FANDOM


DescriptionEdit

EDExpress

ED Express

EDexpress 2011

ED Express 2011

ED Express was first noticed in October 2007. It displays a copyright statement for Canadian Pharmacy.

EDExpress copyright

However, there is sufficient evidence to attribute this spam brand to Vincent Chan - the author of the ED Choice brand.

VariantsEdit

ED Express sites have a variety of appearances. It also may be called "Pills for Men" or "United ED Meds." All variants load images from a common domain, such as waklazr.net, or a common IP address (212.95.37.136 or 94.229.65.172). They also share a common "monthly special" marketing device.

EDexpressXmas

ED Express variant 1

EDexpressAlt3

ED Express variant 2

EDexpressAlt6

ED Express variant 3

EDexpressAlt4

ED Express variant 4

EDexpressAlt5

ED Express variant 5

EDexpressAlt7

ED Express variant 6

EDexpressAlt8

ED Express variant 7

EDexpressAlt9

ED Express variant 8

EDexpressAlt10

ED Express variant 9

False PretensesEdit

False: "Safe as Fort Knott" secure link claimEdit

In a laughable display of ignorance, the spam site developer repeats the same error as seen in other scams including ED Choice. Once again he confuses the US gold repository with the Knott's Berry Farm family entertainment site near Disneyland in Los Angeles, in an attempt to impress people with the site's security.

EDExpress security

To make it worse, he refers to "world wide known processor MyPaySystems.com" which is unfortunately known for all the wrong reasons.

But it gets even worse than that. When you go to their checkout page you are expected to enter your identity details and your full credit card information on a page using non-secure http instead of secure https despite the previous assurances of security - another example of fraud.

False: Claim to be CanadianEdit

The copyright notice would lead you to believe that this site is somehow related to Canada. But in the Frequently Asked Questions link there is some conflicting information:

EDExpress canadian

Spam ExamplesEdit

Subject: "Re: ClALnlS - $ 1.45 (arrears superpose) VilAGRA - $ 1.29"

EDexpressSpam1


Subject: "RE: CltALlS : $ 2.53; VlAGRtA : $ 1.34 quest"

EDexpressSpam2

Spam emails include a footnote promoting a legitimate site. That URL may be picked up by Spamcop.net and reported as a spammed URL if the reporter is not alert when confirming the report.

RedirectionsEdit

Microsoft spaces.live.comEdit

In February 2010, spammers began using redirection abuse on Microsoft's free hosting service Spaces.live.com. The redirection target was canadapharmsite.com registered on INTERNET.BS CORP by Registrant

   Ksenia Siniceva
   Kondrikova str. 6-219
   620143 Zavoljsk
   Russia
   Tel: +7.3912488322

Storm TrojanEdit

As at March 21, 2008, Storm Trojan infected machines were found to be redirecting to four different fake pharmacy sites using the format http://xxx.xxx.xxx.xxx/anything/

For ED Express, the redirection sites detected were

  • superwildside.com
  • darksidehq.com

Sponsoring RegistrarsEdit

Name ServersEdit

Spamvertized SitesEdit

  • Site = theloglady.com Beijing Innovative Linkage Technology (Uses image server oleoneg.info)
  • Site = dovewoodmj.cn Registrar = 厦门华商盛世网络有限公司 = Bizcn
  • Site = theregulusesworld.com Registrar = Beijing Innovative Linkage Technology (Uses image server waklazr.net)

Some of the other multiple domains spammed within a three day period:

  • ansarcg.cn
  • chevybl.cn
  • limperda.cn
  • eggfishbd.cn
  • yourgovgrants.com
  • puttruelandlate.com
  • eshowdesign.com

These examples from March 2009 use two name servers registered with Russian providers

  • * ns1.hostpharmacytechnician.com (Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU)
  • * ns2.cheapfaxserver.com (Registrar: CENTROHOST CLOSED JOINT STOCK COMPANY)
  • goodcarecard.at
  • fullwelfare.at
  • fullshoppinglist.at
  • fullspectrumdirect.at
  • globalfitlist.at
  • globalairmed.at
  • gisro.at
  • globalindexcast.at
  • globalcoachlist.at
  • globalindexus.at
  • fullmedicalnetworks.at
  • fullmedicalhelp.at
  • fullmedicalcare.at

Web site registrant details:

personname:     Aleksandr Belkov
organization:
street address: Molodezhnaya str. d.9 kv.1
postal code:    152061
city:           Sereda
country:        Russland
phone:          +74853161263
fax-no:         +74853161263
e-mail:         sashabel@ipanda.info

Image ServersEdit

  • Site = waklazr.net Registrar = MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE for Yahoo.com
waklazr.net has address 68.142.212.117, 68.142.212.118, 68.142.212.119, 68.142.212.120, 68.142.212.121, 68.142.212.122
waklazr.net mail is handled by mx5.biz.mail.yahoo.com and mx1.biz.mail.yahoo.com.
  • Site = oleoneg.info Registrar = blog.com Digital Communications Inc.

Typical Fake WHOIS Contact InformationEdit

Domain Name.......... bestbobleonard.com
 Creation Date........ 2008-01-27 13:28:05
 Registration Date.... 2008-01-27 13:28:05
 Expiry Date.......... 2009-01-27 13:28:05
 Organisation Name.... Sevila FC
 Organisation Address. Spain City
 Organisation Address.
 Organisation Address. Bulgaria
 Organisation Address. 45214
 Organisation Address. WG
 Organisation Address. BG

How to report this spamEdit

The Complainterator is configured to request removal of these fraudulent sites. Add a link to this page as evidence. Image servers should be reported directly to the responsible registrar.

Evidence to include:

  • Any violations of your country's anti-spam laws (such as forged "from" fields or lack of contact information/unsubscribe information in the U.S.)
  • Violations of terms of service of registrar (many of the image servers have been on Yahoo servers and are quickly taken down by that company for acceptable use violations)
  • Advertising counterfeit generic versions of drugs that are still under patent (patent law violation)
  • Use of the name/image of those drugs without authorization from the manufacturers (trademark violations)
  • False whois information, if you are able to contact the person listed in the whois info by phone or mail (not email)
  • If there is any evidence of botnet activity, as shown by sites with multiple/frequently changing IP addresses (although not observed for this site, it is a common occurrence with the site "Canadian Pharmacy")

Related spam operationsEdit

The "Fort Knott security" gaffe can be used as a "fingerprint" to locate other spam brands most likely from the same author.

  • dovewoodmj.cn Pills for Men
  • savssatbc.cn United ED Meds
  • 2oqwplqcp8qgllkvpkkv7k22.crevicedin.cn ED Choice

ED Choice is the fore-runner to this spam brand. All of the above related spam operations are attributable to the same source, Vincent Chan.

Mailien-options

Sharing the same IP Address

No known relation: ED Pill Store

Refer to the captured screen image. In 2011, spammer affiliates who registere with the Mailien spamming program were presented with pharmacy operations to select from. These included

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.