R01-RU

R01**R01** is a registrar in Russia. *Регистратор R01*

# Description of the Registrar

Registrar R01 - domain name registrar belonging to the group of companies "Hosting Community". The company became the first accredited registrar in the RU national domain and today offers a wide range of professional services, being one of the leaders in terms of the number of registered domains for .RU .SU and .рф.

*Регистратор R01 — регистратор доменных имен, входящий в группу компаний Hosting Community. Компания стала первым аккредитованным регистратором в национальном домене RU и сегодня предоставляет широкий спектр профессиональных услуг, являясь одним из лидеров по количеству регистрируемых доменов .RU, .SU и .РФ.*

## Actual Behavior

R01 is widely abused by the Russian EvaPharmacy fraud operation.

R01 ignores all requests to suspend illegal domains. Domains are only suspended at the expiry date.

*R01 широко злоупотребляли Российской EvaPharmacy мошеннической операции.*

*R01 игнорирует все просьбы приостановить незаконные доменов. Домены только приостанавливается на срок годности.*

# Registrar responsiveness

Showing all registrars including R01.RU

Showing all registrars excluding R01.RU

Piechart showing the crime sponsoring contribution by each registrar.

The comparison between this registrar and others can be seen on the graphs.

It shows how many domains have *not* been suspended by various registrars over the past year.
The higher the column, the more domains are sponsored by the registrar.

Currently the most abused registrar is Russia's R01.ru.
This registrar sponsors the vast majority (often over 60%) of the fraud domains used within the Eva Pharmacy group.

The second most abused registrar is Russia's REG.RU REG.RU at over 25%

The next most abused registrar is GKG GKG at 4%.

The next most abused registrar is The Netherlands' Hosting Concepts aka OpenProvider at 3%.

These are followed by Russia's ARDIS, India's PublicDomainRegistry PDR, China's CNOBIN, Canada's Tucows, and Pakistan's PakNIC.

Outside of Russia, most registrars have been quick to terminate the service contracts with these cyber-criminals upon seeing the obvious evidence of fraud.

Сравнение между этим регистратором и другие можно увидеть на графике.

Она показывает, сколько доменов не были приостановлены по различным регистраторам за прошедший год.

Чем выше столбец, тем больше доменов спонсируются регистратора.

В настоящее время наиболее распространенным регистраторы Индии Netlynx и России R01.ru и Naunet

Этих трех регистраторов спонсор подавляющее большинство мошеннических доменов, используемых в рамках Eva Pharmacy

Другие регистраторы были быстры, чтобы расторгнуть договоры на обслуживание с эти кибер-преступники, видя очевидные факты фальсификаций.

Нажмите на график чтобы увеличить ее.

# Examples of domains used for fraud

**Click on any heading for evidence of fraud.**

Over 1,000 domains with false registrant information is listed at R01-RU\_list

# Common IP addresses

A quick way to verify these sites is to examine the hosting addresses. Note that \* items have been removed.
Many compromised hosts used for this operation during September 2020 - May 2021 were located at these IPs.

