FANDOM


Canadian Family Pharmacy is an Eva Pharmacy fraud.

DescriptionEdit

Canadian Family Pharmacy is yet another Bulker.biz property selling fake pharmaceutical products, using domains promoted solely by illegally-sent spam messages. This site made its first appearance in August 2009.

Canfampharm med


Their "Help and FAQ" page fraudulently states

We use the Secure Socket Layer (SSL) protocol which enables end-to-end data protection.

As with every single Bulker.biz website, no such security is present, or ever has been present.

When last tested (August 2010) the links to the American Red Cross, IMPac, CIPA, Pharmacy Checker, or the Better Business Bureau were all locally hosted, and did not link directly to any of these agencies or associations. Canadian Family Pharmacy, in common with all other Bulker.biz pharmacy operations, has no licenses, approval, quality guarantees, security or site awards.

Canfampharm logos

Under "Our Address" the site lists two fake Canadian addresses (one in Ottawa, Ontario previously associated with another Bulker.biz property My Canadian Pharmacy, another in Winnipeg) and lists their warehouse address as being located in Bihar, India.

Prominent use of the Canadian flag belies the fact that all of the domains used to host these fraudulent sites are registered in China.


As with all other Bulker.biz properties, hosting is provided illegally by using a hijacked host. Images loaded into web pages, as is common with Bulker.biz hijacked servers, are pulled down from a variety of other hijacked hosts. Each name server used to resolve the domain name to the IP address is also run on yet another hijacked host. These are all Unix servers which have had an exploit loaded on to them to act as a proxy web server or dns server. The owners of these servers are completely unaware that their servers are being used in this way.

Fake Doctors and TestimonialsEdit

Unlike most of the other Bulker.biz properties, Canadian Family Pharmacy has wisely chosen not to claim who their alleged "doctors" or "pharmacists" are. On all other sites these have been fake personas supported by easily-purchased stock photos of models posing as doctors. Also unlike all other Bulker.biz properties, there are no "testimonials" on this particular site either. Another wise choice, since these were also completely fake in the first place.

The picture of the staff on the "About Us" page is fake, and can be found on Getty Images

Fake LicensesEdit

Canadian Family Pharmacy fake license

Click to enlarge fake license version 1

Canadian Family Pharmacy fake license2

Click to enlarge fake license version 2

CFPLicense

Click to enlarge fake license version 3

Like other fraud pharmacies, these fraudsters have printed their own version of a pharmacy license. Not being particularly adept, they have chosen to spell license in the US fashion, ignorant of the Canadian spelling of licence.

Version 1

They have referred to the college as "College of Pharmacists of Ontario" whereas the actual college refers to itself as "Ontario College of Pharmacists" - see http://www.ocpinfo.com/

The address that they have used for the fake license is 913 Montreal Road, Ottawa, ON, Canada. That is the same non-existent address that they use for their own headquarters.

They have put a watermark on the document to try to lend it authenticity. However, the watermark is not the logo of the actual Ontario College of Pharmacists depicted below.


OCP logo

Version 2

On some sites, they display another fake license, this time pretending it is from the Manitoba Pharmaceutical Association. Unlike a real license, it has spelling and grammatical errors, consistent with a fake produced by criminals who lack a good grasp of the English language. They have lifted the MPhA logo from their web site and placed it on the fake license.

Once again, the address that they have used for the fake license is 913 Montreal Road, Ottawa, ON, Canada. That is the same non-existent address that they use for their own headquarters.

The actual real address for the MPhA is

Manitoba Pharmaceutical Association

200 Tache Avenue

Winnipeg, MB, R2H 1A7

Phone: 204-233-1411

Fax: 204-237-3468

Email: info@mpha.mb.ca


Mpha-white-logo-small Logo which was stolen, re-colored, and placed on the fake license.

Version 3'

In 2014, the fake license shows an address of the Preston Business Center in Ottowa, 343 Preston St, Ottawa, ON, K1S 5N4, Canada.

Fake OfficesEdit

Subsequent to this publishing, these Russian fraudsters have changed the addresses to try to regain credibility, but they have switched to faceless locations, such as business centers or box-drops.

