Spam Alert
 
 Full Report: /Canadian_Health_amp_Care_Mall_spam212078.html
 
 Consumed following related reports:

[212077] http://gnr.dgcast.cn
Consumed following related reports:

[211955] http://dlyclurcau.com/
Changed status to confirmed spam.
Spammed domain, dgcast.cn, has already been deleted by 35.cn (thank you!). Whois obtained when I first started this report:

Domain Name: dgcast.cn
ROID: 20080813s10001s48454152-cn
Domain Status: clientTransferProhibited
Registrant Name: 古长春
Administrative Email: *******@163.com
Sponsoring Registrar: 厦门三五互联科技股份有限公司
Name Server:ns1.pondisblue.org
Name Server:ns2.pondisblue.org
Registration Date: 2008-08-13 19:14
Expiration Date: 2009-08-13 19:14

dcmonth.cn is another disposable domain sharing very similar registration and DNS info with dgcast.cn. It is still active:

Domain Name: dcmonth.cn
ROID: 20080813s10001s48453484-cn
Domain Status: clientTransferProhibited
Registrant Name: 马永军
Administrative Email:
Sponsoring Registrar: 厦门三五互联科技股份有限公司
Name Server:ns1.pondisblue.org
Name Server:ns2.pondisblue.org
Registration Date: 2008-08-13 19:12
Expiration Date: 2009-08-13 19:12

ghe.dcmonth.cn also redirects to dlyclurcau.com, as do all subdomains beginning with the letter "g." Those beginning with "b" currently redirect to siterxspecial.com, a Canadian Pharmacy site, those beginning with "t" redirect to leapzoom.com, a King Replicas site, and those beginning with "r" redirect to greatwactheseen.com which is Swiss Watches Direct.


