Online Pharmacy Shop

# Russian pharmacy fraud

## Sells with no prescription

From the FAQ

```
*Should I have a prescription to order from you?*

```

No, you needn't. We do not require any prescription from our customers. However we would
strongly recommend you to consult your doctor before taking a medication. You may have some
diseases contra-indicated for taking certain kinds of medicines and your doctor will advise
you what you should or shouldn't take.

This is not only dangerous, but illegal in most countries.

## Fake certifications

* The certification for CPA Approved is a stolen image, and does not provide a valid click-through to the actual certification.

* The certification for CIPA/Rx Approved is a stolen image, and does not provide a valid click-through to the actual certification.

* The certification for HealthPricer is a stolen image, and does not provide a valid click-through to the actual certification.

* The certification for MIPA Approved is a stolen image, and does not provide a valid click-through to the actual certification.

## Example site

```
onlinedrugstore24hour.com

```

It is registered in Russia using fake registrant details. For example, the contact number +375.259515145 does not exist.

```
Domain Name: ONLINEDRUGSTORE24HOUR.COM
Registry Domain ID: 2009665666_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.r01.ru
Registrar URL: http://www.r01.ru
Updated Date: 2017-07-18T12:15:15+03:00
Creation Date: 2016-03-06T15:27:28+03:00
Registrar Registration Expiration Date: 2018-03-06T15:27:28+03:00
Registrar: CJSC REGISTRAR R01
Registrar Abuse Contact Email: tld-abuse@r01.ru
Registrar Abuse Contact Phone: +7.4957833783
Registrant Name: Mironov Vladimir Vladimirovich
Registrant Organization: N/A
Registrant Street: Minsk, st. Ya. Kolosa,23
Registrant City: Minsk
Registrant State/Province: Minskaya
Registrant Postal Code: 220013
Registrant Country: RU
Registrant Phone: +375.259515145
Registrant Email: tadalafilman@yandex.ru

```

The onlinedrugstore24hour.com site resided on 199.79.62.207 which is in the address space administered by PDR.
Then it moved to 185.36.100.131 owned by Disk Group Ltd., British Virgin Islands, abuse reports go to abuse@disk-group.biz
In July 2017 the name servers changed from ns1.md-40.webhostbox.net & ns2.md-40.webhostbox.net to ns3.go4cloud.com & ns4.go4cloud.com

Other sites, registered in Russia with R01-RU, that are spammed, and redirect to this site, may reside on IP 94.185.81.144 in Sweden:

```
buyviagraindia.ru
buyviagraukonline.ru
canadianpharmacysupportteam.ru
cheapfemaleviagra.ru
cheapviagraindia.ru
cheapviagrarx.ru
needviagrafast.ru
nodoctorviagra.ru
sunriseviagra.ru
tabviagra.ru
viagra25mg.ru
viagraavendre.ru
viagrabelgium.ru
viagrabestprice.ru
viagraca.ru
viagradogrx.ru
viagrafromeurope.ru
viagrafromgeremy.ru
viagragiftcard.ru
viagragoldusa.ru
viagrainitalia.ru
viagraireland.ru
viagralowcost.ru
viagramexico.ru
viagranongeneric.ru
viagraonlineusa.ru
viagrapfizer.ru
viagraphizer.ru
viagrapillsoline.ru
viagrarxmedstore.ru
viagrasofttabs.ru
viagratesco.ru

```

These initially land on a site that looks like the Canadian Health&Care Mall.But in fact it is just a screen-captured image of that fraud site. If you click on the image of that site you are quickly redirected to onlinedrugstore24hour.com

The above list of redirection domains originally used the same common name servers

```
 ns1.md-7.webhostbox.net
 ns2.md-7.webhostbox.net

```

webhostbox.net is registered with PDR in India.

They all resided on the same IP host address, 208.91.198.51
This address was administered by Public Domain Registry (PDR)

```
 P.D.R Solutions LLC, 10, Corporate Drive, Suite 300
 Burlington
 MA
 01803
 US
 Abuse Admin
 +1-415-230-0648
 abuse@publicdomainregistry.com

```

In July 2017 they changed name servers to

```
ns1.canadianpharmacysupportteam.ru
ns2.canadianpharmacysupportteam.ru

```

## Direct hosting domains

These all reside on IP address 94.185.81.144 owned by Netrouting Sweden with abuse reporting on abuse*@*netrouting.se

```
24hourcanadianpharmacyrx.ru
24hourcialis.ru
antibioticsforsaleonlinerx.ru
antibioticsonlineovernightdelivery.ru
antibioticsonlineovernightdeliveryrx.ru
awccanadianpharmacyrx.ru
canadianpharmaciesmailorderrx.ru
canadianpharmaciesthatacceptpaypalrx.ru
wheretopurchasealli.ru
xenical120mgforsale.ru
xlpharmacyindiarx.ru
zoloftwithoutaprescription.ru
zoloftwithoutaprescriptionrx.ru

```

They all use the same name servers for resolution to the IP address

```
 ns1.canadianpharmacysupportteam.ru on 94.185.81.145
 ns2.canadianpharmacysupportteam.ru on 94.185.81.145

```

canadianpharmacysupportteam.ru is also a fake version of Canadian Health&Care Mall that redirects to onlinedrugstore24hour.com

## Checkout Server

It does use a secure checkout at **card-billing.net**, security certificate issued by COMODO RSA Certification Authority. The secure checkout domain is registered with Instra Corporation, and the registrant details are hidden by New Zealand company Private Ranger Ltd.

```
Domain Name: CARD-BILLING.NET
Registry Domain ID: 1894384520_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.instra.net
Registrar URL: http://www.instra.com/
Updated Date: 2016-12-19T11:28:17Z
Creation Date: 2015-01-06T19:07:34Z
Registrar Registration Expiration Date: 2019-01-06T19:07:34Z
Registrar: Instra Corporation Pty Ltd.
Registrar IANA ID: 1376
Registrar Abuse Contact Email: abuse@instra.com
Registrar Abuse Contact Phone: +61.397831800

Admin Name: C/O Private Ranger Limited
Admin Organization: Registrant of card-billing.net
Admin Street: Level 31 Vero Centre, 48 Shortland Street
Admin City: Auckland
Admin State/Province: Auckland District
Admin Postal Code: 1010
Admin Country: NZ
Admin Phone: +64.98011234
Admin Email: 7383741@privateranger.com

```

This secure server runs on IP address 5.199.175.235. That address is administered by

```
Nicolae Gherisescu
Rosu 26, Bucharest, Romania
abuse@pay-w.com
+40212242850

```

That is an invalid phone number.

Note that his email domain, pay-w.com, is registered in Russia

```
Domain Name: PAY-W.COM
Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

```

```
Registrant Name: OOO LIDER
Registrant Organization: OOO LIDER
Registrant Street: B. Akademicheskaya dom. 65
Registrant City: Moscow
Registrant State/Province: Moscow
Registrant Postal Code: 125183
Registrant Country: RU
Registrant Phone: +7.9647697300
Registrant Email: ooolider10@mail.ru

```

## Contact details

The web site provides contact phone numbers:

```
US: +1-760-284-3222
EU: +4420-3286-3820

```

These are not responsive on a 24 hour basis.