FANDOM


Key-Systems is a registrar in Germany.

Description of the RegistrarEdit

KeyDrive S.A. is an internet solutions holding company located in Luxembourg. Its subsidiaries offer different internet related services. Among the core business areas are domain registration, monetization and aftermarket services. The holding company includes the Key-Systems group (St. Ingbert, Germany), the NameDrive group (Wasserbillig, Luxembourg) as well as Moniker and SnapNames (Florida and Oregon/USA) with more than 160 employees. With the takeover of Moniker in January 2012 KeyDrive has more than 6 million domains under management. Chairman of the KeyDrive S.A. is Alexander Siffrin, CEO and founder of Key-Systems™.

Key-Systems is a successful international ICANN accredited registrar for internet addresses. The company provides international resellers and end customers with comprehensive access to the world’s top-level domains.

Anti-Spam PositionEdit

Official PositionEdit

http://www.key-systems.net/deutsch/registrierungsvereinbarung.html

Ein registrierter Domainname kann vorübergehend gesperrt oder deaktiviert werden, wenn der Kunde durch die darunter verfügbar gemachten Inhalte in schwerwiegender Weise gegen geltendes Recht oder diese Vereinbarung verstößt bzw. ein solcher Verstoß glaubhaft gemacht wurde, und auf die Aufforderung, diese Inhalte nicht zu entfernen oder anzupassen nicht entsprechend reagiert.

Soweit einzelne Domainnamen durch den Kunden, wegen Verstoß gegen die Registrierungsbedingungen, aufgrund verbindlicher Entscheidungen in Domainstreitigkeiten, oder aufgrund sonstiger in diesen Bedingungen genannten Gründen gekündigt oder übertragen werden, besteht kein Anspruch auf Beantragung einer unentgeltlichen Ersatzdomain oder eine sonstige Erstattung, sofern nicht die Kündigung durch Registrar vorsätzlich oder grob fahrlässig widerrechtlich verschuldet worden ist. Dies gilt ebenso für sonstige Leistungen oder zusätzlich gebuchte Optionen hinsichtlich de betroffene Domainnamen.

http://www.key-systems.net/english/registration-agreement.html

A registered domain name can be temporarily blocked or disabled if the customer offends applicable law or this arrangement in a serious manner through the content made available under the domain name or if such an offence was made plausible and Customer does not react to the request to remove or adapt the content accordingly.

As far as a single domain name is canceled or transferred by Customer, due to violation of the registration agreement, due to binding decisions in domain name disputes or due to other causes specified in these conditions, no right to request for a free replacement domain or other reimbursement exists, provided that the termination was not caused illegally by Registrar in a culpable or grossly negligent manner. This also applies to other services or additionally booked options regarding the affected domain names.

Actual BehaviorEdit

This registrar has previously acted decisively to remove illegal sites. In 2016 they failed to investigate and take action in most cases. As a result, they now have the second highest abuse rate after Russia's notorious R01-RU.

Key-Systems GmbH has been widely abused by the Russian EvaPharmacy fraud operation. In May, June, July, and August, September, October and November 2016 Key-Systems is now second only to registrar R01.RU from Russia in sponsoring pharmaceutical frauds and cyber-crime.

Registrar responsivenessEdit

Showing all registrars including R01.RU LiveSite2014

Showing all registrars excluding R01.RU LiveMinors

Piechart showing the crime sponsoring contribution by each registrar.

RegPie

The comparison between this registrar and others can be seen on the graphs.

It shows how many domains have not been suspended by various registrars over the past year. The higher the column, the more domains are sponsored by the registrar.

Currently the most abused registrar is Russia's R01.ru. This registrar sponsors the vast majority (often over 85%) of the fraud domains used within the Eva Pharmacy group.

The second most abused registrar is Public Domain Registry PDR at 3%.

The next most abused registrar is China's Bizcn at 2%.

The next most abused registrar is Germany's Key-Systems at 2%.

The next most abused registrar is Canada's Tucows at 2%.

Next is Endurance at 2%.

Most registrars have been quick to terminate the service contracts with these cyber-criminals upon seeing the obvious evidence of fraud.



Examples of domains used for fraudEdit

These domains were tested on August 14, 2016 and found to be live. The cyber-criminals behind these scams use IP blocking to try to prevent verification of their sites. They block known law enforcement addresses, pharmaceutical company addresses, VISA, Mastercard, Paypal and American Express addresses, registrar addresses, and any IP address that repetitively loads a series of their domains in quick succession. They often use disposable domains whose sole purpose is to redirect to illegal pharmacies running on bullet-proof domains registered in Russia. Most competent registrars have the skills to circumvent these blocking methods, using tunnels, proxies and external IP addresses. Key-Systems appear to lack this ability.

