Nameserver

## Definition

Name servers are used to resolve domain names to the IP Address.

The EvaPharmacy name servers are set up to be authoritative for every domain in their family. This enables them to implement IP Blocking to prevent many legitimate entities from seeing their illegal web sites. They perform IP blocking for

* Legal authorities
	+ FDA
	+ FBI
	+ Interpol
* Pharmaceutical manufacurers
	+ Eli Lilley
	+ Pfizer
* Pharmacy rating companies
	+ Better Business Bureau
	+ Pharmacy Checker
	+ LegitScript
	+ Knujon
	+ CIPA
* Internet Domain Name Registrars
* Domain Registries
* ICANN

and a wide range of IP Proxy services, including Tor

These servers have been hijacked, as described at Hijacked\_host

## Examples of hijacked machines

Taken from a list of live name servers in August / September 2021

### R01.RU

Speedy Cloud, China speedycloud.cn and zenlayer.com (Last seen August 9)

```
ns2.emeliashina.ru has address 128.1.60.6
ns2.gertiesabina.ru has address 128.1.60.6
ns2.ginellelina.ru has address 128.1.60.6
ns2.ileanelivy.ru has address 128.1.60.6
ns2.janayacelene.ru has address 128.1.60.6
ns2.jasminabrittaney.ru has address 128.1.60.6
ns2.jillieeulalie.ru has address 128.1.60.6
ns2.laurainebrenda.ru has address 128.1.60.6
ns2.lorileemodestine.ru has address 128.1.60.6
ns2.merissasashenka.ru has address 128.1.60.6
ns2.odellahope.ru has address 128.1.60.6
ns2.olympiazonda.ru has address 128.1.60.6

```

Dhruva Cloud, Bangalore dhruva.cloud

```
ns1.angelinesteffi.ru has address 103.157.224.90
ns1.ashlieniki.ru has address 103.157.224.90
ns1.cassandrenicole.ru has address 103.157.224.90
ns1.chrisdonella.ru has address 103.157.224.90
ns1.desdemonashara.ru has address 103.157.224.90
ns1.dynahpaulette.ru has address 103.157.224.90

```

Bach Kim Network Solutions, Vietnam. bkns.vn

```
ns2.tjocygks.ru has address 103.121.91.117
ns2.twcqllbd.ru has address 103.121.91.117
ns2.veabqpwr.ru has address 103.121.91.117
hdizvjag.ru has address 103.121.91.117
tjocygks.ru has address 103.121.91.117
twcqllbd.ru has address 103.121.91.117
veabqpwr.ru has address 103.121.91.117

```

Nguyen Ngoc Thanh Trading Limited Company tnd.vn

```
ns2.hotaidservice.su has address 103.139.42.59
ns2.laurynsadie.ru has address 103.139.42.59
ns2.lorileemodestine.ru has address 103.139.42.59
ns2.patsycarlita.ru has address 103.139.42.59
ns2.smarttabletshop.su has address 103.139.42.59
ns2.sonjafeliza.ru has address 103.139.42.59

```

```
bestonlinesupply.ru has address 103.139.42.59
brynnhelga.ru has address 103.139.42.59
canadiancaremart.su has address 103.139.42.59
chrisdonella.com has address 103.139.42.59
coipjsft.ru has address 103.139.42.59
curingpharminc.su has address 103.139.42.59
curingpillgroup.su has address 103.139.42.59
ellenkamilamag.ru has address 103.139.42.59

```

Iran Information Technology Organization ito.gov.ir

```
ns1.jwkteyvv.ru has address 2.184.67.164
ns1.khharfjs.ru has address 2.184.67.164
ns1.marenezmeralda.ru has address 2.184.67.164
ns1.myhealthcareshop.ru has address 2.184.67.164
ns1.mysafeinvestment.su has address 2.184.67.164
ns1.rcldpyes.ru has address 2.184.67.164
ns1.rshknolq.ru has address 2.184.67.164
ns1.safepharmvalue.su has address 2.184.67.164
ns1.smartnaturalinc.su has address 2.184.67.164
ns1.smarttabletshop.su has address 2.184.67.164
ns1.thomasinerochalena.ru has address 2.184.67.164
ns1.ugrmdnza.ru has address 2.184.67.164
ns2.homefastmall.su has address 2.184.67.164
ns2.homeonlineeshop.su has address 2.184.67.164

