recursal/Fanatic-Fandom huggingface dataset:
Jakarta

* Narrow
* Wide
* Promo

**Jakarta** is the 105th city in *Gummy Drop!*.

## Story

**Introduction:**

You arrived in Jakarta with Gummy riding a horse-drawn carriage to rebuild the monuments.

**Epilogue:**

After you built all the monuments, you will travel by hot air balloon to Santiago.

## Souvenir symbols

* Turtle
* Bench & parasol
* Rooster

## Levels

This city contains 176 levels, consisting of 120 normal levels, 44 side-levels, and 12 Helping Hand levels.

### Mystery Boxes

 2

## Quotes by Sam

* "Congratulations! Welcome to Jakarta!"
* "Everything's jubilant in Jakarta!"
* "Great job! You've reached Jakarta!"
* "Jaw-dropping! You're in Jakarta!"

## Trivia

* The beach and parasol souvenir also appears in Rio de Janeiro, Dar es Salaam, Key West and Lagos.
* The turtle souvenir also appears in Hawaii, Zoo Adventure Park and Big Fish's 20th Anniversary.
* There are several non-buildable monuments scattered in the map, they are:
	+ Indonesian Children Castle in Taman Mini Indonesia Indah Park, and
	+ Jakarta Theatre.
ICANN

**ICANN** (Internet Corporation for Assigned Names and Numbers) is the international organisation that is ultimately running the DNS.

For example, it grants accreditation to private registrars that can sell domain names at GTLD's.

Maintains contact details (email and phone) for all accredited registrars.
See the official ICANN contact list
Kheweul list

Click on the headings for evidence of fraud.

**Suspended by the registrar**

## Canadian Health&Care Mall

```
rbdnsiuk.com (suspended)
fsaflwrp.com (suspended)
luckyremedialmart.com (suspended)
magicremedialsale.com (suspended)
kbhvwtii.com (suspended}
lfyhsmoh.com (suspended}
oxuswjmq.com (suspended}
qmateiut.com (suspended}
wkhczros.com (suspended}
yhyrrkxo.com (suspended}

```

## CanadianPharmacy

```
familyherbsupply.com (suspended)
curativefastsupply.com (suspended)
familypharmvalue.com (suspended)
safegenericquality.com (suspended)
excellenthealthsale.com (suspended}
familyherbsbargain.com (suspended}
healingpharmmarts.com (suspended}
medicalbestmart.com (suspended}

```

## International Legal RX

```
bestpharmacyreward.com (suspended)

```

## My Canadian Pharmacy

```
herbalfastpurchase.com

```

## Men's Health

```
medicativesmartmall.com (suspended)
medicinalfastvalue.com (suspended)
mymedsservices.com (suspended)
redhotorganicinc.com (suspended)
hotnaturalreward.com (suspended}
puremedicativetrade.com (suspended}

```

## RxExpressOnline

```
dortheaperri.com (suspended)

```

## Where to send abuse complaints

* By email

kheweul*@*kheweul*.*com

* By contact page

http://kheweul.org/support/contact-us.php
Canadian Pharmacy 2001

Information here will describe the version found in 2018-2019

## Description

The web site title is "Canadian-Pharmacy".

The logo has the words Canadian Pharmacy SINCE 2001

The contact number was: Phone: +19092510938 and more recently: +1-317-4890699

## False Pretenses

### False: Claims to have "FDA" approval

The FDA warns against pharmacies that have no regard to licenses and regulations.

### No Pharmacy License

Canadian Pharmacy displays a miniature image of a License, but it can not be viewed, not even if you click on it.From the FAQ:

### False: Claim to be approved by pharmacychecker

```
Is your pharmacy legal?

Yes, absolutely. We possess a license which allows our company to sell herbal and non-herbal medications
worldwide. You can see it on our website’s homepage. Our Online Pharmacy is also valid on https://www.pharmacychecker.com.

```

The home page does not display any license that can be viewed. Pharmacy Checker does not list them..

### No Pharmacist Oversight

They do not make any statement that there is a pharmacist overseeing orders and deliveries.

### No prescription

The FAQ admits that they ship without a presciption, which is illegal

```
Do I need a prescription?
You don't need any prescriptions to order from our Online Pharmacy.

```

## Redirections

It is a common practice with fraud pharmacies that they hide the actual hosting web server, and redirct spammed domains to them, to reduce the likelihood of being shut down by law abiding registrars. Examples of redirection targets from October 2018

```
bestpills.su (registrar:     REGRU-SU)
topbestweb.su (registrar:     ARDIS-SU)

```

## Sponsoring Registrars

R01-RU

```
cloardelis.ru
corinejacky.ru
eleanoreterri.ru
felicitydelia.ru
guendolenlivvy.ru
janeczkadina.ru
joanieamieadina.ru
jordannaraynell.ru
klarahaily.ru
laurellarahel.ru
libbiedulcine.ru
maegantanhya.ru
margauxamesybila.ru
mariannejobye.ru
marjiebrear.ru
meridithnatala.ru
nanetegillykial.ru
nertadarleen.ru
teressacorabella.ru
tinerebekah.ru
virgieclemmy.ru

```

CNOBIN

```
christenflossy.com
claudeeuphemia.com
katimechelle.com
lauriannedena.com
riccaianthe.com

```

TUCOWS DOMAINS INC.

```
daritimmie.com
deannecrissy.com
kirstenicarlota.com
rosamundfrankie.com

```

REGTIME-SU

```
mallonline.su
readytobuy.su
testdiscount.su

```

R01-SU

```
charlenadoloritas.su
clarestaanabal.su
melaniaclary.su

```

REGRU-SU

```
buydiscount.su
greatvipsale.su

```

## How to report this spam

Report the offending domain name to the registrar, noting that by providing registration of a domain used for illegal purposes, they are breaking their terms of service.

