Fraud Reports Wiki
Advertisement

Netlynx is a registrar in India. The CEO on record is Pankaj Jaiswal (pictured)

Jaiswal


Anti-Spam Position[]

Official Position[]

http://www.netlynx.in/support/legal.php?requestfor=customerdomainagreement&from=agree_page

OBLIGATIONS OF THE CUSTOMER

Parent and Service Providers, in their sole discretion, expressly reserve the right to freeze, delete, suspend, deny, cancel, modify, take ownership of or transfer any Domain Order, in order to comply with any applicable Dispute policies, requests of law enforcement, or in compliance with any Court Orders, or if Parent or Service Providers in their sole discretion determine that the information associated with the Domain Order is inaccurate, or has been tampered with, or has been modified without authorization, or if Parent or Service Providers in their sole discretion determine that the Domain Order ownership should belong to another entity, or if Customer/Customer/Registrant does not comply with any applicable terms and conditions, standards, policies, procedures, and practices laid down by Parent, Service Providers, ICANN, the Registrar and the Registry Operator. The Customer agrees that Parent and Service Providers, and the contractors, employees, directors, officers, representatives, agents and affiliates, of Parent and Service Providers, are not liable for loss or damages that may result from any of the above.

Required to abide by the agreement with ICANN for accreditation.

From the ICANN Registration Accreditation Agreement (RAA):
3.7.7.9 The Registered Name Holder shall represent that, to the best of the Registered Name Holder's knowledge and belief, neither the registration of the Registered Name nor the manner in which it is directly or indirectly used infringes the legal rights of any third party.

1.13 "Illegal Activity" means conduct involving use of a Registered Name sponsored by Registrar that is prohibited by applicable law and/or exploitation of Registrar's domain name resolution or registration services in furtherance of conduct involving the use of a Registered Name sponsored by Registrar that is prohibited by applicable law.

5.5 Termination of Agreement by ICANN. This Agreement may be terminated ... [if the] Registrar .. is convicted by a court of competent jurisdiction of a felony or other serious offense related to financial activities, or is judged by a court of competent jurisdiction to have: ...

with actual knowledge (or through gross negligence) permitted Illegal Activity in the registration or use of domain names or in the provision to Registrar by any Registered Name Holder of inaccurate Whois information

Actual Behavior[]

Usually acts rapidly to remove illegal sites. But in 2014 this registrar failed to act on fraud domains. By August 2014 all detected sites were reported and suspended. In 2017-2018 Netlynx had rapidly suspended all fraud pharmacy domains reported.

Registrar responsiveness[]

Showing all registrars including R01.RU LiveSite2014

Showing all registrars excluding R01.RU LiveMinors

Piechart showing the crime sponsoring contribution by each registrar.

RegPie

The comparison between this registrar and others can be seen on the graphs.

It shows how many domains have not been suspended by various registrars over the past year. The higher the column, the more domains are sponsored by the registrar.

Currently the most abused registrar is Russia's R01.ru. This registrar sponsors the vast majority (often over 60%) of the fraud domains used within the Eva Pharmacy group.

The second most abused registrar is Russia's REG.RU REG.RU at over 25%

The next most abused registrar is GKG GKG at 4%.

The next most abused registrar is The Netherlands' Hosting Concepts aka OpenProvider at 3%.

These are followed by Russia's ARDIS, India's PublicDomainRegistry PDR, China's CNOBIN, Canada's Tucows, and Pakistan's PakNIC.


Outside of Russia, most registrars have been quick to terminate the service contracts with these cyber-criminals upon seeing the obvious evidence of fraud.




Sample illegal domains[]

These were all part of the pharmacy fraud network centered in Russia, known as EvaPharmacy.

They were checked and found to be live on May 13, 2015. Domains had false registrant details, which breaks the above customer obligations, that the information associated with the Domain Order (must not be} inaccurate

The registrant details are generated using a well known fake identity generator. This has been the case for thousands of false registrants for other fraud domains.

