Netlynx

**Netlynx** is a registrar in India.
The CEO on record is Pankaj Jaiswal (pictured)

# Official Position

http://www.netlynx.in/support/legal.php?requestfor=customerdomainagreement&from=agree\_page

OBLIGATIONS OF THE CUSTOMER

*Parent and Service Providers, in their sole discretion, expressly reserve the right to freeze, delete, suspend, deny, cancel, modify, take ownership of or transfer any Domain Order, in order to comply with any applicable Dispute policies, requests of law enforcement, or in compliance with any Court Orders, or if Parent or Service Providers in their sole discretion determine that the information associated with the Domain Order is inaccurate, or has been tampered with, or has been modified without authorization, or if Parent or Service Providers in their sole discretion determine that the Domain Order ownership should belong to another entity, or if Customer/Customer/Registrant does not comply with any applicable terms and conditions, standards, policies, procedures, and practices laid down by Parent, Service Providers, ICANN, the Registrar and the Registry Operator. The Customer agrees that Parent and Service Providers, and the contractors, employees, directors, officers, representatives, agents and affiliates, of Parent and Service Providers, are not liable for loss or damages that may result from any of the above.*

Required to abide by the agreement with ICANN for accreditation.

From the ICANN Registration Accreditation Agreement (RAA):

*3.7.7.9 The Registered Name Holder shall represent that, to the best of the Registered Name Holder's knowledge and belief, neither the registration of the Registered Name nor the manner in which it is directly or indirectly used infringes the legal rights of any third party.*

*1.13 "Illegal Activity" means conduct involving use of a Registered Name sponsored by Registrar that is prohibited by applicable law and/or exploitation of Registrar's domain name resolution or registration services in furtherance of conduct involving the use of a Registered Name sponsored by Registrar that is prohibited by applicable law.*

*5.5 Termination of Agreement by ICANN. This Agreement may be terminated ...* [if the]
*Registrar .. is convicted by a court of competent jurisdiction of a felony or other serious offense related to financial activities, or is judged by a court of competent jurisdiction to have:*
...

 *with actual knowledge (or through gross negligence) permitted Illegal Activity in the registration or use of domain names or in the provision to Registrar by any Registered Name Holder of inaccurate Whois information*

# Actual Behavior

Usually acts rapidly to remove illegal sites. But in 2014 this registrar
failed to act on fraud domains. By August 2014 all detected sites were reported and suspended.
In 2017-2018 Netlynx had rapidly suspended all fraud pharmacy domains reported.

# Registrar responsiveness

Showing all registrars including R01.RU

Showing all registrars excluding R01.RU

Piechart showing the crime sponsoring contribution by each registrar.

The comparison between this registrar and others can be seen on the graphs.

It shows how many domains have *not* been suspended by various registrars over the past year.
The higher the column, the more domains are sponsored by the registrar.

Currently the most abused registrar is Russia's R01.ru.
This registrar sponsors the vast majority (often over 60%) of the fraud domains used within the Eva Pharmacy group.

The second most abused registrar is Russia's REG.RU REG.RU at over 25%

The next most abused registrar is GKG GKG at 4%.

The next most abused registrar is The Netherlands' Hosting Concepts aka OpenProvider at 3%.

These are followed by Russia's ARDIS, India's PublicDomainRegistry PDR, China's CNOBIN, Canada's Tucows, and Pakistan's PakNIC.

Outside of Russia, most registrars have been quick to terminate the service contracts with these cyber-criminals upon seeing the obvious evidence of fraud.

# Sample illegal domains

These were all part of the pharmacy fraud network centered in Russia, known as EvaPharmacy.

They were checked and found to be live on
May 13, 2015.
Domains had false registrant details, which breaks the above customer obligations, *that the information associated with the Domain Order (must not be} inaccurate*

The registrant details are generated using a well known fake identity generator.
This has been the case for thousands of false registrants for other fraud domains.

