PharmacyMall

Information here will describe the versions found in 2017-2020, which have varying title lines, but the same contact phone numbers.

## Description

There are 4 brands that belong to the same family of fake pharmacies. Contact phone numbers in common are US +1 718 487 9792 and UK +4420 3239 7092.

* PharmacyMall
* Canadian X Pharmacy
* HappyFamilyStore
* TrustPharmacy

These are 4 pharmacies all belonging to the same affiliate program. Each has a different appearance ("skin") but shares the same characteristics. The skins are readily interchangeable.

Note: Canadian X Pharmacy is so named because the banner has the words "Canadian" and "Pharmacy" but between them is an image of a man with arms crossed and folded.

### Common features

What they have in common:

1. Help desk phone numbers (which are always busy)

* US: +1 (888) 243-74-06
* GB: +44 (800) 041-87-44
* US +1-718-487-9792 (always busy)
* UK +4420-3239-7092 (valid, but the owner is not associated with any pharmacy)

2. Trailer lines at the bottom of the web page

* 2020 Canadian Pharmacy Ltd. All rights reserved
* © 2001-2019 Canadian Pharmacy Ltd. All rights reserved.
* Canadian Pharmacy Ltd. is licensed online pharmacy.

3. Followed by a pseudo license, currently
"International license number XXXXXXXX issued 17 aug 2019"

```
var s3 = "International license number 1"+"0"+"3"+"1"+"0"+"1"+"1"+"1 issued 17 aug " + var_date_y_l;

```

where XXXXXXXX varies across a range of random numbers, for example

```
11111010
11511697
11597108
49115116
50521205
50521111
98101115
98111117
99971109

```

Note: The date 17 aug 2019 is usually programmed to automatically roll over to 17 aug 2020 on January 1 2020. It is faked.

4. All 4 skins select from a limited pool of title lines. Some of these are -

1. Big Sale: -80% off on all meds. Time Limited Offer.
2. Buy Cheap Medication Online
3. Buy Medication Online: Fast Delivery, High Quality, Lowest Prices, Discounts
4. Buying medication online without prescription
5. Cheap Medicine and Fast Delivery
6. Compra farmaci online senza prescrizione
7. Online Pharmacy, Lowest Prices
8. Online Pharmacy: generic and brand medication
9. Order Medication Online: Antibiotics, Pain Relief, Skin Care

5. All sites previously used the same checkout, secure-bills.net and in 2018/2019/2020 safe-payment.net or payments-page.com

Domain secure-bills.net was set up the day that its predecessor,
secure-bill.net was suspended by registrar Eranet International Limited in November.

Those former checkout pages have ceased to function.

* Suspension of secure-bill.net: 2017-11-27 T11:18:36Z
* Creation of secure-bills.net 2017-11-27 T12:26:30Z
* Creation of safe-pay.net 2018-09-14 with Registrar: Hosting Concepts B.V. d/b/a Openprovider, certificate from COMODO from 17 Oct 2018

The registrant ID is privacy protected, but a verification will show that it is false.

## False Pretenses

Most sites display authorization images, from reputation services. They are faked. There is no click-through to the service, just the theft of their copyrighted logo. Examples

* Certified Canadian International Pharmacy (CIPA)
* Manitoba International Pharmacists Association (MIPA)
* FDA

## Registrars

They abuse a wide range of registrars. The most prevalent in descending order of frequency are

* GKG.Net, Inc.
* Rebel.com
* GoDaddy.com, LLC
* BIZCN.COM, INC.
* JSC Registrar R01
* Hosting Concepts
* TurnCommerce
* DOMAINCONTEXT
* NameCheap Inc.
* GuangDong NaiSiNiKe
* REG.RU
* PakNIC (Private) Limited
* NICENIC

## Hosting IP addresses

Some of the most used IP hosting addresses are

* 185.234.217.112 (World Hosting Farm)
* 109.236.81.38 (Worldstream, NL)
* 109.236.81.39 (Worldstream, NL)
* 109.236.81.41 (Worldstream, NL)
* 54.156.228.81 (Amazon AWS)
* 52.6.177.174 (Amazon AWS)
* 54.208.21.117 (Amazon AWS)

Contacts are abuse*@*worldstream.nl and abuse*@*amazonaws.com abuse*w*orldhostingfarm.com