Changes: -Canadian-Pharmacy-

Latest revision as of 23:40, 3 May 2021

Information here will describe the version found in 2016 and 2017 with title -Canadian-Pharmacy- or Canadian Pharmacy since 2001.

Description[]

Contact number is 
Toll-Free Phone: +13177599378
Working hours: 9 :00 am - 11 :00 pm Eastern Time Zone (ET UTC-05:00)
© 2001–2016 Canadian Health&Care Mall. All rights reserved. or
© 2001–2017 Canadian Pharmacy. All rights reserved.

Note that the support line number of +13177599378 is common to CANADA-PHARMACY and -Canadian-Pharmacy- and Canadian Pharmacy

Canadian-Pharmacy, April, 2016 - Click to enlarge

Canadian-Pharmacy trailer, April 2016 - Click to enlarge

False Pretenses[]

Fake accreditations[]

False claims

Akoranga — Fake license, April 2016 - Click to enlarge

There is no approval from the FDA nor the CPA. Likewise, the American Consumers Organization has given no approval for this fraud. It is obvious that these ratings are provided by the criminals themselves. When you click on the logo, their own server displays their fake certificates.

No Pharmacy License[]

Canadian-Pharmacy sometimes fails to display any valid license. They are therefore not entitled to sell pharmacy products online.

At other times, it displays a photo-shopped fake license for Pharmacy Express (another fraud) at the address of a real pharmacy in Akoranga Drive, Northcote, New Zealand. The real pharmacy in New Zealand has no relationship with this fraud, which has stolen their identity. There is no such thing as the "New Zealand Board of Pharmacy".

No Pharmacist Oversight[]

They do not make any statement that there is a pharmacist overseeing orders and deliveries.

False claim to use encryption[]

Privacy Our customers’ privacy is paramount to our business. That’s why none of your personal data will ever be misused, including name, address, and any other information you give us. We guarantee that it is completely secure to place orders with our secure, modern billing system. All credit card information is kept safe and sound.

Is it safe for my privacy to order from your pharmacy? Privacy and safety of our customers are our greatest concern. Our online order system uses the latest security encryption technology, ensuring your credit card information stays safe.

However, you will find that when you take your order to the checkout page, your identity and credit card information is taken over a link that is not encrypted.

Spam method[]

Refer to the example on the right.

Spammers send a short email with a "click here" link.

Click to enlarge

The click here link in this case leads to

mobil.deturno.cl/account/first/articles/articles/sitemap.html

Clearly, www.deturno.cl, a WordPress site, has been compromised, and the additional sitemap.html code has been inserted. The link acts as a redirection. It contains one of these

<META HTTP-EQUIV="REFRESH" CONTENT="0;URL=http://magicvipsale.su/">
<META HTTP-EQUIV="REFRESH" CONTENT="0;URL=http://bestwebtrade.su/">

The redirection takes you to the Russian -Canadian-Pharmacy- fraud location, magicvipsale.su or bestwebtrade.su

Other examples: 1. vacances-scolaires-belgique.be has been hacked with vacances-scolaires-belgique.be/administrator/components/com_jumi/module/language/en-GB/sitemap.html which redirects to magicvipsale.su

2. yourworshipspace.com has been hacked with yourworshipspace.com/trinityvirtual.com/Backup/wp-content/plugins/wpclef/assets/sitemap.htm which redirects to magicvipsale.su

3. larahomans.com has been hacked with larahomans.com/ru/wp-content/uploads/2016/10/glyuo/sitemap.html which redirects to bestwebmarket.su

Sponsoring Registrars[]

From May 2021

REG.RU[]

discounthiti.su
discountwebe.su
lightorderm.su
newbrandi.su
newbrandj.su
newbrandk.su
newbrandl.su
newbrandm.su
newbrandn.su
newbrando.su
newbrandp.su
shopsecret.su
tradesaleu.su
tradeshopt.su
tradeshopu.su
tradeshopv.su
webshopn.su
webshopo.su
webshopp.su
webshopq.su

These are examples from November 2020

ACTIVE.SU[]

beststockm.su
beststockn.su
beststocko.su
beststockp.su
easypayq.su
easypayx.su
easypayy.su
easypayz.su

ARDIS-SU[]

Suspended by registrar

clubstoree.su
clubstoreq.su
clubstorer.su
clubstorew.su
easyinfot.su
easyinfou.su
easyinfov.su
easyinfow.su

 superms-shop.su

DOMAINSHOP-SU[]

Suspended

salekeyd.su
salekeye.su
salekeyf.su
salekeyg.su
startsalel.su
startsaleo.su
startsaler.su
startsalet.su

DR-SU[]

buyservicek.su
buyservicel.su
buyservicem.su
buyservicen.su
deliveryclubg.su
deliveryclubh.su
deliveryclubi.su
deliveryclubj.su

PN-SU[]

easyinfoo.su
easyinfop.su
easyinfor.su
easyinfos.su
newmarketd.su
newmarkete.su
newmarketf.su
newmarketg.su

R01-SU[]

lifesupporte.su
lifesupportf.su
lifesupportg.su
lifesupporth.su
tastypricea.su
tastypricej.su
tastypricek.su
tastypricel.su

REGTIME-SU[]

REGRU-SU[]

Mostly disabled, no address record

beststocki.su
beststockj.su
beststockk.su
beststockl.su
brandnewu.su
brandnewv.su
brandnewx.su
brandnewy.su
buyonlinea.su
buyonlineb.su
buyonlinec.su
buyonlined.su
buystockk.su
buystockl.su
buystockm.su
buystockn.su
clubstarti.su
clubstartj.su
clubstartk.su
clubstartl.su
easydiscountd.su
easydiscounte.su
easydiscountf.su
easydiscountg.su
fastdealo.su
fastorderk.su
fastorderl.su
fastorderm.su
fastordern.su
tastypriceo.su
tastypricep.su
tastypriceq.su
tastypricer.su
topdiscounte.su
topdiscountf.su
topdiscountg.su
topdiscounth.su
trustpriceo.su
trustpricep.su
trustpricer.su
trustpricet.su
websupplya.su
websupplyb.su
websupplyc.su
websupplyd.su
websupplye.su
websupplyf.su
websupplyg.su
websupplyh.su

Sponsoring ISPs[]

IP addresses detected in November 2020, with abuse e-mail address

151.80.57.155 abuse@ovh.net
185.66.9.115 abuse@coolvds.com

IP addresses detected in February 2019, with abuse e-mail address

179.43.149.28 support@PRIVATELAYER.COM
139.60.161.76 abuse@hostkey.com
5.9.101.38 abuse@hetzner.de
195.123.242.225 abuse@greenfloid.com
38.135.122.89 abuse@cogentco.com
140.82.3.17 abuse@choopa.com abuse@vultr.com
139.60.161.46 abuse@hostkey.com
139.60.161.166 abuse@hostkey.com

Typical Fake WHOIS Contact Information[]

Russian domains do not reveal information about registrants

person: Private Person

How to report this spam[]

Send compliance requests to the abuse contacts for the registrars, and to the IP address abuse contacts.

Related spam operations[]

Related brands[]

At the bottom of the trailer there is sometimes a reference to another widely known pharmacy fraud, Canadian Health&Care Mall

Sponsor Organization[]

This fraud is not part of the Eva Pharmacy operation, but may be associated with them.