See Netlynx\_list

## Canadian Health&Care Mall

```
curativecareelement.in (suspended)
fastmedicatinggroup.in (suspended)
firsthealthmart.in (suspended)
goodcareexchange.com (suspended)
homemedicalonlinereward.in (suspended)
hothealingpurchase.in (suspended)
magicdrugmart.in (suspended)
magicnaturalmart.com (suspended)
medicatingrxreward.in (suspended)
onlineorganiceshop.in (suspended)
cxtzhwqt.com (suspended)
fastcarepurchase.in (suspended)
firstherbassist.in (suspended)
firstmedsservice.in (suspended)
healingherbsservice.in (suspended)
llfinfbe.in (suspended)
luckynaturalvalue.in (suspended)
perfectcuringmarket.com (suspended)
smartremedialworth.in (suspended)
bestandworstwwe.com (suspended)
globalremedyassist.in (suspended)
herbalprivategroup.in (suspended)
mymedicinalstore.in (suspended)
onlinecuringbargain.in (suspended)
organicpillpurchase.in (suspended)
theorganicherbstore.com (suspended)
cwhbaejb.com (suspended)
curativefastassist.com (suspended)
globalcuringvalue.in (suspended)
globalpillsservice.in (suspended)
goodherbsdeal.in (suspended)
herbaltabletbargain.in (suspended)
hothealthcaremall.in (suspended)
medicalsafetrade.in (suspended)
mygenericbargain.in (suspended)
smarthealingcompany.com (suspended)
thecanadiandeal.in (suspended)
thehealingquality.com (suspended)
vslhnzlf.com (suspended)
yourorganictrade.com (suspended)
curingremedygroup.com (suspended)
herbalpillmall.com (suspended)
jhcurorf.com (suspended)
luckymedsservice.com (suspended)
naturaldrugassist.com (suspended)
oliytabbi.com (suspended)
securehealthexchange.com (suspended)
tixnuofa.com (suspended)
bamsxgsk.com (suspended)
fastdrugsvalue.com (suspended)
healingfasteshop.com (suspended)
devicesmarket.com (suspended)
genericherbsupply.com (suspended)
securemedicareshop.com (suspended)
curinghotdeal.com (suspended)
fnfxbthv.com (suspended)
fuhdqqdt.com (suspended)
gkjhtxdb.com (suspended)
gwmnbxwz.com (suspended)
wqosfyxk.com (suspended)

```

## Canadian Neighbor Pharmacy

```
medicativefastinc.in (suspended)
naturalremedyshoponline.com (suspended)
curingmedsbuy.com (suspended)
fastcaremarket.com (suspended)
magicgenericinc.com (suspended)
safemedicinalgrouponline.com (suspended)

```

## Men's Health

```
hotmedicinalstore.com (suspended)

```

## RxExpressOnline

```
henriettacharlene.com (suspended)
bonnylaurie.com (suspended)
brennjacky.com (suspended)
fasthealingeshop.com (suspended)
kelseytrixie.com (suspended)
kimberlynaleta.com (suspended)
maiblereta.com (suspended)
medicaldruginc.com (suspended)
medicativefirstsale.com (suspended)
remedialhotelement.com (suspended)
willieabigail.com (suspended)
hometabletmall.com (suspended)
onlinepillvalue.com (suspended)

```

## RxMedications

```
privateherbvalue.com (suspended)
trustedherbquality.com (suspended)

```

## My Canadian Pharmacy

```
luckyherbalelement.in (suspended)
curingfamilymall.com (suspended)
genericsafepurchase.com (suspended)
homeherbalmall.com (suspended)
hotpillsstore.com (suspended)
hottabsservice.com (suspended)
normansmart.com (suspended)
newcanadianmart.com (suspended)
privatemedicalinc.com (suspended)
purepillsgroup.com (suspended)

```

## CanadianPharmacy

```
genericherbstore.in (suspended)
onlinepillinc.in (suspended)
safemedicalgood.in (suspended)
homemedsquality.in (suspended)
luxuryhomeherbalassist.in (suspended)

```

# Common IP addresses

A quick way to verify these sites is to examine the hosting addresses. Note that \* items have been removed.
Many compromised hosts used for this operation during September 2020 - May 2021 were located at these IPs.

