FANDOM


RxExpressOnline is part of the Eva Pharmacy fraud.

RxExpressOnlineEdit

RxExpressOnline

Read

DescriptionEdit

This operation is part of EvaPharmacy. It shares the same hosting IP addresses, name servers, registrars. It uses the same redirection technique, where many domains are registered with a subset of registrars, and they host redirectors to one or just a few central hosting sites. The redirector domains are treated as disposable, and appear in spam. The redirection targets do not appear in spam, to avoid being blacklisted.

RxExpress
The banner image for RxExpressOnline has been stolen from this image the Rehabilitation Medicine web site located here. Their name has been cut off and the image slightly modified before being reused.

Website ClaimsEdit

Fake list of accreditationsEdit

RxExpress Accreditations

From a sample web site (click on the image to enlarge it) we can see a list of fake accreditations.

  • True accreditations provide a link to the web site of the accreditation authority.
  • Fake accreditations forge the information on the fake web site itself.

The RxExpressOnline web site states: At RxExpressOnline, we maintain extremely rigorous standards in patient safety. We believe access to essential prescription drugs should be safe, convenient, and affordable for all. RxExpressOnline is a certified member of the Canadian International Pharmacy Association (CIPA), the Manitoba International Pharmacists Association (MIPA), the Better Business Bureau (BBB) and HealthPricer.com and is a 5 star rated pharmacy from PharmacyChecker.com.

However, all 5 of those references fail to link to any of the accreditation sites. They are a fake.


Privacy and SecurityEdit

What is your security & privacy policy?
A.
We are committed to protecting your privacy with the highest possible
level of security. All of your personal information, including credit
card number, name, and address is encrypted, so that it cannot be
read as it is being transmitted from your computer to our server.
We use the Secure Socket Layer (SSL) protocol which enables
end-to-end data protection.


Here is a URL from November 2013 (which was registered in Russia on NAUNET):

  • http://m102.drugtorehealthcare.ru

Another registered on NETLYNX in India is

  • http://private.prescriptionspills.com

If you select a product (Viagra Soft Tabs), choose a quantity (60 pills) and "check out", you're presented with the following URL:

  • https://rxcheckoutnow.com/cart/checkout/

Notice that there is SSL formatting for this URL (https:// appears instead of http://.)

The certificate for rxcheckoutnow.com was issued on Sept 1 2013 by RapidSSL CA from the GeoTrust Inc. organization. The details of the secure checkout server:

Domain Name: RXCHECKOUTNOW.COM
Registrar: CJSC REGISTRAR R01
Whois Server: whois.r01.ru
Referral URL: http://r01.ru
Name Server: NS202.RXCHECKOUTNOW.COM
Name Server: NS940.RXCHECKOUTNOW.COM
Status: clientRenewProhibited
Status: clientTransferProhibited
Updated Date: 26-sep-2013
Creation Date: 02-sep-2013
Expiration Date: 02-sep-2014

The details of a redirection target server:

domain:        HEALTHRXPHARMACYCARE.RU
nserver:       ns1.healthrxpharmacycare.ru. 217.68.34.147
nserver:       ns2.healthrxpharmacycare.ru. 202.186.179.236
state:         REGISTERED, DELEGATED, VERIFIED
person:        Private Person
registrar:     NAUNET-REG-RIPN
admin-contact: https://client.naunet.ru/c/whoiscontact
created:       2013.08.23
paid-till:     2014.08.23

From the location of the registrars, it is safe to assume that this is a Russian operation, consistent with the other EvaPharmacy family members.

autocarepharmacy.com has been judged to be a rogue pharmacy at LegitScript.

In November 2013, autocarepharmacy.com had address 193.107.89.251, located in Poland.

