program at cloudninelifestyle.com.