The "contacts" page previously included the following addresses for their alleged "Canadian" offices:

Canfampharm offices

Main Headquarters 913 Montreal Road, Ottawa, ON, Canada

CFP Banc Sushi

Nearest location to 913 Montreal Road


This was a fake address. There is no 913 on Montreal Road in Ottawa. That address has been used for many years as the reported address for Canadian Health&Care Mall, another well-known Bulker.biz spammed property. The nearest address is 919 Montreal Road, which is the location of the Banc Sushi Restaurant. The image of the building can be found at Getty Images

The property at what would be 913 Montreal Road is shown in the picture taken from Google Maps


Office: 18/4 Centennial st., Winnipeg, Manitoba

This was also a fake address. This is further corroborated by visiting the actual Better Business Bureau report on this fake pharmacy:

Additional Locations and Phone Numbers
Additional Addresses
4 Centennial Street, Unit 18
(Invalid Address)
Winnipeg, MB  .
Canada

BBB link

The third was their "warehouse" location, which appears to be a poorly Photoshopped stock photo of a nondescript warehouse building. That address is listed as:

Jaiswal Lane, Dakbunglow Road, Bihar, India

We have not yet confirmed that address, but given the track record of literally every other address they have used (previously in Toronto, Calgary, Louisiana and New Delhi) the probability is extremely low that this address would actually lead to any real "warehouses" for this operation.

Fake RegistrationEdit

Like other Yambo family sites, Canadian Family Pharmacy uses identity theft to register its sites. Victims whose personal information has been used to register one of these sites should follow the steps outlined here.

Hijacked ServersEdit

Like other Yambo sites, this one uses the tirqd Unix infection to hijack servers for hosting the websites, their images, and their nameservers. A given hijacked machine may be serving images to all sites in the Yambo family at one time:

Similarly, the servers used to host the website and nameservers for Yambo sites are swapped around among sites during their frequent changes.

How to Report this SpamEdit

The Complainterator is configured to report this spam to the registrars. It performs a "whois" lookup on the domain names used by the name servers that resolve access to the web site. It discovers the registrars that are sponsoring the access to the web site. It prepares a complaint to the sponsoring registrars.

Removal instructions

web site domains
- the registrar needs to set the status of the domain to

  • clientHold
  • clientUpdateProhibited
  • clientDeleteProhibited
  • clientTransferProhibited

name server domains
- the registrar needs to set the status of each of the name server domains to

  • clientHold
  • clientUpdateProhibited
  • clientDeleteProhibited
  • clientTransferProhibited

In addition, to remove them as name servers, the subdomain address records (eg for ns1 and ns2) need to be changed to a non-routable address, such as 0.0.0.0 or a blackhole address within their own address space.

Sample sites and registrars sponsoring themEdit

CJSC REGISTRAR R01Edit

healthiestmen.net

R01-RUEdit

bestcanadianquality.ru
bestmedicinalsupply.ru
besttabscompany.ru
canadiansmartoutlet.ru
excellentcuringmart.ru
fastpillservices.ru
firstcareprogram.ru
firstremedymart.ru
firsttabsservices.ru
genericdrugpurchase.ru
genericsafecompany.ru
goodhealthcareinc.ru
healingsafesupply.ru
healthiestmen.net
hotsupplementinc.ru
luckymedsservice.ru
luckyremedyservice.ru
magiccarevalue.ru
magicpharmpurchase.ru
magicpharmsale.ru
mycanadianinc.ru
mypowerpack.net
naturalaidshop.ru
naturalhotmall.ru
naturalprivatedeal.ru
newfastcompany.ru
newhealthcareassist.ru
newpillsvalue.ru
onlinehealthquality.ru
organicglobalmart.ru
organicsecuremall.ru
organicsecurevalue.ru
perfectpillsquality.ru
perfectpillsupply.ru
pureherbalservices.ru
pureremedyeshop.ru
puresecureshop.ru
remedialdrugstrade.ru
remedialpillbargain.ru
remedialsmartstore.ru
saferemedialservice.ru
securehealthwebmart.ru
thepharmacydeal.ru
yourdrugassist.ru

Edit

Bulker.biz is the sponsor organization behind this type of site. They pay spammers to promote it, and they don't shut down illegal spammers.

Related spam operationsEdit

See: Category:Yambo family

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.