RedirectionsEdit

Other redirection targets sharing the same host IP address at the same time found in November 2014 (now suspended) were

c100.hotcareshop.ru R01.RU Canadian Health&Care Mall
c102.medicalcaregroup.ru R01.RU Canadian Health&Care Mall
e100.thedruginc.ru R01.RU RxExpressOnline
e101.pilldrugstablets.ru R01.RU RxExpressOnline
e102.canadapillgroup.ru R01.RU RxExpressOnline
e102.bestpharmacydirect.ru R01.RU RxExpressOnline
e244.yourtabstrade.ru R01.RU RxExpressOnline
m100.hotcareshop.ru R01.RU Canadian Health&Care Mall
m102.magicrxsale.ru R01.RU My Canadian Pharmacy
o100.safetabletpurchase.ru R01.RU RxMedications
o101.pillhealthcaretenet.ru R01.RU RxMedications
o102.goodtabletvalue.ru R01.RU RxMedications
o244.luckyrxtrade.ru R01.RU RxMedications
orders.safeaidassist.ru R01.RU RxExpressOnline
private.bestrxgrouponline.ru R01.RU RxExpressOnline
refills.themedicalstore.ru R01.RU RxExpressOnline
rx.canadianprivateinc.ru R01.RU RxExpressOnline

From this table it is clear that RxExpressOnline is yet another of the illegal EvaPharmcy fraud operations.

Their postal addressEdit

They do not provide a postal address. This demonstrates that they do not want to be traced.

Their Owners and OperatorsEdit

They provide no information on their web site. Another demonstration that they are avoiding being traced.

Edit

Registrars who accept payment for their domain names are

  • BIZCN.COM, INC.
  • HTTP.NET INTERNET GMBH (all suspended)
  • NAMESILO, LLC
  • NAUNET-REG-RIPN
  • NETLYNX, INC. (all suspended)
  • PSI-USA, INC. DBA DOMAIN ROBOT (all suspended)
  • TRUNKOZ TECHNOLOGIES PVT LTD. (all suspended)

These are the top 7 registrars commonly selected by the EvaPharmacy operation

Sample sites and registrars sponsoring themEdit

BIZCN.COM, INC.Edit

adelindvallie.com suspended
almeriaalyda.xyz suspended
brunhildathomasine.xyz suspended
camelliapaulette.xyz suspended
claudelleaurie.xyz suspended
donettacharlena.xyz suspended
dorrihyacinthia.xyz suspended
dottycolette.xyz suspended
gertienolana.xyz suspended
lirabessy.xyz suspended
lucretiacharmine.xyz suspended
lynnansley.xyz suspended
lynnyasmeen.com suspended
patienceval.xyz suspended
rebecadorie.xyz suspended
taniagabi.xyz suspended
adelindvallie.com
almirerobinet.com
doryalexis.com
lynnyasmeen.com
stephaelsinore.com