Where to contact the compromised hosting ISP:

```
Abuse contact for '5.2.88.0 - 5.2.89.255' is 'alvaro.montero@ipcore.com'
Abuse contact for '5.45.80.0 - 5.45.83.255' is 'abuse@ispiria.net'
Abuse contact for '5.101.140.64 - 5.101.140.95' is 'abuse@ukservers.com'
Abuse contact for '5.181.158.0 - 5.181.158.255' is 'abuse@mivocloud.com'
Abuse contact for '5.133.8.0 - 5.133.15.255' is 'abuse@artnet.pl'
Abuse contact for '5.187.48.0 - 5.187.55.255' is 'abuse@artnet.pl'
Abuse contact for '5.188.211.0 - 5.188.211.255' is 'abuse@pindc.ru'
Abuse contact for '5.253.60.0 - 5.253.63.255' is 'abuseto@adminvps.ru' (Removed)
Abuse contact for '27.124.80.0 - 27.124.95.255' is 'abuse@medialink.net.id'
Abuse contact for '31.200.247.0 - 31.200.247.255' is 'ripe@unelink.com'
Abuse contact for '37.46.132.0 - 37.46.135.255' is 'abuse@abusehost.ru'
Abuse contact for '45.67.116.0 - 45.67.116.255' is 'abuse@itns.md'
Abuse contact for '45.86.163.0 - 45.86.163.255' is 'support@crowncloud.net'
Abuse contact for '45.125.65.0 - 45.125.65.255' is 'abuse@tele-asia.net'
Abuse contact for '45.131.83.0 - 45.131.83.255' is 'abuse@sered.net'
Abuse contact for '51.89.148.0 - 51.89.151.255' is 'abuse@ovh.net'
Abuse contact for '79.172.193.0 - 79.172.193.255' is 'abuse@deninet.hu' (Removed)
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '82.199.104.0 - 82.199.107.254' is 'abuse@seven-sky.net'
Abuse contact for '84.15.136.0 - 84.15.143.255' is 'abuse@bi.lt'
Abuse contact for '84.200.77.0 - 84.200.77.255' is 'abuse@accelerated.de' (Removed)
Abuse contact for '85.254.72.0 - 85.254.72.255' is 'support@serveria.com'
Abuse contact for '87.120.253.0 - 87.120.253.255' is 'abuse@neterra.net'
Abuse contact for '89.105.192.0 - 89.105.223.255' is 'abusedesk@novoserve.com'
Abuse contact for '89.222.128.0 - 89.222.131.255' is 'abuse@netorn.net' 'abuse@netorn.ru'
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '93.119.104.0 - 93.119.105.255' is 'abuse@virtono.com'
Abuse contact for '94.152.0.0 - 94.152.255.255' is 'abuse@kei.pl'
Abuse contact for '94.156.175.0 - 94.156.175.255' is 'abuse@iws.co'
Abuse contact for '95.24.0.0 - 95.31.255.255' is 'abuse-b2b@beeline.ru'
Abuse contact for '95.84.128.0 - 95.84.159.255' is 'abuse@rt.ru'
Abuse contact for '95.165.128.0 - 95.165.255.255' is 'abuse@spd-mgts.ru'
Abuse contact for '103.6.204.0 - 103.6.207.255' is 'yogie@redwhite.co.id'
Abuse contact for '103.9.156.0 - 103.9.159.255' is 'cuong.trinh@vnso.vn'
Abuse contact for '103.28.148.0 - 103.28.149.255' is 'support@easyway.co.id'
Abuse contact for '103.56.148.0 - 103.56.149.255' is 'abuse@jagoanhosting.com'
Abuse contact for '103.86.48.0 - 103.86.48.255' is 'abuse@bangmodhosting.com'
Abuse contact for '103.92.24.0 - 103.92.27.255' is 'hm-changed@vnnic.vn' 'system@tlsoft.vn'
Abuse contact for '103.117.141.0 - 103.117.141.255' is 'abuse@casbay.com'
Abuse contact for '103.121.88.0 - 103.121.91.255' is 'tampd@bkns.vn'
Abuse contact for '103.126.6.0 - 103.126.7.255' is 'shazim@serverstack.in'
Abuse contact for '103.138.96.0 - 103.138.96.255' is 'hello@hostitsmart.in'
Abuse contact for '103.146.22.0 - 103.146.23.255' is 'duc@lanit.com.vn'
Abuse contact for '103.147.152.0 - 103.147.153.255' is 'abuse@shineservers.com'
Abuse contact for '103.221.220.0 - 103.221.223.255' is 'hoanglong@azdigi.com'
Abuse contact for '103.236.201.0 - 103.236.201.255' is 'admin@idcloudhost.com'
Abuse contact for '111.90.128.0 - 111.90.159.255' is 'abuse@shinjiru.com.my'
Abuse contact for '112.78.0.0 - 112.78.15.255' is 'vanht@ods.vn'
Abuse contact for '130.185.72.0 - 130.185.72.255' is 'report@parspack.com'
Abuse contact for '119.59.96.0 - 119.59.127.255' is 'abuse@metrabyte.cloud'
Abuse contact for '141.98.10.0 - 141.98.10.255' is 'admin@serveroffer.lt'
Abuse contact for '146.247.49.0 - 146.247.49.255' is 'abuse@netcetera.co.uk'
Abuse contact for '159.148.186.0 - 159.148.186.255' is 'support@serveria.com'
Abuse contact for '159.148.0.0 - 159.148.255.255' is 'abuse@latnet.eu'
Abuse contact for '171.224.0.0 - 171.255.255.255' is 'hm-changed@vnnic.vn' 'soc@viettel.com.vn'
Abuse contact for '176.123.0.0 - 176.123.11.255' is 'abuse@alexhost.com'
Abuse contact for '178.239.176.0 - 178.239.177.255' is 'abuse@irideos.it'
Abuse contact for '178.255.40.232 - 178.255.40.235' is 'abuse@artnet.pl'
Abuse contact for '179.43.149.0/26' is 'support@privatelayer.com'
Abuse contact for '180.131.144.0 - 180.131.147.255' is 'abuse@nawala.org'
Abuse contact for '185.24.232.0 - 185.24.232.255' is 'abuse@servebyte.com'
Abuse contact for '185.128.40.0 - 185.128.43.255' is 'abuse@rackend.net'
Abuse contact for '185.130.206.0 - 185.130.207.255' is 'abuse@as61317.net'
Abuse contact for '185.140.248.0 - 185.140.249.255' is 'contact@buzinessware.com'
Abuse contact for '185.183.104.0 - 185.183.104.255' is 'abuse@m247.ro'
Abuse contact for '194.5.176.0 - 194.5.179.255' is 'berbid238@gmail.com'
Abuse contact for '200.55.243.166'  is 'radhios*@*gmail.com' syt.com web page
Abuse contact for '202.145.0.0 - 202.145.3.255' is 'abuse@uninet.net.id'
Abuse contact for '209.127.0.0 - 209.127.138.255' is 'abuse@servermania.com'

