Spam Alert
 
 Full Report: /Canadian_Health_amp_Care_Mall_spam172792.html
 
 Changed status to confirmed spam.

ixflintere.com is one of the sites for the spam operation, "Canadian Health&Care Mall." This site and its spam are violating US law:
* It offers medications which may not be dispensed without a prescription, sometimes including Provigil and sometimes Valium, which are federal contolled substances, without requiring any prescription.
* Its site advertises generic versions of drugs like Viagra which are still under patent protection. Therefore, any generics are by definition counterfeit.
* Its site includes "certificates" claiming endorsement from Verisign, The "Canadian Pharmaceutical Association," The American Food and Drug Administration, and the "American Consumers Organization." All of these claims are outright falsehoods and violations of these agencies' trademarks in those cases in which such an organization actually exists. See also the BBB alert at http://www.bbbmwo.ca/commonreport.html?bid=1134034 regarding sister site My Canadian Pharmacy.
* Viewing satellite photos of the addresses it gives for the locations of its offices in Ontario and Louisiana show residential areas with no evidence of the existence of large buildings like those pictured on the "contact us" page of their website. The location of the warehouse in New Delhi, India is not precise enough for Google Maps to locate it and may be a nonexistent address. See http://spamtrackers.eu/wiki/index.php?title=Canadian_Health%26Care_Mall .
* The site displays a forged pharmacy license claiming to be issued by the state of Minnesota, USA. See http://spamtrackers.eu/wiki/index.php?title=Canadian_Health%26Care_Mall for a response from the Executive Director of the Minnesota Board of Pharmacy confirming that this is a forgery.
* It presents photos of people it claims are the physicians and pharmacists running their operation. At least some of these photos have been identified as stock photos from gettyimages.com. See http://spamtrackers.eu/wiki/index.php?title=Canadian_Health%26Care_Mall#Fake_Doctors
* There is doubt whether they actually sell anything; the website may only be collecting credit card numbers.
* It violates US law by offering drugs for sale to US residents that they may not legally import from pharmacies outside the US, and it offers them for sale without prescription. See http://www.fda.gov/oc/buyonline/faqs.html
* It offers for sale to US residents drugs that have not been approved by the FDA for sale in the US, like rimonabant.
* Its site offers for sale antiepileptic medications like Neurontin, Depakote, Lamictal, Trileptal, Keppra, and Topamax. Given the documented fact that even when spamvertised pharmacies deliver medications, they are subpotent or completely inactive about half the time, well-controlled epileptics taking these pills could have seizures while driving, causing an accident that could kill or seriously injure themselves or others, or at very least, lead to loss of their drivers' licenses.
* Its site offers for sale anticancer agents like casodex and nolvadex. Again, even when spamvertised pharmacies deliver medications, they are subpotent or completely inactive about half the time. The first indication people taking these medications would have that they are taking inactive drug would be recurrence of their cancers.
* Its site offers for sale antibiotics like Levaquin, Amoxicillin, Augmentin, Cipro, Zithromax, and Suprax. As Canadian Health&Care Mall does not even claim to offer overnight delivery, the only reason to order these drugs without prescription from a pharmacy that takes weeks to deliver (if it ever delivers at all), is to keep it at home "just in case." As most people are unaware that viral illnesses do not respond to antibiotics, are not aware of which organisms are most likely to cause which infections nor which antibiotics will cover those organisms, and do not have the ability to perform culture and sensitivity testing to confirm empiric treatment, this practice is highly likely to select for drug resistant organisms like CA-MRSA (community acquired methicillin resistant staphylococcus aureus, a particularly aggressive variety of staph that causes recurrent skin boils and has a 50% mortality when it causes pneumonia). As Cipro and Levaquin also have anti-tubercular activity, their use can select for drug resistant tuberculosis. Extended drug resistant mycobacterium tuberculosis (XDR-TB) is extracting nearly 100% mortality in South Africa at present.
* Its site offers for sale Coumadin, a narrow therapeutic index drug that requires very frequent blood testing to determing the correct dose, and continued monitoring to readjust dose due to interactions with food and other medications. The consequence of too much OR too little can be stroke or death.
* Its site offers for sale major antipsychotic medications like Seroquel, Abilify, and Risperdal. In addition to the fact that inactive drug could cause a patient to relapse, leading to consequences like loss of employment, even if these pills contain real medication and the correct quantity of real medication, they are only sold by prescription because patients taking them must be monitored for possible side effects like diabetes.
* Its site offers for sale the fertility medication clomid which carries the risk of multiple pregnancy, visual disturbances, and ovarian tumors, especially if used in excess.
* Their spam messages violate the CAN-SPAM act because they have forged "from" and "reply to" addresses, are sent from hijacked computers without the knowledge or permission of the owners, do not include valid information identifying who has sent the spam or how to opt out, and do not honor opt-out requests on their websites. Addresses are collected by bots spidering the internet for email addresses.
* Sites in this spam family (My Canadian Pharmacy, International "Legal" Rx, Canadian Health&Care Mall, Men+ Health, US Drugs, VIP Pharmacy/"Viagra+Cialis") utilize hijacked Unix servers using the tirqd trojan. See:
http://www.spamtrackers.eu/wiki/index.php?title=My_Canadian_Pharmacy#The_tirqd_Unix_infection
* In each case in which this reporter was able to contact the person named in the whois information in the domain registration of one of these sites, that person denied having any knowledge of his/her personal information being used to register any domains. Some victims had already been aware of fraudulent charges on their credit cards for domain registrations. See documentation at http://spamtrackers.eu/wiki/index.php?title=Fake_yambo_whois . In this case I spoke with the person whose name is used, and she confirmed she did not register the domain name.
* Spamwiki entry: http://spamtrackers.eu/wiki/index.php?title=Canadian_Health%26Care_Mall . SiteAdvisor reviews at http://www.siteadvisor.com/sites/ixflintere.com