dlyclurcau.com is one of the sites for the spam operation, "Canadian Health&Care Mall." This site and its spam are violating US law:
* It offers medications which may not be dispensed without a prescription, including Provigil and sometimes Valium, which are federal contolled substances, without requiring any prescription.
* Its site advertises generic versions of drugs like Viagra which are still under patent protection. Therefore, any generics are by definition counterfeit.
* Its site includes "certificates" claiming endorsement from Verisign, The "Canadian Pharmaceutical Association," The American Food and Drug Administration, and the "American Consumers Organization." All of these claims are outright falsehoods and violations of these agencies' trademarks in those cases in which such an organization actually exists. See also the BBB alert at http://www.bbbmwo.ca/commonreport.html?bid=1134034 regarding sister site My Canadian Pharmacy.
* Viewing satellite photos of the addresses it gives for the locations of its offices in Ontario and Louisiana show residential areas with no evidence of the existence of large buildings like those pictured on the "contact us" page of their website. The location of the warehouse in New Delhi, India is not precise enough for Google Maps to locate it and may be a nonexistent address. See http://spamtrackers.eu/wiki/index.php?title=Canadian_Health%26Care_Mall .
* The site displays a forged pharmacy license claiming to be issued by the state of Minnesota, USA. See http://spamtrackers.eu/wiki/index.php?title=Canadian_Health%26Care_Mall for a response from the Executive Director of the Minnesota Board of Pharmacy confirming that this is a forgery.
* It presents photos of people it claims are the physicians and pharmacists running their operation. At least some of these photos have been identified as stock photos from gettyimages.com. See http://spamtrackers.eu/wiki/index.php?title=Canadian_Health%26Care_Mall#Fake_Doctors
* There is doubt whether they actually sell anything; the website may only be collecting credit card numbers.
* It violates US law by offering drugs for sale to US residents that they may not legally import from pharmacies outside the US, and it offers them for sale without prescription. See http://www.fda.gov/oc/buyonline/faqs.html
* It offers for sale to US residents drugs that have not been approved by the FDA for sale in the US, like rimonabant.
* Its site offers for sale antiepileptic medications like Neurontin, Depakote, Lamictal, Trileptal, Keppra, and Topamax. Given the documented fact that even when spamvertised pharmacies deliver medications, they are subpotent or completely inactive about half the time, well-controlled epileptics taking these pills could have seizures while driving, causing an accident that could kill or seriously injure themselves or others, or at very least, lead to loss of their drivers' licenses.
* Its site offers for sale anticancer agents like casodex and nolvadex. Again, even when spamvertised pharmacies deliver medications, they are subpotent or completely inactive about half the time. The first indication people taking these medications would have that they are taking inactive drug would be recurrence of their cancers.
* Its site offers for sale antibiotics like Levaquin, Amoxicillin, Augmentin, Cipro, Zithromax, and Suprax. As Canadian Health&Care Mall does not even claim to offer overnight delivery, the only reason to order these drugs without prescription from a pharmacy that takes weeks to deliver (if it ever delivers at all), is to keep it at home "just in case." As most people are unaware that viral illnesses do not respond to antibiotics, are not aware of which organisms are most likely to cause which infections nor which antibiotics will cover those organisms, and do not have the ability to perform culture and sensitivity testing to confirm empiric treatment, this practice is highly likely to select for drug resistant organisms like CA-MRSA (community acquired methicillin resistant staphylococcus aureus, a particularly aggressive variety of staph that causes recurrent skin boils and has a 50% mortality when it causes pneumonia). As Cipro and Levaquin also have anti-tubercular activity, their use can select for drug resistant tuberculosis. Extended drug resistant mycobacterium tuberculosis (XDR-TB) is extracting nearly 100% mortality in South Africa at present.
* Its site offers for sale Coumadin, a narrow therapeutic index drug that requires very frequent blood testing to determing the correct dose, and continued monitoring to readjust dose due to interactions with food and other medications. The consequence of too much OR too little can be stroke or death.
* Its site offers for sale major antipsychotic medications like Seroquel, Abilify, and Risperdal. In addition to the fact that inactive drug could cause a patient to relapse, leading to consequences like loss of employment, even if these pills contain real medication and the correct quantity of real medication, they are only sold by prescription because patients taking them must be monitored for possible side effects like diabetes.
* Its site offers for sale the fertility medication clomid which carries the risk of multiple pregnancy, visual disturbances, and ovarian tumors, especially if used in excess.
* Their spam messages violate the CAN-SPAM act because they have forged "from" and "reply to" addresses, are sent from hijacked computers without the knowledge or permission of the owners, do not include valid information identifying who has sent the spam or how to opt out, and do not honor opt-out requests on their websites. Addresses are collected by bots spidering the internet for email addresses.
* Sites in this spam family (My Canadian Pharmacy, International "Legal" Rx, Canadian Health&Care Mall, Men+ Health, US Drugs, VIP Pharmacy/"Viagra+Cialis") utilize hijacked Unix servers using the tirqd trojan. See:
http://www.spamtrackers.eu/wiki/index.php?title=My_Canadian_Pharmacy#The_tirqd_Unix_infection
* In each case in which this reporter was able to contact the person named in the whois information in the domain registration of one of these sites, that person denied having any knowledge of his/her personal information being used to register any domains. Some victims had already been aware of fraudulent charges on their credit cards for domain registrations. See documentation at http://spamtrackers.eu/wiki/index.php?title=Fake_yambo_whois
* Spamwiki entry: http://spamtrackers.eu/wiki/index.php?title=Canadian_Health%26Care_Mall . SiteAdvisor reviews at http://www.siteadvisor.com/sites/dlyclurcau.com
Online prices for warfarin 5mg x 90 tabs (generic coumadin, a blood thinner) on 4/13/08:
Rite Aid (drugstore.com): US $35
CVS US $46
My Canadian Pharmacy US $227

The only reason for someone to order warfarin via an illegal pharmacy is to avoid having to see a doctor and get blood tests done to obtain a prescription. Warfarin is derived from a natural compound and has a complex metabolism and many food/drug interactions. Not only is there a very narrow range between the dose that prevents clots and the dose that causes excessive bleeding, the dose is different from person to person and even varies at different times for the same person. There is an extremely high risk of someone having complications like bleeding or strokes if he/she is not getting regular blood tests to check whether the dosage needs to be changed.

SiteAdvisor review at http://www.siteadvisor.com/sites/dlyclurcau.com


DNS Traversal for dlyclurcau.com.
Generated by www.DNSstuff.com at 17:34:55 GMT on 22 Aug 2008.