## Related brands

Pharmacy Express uses the same contact number +13174890699 and the support web site topsupport24x7.su
InterNetworX list

Click on headings for evidence of fraud

# Already suspended

## Canadian Family Pharmacy

```
familyherbalprogram.eu (suspended)
globalorganicshop.be (suspended)

```

## Canadian Health&Care Mall

```
globalpillsmarket.eu (suspended)
newtreatmentreward.eu (suspended)
medicalglobaloutlet.be (suspended)
countrytubulargoods.eu (suspended)
fastmedicinaltrade.eu (suspended)
herbalhealthgood.eu (suspended)
luckyhealinggroup.eu (suspended)
medicinalfastmall.eu (suspended)

```

## Canadian Neighbor Pharmacy

```
genericbestservices.eu (suspended)
luckygenericassist.be (suspended)
fastaidprogram.eu (suspended)

```

## CanadianPharmacy

```
fastherbinvestment.eu (suspended)
medicalsafetrade.be (suspended)
privatewelnessinc.eu (suspended)
theorganiconline.be (suspended)
familyherbalcompany.be (suspended)
fastherbalshop.eu (suspended)
globalpillprogram.eu (suspended)
goodrxquality.be (suspended)
magictabletinc.eu (suspended)
myhealingquality.eu (suspended)
remedialpillsoutlet.eu (suspended)
thegenericformula.eu (suspended)

```

## My Canadian Pharmacy

```
medicalglobalvalue.be (suspended)
curativefasttrade.eu (suspended)
fastdrugsassist.eu (suspended)
themedicalinc.be (suspended)

```

## Toronto Drugstore

```
bestmedicareassist.eu (suspended)

```
Cloud Group

**Cloud Group Ltd** is a registrar in the UK as part of the UK2 Group, a global group of web hosting brands. With offices in London and Utah the UK2 Group employs over 200 staff and supplies around a million customers worldwide. The UK2 Group utilizes a domain accreditation provided by a partner, Cloud Group Limited.

# Anti-Spam Position

Cloud Group through resell.biz acts quickly and decisively to terminate contracts for domain names that are shown to be used for fraud or unlawful purposes. The acceptable use agreement makes it clear that spamming and illegal activities are not tolerated.

## Official Position

The UK2 Group license agreement is at http://www.uk2group.com/domain-names/registration-agreement.php

```
17. Severability

In the event that any of the terms of this Registration Agreement become
or are declared to be illegal or otherwise unenforceable by any court
of competent jurisdiction, such term(s) shall be null and void and shall
be deemed deleted from this Registration Agreement. All remaining terms
of this Registration Agreement shall remain in full force and effect.

```

The resell.biz Acceptable Use Agreement at http://www.resell.biz/legal/acceptable-use.php states

```
By using our services you agree not to, or to allow your customers
to do any of the following:

1. Transmitting unsolicited bulk email (spam)
2. Taking part in any activity which results in abuse reports to spam
   blocking organizations, or other organizations which attempt to
   police or monitor abuse of the Internet
...
8. Any illegal, dishonest, deceptive or unfair trade practices

```

## Actual Behavior

Under UK2 Group, resell.biz provides domain registration and domain management services.
They act quickly and decisively to remove illegal sites. Providing evidence speeds the process.

They also acts as a central point of contact for their reseller registrars.

## Blacklisted domains over a 5-day period

Source: URIBL
http://rss.uribl.com/nic/CLOUD\_GROUP\_LIMITED.html

# Description of the Registrar

Service contracts are terminated by resell.biz in a timely fashion.

# Where to send abuse complaints

All Cloud Group Limited domains are registered via their domain reseller brand, www.resell.biz and all domain name support inquiries should be addressed to the resell.biz support team. (support*@*resell*.*biz)

Web page for reporting abuse: http://www.resell.biz/contact/

# Additional Contact Information

## Postal address

```
   Resell.biz
   517 W. 100 N.
   Suite #225
   Providence, Utah 84332

```

# Sources for this article

## Corporate

* http://www.uk2group.com/
* http://www.resell.biz/
Love Your Pet Event

* Splash
* Promo (2022)
* Promo (2023)
* Promo (2023)
* Level Narrow
* Level Wide

**Love Your Pet Event** is the tenth 70-level event of *Gummy Drop!*. This event has 70 levels and started on June 27, 2022 at 12:00 (PST). It was a revival of Forever Home Party.

It has a limited time of 14 days. Each set of 10 levels is unlocked every day.

The event was revived on August 24, 2023 at 12:00 (PST) for a limited time of 12 days.

## Story

**Introduction:**

You arrived in Forever Home Party to rebuild the monuments.

**Epilogue:**

After you built all the monuments, you will leave with various gummies floating around.

## Souvenir symbols

* Bell
* Bone
* Paw print

## Rewards (2022)

 After Lv. 20
 After Lv. 30
 After Lv. 40
 After Lv. 50
 After Lv. 60
 After Lv. 70

## Rewards (2023)

 After Lv. 10
 After Lv. 20
 After Lv. 30
 After Lv. 50
 After Lv. 60

## Quotes by Sam

* "Happy Pet Appreciation Month!"
* "Help these pets find their new best friend!"

## Trivia

* The background music also appears in Easter Picnic Makeover and the Fur-ever Friends coloring event.
* The bone souvenir also appears in Dog Park, Pets Playdate, Love Your Pet Day and Forever Home Party.
* The pawprint souvenir also appears in Pets Playdate, Love Your Pet Day and Forever Home Party.
Black hole

A Black hole IP address is one that registrars put in place to erase the glue records of a nameserver.

* **DSTR Acquisition:**

* **GANDI:**

 217.70.185.1

* **Ace of Domains:**

* **Beijing Innovative:**

* **General use:** - *Not strictly speaking black holes, these addresses are simply non-routable and serve the same purpose of invalidating an address.*

 127.0.0.\*
Dakar

* Narrow
* Wide
* Memories

**Dakar** is the 149th city in *Gummy Drop!*.

## Story

**Introduction:**

You arrived in Dakar by helicopter to rebuild the monuments.

**Epilogue:**

After you built all the monuments, you will travel by turboprop airplane to San José.

## Souvenir symbols

* Chequered flags
* Seashell
* Canoe

## Levels

This city contains 173 levels, consisting of 120 normal levels, 41 side-levels, and 12 Helping Hand levels.

### Mystery Boxes

 2

## Trivia

* The chequered flags souvenir also appears in Abu Dhabi.
* The seashell souvenir also appears in Hawaii.
* The canoe souvenir also appears in Minneapolis, Venice and Family Fishing Trip.
* The background music also appears in Gqeberha and Lagos.
Authentic-looking whois address

Using the identity of someone else (whois identity theft) can result in a lawsuit for fraud, or other action depending on the national laws in effect.