Where to contact the compromised hosting ISP:

```
Abuse contact for '5.2.88.0 - 5.2.89.255' is 'alvaro.montero@ipcore.com'
Abuse contact for '5.45.80.0 - 5.45.83.255' is 'abuse@ispiria.net'
Abuse contact for '5.101.140.64 - 5.101.140.95' is 'abuse@ukservers.com'
Abuse contact for '5.181.158.0 - 5.181.158.255' is 'abuse@mivocloud.com'
Abuse contact for '5.133.8.0 - 5.133.15.255' is 'abuse@artnet.pl'
Abuse contact for '5.187.48.0 - 5.187.55.255' is 'abuse@artnet.pl'
Abuse contact for '5.188.211.0 - 5.188.211.255' is 'abuse@pindc.ru'
Abuse contact for '5.253.60.0 - 5.253.63.255' is 'abuseto@adminvps.ru' (Removed)
Abuse contact for '27.124.80.0 - 27.124.95.255' is 'abuse@medialink.net.id'
Abuse contact for '31.200.247.0 - 31.200.247.255' is 'ripe@unelink.com'
Abuse contact for '37.46.132.0 - 37.46.135.255' is 'abuse@abusehost.ru'
Abuse contact for '45.67.116.0 - 45.67.116.255' is 'abuse@itns.md'
Abuse contact for '45.86.163.0 - 45.86.163.255' is 'support@crowncloud.net'
Abuse contact for '45.125.65.0 - 45.125.65.255' is 'abuse@tele-asia.net'
Abuse contact for '45.131.83.0 - 45.131.83.255' is 'abuse@sered.net'
Abuse contact for '51.89.148.0 - 51.89.151.255' is 'abuse@ovh.net'
Abuse contact for '79.172.193.0 - 79.172.193.255' is 'abuse@deninet.hu' (Removed)
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '82.199.104.0 - 82.199.107.254' is 'abuse@seven-sky.net'
Abuse contact for '84.15.136.0 - 84.15.143.255' is 'abuse@bi.lt'
Abuse contact for '84.200.77.0 - 84.200.77.255' is 'abuse@accelerated.de' (Removed)
Abuse contact for '85.254.72.0 - 85.254.72.255' is 'support@serveria.com'
Abuse contact for '87.120.253.0 - 87.120.253.255' is 'abuse@neterra.net'
Abuse contact for '89.105.192.0 - 89.105.223.255' is 'abusedesk@novoserve.com'
Abuse contact for '89.222.128.0 - 89.222.131.255' is 'abuse@netorn.net' 'abuse@netorn.ru'
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '93.119.104.0 - 93.119.105.255' is 'abuse@virtono.com'
Abuse contact for '94.152.0.0 - 94.152.255.255' is 'abuse@kei.pl'
Abuse contact for '94.156.175.0 - 94.156.175.255' is 'abuse@iws.co'
Abuse contact for '95.24.0.0 - 95.31.255.255' is 'abuse-b2b@beeline.ru'
Abuse contact for '95.84.128.0 - 95.84.159.255' is 'abuse@rt.ru'
Abuse contact for '95.165.128.0 - 95.165.255.255' is 'abuse@spd-mgts.ru'
Abuse contact for '103.6.204.0 - 103.6.207.255' is 'yogie@redwhite.co.id'
Abuse contact for '103.9.156.0 - 103.9.159.255' is 'cuong.trinh@vnso.vn'
Abuse contact for '103.28.148.0 - 103.28.149.255' is 'support@easyway.co.id'
Abuse contact for '103.56.148.0 - 103.56.149.255' is 'abuse@jagoanhosting.com'
Abuse contact for '103.86.48.0 - 103.86.48.255' is 'abuse@bangmodhosting.com'
Abuse contact for '103.92.24.0 - 103.92.27.255' is 'hm-changed@vnnic.vn' 'system@tlsoft.vn'
Abuse contact for '103.117.141.0 - 103.117.141.255' is 'abuse@casbay.com'
Abuse contact for '103.121.88.0 - 103.121.91.255' is 'tampd@bkns.vn'
Abuse contact for '103.126.6.0 - 103.126.7.255' is 'shazim@serverstack.in'
Abuse contact for '103.138.96.0 - 103.138.96.255' is 'hello@hostitsmart.in'
Abuse contact for '103.146.22.0 - 103.146.23.255' is 'duc@lanit.com.vn'
Abuse contact for '103.147.152.0 - 103.147.153.255' is 'abuse@shineservers.com'
Abuse contact for '103.221.220.0 - 103.221.223.255' is 'hoanglong@azdigi.com'
Abuse contact for '103.236.201.0 - 103.236.201.255' is 'admin@idcloudhost.com'
Abuse contact for '111.90.128.0 - 111.90.159.255' is 'abuse@shinjiru.com.my'
Abuse contact for '112.78.0.0 - 112.78.15.255' is 'vanht@ods.vn'
Abuse contact for '130.185.72.0 - 130.185.72.255' is 'report@parspack.com'
Abuse contact for '119.59.96.0 - 119.59.127.255' is 'abuse@metrabyte.cloud'
Abuse contact for '141.98.10.0 - 141.98.10.255' is 'admin@serveroffer.lt'
Abuse contact for '146.247.49.0 - 146.247.49.255' is 'abuse@netcetera.co.uk'
Abuse contact for '159.148.186.0 - 159.148.186.255' is 'support@serveria.com'
Abuse contact for '159.148.0.0 - 159.148.255.255' is 'abuse@latnet.eu'
Abuse contact for '171.224.0.0 - 171.255.255.255' is 'hm-changed@vnnic.vn' 'soc@viettel.com.vn'
Abuse contact for '176.123.0.0 - 176.123.11.255' is 'abuse@alexhost.com'
Abuse contact for '178.239.176.0 - 178.239.177.255' is 'abuse@irideos.it'
Abuse contact for '178.255.40.232 - 178.255.40.235' is 'abuse@artnet.pl'
Abuse contact for '179.43.149.0/26' is 'support@privatelayer.com'
Abuse contact for '180.131.144.0 - 180.131.147.255' is 'abuse@nawala.org'
Abuse contact for '185.24.232.0 - 185.24.232.255' is 'abuse@servebyte.com'
Abuse contact for '185.128.40.0 - 185.128.43.255' is 'abuse@rackend.net'
Abuse contact for '185.130.206.0 - 185.130.207.255' is 'abuse@as61317.net'
Abuse contact for '185.140.248.0 - 185.140.249.255' is 'contact@buzinessware.com'
Abuse contact for '185.183.104.0 - 185.183.104.255' is 'abuse@m247.ro'
Abuse contact for '194.5.176.0 - 194.5.179.255' is 'berbid238@gmail.com'
Abuse contact for '200.55.243.166'  is 'radhios*@*gmail.com' syt.com web page
Abuse contact for '202.145.0.0 - 202.145.3.255' is 'abuse@uninet.net.id'
Abuse contact for '209.127.0.0 - 209.127.138.255' is 'abuse@servermania.com'