```

Example of the highest used IP addresses from November 2020

# Where to send abuse complaints

* Customer Information: +7 (495) 783-3-783; info@r01.ru
* Technical support: +7 (495) 783-3-783; support@r01.ru
* response@cert-gib.ru
* Web site https://partner.r01.ru/contact\_admin.khtml?SID (but sends the complaint to the registrant)

# Additional Contact Information

Applications, which can seriously affect the functionality of your services, are performed only by an authorized request. You can send an authorized request through section https://partner.r01.ru "Contact Us".

Sincerely, Department of Customer R01
(RU-CENTER Group)
Phone: +7 495 783-3-783
8800 775-37-83 (for Russian regions)
Fax: +7 (495) 930-88-00

## Postal address

Headquarters: Moscow, Leningrad Prospect, 74, Building 4

## Telephone and FAX

* General +7 (495) 783-3-783
* Regions 8 (800) 775-3-783

## Related information

Pharmacy fraud operations

* Canadian\_Health&Care\_Mall
* Canadian\_Neighbor\_Pharmacy
* My\_Canadian\_Pharmacy
* Toronto\_Drug\_Store
* Canadian\_Family\_Pharmacy
* WikiPharmacy
* International\_Legal\_RX
* US\_Drugs
* Men Health
* RxMedications
* OEM Software

Affiliate program coordinator employing spammers

* EvaPharmacy

# Sources for this article

## Independent

InBoxRevenge Eva Pharmacy campaign

Rogues and Champions report