It is therefore not uncommon for fake whois information to be totally fictitious. This can take the form of:

* **Blatantly fake whois information**. Such entries may appear to be authentic to automated scoring systems, but appear obviously fake to a human investigator. **For example:**

```
person:         Habra Kahdabrah
address:	231 Noplace Special
address:	90023
address:	New York
address:	United States
phone:		+32.123123123
e-mail:          dbhs3@blabla.net
lastupdated:	2008-04-21 17:08:35

```

In the above instance, clearly a more rigorous scoring script could be called for (zip code in USA does not match the state, the telephone number has the wrong number of digits, the country code is not the correct code for the USA). Even if the zip code, and the telephone number were possible (ex. 10023, and +1.1231231234), even an excellent automated scoring system would accept the registrant data.

* **Possibly correct whois information**. These may be addresses that *could be* correct, and thus can fool both the automated scoring system, and an investigator who does not do a thorough investigation.**For example:**

```
person:         Olf Jøsevold
address:	Postboks 7222
address:	N-0103
address:	Bergen
address:	Norway
phone:		+47.25905491
e-mail:          olof.Josevold@gmail.com
lastupdated:	2008-04-21 17:08:35

```

In this instance, only a dedicated abuse agent (or one living in Norway) would be able to spot the many fallacies and realize the data is fake.
Sao Paulo

* Narrow
* Wide
* Full
* Promo

**São Paulo** is the 74th city in *Gummy Drop!*.

## Story

**Introduction:**

You arrived in São Paulo by ferryboat to rebuild the monuments.

**Epilogue:**

After you rebuilt all the monuments, you will travel by bus to Reykjavik.

## Souvenir symbols

* Coffee bean
* Sunglasses
* Toucan

## Levels

This city contains 171 levels, consisting of 120 normal levels, 39 side-levels, and 12 Helping Hand levels.

## Quotes by Sam

* "Olá from São Paulo!"
* "Say 'hey' to São Paulo!"
* "So much to see in São Paulo!"
* "Time to sightsee in São Paulo!"
* "Welcome to sizzling São Paulo!"

## Trivia

* A different coffee bean souvenir also appears in Bogota.
* The sunglasses souvenir also appears in Atlanta, Durban, and Gummypalooza.
Oktoberfest

* Narrow
* Wide
* Splash
* Exit
* Promo

**Oktoberfest** is the 36th Special City in *Gummy Drop!*. It started on September 15, 2023 at 12:00 (PDT) for a limited time of 12 days.

## Story

**Introduction:**

You arrived in Oktoberfest with Gummy by horse-drawn wagon to rebuild the monuments.

**Epilogue:**

After you built all the monuments, you will leave with brown leaves floating around.

## Souvenir symbols

* Bratwurst
* Boar
* Beer stein

## Pretzel Backpack

Start new levels with boosts when you have a winning streak of consecutive levels by filling your Pretzel backpack with boosts! Main levels completed contribute to a winning streak. The streak is reset to zero if a level is not completed successfully. The boosts will automatically be played until the streak is lost.

## Rewards

 Winning Streak of 1
 Winning Streak of 3
 Winning Streak of 5

## Levels

This city contains 79 levels, consisting of 60 normal levels, 13 side-levels, and 6 Helping Hand levels.

## Quotes by Sam

* "Get ready to celebrate Oktoberfest!"
* "Grab your lederhosen for Oktoberfest!"
* "Porst! Come join the celebration!"

## Trivia

* The background music also appears in Munich.
* The bratwurst souvenir also appears in Chicago, Washington D.C., Father's Day Barbecue, Barbecue Party, Ballpark Bash State Fair, and International Food Festival.
* The boar souvenir also appears in Munich and Warsaw.
* The beer stein souvenir also appears in Prague.
Training grounds

The *Training grounds* are a group of single fights, some to introduce you to the game mechanics, some to allow you to gain xp and gold without going through a quest.

You can reach the Training grounds via the Training grounds main menu option. This menu then presents you the currently available fights, which you start by selecting the appropriate one. Note that most fights need to be unlocked: only the first one is available when starting a new game.
Jiangsu Bangning list

Click on the link to see the evidence of fraud

## The Doctors

**Suspended**

```
agzii.com
cahgb.com
cxevl.com
jfmkht.com
jlfzbg.com
kkyjfo.com
tuxbf.com
uitre.com
uveyoa.com
xmujti.com
com-2zk.net
com-bo6.net
com-odv.net
com-p5a.net
com-rem.net
com-0ub.net
com-20z.net
com-3sl.net
com-7k5.net
com-802.net
com-82w.net
com-8j4.net
com-eum.net
com-lq5.net
com-v54.net
com-595.net
com-b28.net
com-ebk.net
com-l3k.net
com-n57.net
com-oi6.net
com-roh.net
com-w1e.net
com-y1l.net

```

maxnnd.com

## Registrar contact

```
Jiangsu Bangning Science & technology Co. Ltd.
1-3th Floor, BangNing Technology Park,
2 YuHua Avenue, Yuhuatai District
Nanjing City Jiangsu 210012
China
+86 25 86883420
abuse: idc*@*55hl.com

```
Jangsu Bangning list

Click on the link to see the evidence of fraud

The\_Doctors

```
com-0uj.net
com-5j0.net
com-750.net
com-84l.net
com-anf.net
com-h91.net
com-l6s.net
com-p63.net
com-tv3.net

```

## Registrar contact

```
Jiangsu Bangning Science & technology Co. Ltd.
1-3th Floor, BangNing Technology Park,
2 YuHua Avenue, Yuhuatai District
Nanjing City Jiangsu 210012
China
+86 25 86883420
abuse: idc*@*55hl.com

```
IP address

**IP address** distinguishes the computers that connect to TCP/IP network. The largest of those networks is the Internet. IP means Internet Protocol address. IPs are used by computers in order to communicate to one another.

for example: www.spamtrackers.eu resides (at the time of writing) on the computer that has address 213.186.33.19
Sword

The *Sword* is a weapon which can be selected for any of your heroes. It is a single-handed weapon which is very good for attacking single opponents.

A sword can only attack one opponent per turn. Also, the range is limited to the first opponent is sight (ie: you cannot attack an opponent behind another opponent: you'll have to attack the opponent in front first).

This gives the sword a limited range. However, it will give a 50% ATK bonus on any strike, making it the best weapon for attacking single, strong opponents.