The headings below link to evidence that each domain is being used for fraud.

Some examples taken at random are shown on the right. These were screen captured, using a proxy service to avoid their IP blocking of law enforcement and registrar IP addresses. These may serve other fraud sites at other times, or from other geographies. But any site served is still an illegal fraud pharmacy.

2016-08-14 (2)

Live example Aug 16 yournaturalstore.eu

2016-08-16 (10)

Aug 16 2016 fraud sample globalherbassist.be

2016-08-16 (11)

Aug 16 2016 fraud sample herbalhealthmart.be

2016-08-16 (12)

Aug 16 2016 fraud sample naturlfirstmall.be

2016-08-16(20)

Aug 16 2016 fraud sample healingaidstore.be

2016-08-16 (3)

Aug 16 2016 fraud sample janeendinajolie.be

2016-08-16 (4)

Aug 16 2016 fraud sample Redirection marjoriesonja.be

2016-08-16 (6)

Aug 16 2016 fraud sample Redirection pollyannabobbette.be

2016-08-16 (7)

Aug 16 2016 fraud sample Redirection debbiehephzibah.be

2016-08-16 (9)

Aug 16 2016 fraud sample Redirection claretapersis.be

See also Key-Systems_GmbH_list


Canadian Health&Care MallEdit

fasthealthmall.eu
fastherbpurchase.be
firstrxelement.eu
goodcurativeinc.be
homecurativemart.be
jillenesibley.be
luckydrugservice.be
luckyherbalmall.eu
magicaideshop.eu
safeglobalstore.be
smartwelnessdeal.be
theadoraelbertine.be
theglobalprogram.eu
trustedsafeeshop.be
yourbestreward.be
yourherbalinc.be

CanadianPharmacyEdit

abbemilzie.eu
adriaenslil.eu
alisamarian.eu
alisilenetybi.be
almetazonnya.be
almireconstantine.be
alycegavrielle.eu
analisetandy.eu
antoinettejennifer.eu
antoniabarbey.be
ariellechrystel.eu
ariellorashela.eu
aubrettemariellen.eu
austinemeggi.be
avivaannadiana.eu
berthemonique.be
betteannemariquilla.be
beverieevey.eu
britneydarelle.eu
cairistionatrish.be
candicecristionna.be
carlottadelphinia.be
catherinashiagigi.eu
celemariya.eu
chlorisruthy.eu
christalleadena.nl
christenmina.eu
christiernakirby.eu
cilkaadele.eu
claritachristyna.nl
claudettabrit.eu
claudinemarti.eu
clementinadelinda.be
clorisjuliana.be
collettecody.eu
constantinaavie.eu
coralieilse.nl
corrydemeter.eu
daiseyerminia.eu
danellahelena.eu
danyacathyleen.nl
darleenemma.eu
deanatillie.eu
demetrahyacinthie.eu
desirihanny.eu
dixjocelyn.eu
dottiecammi.eu
dustyninnetta.nl
dyanarleyne.eu
dyannenola.eu
edytheauriaraye.eu
eleanorealena.be
emelineclari.eu
erdawenona.eu
ernestineodella.eu
estagunilla.eu
estelletammy.nl
estellmaighdiln.eu
eveydomini.be
fernandafredahedy.eu
feyisabelle.nl
frannirobby.eu
genericmedstrade.eu
georgianneondrea.eu
gertrudetandy.eu
giacintaphaidra.eu
graciekalina.eu
gwynnerobinetta.be
hailykellina.eu
halettegipsy.nl
harmoniamichaelina.eu
heidavickie.eu
hilliaryfayebony.eu
homeherbeshop.be
hothealthshop.eu
imogeneirena.eu
jodiedorrie.eu
johnnagenni.nl
joycelindidi.eu
justinamaiarora.eu
karilmalina.eu
kataestrella.eu
katalinmalissia.be
kattieursa.eu
kelceyflora.be
kissiahhannyarly.eu
krystleilise.be
lauraleeardeen.eu
lissiekelsey.eu
lizalynette.be
lorenzaothelia.eu
lucinasuki.be
lynseymeredith.eu
maddalenapearla.nl
mallorycalida.eu
marcellapauline.eu
margerypansie.nl
margotmaurise.nl
marideldienajoya.be
marieannmeadejana.be
marketajemima.nl
maureenecal.eu
melodievivianne.eu
merlinacassaundra.be
michaelinacandace.eu
milkarosabel.nl
millicentlise.eu
miriamfelisha.eu
monalauren.be
natividadelwira.eu
natividadhappy.be
nedajanean.eu
nestalesyanoni.eu
newgenericgroup.eu
nikkiemorgan.eu
nonnahjillian.eu
normaolaelise.eu
pamelayetta.be
pammywendy.eu
patriciaanya.eu
philomenabertie.eu
rachaelmaude.be
randiminni.eu
raphaelafifine.be
rayeraphaela.be
rianecoletta.eu
robinettelletorey.nl
rosemarielorne.nl
salaidhdeclary.eu
salliebillyeira.nl
sapphirarana.be
sariadelind.eu
savinadarlene.eu
selarhiamon.eu
selestinaelna.eu
shalnemaudpatti.be
sidoniaprisca.be
simonalanna.eu
smartpillelement.eu
sonyaaurel.eu
stormiedreddy.be
susiejodie.eu
tamikonorryviv.eu
teradorice.be
teribobine.nl
timmiemaurita.eu
tineruthie.eu
veradislanie.eu
veronikadenna.eu
viviannedevinne.eu
wendymehetabel.eu
yelenasibylla.eu
yovonndaphedra.be
zsazsacherlyn.nl

