US Pharmacy

## Description

US Pharmacy exploits many different methods of redirections to try to escape detection by spam filters.

## Controlled Substances

The front page of all US Pharmacy sites we've seen so far offers the following controlled substances:

```
Hyrdocodone
750mg Tablets
$7.22 per pill
30 X 750mg $311.61 $239.7

Vicodin ES
750mg Tablets
$7.22 per pill
30 X 750mg $311.61 $239.7

Phentermine
Phentermine HCL
37.5mg Tablets
$3.88 per pill
30 X 37.5mg $254.74 $195.95

Ambien
Zolpidem Tartrate
10mg Tablets
$2.78 per pill
30 X 10mg $153.34 $117.95

Valium
diazepam
10mg Tablets
$2.67 per pill
30 X 10mg $135.14 $103.95

Ultram
Tramadol HCL
50mg Tablets
$1.67 per pill

Xanax
Alprazolam
1mg Tablets
$2.09 per pill

```

"Hydrocodone" (the correct spelling) is defined by the US Food and Drug Administration (FDA) as a Schedule II narcotic (the category of the highest abuse potential legal drugs). When sold as a combination preparation, it is a controlled substance. Typical combination preparations would be hydrocodone combined with acetaminophen (paracetamol) or included as part of a cough syrup; those combined substances limit the ways the hydrocodone can be abused.

Vicodin ES is a combination of hydrocodone and acetaminophen and is therefore Schedule III. For Vicodin ES, the usual dose is one tablet, up to a maximum of five tablets per day. It is only recommended to take this drug (as well as hydrocodone) under the strict recommendations and instructions of a doctor or pharmacist.

Ambien (zolpidem) and Xanax (alprazolam) are drugs in the benzodiazepine class (antianxiety/sleep medications) defined by the FDA as Schedule IV controlled substances.

Phentermine is a Schedule IV stimulant medication used as an appetite suppressant. It is perhaps best known as being half of the "fen/phen" combination that led to sometimes fatal damage to the blood vessels of the lungs.

Ultram (also known as tramadol) is not classified as a controlled substance but can be addictive in some people.

Further reading:
Schedule III (US)
Schedule IV (US)

Controlled substances are considered by the FDA and the international medical community to have a risk of addiction. The FDA classifies them from Schedule V (mildest abuse potential) to Schedule I (highest abuse potential drugs which may not be legally sold in the US).

Narcotics and benzodiazepines suppress the drive to breathe. In high doses or in combination with other drugs with the same side effects (like alcohol), they can cause respiratory arrest leading to death or brain damage. Addiction is a very strong possibility when used improperly. Many deaths also occur in people who increase their dose of combination products to get a stronger effect, leading to destruction of the liver from an overdosage of the acetaminophen component -- an effect also more likely in combination with alcohol.

Sale of these substances via illegal means, without prescription or any advice from any medical professional is a serious offence in numerous countries around the world.

## False Claims

The usual deceit, see http://rx-discount.biz/instant\_privacy.html

```
Our site meets the highest security and privacy standards for both e-commerce and personal information.
Providing a secure shopping experience is one of our top priorities. US Pharmacy has advanced security
measures that protect the loss, misuse, and alteration of the information under our control. We use
Secure Socket Layer (SSL) technology for the areas of our site where we ask you to provide personally
identifiable information. SSL technology guarantees that the personal information you give us will be
transmitted safely because the information is encrypted. Encryption involves systematically scrambling
numbers and letters so that if someone managed to intercept a packet of information, they would not be
able to make sense of it.

```

Go to checkout and it first displays  and then you are on a page such as **http**://pure-best.com/instant\_details.php (not https, not secure).

Notice the fake padlock and false claim "100% Secure"

Another sure indicator that the site is fraudulent is in the first medication in the sales list. It shows as hyrdocodone > > << No self respecting pharmacy would make such a fundamental spelling error when listing its products.

### Domain names

* pure-best.com
* discount-meds.info
* discounted-rx.info
* rx-discount.biz
* mydiscount-rx.net
* mydiscount-rx.com
* top100medicines.com
* discoverydynamic.com
* expressmediroad.com
* starpharmline.com
* comfortpharm.com
* qualityoptimum.com
* vigorouscreation.com
* soothingmeds.com
* omgsupermedicals.com
* discoveyamazing.com

mydiscount-rx.com was already deleted on Nov 16, 2005, and registered later at a different registrar.