Ryall also receives an extra bonus when using a sword due to his Innate ability.
IndianPharmacy

## Description

Indian Pharmacy is a member of the EvaPharmacy fraud operation.

Known examples in 2021 are

```
indianpharmacy.site  registrar  NameSilo, LLC on IP address 5.188.211.29
indianpharmacy.info  registrar  REGTIME-RU on IP address 5.188.211.29

```

Clear signs that this is a fraud can be seen in the usual faked photoshopped credentials.

### Fake CEO

The picture on the web site's About page of the supposed organization members are taken from stock photos. For example, the "President and CEO" called "Shivpraksh Kalakumar" is taken from a stock photo "businessman in suit" seen at alamy.com Alamy stock photo

### Fake Drug Reselling License

This is signed by somebody called "Ed Lear" of the "California Board of Pharmacy". No such person exists there, and the name of the board is incorrrect.
As at September 2021 the expiry date was 22/07/2018

### Fake FDA Approval

This is outdated, created by photoshop, and signed by the non-existent Matthew Loyed.

### Fake Verisign Seal

Once again, this is a fake photoshop image, served not from Verisign but from the Indian Pharmacy site.
As of September 2021 it expired 28 June 2020.

## Other Eva Pharmacy Operations

Illegal Eva Pharmacy Operations that are known for fake credentials and persistent hijacking of name servers and web site servers

* My Canadian Pharmacy
* CanadianPharmacy
* Canadian Health&Care Mall
* Canadian Family Pharmacy
* Canadian Neighbor Pharmacy
* International Legal RX
* US Drugs
* VIP Pharmacy
* CVSPharmacy
* **IndianPharmacy**
* Men Health
MedMarket

## Description

This purports to be a legitimate pharmacy.

However, it is widely believed to be a credit card theft scam - fronted by a fake pharmacy retailer.

The whole site is full of false pretenses.

Distinguishing features.

The help desk phone number is +1 (844) 241-4210 which is the same as the number for Int.Pharmacy.

The web site title is Bestsellers, which is the same as the title for Int.Pharmacy.

The web page icon is

The secure checkout page is at secureprocessplace.com, registered with PDR Ltd. doing business as PublicDomainRegistry.com.
It was registered on Creation Date: 2018-05-18.

## False Claims

Typically fraud pharmacies try to look legitimate by posting images of pharmacy approval organizations. It is obvious that they are fake. On legitimate sited these images will link though to the relevant authority web site.

### Fake registration

MedCenter uses identity theft or fake identity generators to register its sites.

### Not FDA approved

Though it posts this image, there is no link through to any FDA site.

### Not IPAC approved

Though it posts this image, there is no link through to any IPAC site.

### Not USA Quality approved

Though it posts this image, there is no link through to any USA Quality site.

### Not CIPA Rx approved

Though it posts this image, there is no link through to any CPA site.

## Sample sites and registrars sponsoring them

### Hosting Concepts

```
365intmedx.net
365medshipping.com
canadian-healthy24.com
healthyshop24.com
healthystore365.com
inthealthy24.com
meddiscount365.com
myhealthstore365.com
onediscount24.net
onepharm24.com
oneshipping365.com
onlinediscount24.net
onlinemedx24x7.net
pharmstore365x7.com
trustship365x7.com
canadian-pharma.online

```

### PDR Ltd

```
onehealth24.online (suspended)
onlineshipping24.top (suspended)
oneshipping.top (suspended)
onlinediscount24.top (suspended)

```

### Hosting Ukraine

```
canadian-pharma.online

```

### NameCheap

```
canada-pharmacy-24h.club
pharmonline.club

```

## How to Report this Spam

Send complaints to the abuse desk at each registrar.
CNOBIN Rogues

CNOBIN

LegitScript is a trusted source for the accreditation of pharmacies. They also categorize many pharmacies as rogues run by criminal organisations.

## Domains listed as rogue

This is a set of screen captures showing the rogue pharmacies as detected and verified by LegitScript They are registered with CNOBIN.

```
adaphilomena.com
ainsleeannis.com
alejandrajolyn.com
arielphilis.com
arleynemilly.com
arlinakassi.com
asiadedra.com
brigidjacintha.com
caraliekatie.com
claudiachastity.com
corillanell.com
curativerxmall.com
cybillyolande.com
deannecarlen.com
dedraglenn.com
dorriegipsy.com
fdatabls.com
gennaclarisse.com
glennibbie.com
harrietliv.com
henryettaaryn.com
herbalaidtrade.com
jacentasula.com
janalinnell.com
janotmaxine.com
joelieyvonne.com
johannaluella.com
junettecherin.com
kittiebrook.com
kordulashoshana.com
kristafleur.com
leslieloise.com
lottakatine.com
maddyamelie.com
magdaiamargarette.com
malindestephie.com
marileeglenn.com
marislorettalorna.com
matilderamonda.com
mireillecharmaine.com
myragloria.com
myshoppingcart2.com
newherbsquality.com
onlinefasttrade.com
onlinerxprogram.com
paolinadaisy.com
philippamerle.com
pollybrita.com
puretabssale.com
rosannejosepha.com
roxannejasmina.com
savinaamie.com
securehotmall.com
thehotelement.com
thepillbargain.com
vonnyashlen.com
wandieluise.com
wendistarr.com
winifredwinifred.com
yourhotpurchase.com

```

### Previous rogue domains

These were previously reported to the registrar and suspended in 2018.

```
ardythannabela.com (suspended)
britnigiuditta.com (suspended)
carlensadella.com (suspended)
cartcheckoutpage.com (suspended)
catlainacamala.com (suspended)
dannyguglielma.com (suspended)
dustydebera.com (suspended)
franniemarissa.com (suspended)
healingbestshop.com (suspended)
mishacoral.com (suspended)
nicolacarlina.com (suspended)
zondrayolanthe.com (suspended)

angeliqueterza.com (suspended)
ardisleonanie.com (suspended)
babitaannaliese.com (suspended)
cammyfenelia.com (suspended)
cathatomivita.com (suspended)
curinghotmall.com (suspended)
darynmelosa.com (suspended)
elbertinemelicent.com (suspended)
evelinabarb.com (suspended)
fredrabella.com (suspended)
gerdasusanna.com (suspended)
goodherbsoutlet.com (suspended)
grettarasia.com (suspended)
homegenericsinc.com (suspended)
homesecureinc.com (suspended)
hotaidoutlet.com (suspended)
joanneaubine.com (suspended)
krystalleolympia.com (suspended)
laceemozelle.com (suspended)
leylaalmeda.com (suspended)
linniebuffy.com (suspended)
madalenafrederique.com (suspended)
malissarickie.com (suspended)
marcilestormi.com (suspended)
mellisentindira.com (suspended)
merlinecorenda.com (suspended)
mildredisa.com (suspended)
naturalbestsale.com (suspended)
neddamiran.com (suspended)
ofiliaursa.com (suspended)
onlineherbsmart.com (suspended)
rebekaflorrie.com (suspended)
reenadani.com (suspended)
robinamax.com (suspended)
rxmedline.com (suspended)
sashenkabriny.com (suspended)
sonnniejanice.com (suspended)
stephanienike.com (suspended)
tildirhona.com (suspended)
vinnyelinore.com (suspended)
zariaharmony.com (suspended)