```

Firstcolo, Germany. accelerated.de

```
ns1.homefastmall.su has address 84.200.77.180
ns1.homeonlineeshop.su has address 84.200.77.180
ns1.jwkteyvv.ru has address 84.200.77.180
ns1.khharfjs.ru has address 84.200.77.180
ns1.marenezmeralda.ru has address 84.200.77.180
ns1.myhealthcareshop.ru has address 84.200.77.180
ns1.mysafeinvestment.su has address 84.200.77.180

```

MICROHOST - Mr Manoj Dhanda, Legal Dept, MicroHost.com,
Email: manoj@microhost.com (Last seen August 21)

```
ns2.homeonlineeshop.su has address 103.127.31.154
ns2.hotmedsquality.su has address 103.127.31.154
ns2.hotpilloutlet.su has address 103.127.31.154
ns2.mysafeinvestment.su has address 103.127.31.154
ns2.newglobaleshop.su has address 103.127.31.154
ns2.onlinerxelement.su has address 103.127.31.154
ns2.pbcbxweq.ru has address 103.127.31.154
ns2.safepharmvalue.su has address 103.127.31.154
ns2.suanborr.ru has address 103.127.31.154
ns2.theherbalwebmart.su has address 103.127.31.154
pbcbxweq.ru has address 103.127.31.154
suanborr.ru has address 103.127.31.154

```

LanIT, Vietnam. lanit.com.vn

```
ns2.ehnhyajy.ru has address 103.146.23.100
ns2.fzbwqqap.ru has address 103.146.23.100
ns2.hhbnqedb.ru has address 103.146.23.100
ns2.hihlqzaa.ru has address 103.146.23.100
ns2.hqhztsor.ru has address 103.146.23.100
ns2.igwcmivs.ru has address 103.146.23.100
ns2.inmkkwlw.ru has address 103.146.23.100
ns2.kippsydelle.ru has address 103.146.23.100
ns2.laryssadesiri.ru has address 103.146.23.100
ns2.mariannahedwiga.ru has address 103.146.23.100

```

Shine Servers (India) shineservers.com

```
ns1.angelinesteffi.ru has address 103.147.153.126
ns1.ashlieniki.ru has address 103.147.153.126
ns1.bernadettejulianna.ru has address 103.147.153.126
ns1.cassandrenicole.ru has address 103.147.153.126
ns1.chrisdonella.ru has address 103.147.153.126
ns1.desdemonashara.ru has address 103.147.153.126
ns1.dynahpaulette.ru has address 103.147.153.126
ns1.emeliashina.ru has address 103.147.153.126
ns1.gertiesabina.ru has address 103.147.153.126
ns1.ginellelina.ru has address 103.147.153.126
ns1.ileanelivy.ru has address 103.147.153.126
ns1.janayacelene.ru has address 103.147.153.126
etc, and
ns1.deneixsc.ru has address 103.147.153.123 (last seen August 25)

```

GOGETSPACE Ariyes Online Sdn Bhd (Last seen August 24)

```
ns1.yourgenericsmart.su has address 103.135.128.72
ns2.arnlxjze.ru has address 103.135.128.72
ns2.baxfheba.ru has address 103.135.128.72
ns2.bestfirstelement.su has address 103.135.128.72
ns2.cbvjbquk.ru has address 103.135.128.72
ns2.coipjsft.ru has address 103.135.128.72
ns2.fastgenerictrade.ru has address 103.135.128.72
ns2.fastherbsreward.ru has address 103.135.128.72
ns2.fetrjzyt.ru has address 103.135.128.72
ns2.gelyasofia.ru has address 103.135.128.72
ns2.healingfirstmall.ru has address 103.135.128.72
ns2.hhxeldkk.ru has address 103.135.128.72
ns2.homefastmall.su has address 103.135.128.72
ns2.hotaidservice.su has address 103.135.128.72
ns2.hotmedicaltrade.su has address 103.135.128.72
ns2.jwkteyvv.ru has address 103.135.128.72
ns2.khharfjs.ru has address 103.135.128.72
ns2.marenezmeralda.ru has address 103.135.128.72
ns2.myhealthcareshop.ru has address 103.135.128.72
ns2.pureherbalshop.su has address 103.135.128.72
ns2.ubsmsraz.ru has address 103.135.128.72
ns2.uneyfbbs.ru has address 103.135.128.72