In 2008, this spam brand was seen abusing **blogspot.com** by using redirections. Examples:

```
Get the pain meds you want
http://zutulobo05507.blogspot.com/

```

```
Get the pain meds you want
http://pokowixa53976.blogspot.com/

```

```
Living in Pain. We can help
Pain Meds Online
http://govynyve88242.blogspot.com/

```

All of which point to:
http://top100medicines.com/

These blogspot abuses can be reported for removal at:
Blogger Abuse Reporting

The redirected site can be reported using Complainterator.

In mid-January of 2008, their domains were not capable of being searched via WHOIS, since the operators of these sites chose to allow only their special whois domain to provide WHOIS results. Unfortunately that WHOIS domain (whois.paycenter.com.cn) was unreachable. This is in violation of ICANN accreditation rules.

### Name servers

Example - pure-best.com

```
Domain Name: PURE-BEST.COM
Registrar: XIN NET TECHNOLOGY CORPORATION
Whois Server: whois.paycenter.com.cn
Referral URL: http://www.xinnet.com
Name Server: NS1.RELIABLEMARVELOUSLY.COM
Name Server: NS2.RELIABLASTONISHINGLY.COM
Name Server: NS3.ABSOFINEST.COM
Name Server: NS4.RELIABLEMARVELOUSLY.COM
Name Server: NS5.RELIABLASTONISHINGLY.COM
Name Server: NS6.ABSOFINEST.COM
Status: ok

```

```
Administrative Contact:
fdgdfh dfgh
       dfy dry
       dryhrft ftuhrtfuh
       dfgdr ftyht Hunan 564343
       China
       tel: 86 4365 54645745656
       fax: 86 5656 56457645567
       tdyrdgdf@5263.com

```

The same obviously fake registrant details were used for the registration of all 3 name server domains.

Some spamvertized domains had their own domain as the nameserver, using one of two machines: 124.236.247.170 or 58.18.33.246. For example:

ns2.discount-meds.info 124.236.247.170

ns1.discount-meds.info 124.236.247.170

ns9.discount-meds.info 58.18.33.246

ns8.discount-meds.info 58.18.33.246

**Block List Records**

124.236.247.170 is listed under SBL56156 and contains the comment "Not Yambo?". This is our impression as well. US Drugs would appear to be a copycat Yambo.

This IP is also on the following blocklists:

* dnsbl.sorbs.net http://www.dnsbl.nl.sorbs.net/ dnsbl.sorbs.net
* sbl-xbl.spamhaus.org http://sbl-xbl.spamhaus.org sbl-xbl.spamhaus.org
* sbl.spamhaus.org http://www.spamhaus.org/sbl/ sbl.spamhaus.org
* spam.dnsbl.sorbs.net http://www.dnsbl.nl.sorbs.net/ spam.dnsbl.sorbs.net

This IP is registered in Beijing, China (CHINANET hebei province network).

## Samples of the spam

Below is a spam received on Wed, 04 Jul 2007 00:44:05 -0400

```
Subject: Do you need Viagra?

SaVE BiG by 0rdering all of your Favorite RxMeds 0nline!
With fast discreet trackable FedEX shipping!
N0 Prescripti0n Needed!
0rder Now at --> " Discount-Meds .info "

```

## History

The sites listed were registered on registrar Gandi and removed by the registrar shortly after being reported for spamming.

```
* discount-meds.info
* discounted-rx.info
* rx-discount.biz
* mydiscount-rx.net
* mydiscount-rx.com

```

## How to Report this Spam

The spammed domain name can be reported using the Complainterator which will direct an email both to the registrar of the site, and the registrar of the domain name servers that act as the gateway to the sites.

If the spam is using blogspot redirection, report it using Blogger Abuse Reporting

## Related Spams

### Penis Pro

First observed December 2007, Penis Pro is yet another site promising enlargement, apparently on the idea that all the men who had no results from the other products will still be willing to believe that some other product will work. They helpfully provide a link to US Pharmacy for people who need other medications.

International Rx is the sister-site to US Pharmacy, offering (again) almost exclusively controlled pharmaceuticals, in violation of US, UK and Canadian law.

## Sponsor Organization

Gang Productions is the  sponsor organization behind this type of site. They knowingly pay spammers to promote these sites, and they don't shut down illegal spammers.

Category:Well-known Spam

Category:Spam Sponsoring Companies