See Netlynx_list


Canadian Health&Care Mall[]

curativecareelement.in (suspended)
fastmedicatinggroup.in (suspended)
firsthealthmart.in (suspended)
goodcareexchange.com (suspended)
homemedicalonlinereward.in (suspended)
hothealingpurchase.in (suspended)
magicdrugmart.in (suspended)
magicnaturalmart.com (suspended)
medicatingrxreward.in (suspended)
onlineorganiceshop.in (suspended)
cxtzhwqt.com (suspended)
fastcarepurchase.in (suspended)
firstherbassist.in (suspended)
firstmedsservice.in (suspended)
healingherbsservice.in (suspended)
llfinfbe.in (suspended)
luckynaturalvalue.in (suspended)
perfectcuringmarket.com (suspended)
smartremedialworth.in (suspended)
bestandworstwwe.com (suspended)
globalremedyassist.in (suspended)
herbalprivategroup.in (suspended)
mymedicinalstore.in (suspended)
onlinecuringbargain.in (suspended)
organicpillpurchase.in (suspended)
theorganicherbstore.com (suspended)
cwhbaejb.com (suspended)
curativefastassist.com (suspended)
globalcuringvalue.in (suspended)
globalpillsservice.in (suspended)
goodherbsdeal.in (suspended)
herbaltabletbargain.in (suspended)
hothealthcaremall.in (suspended)
medicalsafetrade.in (suspended)
mygenericbargain.in (suspended)
smarthealingcompany.com (suspended)
thecanadiandeal.in (suspended)
thehealingquality.com (suspended)
vslhnzlf.com (suspended)
yourorganictrade.com (suspended)
curingremedygroup.com (suspended)
herbalpillmall.com (suspended)
jhcurorf.com (suspended)
luckymedsservice.com (suspended)
naturaldrugassist.com (suspended)
oliytabbi.com (suspended)
securehealthexchange.com (suspended)
tixnuofa.com (suspended)
bamsxgsk.com (suspended)
fastdrugsvalue.com (suspended)
healingfasteshop.com (suspended)
devicesmarket.com (suspended)
genericherbsupply.com (suspended)
securemedicareshop.com (suspended)
curinghotdeal.com (suspended)
fnfxbthv.com (suspended)
fuhdqqdt.com (suspended)
gkjhtxdb.com (suspended)
gwmnbxwz.com (suspended)
wqosfyxk.com (suspended)

Canadian Neighbor Pharmacy[]

medicativefastinc.in (suspended)
naturalremedyshoponline.com (suspended)
curingmedsbuy.com (suspended)
fastcaremarket.com (suspended)
magicgenericinc.com (suspended)
safemedicinalgrouponline.com (suspended)

Men's Health[]

hotmedicinalstore.com (suspended)

RxExpressOnline[]

henriettacharlene.com (suspended)
bonnylaurie.com (suspended)
brennjacky.com (suspended)
fasthealingeshop.com (suspended)
kelseytrixie.com (suspended)
kimberlynaleta.com (suspended)
maiblereta.com (suspended)
medicaldruginc.com (suspended)
medicativefirstsale.com (suspended)
remedialhotelement.com (suspended)
willieabigail.com (suspended)
hometabletmall.com (suspended)
onlinepillvalue.com (suspended)

RxMedications[]

privateherbvalue.com (suspended)
trustedherbquality.com (suspended)

My Canadian Pharmacy[]

luckyherbalelement.in (suspended)
curingfamilymall.com (suspended)
genericsafepurchase.com (suspended)
homeherbalmall.com (suspended)
hotpillsstore.com (suspended)
hottabsservice.com (suspended)
normansmart.com (suspended)
newcanadianmart.com (suspended)
privatemedicalinc.com (suspended)
purepillsgroup.com (suspended)

CanadianPharmacy[]

genericherbstore.in (suspended)
onlinepillinc.in (suspended)
safemedicalgood.in (suspended)
homemedsquality.in (suspended)
luxuryhomeherbalassist.in (suspended)

Common IP addresses[]