```
Healthy Life

## Overview

This is a fraud pharmacy belonging to the Russian EvaPharmacy family.

## Evidence of fraud

The site pictures their impressive headquarters building, and gives its address as 1030 Washington Boulevard, Detroit.

The picture is taken from a stock photo of the historic Cadillac Sales and Service Building at 6001 Cass Avenue, Detroit, Michigan, United States pictured at
Commons Wikimedia photo of the Cadillac Building
Today that building belongs to the Wayne State University.

It is actually located 3.8 miles from 1030 Washington Boulevard, which is in fact the parking lot adjacent to the Holiday Inn at 1020 Washington Boulevard. You can see the distance between the two addresses at this link
From Cass Avenue to Washington Boulevard

In summary, they have stolen a picture of another building, and given its address as a vacant parking lot.

## Part of the family

The usual signs of EvaPharmacy signatures apply. The name servers for its domains are authoritative for all other EvaPharmacy domains. The IP addresses vary from day to day, and are shared by other EvaPharmacy sites. Healthy Life sits on the same IP addresses as Canadian Health&Care Mall,
CanadianPharmacy,
Herbal Store,
International Legal RX,
Men's Health,
My Canadian Pharmacy and
Toronto Drugstore

## Sample fraud domain

```
smartmedsmarket.com

Registrar: TUCOWS DOMAINS INC.
Sponsoring Registrar IANA ID: 69
Whois Server: whois.tucows.com
Registrar Abuse Contact Email: domainabus*@*tucows.com
Registrar Abuse Contact Phone: +1.4165350123

```

Privacy provided by

```
 Admin Organization: Contact Commercial Limited
 Admin Street: 68 Windsor Road
 Admin City: Swindon
 Admin State/Province: Swindon
 Admin Postal Code: SN3 1JX
 Admin Country: GB
 Admin Phone: +44.2035145961
 Admin Email: whois@contactprivacyprotect.com

```

## Checkout

The checkout page is in the form https://checkoutxxxxxx.quickrxcheckout.com/cart/checkout/

This domain was registered from Russia on May 12 2016

```
Domain Name: QUICKRXCHECKOUT.COM
Registrar: JSC REGISTRAR R01
Sponsoring Registrar IANA ID: 1426
Whois Server: whois.r01.ru
Creation Date: 2016-05-12

```

The registrant has privacy protection supplied from Russia

```
Registrant Name: Privacy protection service - r01.whoisproxy.ru.
Registrant Organization: Privacy protection service - r01.whoisproxy.ru.
Registrant Street: PO box 99, whoisproxy.ru
Registrant City: Moscow
Registrant State/Province: Moscow region
Registrant Postal Code: 123308
Registrant Country: RU
Registrant Phone: +7.4957856536
Registrant Email: quickrxcheckout.com@r01.whoisproxy.ru

```
HICHINA ZHICHENG

### HICHINA ZHICHENG TECHNOLOGY LTD.

#### The Doctors

```
com-01u.net
com-037.net
com-06e.net
com-082.net
com-09h.net
com-0cn.net
com-0l9.net
com-129.net
com-12e.net
com-171.net
com-174.net
com-1kh.net
com-1kp.net
com-1s0.net
com-209.net
com-22j.net
com-256.net
com-27e.net
com-27i.net
com-2dv.net
com-2kc.net
com-2m0.net
com-2y7.net
com-2y9.net
com-328.net
com-32e.net
com-3h0.net
com-3n4.net
com-3v4.net
com-3ys.net
com-41v.net
com-43d.net
com-46c.net
com-47x.net
com-486.net
com-49x.net
com-4cq.net
com-4i8.net
com-4mv.net
com-4rd.net
com-4rx.net
com-4sx.net
com-4y6.net
com-503.net
com-505.net
com-50u.net
com-511.net
com-52y.net
com-59s.net
com-5h9.net
com-5i2.net
com-5jd.net
com-5k4.net
com-5td.net
com-5v3.net
com-602.net
com-63a.net
com-63h.net
com-69o.net
com-69z.net
com-6h5.net
com-6jr.net
com-6l9.net
com-6yi.net
com-706.net
com-70c.net
com-71n.net
com-73r.net
com-7ap.net
com-7ez.net
com-7f0.net
com-7kd.net
com-7m3.net
com-7p3.net
com-7qq.net
com-81m.net
com-83b.net
com-86y.net
com-875.net
com-89a.net
com-8qq.net
com-8wd.net
com-926.net
com-972.net
com-99a.net
com-9a3.net
com-9c4.net
com-9km.net
com-9m9.net
com-9t3.net
com-9us.net
com-9zu.net
com-ae1.net
com-av6.net
com-b76.net
com-bqv.net
com-c58.net
com-cd6.net
com-cr5.net
com-cst.net
com-ctl.net
com-d17.net
com-d21.net
com-d8c.net
com-des.net
com-dm8.net
com-e5f.net
com-eb1.net
com-eem.net
com-ekc.net
com-erm.net
com-esv.net
com-ezv.net
com-f2z.net
com-g0t.net
com-g43.net
com-g61.net
com-g85.net
com-ga0.net
com-glz.net
com-gnn.net
com-gp0.net
com-gti.net
com-h51.net
com-hbt.net
com-hm7.net
com-i55.net
com-i5d.net
com-i69.net
com-i8k.net
com-iuq.net
com-jv3.net
com-k3p.net
com-k50.net
com-kch.net
com-kg5.net
com-kt2.net
com-ld8.net
com-m66.net
com-m72.net
com-m9l.net
com-mwy.net
com-n6l.net
com-n77.net
com-ng7.net
com-niz.net
com-nqo.net
com-nsi.net
com-o72.net
com-oed.net
com-oiz.net
com-ok4.net
com-oy9.net
com-p93.net
com-pr5.net
com-q51.net
com-q52.net
com-rg2.net
com-s22.net
com-s30.net
com-s45.net
com-s6j.net
com-tht.net
com-u06.net
com-ui6.net
com-us2.net
com-v55.net
com-v5b.net
com-v8x.net
com-vbf.net
com-vzp.net
com-w0j.net
com-w91.net
com-wj5.net
com-wl0.net
com-wuf.net
com-x20.net
com-x5a.net
com-x81.net
com-xm5.net
com-xnk.net
com-y1d.net
com-y3h.net
com-y6u.net
com-yq2.net
com-yx5.net
com-z07.net
com-z52.net
com-zwd.net
com-zzf.net