My Canadian PharmacyEdit

besttabsservice.eu
ingeettielna.be
raehollyanne.eu
smarttabsmall.eu
sosannajohnath.eu

RxExpressOnlineEdit

adelicestarlin.be
alisbrandi.eu
allinabrandais.be
aubrypippa.be
clarettedaphna.eu
davinelelahcyb.be
elliealexandrina.be
emaleemistynady.eu
emmalynethelin.be
floangelique.be
gwendolendani.be
hattisimone.eu
jacintheellene.be
kacymelania.eu
kristachery.eu
lettajaneta.eu
lucinashelbi.eu
lucindacarmelina.eu
margaritatimothea.be
mariamtammara.be
melbadorrie.be
pammyvitia.be
pearlelspeth.eu
poppykatleen.be
rickijodie.eu
rosabellatonya.be
ruthyflorentia.be
sashenkateena.be
shellluckyira.be
shoshanacherlyn.be
stephiedalia.eu
wendyecassy.be

RxMedicationsEdit

adriennehetty.be
elianoragerta.eu
harriotjoan.be
lanageorgena.be
madgefianna.eu
marlatierney.eu



Canadian Health&Care Mall SuspendedEdit

curativebestbargain.be (suspended)
curingcaremarket.eu (suspended)
fastnaturalservices.eu (suspended)
flxqokqn.be (suspended)
globalgenericgroup.eu (suspended)
globalpillsmarket.eu (suspended)
homeherbstrade.be (suspended)
homenaturalquality.be (suspended)
luckyorganicassist.be (suspended)
magicpillgroup.be (suspended)
medicalsmartstore.be (suspended)
medicalwelnessshop.eu (suspended)
medicatingfastmart.be (suspended)
naturalfirstmarket.eu (suspended)
remedialtrustedinc.eu (suspended)
secureherbalbargain.be (suspended)
smartremedyinc.be (suspended)
yourorganicprogram.be (suspended)
assistantheadcoach.be (suspended)
besthealthreward.be (suspended)
bestmedicalbargain.eu (suspended)
bodycarerx.eu (suspended)
canadiandrugreward.eu (suspended)
dfnfoskt.be (suspended)
familyhealthquality.be (suspended)
genericglobalmart.be (suspended)
goodremedialmart.be (suspended)
healingsmartgroup.be (suspended)
herbalsecuremart.eu (suspended)
luckyhealingshop.be (suspended)
mybiologicalquality.be (suspended)
naturaldrugsmall.be (suspended)
nhlbqyuc.eu (suspended)
organicsmartbargain.eu (suspended)
perfectaideshop.be (suspended)
pogjlbwb.eu (suspended)
remedialpillmart.be (suspended)
ruaohjji.be (suspended)
rwmxlkwn.eu (suspended)
vrswovjt.be (suspended)
vzbhtapi.eu (suspended)
pureremedyinc.eu (suspended)
smartpharmshop.eu (suspended)
yourmedicatingtrade.eu (suspended)
firstmedsservice.eu (suspended)
globalmedicinaldeal.eu (suspended)
healingprivatemall.be (suspended)
herbaldruggroup.be (suspended)
curingfastprogram.be (suspended)
bestmedswebmart.be (suspended)
goodfitnesswebmart.be (suspended)
hotgenericspurchase.eu (suspended)
magiccaredeal.eu (suspended)
mycuringeshop.eu (suspended)
newtreatmentprogram.eu (suspended)
curativesmartmallorca.be (suspended)
medicinaldrugsinc.eu (suspended)
organicsafesale.eu (suspended)
perfectherbalmart.be (suspended)
remedialglobalmart.eu (suspended)
svxoskid.be (suspended) 
curativesmartmallorca.be (suspended)
curingtrustedoutlet.eu (suspended)
fastgenericsupply.be (suspended)
globaldrugsgroup.eu (suspended)
globalnaturalmarket.be (suspended)
herbalherbpurchase.eu (suspended)
herbalrxpurchase.eu (suspended)
jdjlpdcq.be (suspended)
luckygenericmart.be (suspended)
magictableteshop.eu (suspended)
medicalrxgroup.be (suspended)
mudttflg.eu (suspended)
newpillsinvestment.be (suspended)
newwelnessshop.eu (suspended)
privateremedyoutlet.eu (suspended)
safemedicinalmall.eu (suspended)
familyremedysale.be (suspended)
genericbestgood.eu (suspended)
globalmedicaresale.be (suspended)
naturalrxdeal.eu (suspended)
safemedicativevalue.be (suspended)
thepharmacyservice.eu (suspended)
bestcanadianprogram.eu suspended
fastmedicinalshop.be  (suspended)
genericpillservice.be  (suspended)
globaltreatmentshop.be  (suspended)
klfwyqzo.eu  (suspended)
newsupplementmall.eu  (suspended)
remedialglobalstore.eu suspended
safewelnessgroup.eu  (suspended)
yourcuringsupply.eu  (suspended)