ixflintere.com is located at IP address 218.3.160.2
but loads images from port 8080 of 79.135.167.10
http://79.135.167.10:8080/e/ch/images/theme.jpg

The following other previously used hijacked servers continue to have the images for these sites as well:
http://58.241.87.130:8080/e/ch/images/theme.jpg
http://84.253.77.6:8080/e/ch/images/theme.jpg
http://194.67.66.10:8080/e/ch/images/theme.jpg
Consumed following related reports:

[172794] http://ixflintere.com/e/ch/?action=xanax&t=testimonials
[172795] http://ixflintere.com/e/ch/?action=xanax&t=description
[172796] http://ixflintere.com/e/ch/?action=xanax
[172797] http://ixflintere.com/e/ch/?action=valium&t=testimonials
[172798] http://ixflintere.com/e/ch/?action=valium&t=description
[172799] http://ixflintere.com/e/ch/?action=valium
[172800] http://ixflintere.com/e/ch/?action=testimonials
[172801] http://ixflintere.com/e/ch/?action=secure
[172802] http://ixflintere.com/e/ch/?action=provigil&count=1&t=testimonials
[172803] http://ixflintere.com/e/ch/?action=provigil&count=1&t=description
[172804] http://ixflintere.com/e/ch/?action=provigil
[172805] http://ixflintere.com/e/ch/?action=misoprostol&count=1&t=testimonials

