Description[]
Toronto Drug Store (TDS) is cvvvvbvbvBulker.biz/EvaPharmacy property, observed in August 2010. More complete discussion of the fraudulent nature of these sites is on the pages for their other brands. Control of this organization has been attributed to the spammer using the pseudonym Alex Polyakov. The same group of scam pharmacy brands is referred to as "Yambo Financials" by Spamhaus.
TDS uses a secure payment system at checkout, on https://checkoutpharamcysafe.com
Domain Name: CHECKOUTPHARAMCYSAFE.COM Registrar: KEY-SYSTEMS GMBH owner-fname: Andrey owner-lname: Polev owner-street: ul. Krasnaya d.117 kv.119 owner-city: Solnechnogorsk owner-state: Moskovskaya oblast owner-zip: 199538 owner-country: RU owner-phone: 7.4963612199 owner-fax: 7.4963612199 owner-email: dress@freenetbox.ru
The checkout site uses an SSL certificate issued by
PositiveSSL CA Comodo CA Limited
Like other Bulker.biz/EvaPharmacy sites, just about every claim made on CNP sites is a lie.
False Pretenses[]
Fake Staff[]
As usual with Bulker.biz/EvaPharmacy sites, their supposed staff physicians are actually models whose photos are available from Getty Images.
Fake Locations[]
The address given for their supposed main office is 155 Front Street West, Toronto, Ontario. The clumsy English on the page makes one immediately suspicious about whether these people have ever set foot in Canada:
We have decided to move the general stream of information to our online Support Department, so 90% of all inquiries are processed online. A special contact ticket system would be a helping hand for our clients while trying to contact us by any reason. Still if you want a face to face audience with one of our managers, you may visit our main Headquarters or secondary offices from 10 a.m. till 6 p.m. local time. We are always glad to meet you!
And sure enough, Google street view shows the data centre at 151 Front Street West extends the length of the block. There is certainly nothing resembling the building in the TDS website photo.
Fake License[]
The pharmacy has no real location and no real pharmacists. But like other EvaPharmacy/Bulker.biz pharmacies, they have forged an imaginary license for their pharmacy. It's obviously fake, since it is displaying the same imaginary address.
The Ontario College of Pharmacy has a website that allows you to look up their licensees. Not surprisingly, Toronto Drug Store isn't listed.
Fake American Pharmacists Association Certificate[]
This task apparently fell to one of the non-native English speakers, because it is quite clumsily worded:
All the drugs sold at Toronto Drug Store are considered to be approved by the American Pharmacists Association (APhA). This bulletin certifies that Toronto Drug Store (License Number 05671274) sells high-quality medications that are presented by certified online shop. We ensure that Toronto Drug Store team has the highest standards of practice carried out by its members. The American Pharmacists Association (APhA) is the organization whose members are recognized in society as essential in all patient care settings for optimal medication use that improves health, wellness, and quality of life. Date: 07/04/10 Signature: Harold N. Godwin
This certificate appears to be dated on July 4, 2010. July 4 is one of the most popular public holidays in the U.S. -- nobody would come in to work to do routine bureaucratic functions like issuing certificates. Actually, whoever did the forgery was unfamiliar with the fact that in the U.S., dates are in month-day-year format, rather than day-month-year. They were trying to make it look like an April 7, 2010 date. They've simply used the same certificate they forged for Canadian Neighbor Pharmacy and changed the name and number.
The license number is the same one used on the Ontario College of Pharmacy forgery. Anyone who has to get licensed by multiple agencies will tell you it's never going to be that easy -- you get a different number from each one. When asked if this certificate was fake, the reply from the American Pharmacists Association was
Yes, this is a fake. Thanks for passing along to us. Sharon Corbitt External Communications Director American Pharmacists Association 2215 Constitution Ave. Washington, DC 20037-2895
The APhA does not license pharmacies or approve the quality of medications. The logo they display is wrong as well, resembling the Glavmed logo instead.
| CNP vesion of APhA logo | /APhA logo from their website |
 |
|
Hijacked servers[]
See the discussion at Canadian Neighbor Pharmacy. TDS sites load images from hijacked servers in the same way.
Sample sites and registrars sponsoring them[]
ADVANCED INTERNET TECHNOLOGIES, INC.[]
max-pharmacy.com
R01-RU[]
airweavesupplies.ru (expired) biologicalaidshop.ru
curativesafevalue.ru
curingaidpurchase.ru curingcareoutlet.ru familyrxstore.ru firsthealingservice.ru goodcurativeinc.ru goodgenericsshop.ru healingherbsservice.ru healingonlinestore.ru hotorganicassist.ru hotpharmmart.ru mymedicalservice.ru newbiologicalvalue.ru newcanadianmart.ru newgenericassist.ru newmedicinaldeal.ru onlineremedyreward.ru remedialhotgroup.ru safepillsshop.ru thecuringmarket.ru themedicamentoutlet.ru trustedpillmarket.ru yourmedicamentinc.ru yoursmartsupply.ru
TUCOWS DOMAINS INC.[]
firstmedsgroup.com suspended healinghotsale.com magicherbshop.com
How to Report this Spam[]
The Complainterator is configured to report this spam to the registrars. It performs a "whois" lookup on the domain names used by the name servers that resolve access to the web site. It discovers the registrars that are sponsoring the access to the web site. It prepares a complaint to the sponsoring registrars.
Removal instructions
web site domains
- the registrar needs to set the status of the domain to
- clientHold
- clientUpdateProhibited
- clientDeleteProhibited
- clientTransferProhibited
name server domains
- the registrar needs to set the status of each of the name server domains to
- clientHold
- clientUpdateProhibited
- clientDeleteProhibited
- clientTransferProhibited
In addition, to remove them as name servers, the subdomain address records (eg for ns1 and ns2) need to be changed to a non-routable address, such as 0.0.0.0 or a blackhole address within their own address space.
Sponsor Organizations[]
Bulker.biz also known as EvaPharmacy is the criminal sponsor organization behind this type of site.
Related spam operations[]
The product list, the pricing and the product descriptions for Toronto Drug Store are identical with that of My Canadian Pharmacy
The image showing the Managed Care Organizations refers to other known fraud brands, Canadian Family Pharmacy and My Canadian Pharmacy
