FANDOM


PSI-USA Inc is an ICANN accredited registrar in Germany, also offering its services as InterNetX. Early in 2013 InterNetX suffered the highest abuse rate from the Russian fake pharmacy fraud, EvaPharmacy and has tried to tackle the problem.

Anti-Spam PositionEdit

The Terms of Use state

Code of Conduct. While using the Site or Materials, you agree not to:

  • Restrict or inhibit any other visitor or member from using the Site, including, without limitation, by means of "hacking" or defacing any portion of the Site;
  • Use the Site or Materials for any unlawful purpose;

Official PositionEdit

Required to abide by the agreement with ICANN for accreditation.

From the ICANN Registration Accreditation Agreement (RAA):
3.7.7.9 The Registered Name Holder shall represent that, to the best of the Registered Name Holder's knowledge and belief, neither the registration of the Registered Name nor the manner in which it is directly or indirectly used infringes the legal rights of any third party.

1.13 "Illegal Activity" means conduct involving use of a Registered Name sponsored by Registrar that is prohibited by applicable law and/or exploitation of Registrar's domain name resolution or registration services in furtherance of conduct involving the use of a Registered Name sponsored by Registrar that is prohibited by applicable law.

5.5 Termination of Agreement by ICANN. This Agreement may be terminated ... [if the] Registrar .. is convicted by a court of competent jurisdiction of a felony or other serious offense related to financial activities, or is judged by a court of competent jurisdiction to have: ...

with actual knowledge (or through gross negligence) permitted Illegal Activity in the registration or use of domain names or in the provision to Registrar by any Registered Name Holder of inaccurate Whois information

Actual BehaviorEdit

This registrar has been the most heavily exploited by the EvaPharmacy operation.

InterNetX has sometimes ignored requests to suspend domains used for unlawful purposes. This may have occurred due to email delivery failure. From mid 2013, the response rate improved dramatically for a time.

As of December 2013 they had suspended about 3,440 pharmacy fraud domains.

By mid January 2014, there were 380 live fraud domains reported to this registrar, but there has been little action taken. Another registrar has reported that the perpetrators have offered a bribe to take no action on their domains.

By mid March 2014, there were over 500 live domains sponsored by InterNetX.

By mid April 2014 there were 250 live domains still sponsored by InterNetX.

Registrar responsivenessEdit

Showing all registrars including R01.RU LiveSite2014

Showing all registrars excluding R01.RU LiveMinors

Piechart showing the crime sponsoring contribution by each registrar.

RegPie

The comparison between this registrar and others can be seen on the graphs.

It shows how many domains have not been suspended by various registrars over the past year. The higher the column, the more domains are sponsored by the registrar.

Currently the most abused registrar is Russia's R01.ru. This registrar sponsors the vast majority (often over 85%) of the fraud domains used within the Eva Pharmacy group.

The second most abused registrar is Public Domain Registry PDR at 3%.

The next most abused registrar is China's Bizcn at 2%.

The next most abused registrar is Germany's Key-Systems at 2%.

The next most abused registrar is Canada's Tucows at 2%.

Next is Endurance at 2%.

Most registrars have been quick to terminate the service contracts with these cyber-criminals upon seeing the obvious evidence of fraud.



Sample illegal domainsEdit

These are all part of the pharmacy fraud network centered in Russia, known as EvaPharmacy. There are over 500 fraud domains listed, awaiting termination.

They were checked and found to be live on June 3, 2014. Subsequently they have all been suspended by the registrar.

Click on any heading to see the evidence relating to each fraud.

Common IP addressesEdit

A quick way to verify these sites is to examine the hosting addresses. Many compromised hosts used for this operation during May 2017 were located at these IPs, primarily Russia, Turkey, Latvia and the Seychelles.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
91.242.163.166 95.84.156.43 217.195.60.211 46.29.2.193 62.112.8.135
51.15.145.121 46.29.2.192 1 77.81.111.122 175.45.128.19 75.98.230.254
88.150.227.68 94.199.48.30 81.171.7.156 91.230.121.99 31.31.204.161