```

Fishmonger business! machiwala.in

```
ns1.arnlxjze.ru has address 103.242.117.197
ns1.baxfheba.ru has address 103.242.117.197
ns1.bestfirstelement.su has address 103.242.117.197
ns1.cbvjbquk.ru has address 103.242.117.197
ns1.coipjsft.ru has address 103.242.117.197
ns1.fastgenerictrade.ru has address 103.242.117.197
ns1.fastherbsreward.ru has address 103.242.117.197
ns1.fetrjzyt.ru has address 103.242.117.197
ns1.fipxjvjk.ru has address 103.242.117.197
ns1.gelyasofia.ru has address 103.242.117.197
ns1.healingfirstmall.ru has address 103.242.117.197
ns1.hhxeldkk.ru has address 103.242.117.197
ns1.hotaidservice.su has address 103.242.117.197
ns1.hotmedicaltrade.su has address 103.242.117.197
ns1.newglobaleshop.su has address 103.242.117.197
ns1.onlinerxelement.su has address 103.242.117.197
ns1.pbcbxweq.ru has address 103.242.117.197
ns1.perfectpillgroup.su has address 103.242.117.197
ns1.pureherbalshop.su has address 103.242.117.197
ns1.suanborr.ru has address 103.242.117.197
ns1.theherbalwebmart.su has address 103.242.117.197
ns1.twtkgbsk.ru has address 103.242.117.197
ns1.ubsmsraz.ru has address 103.242.117.197
ns1.uneyfbbs.ru has address 103.242.117.197
ns1.yfwniysu.ru has address 103.242.117.197
ns1.yourhealthmarket.su has address 103.242.117.197
ns1.yourpillprogram.su has address 103.242.117.197

```

WHM Complete Solutions - Easyway, Indonesia. client.easyway.co.id

```
ns1.ehnhyajy.ru has address 103.28.149.174
ns1.fzbwqqap.ru has address 103.28.149.174
ns1.hhbnqedb.ru has address 103.28.149.174
ns1.hihlqzaa.ru has address 103.28.149.174
ns1.hqhztsor.ru has address 103.28.149.174
ns1.igwcmivs.ru has address 103.28.149.174
ns1.inmkkwlw.ru has address 103.28.149.174
ns1.laryssadesiri.ru has address 103.28.149.174
ns1.malissiamaurine.ru has address 103.28.149.174
ns1.marlanemerla.ru has address 103.28.149.174
ns1.melittatoma.ru has address 103.28.149.174
ns1.rosemariatabbatha.ru has address 103.28.149.174
ns1.sonjafeliza.ru has address 103.28.149.174

```

Host4Geeks, India h4g.in

```
ns2.angelinesteffi.ru has address 103.83.192.109
ns2.ashlieniki.ru has address 103.83.192.109
ns2.bernadettejulianna.ru has address 103.83.192.109
ns2.cassandrenicole.ru has address 103.83.192.109
ns2.chrisdonella.ru has address 103.83.192.109
ns2.desdemonashara.ru has address 103.83.192.109
ns2.dynahpaulette.ru has address 103.83.192.109
ns2.emeliashina.ru has address 103.83.192.109
ns2.gerdalisha.ru has address 103.83.192.109
ns2.gertiesabina.ru has address 103.83.192.109
ns2.ginellelina.ru has address 103.83.192.109
ns2.ileanelivy.ru has address 103.83.192.109
ns2.janayacelene.ru has address 103.83.192.109
ns2.jasminabrittaney.ru has address 103.83.192.109
ns2.jillieeulalie.ru has address 103.83.192.109
ns2.laurainebrenda.ru has address 103.83.192.109
ns2.lorileemodestine.ru has address 103.83.192.109
ns2.merissasashenka.ru has address 103.83.192.109
ns2.odellahope.ru has address 103.83.192.109
ns2.olympiazonda.ru has address 103.83.192.109
ns2.qthxvnzf.ru has address 103.83.192.109
ns2.ronnashanda.ru has address 103.83.192.109
ns2.rosabelleloni.ru has address 103.83.192.109
ns2.stormibeverie.ru has address 103.83.192.109
ns2.tonyrosalie.ru has address 103.83.192.109
ns2.tzsxlkdr.ru has address 103.83.192.109
ns2.uhyllsdd.ru has address 103.83.192.109
ns2.uvwgcdsa.ru has address 103.83.192.109
ns2.winnasellajada.ru has address 103.83.192.109
ns2.wkxjqcrt.ru has address 103.83.192.109