```
EPP domain

Domain Name status codes vary by the type of protocol used by the official registry. There are two common registry protocols:

* Registry Registrar Protocol (RRP) Status (no longer in use)
* Extensible Provisioning Protocol (EPP) Status

EPP means Extensible Provisioning Protocol, described in http://www.faqs.org/rfcs/rfc3730.html and illustrated in the Guide to Domain Name Status Codes

Only certain TLDs use EPP. These are: .COM, .NET, .ORG, .BIZ, .INFO, and .NAME.

ICANN rules state that a domain name's registrant or administrative contact must be able to change the transfer status (Transfer Prohibited) of an active domain name, online and free of charge, if it is not in dispute.

Because of the recent transition of .com and .net domains from RRP to EPP, there is currently room for various degrees of implementation of proper EPP status codes among the various registrars for such gTLDs. Additionally, not all hotline abuse agents may be aware that .com and .net domains (now operating under EPP) can be transferred if on HOLD status, because formerly this was not the case. It is therefore a good idea to remind the abuse agent that for .com and .net domains, he/she must also place at least a CLIENT TRANSFER PROHIBITED status on the domain so that it cannot be transferred out to an abuse-friendly registrar.

**Below is a breakdown of the various EPP status codes:**

* OK
* INACTIVE
* TRANSFER PROHIBITED / CLIENT TRANSFER PROHIBITED
* CLIENT RENEW PROHIBITED
* PENDING TRANSFER
* PENDING UPDATE
* PENDING RENEW
* PENDING DELETE
* HOLD / SERVER HOLD
* CLIENT HOLD
* DELETE PROHIBITED / SERVER DELETE PROHIBITED
* UPDATE PROHIBITED / SERVER UPDATE PROHIBITED
* TRANSFER PROHIBITED / SERVER TRANSFER PROHIBITED
* RENEW PROHIBITED / SERVER RENEW PROHIBITED
* LOCK / SERVER LOCK
* CLIENT DELETE PROHIBITED
* CLIENT UPDATE PROHIBITED
* CLIENT TRANSFER PROHIBITED
* CLIENT LOCK
* REDEMPTION PERIOD
* PENDING RESTORE
ARDIS

Russian Registrar appearing as ARDIS-RU and ARDIS-SU

The list of domains awaiting suspension and the list of domains already suspended is shown here.

Each heading is a link to the evidence that these domains are used for fraud.

The registrant information for these domains are typically false, which entitles the registrar to suspend them.

## Domains awaiting suspension

These were found to be live on August 11, 2020.

## Canadian Health&Care Mall

```
naturalherbsinc.com
newtabletgroup.com

```

## Toronto Drugstore

```
torontomedshop.net

```

## CANADA-PHARMACY

```
fastchoice.su
greatsalenow.su

```

## Canadian Pharmacy

```
trustpricebuy.su

```

## Canadian Pharmacy Online

```
bestrxsmart.ru
better-pharm.ru
easy-rxmeds.ru
ez-rxbest.ru
future-rxcenter.ru
hot-meds.ru
new-rxking.ru
online-rxbest.ru
rxbest.ru
rxdirect.ru
rxking-go.ru
rxmarteasy.ru
rxmeds-ez.ru
rxmeds-tips.ru
rxrefillsmart.ru
rxrefillworks.ru
simplenetworkrx.ru
super-rxrefill.ru
superrxday.ru

```

## Canadian\_Pharmacy\_2001

```
freshvictory.su
serviceplus.su

```

## Domains suspended

These domains have the name servers seized and replaced by REG.RU. For example

```
 name server:       ns1.reg.ru  ns2.reg.ru  ns3.reg.ru  ns4.reg.ru.

```

## Nameserver

```
kndpabna.com
miewspfu.com
tycxrsbn.com
zbnvumqa.com

```

## Canadian Health&Care Mall

```
goodnaturalmart.com
homeglobalsale.com
hotherbsdeal.com
pureonlinemall.com
safetabsprogram.com
themedsreward.com
theorganictrade.com

```

### Pharmacy Express

```
beautylife.su
myshopmount.su

```

### -Canadian-Pharmacy-

```
magicdelivery.ru
myjoyblog.ru
myjoystore.ru
tryhelptrade.ru
windiscount.ru

```

### CANADA-PHARMACY

```
bestsalejoy.ru
mybrandmaster.ru
myhotwin.ru
mysimplygroup.ru
onlinewebmall.ru
simplysaleclub.ru
supplycrew.ru
testsale.ru
tryeasydelivery.ru
yourinfohelp.ru

```

## Where to report fraud domains

Find the competent organization at https://cctld.ru/en/security/competent/

```
Email: response*@*cert-gib.ru
Email: info*@*cert.ru
Email: cert*@*bi.zone

```
The Wreckers

*Insert caption here*

The Wreckers it the third episode of season 4 of Dinosaur Island. I was uploaded on October 6 2017 and runs for 10 minutes 22 seconds.

## Plot

The episodes starts with William. Then Fang and Caroline proceed to hunt and chase William. However Fang and Caroline are able to corner William. Luckily for William a Apatosaurus whips out it's tail scaring away Fang and Caroline and saving William from the two Carcharodontosaurus.