Recent High use IP addresses from April 2017

IP.Pie

ALL SUSPENDED

Canadian Health&Care MallEdit

albertakaterine.com
annmariecharmane.com
blanchekaja.com
cautionpharmacy.com
connihannie.com
corneliamalinde.com
dardaolgamala.com
desiriflo.com
dionadanetta.com
euphemiasarine.com
frediadeloris.com
genericmove.net
guinnaaidan.com
healthcarewichi.com
hedvigissie.com
kidneypharmacy.com
kimmieidette.com
louisedelila.com
lucilamelamie.com
maibleselene.com
marcellinajuline.com
margetteshandeigh.com
margyshandra.com
mishakitti.com
mwuylppp.net
myherbalpills.net
newrxmedicine.com
pharmacycanadainc.com
pillbaruchel.com
prescriptionhospital.net
ronicadode.com
sfsnzoig.com
tabletdietmediterranean.com
thedietpharmacy.net
thehealthpills.com
thepharmherbal.net
torontocanadapill.com
valareepearle.com
vanessanevsa.com

Canadian PharmacyEdit

annmariecharmane.com
mishakitti.com

My Canadian PharmacyEdit

amalitafifi.com
aminichole.com
anabelvirgie.com
andreasukey.com
annabalaustina.com
bettekassia.com
claudehesther.com
drugstorespharmacy.com
elizazola.com
enviagratis.com
eqrgvslu.net
healthcareviagra.com
jenhenrie.com
kellilanny.com
livvyelyssa.com
mariannetisha.com
mernasharla.com
mtuoyyrz.com
nhwetear.net
prescriptionmastersdegree.net
tabcialbenghazi.com
welnessjeanstra.com
zulemakai.com

Pharmacy ExpressEdit

beasidoney.com
shelbystevena.com

RxExpressOnlineEdit

adacarleen.com
annmarialorianne.com
aureliechiarra.com
betteshellie.com
canadawelness.net
clairgizela.com
dietpillcanada.com
doralynnbecka.com
eudorafionna.com
freidacamila.com
gustishirlene.com
harrietteroda.com
hattiejeniffer.com
ilsacaitrin.com
jackquelinedoralin.com
joyceivie.com
karrieshaylynn.com
leonoreshayla.com
lindseychristan.com
lissyeachelle.com
malanieanderea.com
mariamgipsy.com
melisandraadrian.com
nelliginni.com
pillhealthgroup.net
pillswealth.com
rorilelah.com
sabraallina.com
sharllinnie.com
shirlineneysa.com
sisilelizabeth.com
therxmed.com
ulricajoscelin.com

RxMedicationsEdit

adelheidines.com
anneannemarie.com
arielchelsie.com
beasidoney.com
betteshellie.com
dahliaadrea.com
deeannegypsy.com
ebbadrusi.com
edyiormina.com
elyseekimmi.com
emilieroxana.com
fiorenzearabele.com
geraldinejenidosi.com
jadeamalita.com
kendraemeline.com
malinatressa.com
mariannaelisa.com
meadeadith.com
mygenericstab.net
nellgabrielle.com
ninnettaeadith.com
nyssastorm.com
rochellebekki.com
rxhealthproducts.net
shelbystevena.com
sukeyalbertine.com
sunnybobbee.com
thetabmedical.com
tomirhodie.com

Toronto DrugstoreEdit

thecaretablet.com

US DrugsEdit

pillmedicinedrug.com

Description of the RegistrarEdit

PSI-USA, Inc. was founded by Robert F. Connelly. PSI-USA is now under the leadership of German citizen Thomas Moerz who also appears as the registrant on domains

  • moerz.com
  • deinzahnarzt.net
  • moerz.org
  • moerz.info

Where to send abuse complaintsEdit

By emailEdit

  • domain-support@internetx.com
  • domain-services@internetx.com

By the online web pageEdit

https://www.internetx.com/en/contact/contact-form.html

Additional Contact InformationEdit

Thomas Mörz

Albertstraße 11
D-93047 Regensburg

Tel.: +49 941 567456-7
Fax: +49 941 567456-8

E-Mail: info@ra-moerz.de

Social Media

Postal addressEdit

Maximilianstr. 6
93047 Regensburg
GERMANY

Registration InformationEdit

Telephone and FAXEdit

Tel.: +49 941 59559 - 0
Fax: +49 941 59559 - 59

Related informationEdit

Pharmacy fraud operations

Affiliate program coordinator employing spammers

Sources for this articleEdit

IndependentEdit

InterviewEdit

CorporateEdit

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.