[172806] http://ixflintere.com/e/ch/?action=misoprostol&count=1&t=description
[172807] http://ixflintere.com/e/ch/?action=misoprostol
[172808] http://ixflintere.com/e/ch/?action=meridia&t=testimonials
[172809] http://ixflintere.com/e/ch/?action=meridia&t=description
[172810] http://ixflintere.com/e/ch/?action=meridia
[172811] http://ixflintere.com/e/ch/?action=license
[172812] http://ixflintere.com/e/ch/?action=index
[172813] http://ixflintere.com/e/ch/?action=howtoorder
[172814] http://ixflintere.com/e/ch/?action=genericviagra&count=1&t=testimonials
[172815] http://ixflintere.com/e/ch/?action=genericviagra&count=1&t=description
[172816] http://ixflintere.com/e/ch/?action=genericviagra
[172817] http://ixflintere.com/e/ch/?action=faq
[172818] http://ixflintere.com/e/ch/?action=delivery
[172819] http://ixflintere.com/e/ch/?action=contact
[172820] http://ixflintere.com/e/ch/?action=clomid&count=1&t=testimonials
[172821] http://ixflintere.com/e/ch/?action=clomid&count=1&t=description
[172822] http://ixflintere.com/e/ch/?action=clomid
[172823] http://ixflintere.com/e/ch/?action=awveri
[172824] http://ixflintere.com/e/ch/?action=awfda
[172825] http://ixflintere.com/e/ch/?action=awcpa
[172826] http://ixflintere.com/e/ch/?action=awaq
[172827] http://ixflintere.com/e/ch/?action=antispam
[172828] http://ixflintere.com/e/ch/?action=ambien&t=testimonials
[172829] http://ixflintere.com/e/ch/?action=ambien&t=description
[172830] http://ixflintere.com/e/ch/?action=ambien
[172831] http://ixflintere.com/e/ch/?action=allproducts
[172832] http://ixflintere.com/e/ch/?action=affiliate
[172833] http://ixflintere.com/e/ch/?action=acomplia&count=1&t=description
[172834] http://ixflintere.com/e/ch/?action=acomplia
[172835] http://ixflintere.com/e/ch/?action=aboutus
[172838] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=women_s_health
[172839] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=weight_loss
[172840] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=pain_relief
[172841] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=men_s_health
[172842] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=general_health
[172843] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=blood_pressure_cholesterol
[172844] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=anti_herpes
[172845] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=anti_diabetic
[172846] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=anti_depressants
[172847] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=anti_biotics
[172848] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=anti_allergic_asthma
[172849] http://ixflintere.com/e/ch/?action=allproducts&count=1&type=anti_acidity

Sites in this spam family (My Canadian Pharmacy, International "Legal" Rx, Canadian Health&Care Mall, Men+ Health, US Drugs, VIP Pharmacy/"Viagra+Cialis") will often block traffic from IP addresses associated with legal, financial and antispam organizations as well as anyone who has visited more than one of their sites. It may be necessary to use a proxy to view the pages. In addition, nameservers will selectively refuse queries for certain domains not currently being spammed, and it is necessary to use traversal to see that the domains themselves are not suspended.

Nameservers:
Generated by www.DNSstuff.com at 05:00:28 GMT on 11 May 2008.
ns2.werfaintish.com [203.174.60.37]
ns1.noparborescent.com [200.204.142.53]
ns2.samnout.info [203.174.60.37]
ns1.betamarop.com [121.121.121.121]

Spamhaus information on these IP addresses:
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL56016 for 218.3.160.2
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL62483 for 79.135.167.10
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL63639 for 203.174.60.37IP Converted: 218.3.160.2

dword = 3657670658
hex1 = 0xda03a002
hex2 = 0xda.0x3.0xa0.0x2
oct = 0332.03.0240.02
View CIDR AS4134 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4134

"4134 | CN | apnic | 2002-08-01 | CHINANET-BACKBONE No.31,Jin-rong Street"<br />
Extended information for AS4134:
State/Province:
Country: cn
Responsible Domain: chinanet.cn.net
Abuse Email: cncert@cert.org.cn
IP Converted: 79.135.167.10

dword = 1334290186
hex1 = 0x4f87a70a
hex2 = 0x4f.0x87.0xa7.0xa
oct = 0117.0207.0247.012
View CIDR AS9121 Report: http://www.cidr-report.org/cgi-bin/as-report?as=9121

"9121 | TR | ripencc | 1998-12-29 | TTNET TTnet Autonomous System"<br />
Extended information for AS9121:
State/Province:
Country: tr
Responsible Domain: telekom.gov.tr
Abuse Email: abuse@ttnet.net.tr
IP Converted: 58.241.87.130

dword = 988895106
hex1 = 0x3af15782
hex2 = 0x3a.0xf1.0x57.0x82
oct = 072.0361.0127.0202
View CIDR AS4837 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4837

"4837 | CN | apnic | 2001-09-17 | CHINA169-BACKBONE CNCGROUP China169 Backbone"<br />
Extended information for AS4837:
State/Province:
Country: cn
Responsible Domain: cnc-noc.net
Abuse Email: abuse@cnc-noc.net
IP Converted: 84.253.77.6

dword = 1425886470
hex1 = 0x54fd4d06
hex2 = 0x54.0xfd.0x4d.0x6
oct = 0124.0375.0115.06
View CIDR AS8629 Report: http://www.cidr-report.org/cgi-bin/as-report?as=8629