Canadian Neighbor Pharmacy SuspendedEdit

trustedaiddeal.be (suspended)
herbalfirstmall.eu (suspended)

CanadianPharmacyEdit

annualhealthcareconference.be (suspended)
bestherbreward.eu (suspended)
bestremedialmart.be (suspended)
bestremedialquality.eu (suspended)
healingtablettrade.eu (suspended)
hotremedystore.eu (suspended)
medicalpharmacysales.eu (suspended)
mypharmvalue.be (suspended)

My Canadian Pharmacy SuspendedEdit

curativesmartvalue.eu (suspended)
fastmedicalgive.eu (suspended)
yourdrugtrade.eu (suspended)
homemedseshop.eu (suspended)
homeremedysale.eu (suspended)
hotherbalpurchase.eu (suspended)
hotremedialquality.eu (suspended)
hotrxtrade.eu (suspended)
luckyherbalwebmart.eu (suspended)
mydrugsale.be (suspended)
naturaltrustedgroup.eu (suspended)
onlinedrugvalue.eu (suspended)
organicfirstreward.be (suspended)
safedrugstrade.eu (suspended)
saferxgroup.eu (suspended)
trustedhealthassist.eu (suspended)
canadianaidmart.eu (suspended)
hotremedyelement.eu (suspended)
canadianfirstshop.eu (suspended)
trustedrxinc.eu (suspended)
pxlckfxe.eu  (suspended)
yourmedicaleshop.be  (suspended)

RxExpressOnline SuspendedEdit

mypillsassist.eu (suspended)
onlineherbalmarket.eu (suspended)
medicalonlinesupply.be (suspended)
curativehealthsale.eu  (suspended)

RxMedications SuspendedEdit

mynaturaldealdirect.be  (suspended)
securemedsinc.be  (suspended)

Toronto Drugstore SuspendedEdit

bestgenericmarket.eu  (suspended)

US DrugsEdit

excellentherbsupply.be

Common IP addressesEdit

A quick way to verify these sites is to examine the hosting addresses. Many compromised hosts used for this operation during May 2017 were located at these IPs, primarily Russia, Turkey, Latvia and the Seychelles.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
91.242.163.166 95.84.156.43 217.195.60.211 46.29.2.193 62.112.8.135
51.15.145.121 46.29.2.192 1 77.81.111.122 175.45.128.19 75.98.230.254
88.150.227.68 94.199.48.30 81.171.7.156 91.230.121.99 31.31.204.161

Recent High use IP addresses from April 2017

IP.Pie

Where to send abuse complaintsEdit

abuse@key-systems.net

Web site http://www.domaindiscount24.com/en/company/contact

Please send your complaint to:

Fax: +49-6894 93 96 851
E-Mail: abuse@key-systems.net for all abuse reports
Or call us on: +49-6894 93 96 850

Additional Contact InformationEdit

Postal addressEdit

Key-Systems GmbH, Im Oberen Werk 1, St. Ingbert, 66386, Germany

Key-Systems USA, Inc., 604 S. King Street, Leesburg, VA, 20175, USA

Registration InformationEdit

Telephone and FAXEdit

Telephone +49 689 4939 6850
Fax +49 689 4939 6851

Related informationEdit

Pharmacy fraud operations

Affiliate program coordinator employing spammers

Sources for this articleEdit

IndependentEdit

InterviewEdit

CorporateEdit

Holding company http://www.keydrive.lu/

Facebook http://www.facebook.com/KeySystems

Twitter http://www.facebook.com/KeySystems

Company Homepage http://www.key-systems.net

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.