```

Example of the highest used IP addresses from November 2020

# Description of the Registrar

Netlynx provides reliable, cost effective and high quality Domain Name Registration and Domain Transfer Services duly complemented with full technical and customer support.

# Where to send abuse complaints

## By email

support*@*netlynx*.*com

abuse*@*netlynx*.*com

## By contact page

http://www.netlynx.com/contact.htm

Report false registration details

http://www.netlynx.in/support/report-false-whois.php

# Additional Contact Information

The CEO is Pankaj Jaiswal

* Twtter:[ https://twitter.com/Pankajjaiswal9 ]
* Home page: [ http://www.pankajjaiswal.com/ ]
* Email [ pankaj*@*jaiswal*.*in ]

## Postal address

Head Office:

Netlynx Technologies Pvt. Ltd.

103, Tirupati Udyog Premises, I. B. Patel Road,

Off. Western Express Highway,

Near HP Petrol Pump. Goregaon

East. Mumbai - 400063

# Telephone and FAX

Tel: +91 22 40811144 / +91 22 40811133

Fax: +91 22 40811100

## Related information

Pharmacy fraud operations

* Canadian\_Health&Care\_Mall
* Canadian\_Neighbor\_Pharmacy
* My\_Canadian\_Pharmacy
* Toronto\_Drug\_Store
* Canadian\_Family\_Pharmacy
* RxMedications
* RxExpressOnline
* WikiPharmacy
* International\_Legal\_RX
* US\_Drugs
* Men Health
* OEM Software

Affiliate program coordinator employing spammers

* EvaPharmacy