A quick way to verify these sites is to examine the hosting addresses. Note that * items have been removed. Many compromised hosts used for this operation during September 2020 - May 2021 were located at these IPs.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Live
----
2.184.67.164 5.101.140.77 5.188.211.29 37.46.135.24 51.222.136.197*
51.89.151.227 84.15.139.143 84.200.77.180 95.165.145.236 95.165.149.124
95.165.27.205 95.31.40.41 103.117.141.163 103.121.91.117 103.126.6.161
103.127.31.154* 103.135.128.72* 103.139.42.59 103.146.23.100 103.147.153.123*
103.147.153.126* 103.157.224.90 103.228.114.93 103.236.150.106* 103.236.201.228
103.92.25.124 103.242.117.197 103.28.149.174 103.30.246.103 103.83.192.109
103.9.158.67 103.92.25.124 185.182.105.220 185.182.105.221 185.227.136.203
185.24.232.98 185.227.136.205 198.211.33.45 200.55.243.166* 202.145.2.67


Removed
----------
5.133.12.16* 5.181.158.179* 5.181.158.181* 5.187.52.1* 5.187.52.12*
5.187.52.13* 5.187.52.9* 5.2.89.72* 5.253.62.111* 5.45.82.242*
31.132.1.40* 37.61.211.187* 37.61.211.188* 37.61.211.189* 45.119.41.11*
45.119.41.12* 45.119.41.14* 45.125.65.93* 45.131.83.10* 45.137.21.144*
45.137.21.166* 45.67.116.219* 45.86.163.7* 51.158.23.140* 51.210.134.178*
51.38.80.31* 58.64.137.69* 62.141.56.196* 78.157.200.139* 80.233.134.248*
80.233.134.249* 81.4.110.230* 82.199.101.248* 82.199.101.44* 82.199.104.3*
85.17.219.96* 85.183.104.125* 85.254.72.7 * 87.120.253.209* 89.105.221.82*
89.222.128.42* 91.199.41.51* 91.199.41.53* 91.199.41.55* 93.119.105.5*
94.126.173.105* 94.152.214.31* 94.156.175.107* 101.53.147.97* 101.99.90.111*
103.108.117.18* 103.117.141.184* 103.130.218.113* 103.138.96.86* 103.142.25.210*
103.160.144.64* 103.160.62.153* 103.221.220.169* 103.42.58.61* 103.56.148.90*
103.6.207.162* 103.8.26.45* 103.86.51.178* 103.92.30.110* 109.232.240.24*
111.90.158.205* 112.78.10.214* 119.59.123.55* 119.59.123.55* 128.1.60.6*
130.185.72.89* 134.119.186.27* 134.119.186.29* 141.98.10.125* 141.98.10.136*
141.98.10.142* 141.98.10.225* 146.247.49.105* 146.88.26.167* 159.148.186.165*
159.148.187.4* 159.148.187.6* 167.114.188.36* 170.130.173.37* 171.244.143.163*
173.213.80.216* 176.123.9.67* 178.239.177.183* 178.255.40.234* 179.43.149.28*
180.131.147.100* 185.105.109.213* 185.108.128.181* 185.128.42.106* 185.128.42.107 *
185.128.43.18* 185.128.43.21* 185.128.43.54* 185.130.206.6* 185.140.249.133*
185.183.104.123* 185.216.8.156* 185.227.136.206* 185.24.232.118* 185.24.232.134*
185.24.232.76* 185.9.158.36* 185.99.3.68* 185.99.3.80* 194.5.179.140*
195.123.247.36* 198.27.110.97* 209.127.28.5* 209.97.184.221* 212.34.158.134*
212.34.158.134* 213.226.100.10*


Where to contact the compromised hosting ISP:

Abuse contact for '5.2.88.0 - 5.2.89.255' is 'alvaro.montero@ipcore.com'
Abuse contact for '5.45.80.0 - 5.45.83.255' is 'abuse@ispiria.net'
Abuse contact for '5.101.140.64 - 5.101.140.95' is 'abuse@ukservers.com'
Abuse contact for '5.181.158.0 - 5.181.158.255' is 'abuse@mivocloud.com'
Abuse contact for '5.133.8.0 - 5.133.15.255' is 'abuse@artnet.pl'
Abuse contact for '5.187.48.0 - 5.187.55.255' is 'abuse@artnet.pl'
Abuse contact for '5.188.211.0 - 5.188.211.255' is 'abuse@pindc.ru'
Abuse contact for '5.253.60.0 - 5.253.63.255' is 'abuseto@adminvps.ru' (Removed)
Abuse contact for '27.124.80.0 - 27.124.95.255' is 'abuse@medialink.net.id'
Abuse contact for '31.200.247.0 - 31.200.247.255' is 'ripe@unelink.com'
Abuse contact for '37.46.132.0 - 37.46.135.255' is 'abuse@abusehost.ru'
Abuse contact for '45.67.116.0 - 45.67.116.255' is 'abuse@itns.md'
Abuse contact for '45.86.163.0 - 45.86.163.255' is 'support@crowncloud.net'
Abuse contact for '45.125.65.0 - 45.125.65.255' is 'abuse@tele-asia.net'
Abuse contact for '45.131.83.0 - 45.131.83.255' is 'abuse@sered.net'
Abuse contact for '51.89.148.0 - 51.89.151.255' is 'abuse@ovh.net'
Abuse contact for '79.172.193.0 - 79.172.193.255' is 'abuse@deninet.hu' (Removed)
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '82.199.104.0 - 82.199.107.254' is 'abuse@seven-sky.net'
Abuse contact for '84.15.136.0 - 84.15.143.255' is 'abuse@bi.lt'
Abuse contact for '84.200.77.0 - 84.200.77.255' is 'abuse@accelerated.de' (Removed)
Abuse contact for '85.254.72.0 - 85.254.72.255' is 'support@serveria.com'
Abuse contact for '87.120.253.0 - 87.120.253.255' is 'abuse@neterra.net'
Abuse contact for '89.105.192.0 - 89.105.223.255' is 'abusedesk@novoserve.com'
Abuse contact for '89.222.128.0 - 89.222.131.255' is 'abuse@netorn.net' 'abuse@netorn.ru'
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '93.119.104.0 - 93.119.105.255' is 'abuse@virtono.com'
Abuse contact for '94.152.0.0 - 94.152.255.255' is 'abuse@kei.pl'
Abuse contact for '94.156.175.0 - 94.156.175.255' is 'abuse@iws.co'
Abuse contact for '95.24.0.0 - 95.31.255.255' is 'abuse-b2b@beeline.ru'
Abuse contact for '95.84.128.0 - 95.84.159.255' is 'abuse@rt.ru'
Abuse contact for '95.165.128.0 - 95.165.255.255' is 'abuse@spd-mgts.ru'
Abuse contact for '103.6.204.0 - 103.6.207.255' is 'yogie@redwhite.co.id'
Abuse contact for '103.9.156.0 - 103.9.159.255' is 'cuong.trinh@vnso.vn'
Abuse contact for '103.28.148.0 - 103.28.149.255' is 'support@easyway.co.id'
Abuse contact for '103.56.148.0 - 103.56.149.255' is 'abuse@jagoanhosting.com'