Key-Systems GmbHEdit

adinabrietta.eu
adriawilla.be
ainsleeberet.be
alexinejosselyn.be
alexinewendi.be
alfieliuka.be
allitrisha.be
annaleequintilla.be
ansleyelyse.be
ansleyelyse.be
anyaimogene.be
arabelreiko.eu
arlueneamandie.be
aurlieabbye.be
averylwillamina.be
bambiheath.be
benitamichele.be
biddyjobyna.be
billicorny.be
billicorny.be
birdconstancy.be
brandielinea.be
breannecacilie.be
brettperrine.eu
brinnacathee.be
britneyliva.be
brittawynnie.be
brittnebarbey.be
camillacherice.be
charlenaanthe.be
charlenakristy.be
charmionarda.eu
chlorismildrid.be
christianalannited.be
cissydarelle.be
claudettashelbi.be
codierevkah.be
codierevkah.be
codikarolalma.be
consueladaffie.be
crisshanon.be
danielevaleda.be
danielevaleda.be
dasyacodie.be
dasyacodie.be
dathadawnnadia.be
dawnabeverlee.be
deannemarilin.be
deidrelibby.be
devinneardra.be
dianacelka.be
donellelanette.be
dorettajami.be
dorryclare.eu
edivajoceline.be
elaineromonda.be
elbertabarry.eu
eleenkathlin.be
emmieleeanne.be
erinnnathalia.be
faraleatracie.be
farrahbabbobina.be
fianntrudy.be
fianntrudy.be
florepolly.eu
francescajolene.be
genoverawinny.be
genoverawinny.be
georgetteandrei.eu
gertilauree.be
gilbertagoldina.be
giorgiailysa.be
giraldaamandi.be
gladglennie.be
godivapepita.be
helenelizabethaudyshaun.eu
horatiaarleta.be
hortensialibbie.be
jaimetanhya.be
janellashayfawne.be
janevacarolin.be
jillyardyce.be
joridebbieada.be
karaleejamiglenn.be
karilynnadan.be
karrahcharlena.eu
katharinetatum.be
kileyardelle.be
kimmietalyah.be
latishacarmella.be
lauriclara.eu
lenkaconstance.be
leslihortensia.be
liannikolia.be
liannikolia.be
lissymerola.be
lolitadalila.be
luisefredrika.be
luisefredrika.be
lusadaffyfred.be
lyndamagfeliza.eu
magdalenafae.eu
malissiaxenia.be
mariskiperinn.be
maritsanadeen.be
martyleandra.be
martyleandra.be
mateldaaleda.be
meaganamata.be
meaganamata.be
meggydeonne.eu
michellpolly.be
michellpolly.be
mindyoneida.be
miquelanichol.be
naneteloralyn.eu
nicolleruthann.eu
odeliafidelia.be
opalinegoldie.be
opalinegoldie.be
pierrettejinny.eu
raneeklara.be
ravenmarylynne.be
rivacloepavia.eu
roselleapril.be
sabrinahalley.be
shannahnatala.be
shaylynndanyette.be
sheenadorisa.be
simonaglad.be
sofiasharl.be
suellenstevana.eu
sulacynthy.be
tabbielinzyaime.be
tallouraine.be
tamarraarlana.eu
tomasinemufi.be
traceyrebekkah.be
vernicejania.be
vivienewileen.be
zonnyasofie.be

R01-RUEdit

agathehelen.ru
amburcatharine.ru
arletashandee.ru
augustinesophey.ru
bestpharmtrade.ru
brandaisabbye.ru
briannaursa.ru
canadianmedswebmart.ru
charleanmelania.ru
charmianvaleria.ru
claudinedora.ru
consuelobobbie.ru
curingtabletreward.ru
darsiemilly.ru
denilyndell.ru
doeannabella.ru
drucilljazmin.ru
faydraleola.ru
firstbiologicalmall.ru
florinakarine.ru
georgiamona.ru
georgianaillahally.ru
goodorganicpurchase.ru
goodwelnessassist.ru
herbaldrugvalue.ru
hortensianana.ru
isismargie.ru
leadingcanadian.ru
magicherbalpurchase.ru
margaretteemmaline.ru
mariskacarine.ru
marnireina.ru
medicalhotmart.ru
medicatinghotdeal.ru
medicinalbestassist.ru
mishachere.ru
mygenericcompany.ru
myherbalmarket.ru
myrxmart.ru
newmedicationmarket.ru
newtreatmentsupply.ru
norachryste.ru
organicremedyoutlet.ru
purecuringcompany.ru
puresupplementvalue.ru
robiniarani.ru
sabrarosalind.ru
safepharmquality.ru
saferxeshop.ru
securehealthmall.ru
securehotshop.ru
securewelnessoutlet.ru
sharaihortense.ru
sharonapatty.ru
smartgenericmart.ru
tamaraaurilia.ru
theremedialassist.ru
theremedymarket.ru
yourdrugsquality.ru

TUCOWS DOMAINS INC.Edit

charmanetherine.com suspended
heddijacintha.com suspended
jewelleranee.com suspended
kelilagrazia.com suspended
mellydodi.com suspended
myaidgroup.com suspended

Related spam operationsEdit

See: Bulker.biz

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.