Next we see Mars who we learn that she has a bit of territory in the Northern Forest. However she is having trouble hunting because her territory is invaded by a bunch of Stegosaurs. Despite this she successfully finds a lone Stegosaurus and is able kill and eat it.

We then see Red-Sail and Anubis. Who are being stalked by Darkclaw with his goal being to steal Red-sails territory. After commanding Anubis to hide. Red-Sail fights Darkclaw. Darkclaw eventually knocks Red-Sail over defeating him. Forcing Red-Sail and Anubis, to leave behind there territory.

## Appearing Characters

* William
* Fang
* Caroline
* Mars
* Red-Sail
* Anubis
* Darkclaw
DiscountWatches

## Introduction

DiscountWatches is just another fake watch site that infringes the manufacturer's trade mark and copyright.
The title line when you visit a site is randomly selected from a range, such as

* Buy Now Omega "James Bond: Quantum of Solace Edition" Seamaster Only For $324,95
* Buy Now Rolex Explorer II Only For $243
* Buy Now Tudor Date-Day Only For $330
* Gorgeous Cartier Women Watches Collection
* Legendary Breitling. Aviator`s choice
* Legendary Breitling. The Brand New Cosmonaute 2009 Collection
* Special Discount on The World Leading Watches Brands
* Special Offer on Omega "James Bond: Quantum of Solace Edition" Seamaster
* Special Offer on Rolex Explorer II
* Special Offer on The Brand New Omega Collection: $375 For Each Item
* The Best Offers on The World Leading Watches Brands
* The Best Watches Online-Shop: Free Shipping For All Orders More Than $300
* The Brand New Omega 2009 Collection

## False pretenses

To give the impression of being a legitimate business site, the checkout operation pretends to take your identity, address and credit card over a secure link. However, it is using ordinary http (not https) and there is no security certificate indicating a secure encrypted connection.

Pretense of a secure transaction

False claim from the site's Privacy Policy:

```
How secure is your information?

* We work to protect the security of your information during transmission by
using Secure Sockets Layer (SSL) software, which encrypts information you input.

```

## Evidence of fraud

Each manufacturer whose copyright is being blatantly infringed provides warnings of these scam operations. For example, see the Breitling front page which states

```
BEWARE OF FRAUDS
Do not buy any Breitling products on the Internet:
99% of the Breitling products for sale on the Internet are fakes. The others are
second-hand watches or models of doubtful origin.

```

## Invalid contact details

The trailer at the bottom of the page gives a contact number, +1(707)736-6165 but if you call it, you find there is no such number.

## Sample sites

Site names and name server domains are usually registered in Russia or China

* scorewinner.ru with sponsoring registrar: REGRU-REG-RIPN
* feelfinal.ru with sponsoring registrar: REGRU-REG-RIPN

Name Servers

* ns1.fieldmind.com with sponsoring registrar: Regional Network Information Center, JSC dba RU-CENTER
* ns3.dimpleunit.com with sponsoring registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
* ns5.0ul.ru ns6.0ul.ru with sponsoring registrar: NAUNET-REG-RIPN

* clunaben.cn

Name Servers

* ns1.heavpass.com ns2.heavpass.com with sponsoring registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
* ns3.6sf.ru ns4.6sf.ru with sponsoring registrar: REGRU-REG-RIPN

* storewatchesheard.com

Name Servers

* ns1.wesheer.com ns2.wesheer.com
* ns3.figfelt.com ns4.figfelt.com

## How to Report this Spam

Complainterator generates requests to the registrars to remove these sites and their name servers
Canadian Pharmacy Shop

The definitive fingerprint identification of Canadian Pharmacy Shop and European Pharmacy Shop lies in the contact phone numbers

```
+1-800-490-06-18
+4420-4901-5906

```

WORK IN PROGRESS APRIL 2018

## Description

### Title lines

medsonline24h.com has title "Buy Viagra online at medsonline24h.com"

euromeds.de has title "Buy Viagra online at euromedds.de"

buydrugs365.com has title "Buy Viagra online at buydrugs365.com"

Note that this is the same format (Buy Viagra online at {domain name}) as is used by Canadian Drugstore and Online Pharmacy.

## False Pretenses

### No Pharmacist Oversight

Like many fake pharmacies, there is no customer protection from orders that exceed normal volumes. That puts lives st risk.

Worse, they offer "Free Pills With Every Order" - adding erective dysfunction pills without verifying that they can be taken in combination with the ordered drugs. When the free drugs are taken in combination, the result can be lethal.

A real pharmacist would never put customers' lives at risk.

### Fake accreditations

These fakes do not even display any of the usual stolen credentials. They have no credibility with any pharmacy watchdogs or associations.

### No Pharmacy License

They do not have a pharmacy license so they do not bother to diplay even a fake photoshop version.

### No prescriptions

They do not even pay lip service to the requirement to display a valid prescription.

### Checkout

Checkout is provide over a secure layer via web site ssl-payments-page.com sponsored by rogue registrar: GKG.Net, Inc.
This registrar is a long term provider of the domain name servers and of privacy protection for this fraud pharmacy operation.

```
Domain Name: SSL-PAYMENTS-PAGE.COM
Updated Date: 2017-12-15T16:17:40Z
Creation Date: 2015-12-14T13:12:42Z
Registry Expiry Date: 2018-12-14T13:12:42Z
Registrar: GKG.Net, Inc.
Registrar Abuse Contact Email: abuse@gkg.net
Registrar Abuse Contact Phone: +1.8776951790
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: NS3.GKG.NET
Name Server: NS4.GKG.NET

```

## Sponsoring Registrars

### GKG Net

```
medsonline24h.com
buydrugs365.com

```
HICHINA ZHICHENG list

Click on the heading to see evidence of fraud

In each case the registrant details are also false (invalid name, address or phone number).