Getting NS record list at f.root-servers.net... Done!
Looking up at the 13 com. parent servers:

Server Response Time
l.gtld-servers.net [192.41.162.30] ns1.backcan.ru. ns2.thednswars.com. 46ms
f.gtld-servers.net [192.35.51.30] ns1.backcan.ru. ns2.thednswars.com. 46ms
g.gtld-servers.net [192.42.93.30] ns1.backcan.ru. ns2.thednswars.com. 62ms
d.gtld-servers.net [192.31.80.30] ns1.backcan.ru. ns2.thednswars.com. 78ms
e.gtld-servers.net [192.12.94.30] ns1.backcan.ru. ns2.thednswars.com. 15ms
h.gtld-servers.net [192.54.112.30] ns1.backcan.ru. ns2.thednswars.com. 133ms
c.gtld-servers.net [192.26.92.30] ns1.backcan.ru. ns2.thednswars.com. 62ms
m.gtld-servers.net [192.55.83.30] ns1.backcan.ru. ns2.thednswars.com. 61ms
a.gtld-servers.net [192.5.6.30] ns1.backcan.ru. ns2.thednswars.com. 62ms
j.gtld-servers.net [192.48.79.30] ns1.backcan.ru. ns2.thednswars.com. 155ms
k.gtld-servers.net [192.52.178.30] ns1.backcan.ru. ns2.thednswars.com. 156ms
i.gtld-servers.net [192.43.172.30] ns1.backcan.ru. ns2.thednswars.com. 124ms
b.gtld-servers.net [192.33.14.30] ns1.backcan.ru. ns2.thednswars.com. 140ms

Status: Records all match.

Looking up at the 2 dlyclurcau.com. parent servers:

Server Response Time
ns2.thednswars.com [209.88.103.12] 59.124.253.90 540ms
ns1.backcan.ru [209.88.103.12] 59.124.253.90 556ms


dlyclurcau.com is currently located at IP address 59.124.253.90
but loads images from port 8080 of the following servers:
http://62.168.101.112:8080/e/ch/images/theme.jpg
http://83.148.186.142:8080/e/ch/images/theme.jpg
http://116.228.7.35:8080/e/ch/images/theme.jpg
http://88.191.17.209:8080/e/ch/images/theme.jpg
http://193.165.209.3:8080/e/ch/images/theme.jpg

Sites in this spam family (My Canadian Pharmacy, International "Legal" Rx, Canadian Health&Care Mall, Men+ Health, US Drugs, VIP Pharmacy/"Viagra+Cialis") will often block traffic from IP addresses associated with legal, financial and antispam organizations as well as anyone who has visited more than one of their sites. It may be necessary to use a proxy to view the pages. In addition, nameservers will selectively refuse queries for certain domains not currently being spammed, and it is necessary to use traversal to see that the domains themselves are not suspended.

Nameservers move frequently from one IP address to another, as is typical of hijacked servers. These nameservers were observed at all of the following IP addresses within recent days:
ns1.backcan.ru A 41.207.125.18
ns1.backcan.ru A 200.30.140.150
ns1.backcan.ru A 209.88.103.12
ns1.backcan.ru A 219.237.229.198
ns2.thednswars.com A 41.207.125.18
ns2.thednswars.com A 209.88.103.12

IP Converted: 59.124.253.90

dword = 998047066
hex1 = 0x3b7cfd5a
hex2 = 0x3b.0x7c.0xfd.0x5a
oct = 073.0174.0375.0132
View CIDR AS3462 Report: http://www.cidr-report.org/cgi-bin/as-report?as=3462

"3462 | TW | apnic | 2002-08-01 | HINET Data Communication Business Group"<br />
Extended information for AS3462:
State/Province:
Country: tw
Responsible Domain: hinet.net
Abuse Email: cracker@hinet.net
IP Converted: 62.168.101.112

dword = 1051223408
hex1 = 0x3ea86570
hex2 = 0x3e.0xa8.0x65.0x70
oct = 076.0250.0145.0160
View CIDR AS5578 Report: http://www.cidr-report.org/cgi-bin/as-report?as=5578

"5578 | CZ | ripencc | 1996-03-18 | GTS-SK-AS GTS Nextra a.s."<br />
Extended information for AS5578:
State/Province:
Country: sk
Responsible Domain: gtsi.sk
Abuse Email: abuse@gtsi.sk
IP Converted: 83.148.186.142

dword = 1402256014
hex1 = 0x5394ba8e
hex2 = 0x53.0x94.0xba.0x8e
oct = 0123.0224.0272.0216
View CIDR AS20500 Report: http://www.cidr-report.org/cgi-bin/as-report?as=20500

