Viagra & Cialis

## Introduction

http://viagra.euweb.cz
© HZMedia Ltd.
Suite B, 29 Harley street London W1G9QR GB

Looking up the registration we find

```
Domain Name: ONLINE-RXMEDS.COM
Registrar: DIRECTNIC, LTD
Whois Server: whois.directnic.com
Referral URL: http://www.directnic.com
Name Server: NS1.NSCONTROL.COM
Name Server: NS2.NSCONTROL.COM
Name Server: NS3.NSCONTROL.COM
Name Server: NS4.NSCONTROL.COM
Name Server: NS5.NSCONTROL.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 29-may-2009
Creation Date: 26-nov-2007
Expiration Date: 26-nov-2009
...
Domain Name: ONLINE-RXMEDS.COM
Administrative Contact:
 HZMedia, Limited info@hzmedia.info
 Suite B, 29 Harley Street
 London, Not Applicable W1G 9QR
 GB
 +1.8664207070

```

## What is HZMedia.info?

```
Domain Name:HZMEDIA.INFO
Created On:23-Nov-2006 14:20:03 UTC
Last Updated On:18-Jul-2009 05:12:54 UTC
Expiration Date:23-Nov-2009 14:20:03 UTC
Sponsoring Registrar:DirectNIC, LTD (R152-LRMS)
...
Registrant Name:Limited HZMedia
Registrant Organization:HZMedia Limited
Registrant Street1:Suite B, 29 Harley Street
Registrant City:London
Registrant State/Province:Not Applicable
Registrant Postal Code:W1G 9QR
Registrant Country:GB
Registrant Phone:+1.8664207070

```

That address, Suite B, 29 Harley Street, London W1G 9QR is a commonly used address for "instant companies" as seen at this companies house link. Other "companies" sharing Suite B are

* ONLINE MEDIA LTD
* ONLINE MEDIA SOLUTIONS LIMITED
* ONLINE PARTNERS LTD
* ONLINE SPORTS UK LIMITED
* ONLINE TELECOM LTD

## Where is the name server domain registered?

```
Domain Name: NSCONTROL.COM
Registrar: NETWORK SOLUTIONS, LLC.
...
Registrant:
 Dvoshilin, Michail

```

## Where is the web site hosted?

```
ONLINE-RXMEDS.COM has address 195.95.155.20
inetnum:        195.95.155.0 - 195.95.155.255
netname:        MSKCOM-NET
descr:          MoskvaCom Ltd
country:        RU
...
person:         Pavel Gorbunov
address:        Parusnyj pr. 49/2
address:        Moscow, Russia
phone:          +7 910 4311272
e-mail:         dilotto@gmail.com
...
descr:          RusDesign Autonomous System
origin:         AS2118

```

## Where are the name servers hosted?

```
ns1.nscontrol.com [195.95.155.13] (see above)
ns2.nscontrol.com [195.95.155.4]  (see above)
ns4.nscontrol.com [91.209.183.18]
ns5.nscontrol.com [91.209.183.19]

```

The 91.209.183.18 and .19 addresses are found here

```
inetnum:        91.209.183.0 - 91.209.183.255
netname:        ATILEKT-NET
descr:          OOO ATILEKT
country:        RU
...
person:         Ilya Yurpolskiy
address:        Russia, Moscow
address:        Uchinskaya 6
phone:          +79162427894

```

## What other sites use these name servers?

Refer to http://who.is/nameserver/ns1.nscontrol.com/

Take for the second example the site at http://www.pillsforlove.com

The copyright on this site states
© Copyright pillsforlove.com, 2003-2008.

Looking up the registration we find

```
Domain Name: PILLSFORLOVE.COM
Registrar: DIRECTNIC, LTD
Whois Server: whois.directnic.com
Referral URL: http://www.directnic.com
Name Server: NS1.NSCONTROL.COM
Name Server: NS2.NSCONTROL.COM
Name Server: NS3.NSCONTROL.COM
Name Server: NS4.NSCONTROL.COM
Name Server: NS5.NSCONTROL.COM
Status: ok
Updated Date: 08-jul-2009
Creation Date: 20-dec-2008
Expiration Date: 20-dec-2009
...
Domain Name: PILLSFORLOVE.COM

Administrative Contact:
 Smirnov, Andrey andrewsmirnov.whois@gmail.com
 32, Harley st.
 London, london W1G 7HP
 GB
 442075588078

```

Notice the Harley Street address again, this time at number 32.

You will find more information on Andrey Smirnov / Andrew Smirnov of GlavMed at GlavMed, US Drugstore and Nature Meds

## Are there any legitimate sites defined under the NSCONTROL Name Servers?

All domains using these name servers are fake pharmacies, as shown in these listings

## What is the conclusion?

This is another fake pharmacy operated from Russia. The registration details present the impression that the company behind the site is located in Harley Street, London, in the hope that a perfunctory look-up will convince its victims that the company is genuine.