## The Doctors

```
alogu.com
ckakei.com
dpvmv.com
giklm.com
giyjuf.com
ifsoad.com
iozgra.com
izxcrx.com
kcect.com
ogbuvu.com
pgftza.com
sfsupg.com
totaby.com
udshyo.com
ycktxp.com

```

## The Doctors

**Suspended**

```
07aug5.net (suspended)
1h0mg7.net (suspended)
1tzafm.net (suspended)
6gykg2.net (suspended)
com-4ym.net (suspended)
com-5y0.net (suspended)
com-60d.net (suspended)
com-74x.net (suspended)
com-7az.net (suspended)
com-7l8.net (suspended)
com-7y9.net (suspended)
com-8cz.net (suspended)
com-8zf.net (suspended)
com-djk.net (suspended)
com-ei4.net (suspended)
com-hpp.net (suspended)
com-j0r.net (suspended)
com-kd2.net (suspended)
com-mfi.net (suspended)
com-n0j.net (suspended)
com-nko.net (suspended)
com-odm.net (suspended)
com-pcy.net (suspended)
com-rc0.net (suspended)
com-tuo.net (suspended)
com-v25.net (suspended)
com-xre.net (suspended)
com-xyh.net (suspended)
com-zrm.net (suspended)
ldlv4e.net (suspended)
sd1ih9.net (suspended)
xksxxd.net (suspended)
y5j6aj.net (suspended)
com-05s.net (suspended)
com-0p1.net (suspended)
com-0ry.net (suspended)
com-21d.net (suspended)
com-2ro.net (suspended)
com-304.net (suspended)
com-41w.net (suspended)
com-49m.net (suspended)
com-5k7.net (suspended)
com-5np.net (suspended)
com-694.net (suspended)
com-6g4.net (suspended)
com-6hp.net (suspended)
com-789.net (suspended)
com-793.net (suspended)
com-7d0.net (suspended)
com-7i7.net (suspended)
com-8dk.net (suspended)
com-8sd.net (suspended)
com-8vl.net (suspended)
com-8z3.net (suspended)
com-98j.net (suspended)
com-98l.net (suspended)
com-bkc.net (suspended)
com-cdk.net (suspended)
com-e7l.net (suspended)
com-eo1.net (suspended)
com-f0i.net (suspended)
com-f6e.net (suspended)
com-gjo.net (suspended)
com-h0h.net (suspended)
com-ioe.net (suspended)
com-j1j.net (suspended)
com-k8z.net (suspended)
com-kvq.net (suspended)
com-lz5.net (suspended)
com-m32.net (suspended)
com-q73.net (suspended)
com-r4d.net (suspended)
com-sg1.net (suspended)
com-sk9.net (suspended)
com-teg.net (suspended)
com-v35.net (suspended)
com-wbo.net (suspended)
com-xzv.net (suspended)
com-y02.net (suspended)

```

## Complaint process

Email to english*@*hichina.com, mamj*@*hichina.com
Fraud Reports Wiki

SUMMARY: Fraud Reports contains information about Internet fraud. It is intended for Internet Service Providers, Domain Name Registrars, Law Enforcement, ICANN and the general public.

*The 2020 Malaysian 15th Anniversary scratch and win fraud is at Malaysian\_Travel\_fraud*

Use this site as an information resource. It has documentation of scams and frauds with specific details and evidence.

## Welcome to the Fraud Reports

Previously known as spamtrackers.eu, Fraud Reports contains information about Internet fraud. It is intended for Internet Service Providers, Domain Name Registrars, Law Enforcement, ICANN and the general public.

Use this site as an information resource. It has documentation of scams and frauds with specific details and evidence.

## Important sections

See information relating to Registrars

See information relating to Pharmacy fraud

See listings of fraud domains by Registrar Fraud\_Lists

See an index to this site Site Index

## Guidelines

1. **Keep it civil**: Do not make personal attacks on other people. If you need to criticize another user’s argument, do so without attacking them as a person. Do not use bigoted language, including slurs which degrade another person or companies based on gender, race, sexual orientation, nationality, religion, etc.
2. **Be a productive member of the wiki**: Contribute to the wiki in line with the established processes and conventions. Need help? Ask an administrator!
3. **Do not engage in excessive self-promotion**: The wiki is a collaborative community resource for the topic at hand. It is NOT a free place to advertise your related website, YouTube channel, blog, social media account, etc.
4. **Do not harass other users**: If somebody asks you to stop posting certain content on their wall, respect their wishes. It is their wall.
5. **Do follow community guidelines for formatting**: When a community has established formatting, it’s important to adhere to them.
Canadian Drugstore

Canadian Drugstore comes from the same offenders as Online\_Pharmacy

The web site looks like this screenshot. Click to enlarge it.

The Help Line phone numbers shown are

```
US Toll Free: +1-800-715-5341
Europe: +44-203-318-5981

```

If you call either of those numbers, a recorded message directs you to the web site contact form, without mentioning the web site by name.

### Title lines

topcanadianshop.com has title "Buy Viagra online at topcanadianshop.com"

1st-canadian-healthcare.com has title "Buy Viagra online at 1st-canadian-healthcare.com"

Note that this is the same format (Buy Viagra online at {domain name}) as is used by Canadian\_Pharmacy\_Shop and European\_Pharmacy\_Shop.

## Fake Credentials

Across the bottom of the web page, they display images that for a genuine pharmacy would allow you to click through to view the certificate.
But because this is a fraud, just the image is displayed.

"CPA Approved" links nowhere, and is not defined.

They have no certification with the "Canadian International Pharmacy" (CIPA Rx). The CIPA Rx web site at https://www.cipa.com/ lists the 66 approved pharmacies. CIPA Rx allows you to view the approved list at http://www.cipa.com/certified-safe-online-pharmacies/
One site on that list, called candugstore.com, has both a genuine CIPA approval and a Pharmacy Checker approval. Certificate images on that site correctly click through to the certifier's web site. But that is not one of the Canadian Drugstore sites.

Similarly, there is no certification with the "Manitoba International Pharmacists Association" (WWW.MIPA.CA). They can be contacted at

```
103 - 1780 Wellington Avenue, Winnipeg, MB, R3H 1B3
Phone: +1 (204) 800-2089
Email: info*@*mipa.ca

```

## Checkout

The checkout page is **secure-checkout-247.com** sponsored by registrar: GKG.Net, Inc. Its security certificate is issued by COMODO RSA.

This same checkout is used by another fraud family - Online Pharmacy

## Sponsoring Registrars

### GKG.Net, Inc.

```
1st-canadian-healthcare.com
canadianmeds-24.com
medicaltrustshop.com (suspended)
mycanadianrxmeds.com
topcanadianshop.com

```

### Hosting Concepts

```
onlinepharmacy-ca.com

```

### PakNIC (Private) Limited

```
drugsfromcanada.com
pricelessdrugs.com (suspended)

```

### JSC Registrar R01

```
rxlegal.com (suspended)

```