Fraud Reports Wiki

Canadian Family Pharmacy is an Eva Pharmacy fraud.


Canadian Family Pharmacy is yet another property selling fake pharmaceutical products, using domains promoted solely by illegally-sent spam messages. This site made its first appearance in August 2009.

Canfampharm med.jpg

Fake Security[]

Their "Help and FAQ" page fraudulently states

We use the Secure Socket Layer (SSL) protocol which enables end-to-end data protection.


As with every single website, no such security is present, or ever has been present.

When last tested (August 2010) the links to the American Red Cross, IMPac, CIPA, Pharmacy Checker, or the Better Business Bureau were all locally hosted, and did not link directly to any of these agencies or associations. Canadian Family Pharmacy, in common with all other pharmacy operations, has no licenses, approval, quality guarantees, security or site awards.

Canfampharm logos.jpg

Under "Our Address" the site lists two fake Canadian addresses (one in Ottawa, Ontario previously associated with another property My Canadian Pharmacy, another in Winnipeg) and lists their warehouse address as being located in Bihar, India.

Prominent use of the Canadian flag belies the fact that all of the domains used to host these fraudulent sites are registered in China.

As with all other properties, hosting is provided illegally by using a hijacked host. Images loaded into web pages, as is common with hijacked servers, are pulled down from a variety of other hijacked hosts. Each name server used to resolve the domain name to the IP address is also run on yet another hijacked host. These are all Unix servers which have had an exploit loaded on to them to act as a proxy web server or dns server. The owners of these servers are completely unaware that their servers are being used in this way.

Fake Doctors and Testimonials[]

Unlike most of the other properties, Canadian Family Pharmacy has wisely chosen not to claim who their alleged "doctors" or "pharmacists" are. On all other sites these have been fake personas supported by easily-purchased stock photos of models posing as doctors. Also unlike all other properties, there are no "testimonials" on this particular site either. Another wise choice, since these were also completely fake in the first place.

The picture of the staff on the "About Us" page is fake, and can be found on Getty Images

Fake Licenses[]

Click to enlarge fake license version 1

Click to enlarge fake license version 2

Click to enlarge fake license version 3

Like other fraud pharmacies, these fraudsters have printed their own version of a pharmacy license. Not being particularly adept, they have chosen to spell license in the US fashion, ignorant of the Canadian spelling of licence.

Version 1

They have referred to the college as "College of Pharmacists of Ontario" whereas the actual college refers to itself as "Ontario College of Pharmacists" - see

The address that they have used for the fake license is 913 Montreal Road, Ottawa, ON, Canada. That is the same non-existent address that they use for their own headquarters.

They have put a watermark on the document to try to lend it authenticity. However, the watermark is not the logo of the actual Ontario College of Pharmacists depicted below.

Actual logo

Version 2

On some sites, they display another fake license, this time pretending it is from the Manitoba Pharmaceutical Association. Unlike a real license, it has spelling and grammatical errors, consistent with a fake produced by criminals who lack a good grasp of the English language. They have lifted the MPhA logo from their web site and placed it on the fake license.

Once again, the address that they have used for the fake license is 913 Montreal Road, Ottawa, ON, Canada. That is the same non-existent address that they use for their own headquarters.

The actual real address for the MPhA is

Manitoba Pharmaceutical Association

200 Tache Avenue

Winnipeg, MB, R2H 1A7

Phone: 204-233-1411

Fax: 204-237-3468


Actual MPhA logo Logo which was stolen, re-colored, and placed on the fake license.

Version 3'

In 2014, the fake license shows an address of the Preston Business Center in Ottowa, 343 Preston St, Ottawa, ON, K1S 5N4, Canada.

Fake Offices[]

Subsequent to this publishing, these Russian fraudsters have changed the addresses to try to regain credibility, but they have switched to faceless locations, such as business centers or box-drops.

The "contacts" page previously included the following addresses for their alleged "Canadian" offices:

Canfampharm offices.jpg

Main Headquarters 913 Montreal Road, Ottawa, ON, Canada

Nearest location to 913 Montreal Road

This was a fake address. There is no 913 on Montreal Road in Ottawa. That address has been used for many years as the reported address for Canadian Health&Care Mall, another well-known spammed property. The nearest address is 919 Montreal Road, which is the location of the Banc Sushi Restaurant. The image of the building can be found at Getty Images

The property at what would be 913 Montreal Road is shown in the picture taken from Google Maps

Office: 18/4 Centennial st., Winnipeg, Manitoba

This was also a fake address. This is further corroborated by visiting the actual Better Business Bureau report on this fake pharmacy:

Additional Locations and Phone Numbers
Additional Addresses
4 Centennial Street, Unit 18
(Invalid Address)
Winnipeg, MB  .

BBB link

The third was their "warehouse" location, which appears to be a poorly Photoshopped stock photo of a nondescript warehouse building. That address is listed as:

Jaiswal Lane, Dakbunglow Road, Bihar, India

We have not yet confirmed that address, but given the track record of literally every other address they have used (previously in Toronto, Calgary, Louisiana and New Delhi) the probability is extremely low that this address would actually lead to any real "warehouses" for this operation.

Fake Registration[]

Like other Yambo family sites, Canadian Family Pharmacy uses identity theft to register its sites. Victims whose personal information has been used to register one of these sites should follow the steps outlined here.

Hijacked Servers[]

Like other Yambo sites, this one uses the tirqd Unix infection to hijack servers for hosting the websites, their images, and their nameservers. A given hijacked machine may be serving images to all sites in the Yambo family at one time:

Similarly, the servers used to host the website and nameservers for Yambo sites are swapped around among sites during their frequent changes.

How to Report this Spam[]

Determine the registrar of the domain name and send a compliance request citing their own terms of service.

Determine the IP address of the hosting site and request it be taken down.

Provide a link to this web site as evidence of fraud.

No reputable service provider wants to have their reputation smeared by being exposed as crime sponsors.

Sample sites and registrars sponsoring them[]



[] is the sponsor organization behind this type of site. They pay spammers to promote it, and they don't shut down illegal spammers.

Related spam operations[]

See: Category:Yambo family