Abuse contact for '103.86.48.0 - 103.86.48.255' is 'abuse@bangmodhosting.com'
Abuse contact for '103.92.24.0 - 103.92.27.255' is 'hm-changed@vnnic.vn' 'system@tlsoft.vn'
Abuse contact for '103.117.141.0 - 103.117.141.255' is 'abuse@casbay.com'
Abuse contact for '103.121.88.0 - 103.121.91.255' is 'tampd@bkns.vn'
Abuse contact for '103.126.6.0 - 103.126.7.255' is 'shazim@serverstack.in'
Abuse contact for '103.138.96.0 - 103.138.96.255' is 'hello@hostitsmart.in'
Abuse contact for '103.146.22.0 - 103.146.23.255' is 'duc@lanit.com.vn'
Abuse contact for '103.147.152.0 - 103.147.153.255' is 'abuse@shineservers.com'
Abuse contact for '103.221.220.0 - 103.221.223.255' is 'hoanglong@azdigi.com'
Abuse contact for '103.236.201.0 - 103.236.201.255' is 'admin@idcloudhost.com'
Abuse contact for '111.90.128.0 - 111.90.159.255' is 'abuse@shinjiru.com.my'
Abuse contact for '112.78.0.0 - 112.78.15.255' is 'vanht@ods.vn'
Abuse contact for '130.185.72.0 - 130.185.72.255' is 'report@parspack.com'
Abuse contact for '119.59.96.0 - 119.59.127.255' is 'abuse@metrabyte.cloud'
Abuse contact for '141.98.10.0 - 141.98.10.255' is 'admin@serveroffer.lt'
Abuse contact for '146.247.49.0 - 146.247.49.255' is 'abuse@netcetera.co.uk'
Abuse contact for '159.148.186.0 - 159.148.186.255' is 'support@serveria.com'
Abuse contact for '159.148.0.0 - 159.148.255.255' is 'abuse@latnet.eu'
Abuse contact for '171.224.0.0 - 171.255.255.255' is 'hm-changed@vnnic.vn' 'soc@viettel.com.vn'
Abuse contact for '176.123.0.0 - 176.123.11.255' is 'abuse@alexhost.com'
Abuse contact for '178.239.176.0 - 178.239.177.255' is 'abuse@irideos.it'
Abuse contact for '178.255.40.232 - 178.255.40.235' is 'abuse@artnet.pl'
Abuse contact for '179.43.149.0/26' is 'support@privatelayer.com'
Abuse contact for '180.131.144.0 - 180.131.147.255' is 'abuse@nawala.org'
Abuse contact for '185.24.232.0 - 185.24.232.255' is 'abuse@servebyte.com'
Abuse contact for '185.128.40.0 - 185.128.43.255' is 'abuse@rackend.net'
Abuse contact for '185.130.206.0 - 185.130.207.255' is 'abuse@as61317.net'
Abuse contact for '185.140.248.0 - 185.140.249.255' is 'contact@buzinessware.com'
Abuse contact for '185.183.104.0 - 185.183.104.255' is 'abuse@m247.ro'
Abuse contact for '194.5.176.0 - 194.5.179.255' is 'berbid238@gmail.com'
Abuse contact for '200.55.243.166'  is 'radhios@gmail.com' syt.com web page
Abuse contact for '202.145.0.0 - 202.145.3.255' is 'abuse@uninet.net.id'
Abuse contact for '209.127.0.0 - 209.127.138.255' is 'abuse@servermania.com'