"20500 | GB | ripencc | 2001-03-15 | GRIFFIN Griffin Internet European Network"<br />
Extended information for AS20500:
State/Province:
Country: uk
Responsible Domain: griffin.net.uk
Abuse Email: postmaster@griffin.net.uk
IP Converted: 116.228.7.35

dword = 1961101091
hex1 = 0x74e40723
hex2 = 0x74.0xe4.0x7.0x23
oct = 0164.0344.07.043
View CIDR AS4812 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4812

"4812 | CN | apnic | 1996-01-09 | CHINANET-SH-AP China Telecom (Group)"<br />
Extended information for AS4812:
State/Province:
Country: cn
Responsible Domain: chinanet.cn.net
Abuse Email: cncert@cert.org.cn
IP Converted: 88.191.17.209

dword = 1488916945
hex1 = 0x58bf11d1
hex2 = 0x58.0xbf.0x11.0xd1
oct = 0130.0277.021.0321
IP Converted: 193.165.209.3

dword = 3248869635
hex1 = 0xc1a5d103
hex2 = 0xc1.0xa5.0xd1.0x3
oct = 0301.0245.0321.03
View CIDR AS12322 Report: http://www.cidr-report.org/cgi-bin/as-report?as=12322

"12322 | FR | ripencc | 1999-03-11 | PROXAD AS for Proxad/Free ISP"<br />
Extended information for AS12322:
State/Province:
Country: fr
Responsible Domain: proxad.net
Abuse Email: abuse@proxad.net
View CIDR AS5407 Report: http://www.cidr-report.org/cgi-bin/as-report?as=5407

"5407 | EU | ripencc | 1995-08-17 | SKYNET-CZ SkyNet, a.s. / www.skynet.cz"<br />
Extended information for AS5407:
State/Province:
Country: cz
Responsible Domain: skynet.cz
Abuse Email: postmaster@skynet.cz
IP Converted: 209.88.103.12

dword = 3512231692
hex1 = 0xd158670c
hex2 = 0xd1.0x58.0x67.0xc
oct = 0321.0130.0147.014
View CIDR AS6505 Report: http://www.cidr-report.org/cgi-bin/as-report?as=6505

"6505 | BR | lacnic | 1996-05-09 | Global One Communicaoes Ltda"<br />
Extended information for AS6505:
State/Province:
Country: br
Responsible Domain: equant.com
Abuse Email: sirt@equant.com


ISPs: Please assist your customers in identifying and disinfecting servers at the following addresses:

chinanet.cn.net
116.228.7.35

equant.com
209.88.103.12

griffin.net.uk
83.148.186.142

gtsi.sk
62.168.101.112

hinet.net
59.124.253.90

proxad.net
88.191.17.209

skynet.cz
193.165.209.3


Registrars: please suspend the following domains and nameservers. Please investigate the payment history as it was almost certainly fraudulent as well. Please forward evidence of fraudulent activity to law enforcement.

See domain suspension instructions at
http://www.spamtrackers.eu/wiki/index.php?title=Registrar_Advice
Hong Kong mirror:
香港 镜象地点
http://spamtrackers.hk/wiki/index.php/Suspending_an_EPP_domain
http://spamtrackers.hk/wiki/index.php/Suspending_a_non-EPP_domain

(Removal of nameservers is here:
http://spamtrackers.hk/wiki/index.php/Suspending_an_EPP_name_server_domain
http://spamtrackers.hk/wiki/index.php/Suspending_a_non-EPP_name_server_domain )

As the domains for the Yambo family of spamvertised websites (My Canadian Pharmacy, International Legal Rx Medications, Men+ Health, US Drug, VIP Pharmacy ("Viagra + Cialis"), and Canadian Health&Care Mall are uniformly registered with information obtained by identity theft and paid with fraudulent credit/debit card information, please suspend any other sites in this family that you become aware of.

Wildwestdomains:
dlyclurcau.com

naunet.ru
backcan.ru
ns1.backcan.ru [209.88.103.12]

xinnet.com
thednswars.com
ns2.thednswars.com [209.88.103.12]

Looks as though http://dlyclurcau.com/ has been taken down, but http://gnr.dgcast.cn is now redirecting to http://nixqugzadr.com/. Just thought you would like to know.

Yes, thank you. It appears it was not taken down by 35.cn (It may have been a problem with our proxy making appear that it had been).