```

TLSOFT CO LTD in Vietnam. tlsoft.com.vn

```
ns2.fkzzfqej.ru has address 103.92.25.124
ns2.fmjmdaub.ru has address 103.92.25.124
ns2.ghlneqll.ru has address 103.92.25.124
ns2.gkcnqpbr.ru has address 103.92.25.124
ns2.irpcpnxa.ru has address 103.92.25.124
ns2.kavrpvxm.ru has address 103.92.25.124

```

ODS Joint Stock Company, Vietnam. ods.vn (Last see August 9)

```
ns1.purepillstore.su has address 112.78.10.214
ns2.arnlxjze.ru has address 112.78.10.214
ns2.baxfheba.ru has address 112.78.10.214
ns2.bestfirstelement.su has address 112.78.10.214
ns2.cbvjbquk.ru has address 112.78.10.214
ns2.coipjsft.ru has address 112.78.10.214
ns2.fastgenerictrade.ru has address 112.78.10.214
ns2.fastherbsreward.ru has address 112.78.10.214
ns2.fetrjzyt.ru has address 112.78.10.214
ns2.gelyasofia.ru has address 112.78.10.214
ns2.healingfirstmall.ru has address 112.78.10.214
ns2.hhxeldkk.ru has address 112.78.10.214
ns2.hotmedsquality.su has address 112.78.10.214
ns2.hotpilloutlet.su has address 112.78.10.214
ns2.myhealthcareshop.ru has address 112.78.10.214
ns2.mysafeinvestment.su has address 112.78.10.214
ns2.newglobaleshop.su has address 112.78.10.214
ns2.onlinerxelement.su has address 112.78.10.214
ns2.pbcbxweq.ru has address 112.78.10.214
ns2.perfectpillgroup.su has address 112.78.10.214
ns2.pureherbalshop.su has address 112.78.10.214
ns2.rcldpyes.ru has address 112.78.10.214
etc

```

## Reporting hacked name servers

```
2.184.67.164 abuse*@*ito.gov.ir
5.101.140.77 abuse*@*ukservers.com
37.46.135.24 abuse*@*abusehost.ru
84.200.77.180 abuse*@*accelerated.de
103.9.158.67 https://id.vnso.vn/contact.php
103.117.141.163 abuse*@*casbay.com
103.117.141.184 abuse*@*casbay.com
103.121.91.117 id*@*bkns.vn
103.126.6.161 abuse*@*serverstack.in
103.127.31.154 noc*@*microhost.com
103.135.128.72 abuse*@*gogetspace.com
103.146.23.100 info*@*lanit.com.vn
103.147.153.123 abuse*@*shineservers.com
103.147.153.126 abuse*@*shineservers.com
103.157.224.90 abuse*@*dhruva.cloud
103.228.114.93 odeoninfra*@*gmail.com
103.236.150.106 abuse*@*serverkeren.com
103.236.201.228 admin*@*idcloudhost.com
103.242.117.197 sales*@*machiwala.in
103.28.149.174 support*@*easyway.co.id
103.83.192.109 abuse.support*@*h4g.in
103.92.25.124 info*@*tlsoft.vn
112.78.10.214 vanht*@*ods.vn
128.1.60.6 support*@*speedycloud.cn abuse*@*zenlayer.com
171.244.143.163 soc*@*viettel.com.vn
185.130.206.6 abuse*@*as61317.net
198.27.110.97 abuse*@*ovh.ca
202.145.2.67 abuse*@*uninet.net.id
209.127.28.5 abuse*@*servermania.com

```

Notify the abuse contacts, with a link to this page.