Example of the highest used IP addresses from November 2020 IPabuses

Examples of fake registrant data[]

Domain Registrant name Registrant address Registrant phone False data
curingremedygroup.com Selene Granado Rua Sao Jorge 1739, Canoas, RS, 92030-660, BR +55.5179365855 phone
herbalpillmall.com Maria Carman 150 Winter Street, Mangapapa, Gisborne, 4010, NZ +64.026101274 address & phone
ijvgafyl.com Jamie Haynes 24 Rose Street, Whitby, Porirua, 5024, NZ +64.022777048 address & phone
luckymedsservice.com Amanda Heijne Papiermolen 69, Maassluis, ZH, 3146 TD, NL +31.0633702111 address
oliytabbi.com Ryan Birge 156 Beverley Place, Shiel Hill, Dunedin, 9013, NZ +64.020254893 address & phone
securehealthexchange.com Sophia Egger Holstenwall 57, Bad Schandau, SN, 1814, DE +49.0350228480 phone
tixnuofa.com Jana Bueno 41 Manu Tapu Drive, Mangere Bridge, Manukau, 2022, NZ +64.020191951 address & phone
privatemedicalinc.com Stefanie Braun torkower Strasse 3, Neuwied Block, RP, 56566, DE +49.02622951341 phone
curinghotdeal.com Elizabeth Hall 183 Alexandra Street, Maori Park, Timaru, 7910, NZ +64.028413347 address & phone
fnfxbthv.com Liane Perillard 55 Rue Hubert de Lisle, Lunel, Lunel, 34400, FR +33.0433966389 phone
fuhdqqdt.com Reem Daoudi Griend 22, Lelystad, FL, 8225 RC, NL +31.0664369055 phone
gkjhtxdb.com Flynn Aird 6 Acheron Road, Giffard, VIC, 3850, AU +61.353582920 address
gwmnbxwz.com Katariina Nurmi Viinikantie 6, Petaskyla, Petaskyla, 75930, FI +358.0421260504 address & phone
wqosfyxk.com Louis Duclos 96 rue Porte dOrange, Castres, Castres, 81100, FR +33.0533368047 address & phone
qdqfvssr.com Armand Laux 43 rue Saint Germain, Gap, Gap, 5000, FR 33.0454723450 phone
organicbestdeal.com Mercedes Medrano Calle Canada del Rosal 38, Campofrio, Huelva, 21668, ES +34.628355204 address
pillhealthgroup.com Darcy Crowther 17 Boonah Qld, Mount Tarampa, QLD, 4311, AU +61.745696831 address & phone
naturalorganicpharmacydeal.com Battista Sabbatini Via San Domenico Soriano 27, Castel Di Tusa, ME, 98070, IT +39.03780684863 phone
vanyaandeee.in Metehan Albert Heggeroos 167,Zeewolde, FL, 3892 XR, NL +31.0631843425 address
remedialhealthshop.com Pauliina Harikkala Kylpylaitoksentie 61, Roukalahti, Roukalahti, 83150, FI +358.0501288347 address & phone
remedialhotoutlet.com Nusi Sinka Wesselenyi u. 25, Nemesker, 9471, HU +36.99540158 address & phone
edivablakelee.in Natasha Fetherston 44 Argyle Street,Mares Run, NSW, 2422, AU +61.249803774 address & phone
jessalynericka.in Jonathan Underwood 33 Patton Street,Kilsyth, VIC, 3137, AU +61.398054133 address & phone
shanteetracey.in Luisa Becher 1655 Tchesinkut Lake Rd,Hansard, BC, V0J 2Z0, CA +1.2509661239 phone
audreytheo.in Maika Logtenberg Maarse Hof 72,Aalsmeer, NH, 1431 PC, NL +31.0612338828 phone
cassondradebbi.in Shayla Veenhuis Havensingel 188,Eindhoven, NB, 5611 VS, NL +31.0634206373 phone
silvanaerica.in Ema Valenzuela Estrela 66,Santa Cruz de Bezana, Cantabria, 39100, ES +34.677518527 phone
galinachristal.in Selene Castaneda Calle Canada del Rosal 69,Villanueva de los Castillejos, Huelva, 21540, ES +34.959437010 phone
myrleneherminia.in Janice Gastelum Calvo Sotelo 96,Alaejos, Valladolid, 47510, ES +34.983610807 phone
coraliemadeleine.in Angelina Fanucci Via Nolana 44,La Spezia, SP, 19132, IT +39.03332707177 phone
audiecahra.in Nilde Lombardi Via degli Aldobrandeschi 42,Marianopoli, CL, 93010, IT +39.03392828680 phone
adriaensmelita.in Fortunata Onio Via del Pontiere 117,Villastellone, TO, 10029, IT +39.03882760066 phone

Description of the Registrar[]

Netlynx provides reliable, cost effective and high quality Domain Name Registration and Domain Transfer Services duly complemented with full technical and customer support.

Where to send abuse complaints[]

By email[]

support@netlynx.com
abuse@netlynx.com

By contact page[]

http://www.netlynx.com/contact.htm

Report false registration details
http://www.netlynx.in/support/report-false-whois.php

Additional Contact Information[]

The CEO is Pankaj Jaiswal

Postal address[]

Head Office:
Netlynx Technologies Pvt. Ltd.
103, Tirupati Udyog Premises, I. B. Patel Road,
Off. Western Express Highway,
Near HP Petrol Pump. Goregaon
East. Mumbai - 400063

Registration Information[]

Telephone and FAX[]

Tel: +91 22 40811144 / +91 22 40811133
Fax: +91 22 40811100

Related information[]

Pharmacy fraud operations

Affiliate program coordinator employing spammers

Sources for this article[]

Independent[]

EVA Pharmacy forum at FraudReports

Interview[]

Corporate[]

http://www.netlynx.com

Advertisement