"8629 | RU | ripencc | 1998-01-22 | MCNTT-AS MCNTT Autonomous System"<br />
Extended information for AS8629:
State/Province:
Country: ru
Responsible Domain: ntt.ru
Abuse Email: postmaster@ntt.ru
IP Converted: 194.67.66.10

dword = 3259187722
hex1 = 0xc243420a
hex2 = 0xc2.0x43.0x42.0xa
oct = 0302.0103.0102.012
View CIDR AS2683 Report: http://www.cidr-report.org/cgi-bin/as-report?as=2683

"2683 | EU | ripencc | 1993-09-01 | RADIO-MSU RADIO-MSU"<br />
Extended information for AS2683:
State/Province:
Country:
Responsible Domain: radio-msu.net
Abuse Email: abuse@radio-msu.net
IP Converted: 203.174.60.37

dword = 3417193509
hex1 = 0xcbae3c25
hex2 = 0xcb.0xae.0x3c.0x25
oct = 0313.0256.074.045
View CIDR AS9381 Report: http://www.cidr-report.org/cgi-bin/as-report?as=9381

"9381 | HK | apnic | 1998-08-17 | NEWTT-IP-AP Wharf T&T Ltd."<br />
Extended information for AS9381:
State/Province:
Country: hk
Responsible Domain: wharftt.com
Abuse Email: abuse@wharftt.com
IP Converted: 200.204.142.53

dword = 3368848949
hex1 = 0xc8cc8e35
hex2 = 0xc8.0xcc.0x8e.0x35
oct = 0310.0314.0216.065
View CIDR AS27699 Report: http://www.cidr-report.org/cgi-bin/as-report?as=27699

"27699 | BR | lacnic | 2003-06-24 | TELECOMUNICACOES DE SAO PAULO S/A - TELESP"<br />
Extended information for AS27699:
State/Province:
Country: br
Responsible Domain: telesp.com.br
Abuse Email: abuse@telesp.net.br
IP Converted: 121.121.121.121

dword = 2038004089
hex1 = 0x79797979
hex2 = 0x79.0x79.0x79.0x79
oct = 0171.0171.0171.0171
View CIDR AS9534 Report: http://www.cidr-report.org/cgi-bin/as-report?as=9534

"9534 | MY | apnic | 1999-05-17 | MAXIS-AS1-AP Binariang Berhad"<br />
Extended information for AS9534:
State/Province:
Country: my
Responsible Domain: maxis.net.my
Abuse Email: tony@maxis.net.my

ISPs: Please assist your customers in identifying and disinfecting

servers at the following addresses:

chinanet.cn.net
218.3.160.2

cnc-noc.net
58.241.87.130

maxis.net.my
121.121.121.121

ntt.ru
84.253.77.6

radio-msu.net
194.67.66.10

telekom.gov.tr
79.135.167.10

telesp.com.br
200.204.142.53

wharftt.com
203.174.60.37


Registrars: please suspend the following domains and nameservers. Please

investigate the payment history as it was almost certainly fraudulent as

well. Please forward evidence of fraudulent activity to law enforcement.

See domain suspension instructions at
http://www.spamtrackers.eu/wiki/index.php?title=Registrar_Advice
Hong Kong mirror:
香港 镜象地点
http://spamtrackers.hk/wiki/index.php/Suspending_an_EPP_domain
http://spamtrackers.hk/wiki/index.php/Suspending_a_non-EPP_domain

(Removal of nameservers is here:
http://spamtrackers.hk/wiki/index.php/Suspending_an_EPP_name_server_doma

in
http://spamtrackers.hk/wiki/index.php/Suspending_a_non-EPP_name_server_d

omain )

As the domains for the Yambo family of spamvertised websites (My

Canadian Pharmacy, International Legal Rx Medications, Men+ Health, US

Drug, VIP Pharmacy ("Viagra + Cialis"), and Canadian Health&Care Mall

are uniformly registered with information obtained by identity theft and

paid with fraudulent credit/debit card information, please suspend any

other sites in this family that you become aware of.

moniker.com
ixflintere.com

dns.com.cn
noparborescent.com
ns1.noparborescent.com [200.204.142.53]

xinnet.com
werfaintish.com
ns2.werfaintish.com [203.174.60.37]

ENOM
samnout.info
ns2.samnout.info [203.174.60.37]