RxMedications

RxMedications

Read

• Eva Pharmacy fraud description
• FDA Press Announcement
• CIPA listing of fraud sites
• FDA Warning letter

Description

This operation is part of EvaPharmacy. It shares the same hosting IP addresses, name servers, registrars. It uses the same redirection technique, where many domains are registered with a subset of registrars, and they host redirectors to one or just a few central hosting sites. The redirector domains are treated as disposable, and appear in spam. The redirection targets do not appear in spam, to avoid being blacklisted.

The banner image for RxMedications has been taken from this "mature couple embracing" image the Getty Images web site.

Website Claims

What is your security & privacy policy?
A.

We are committed to protecting your privacy with the highest possible
level of security. All of your personal information, including credit
card number, name, and address is encrypted, so that it cannot be
read as it is being transmitted from your computer to our server.
We use the Secure Socket Layer (SSL) protocol which enables
end-to-end data protection.

RxMedications used to use secure SSL encryption at checkout, but the checkout servers have since been suspended. As ov November 2014, the checkout is not encrypted.

Here is a URL from November 2013 (which was registered in Russian on NAUNET):

• http://c100.healthrxshop.ru/

If you select a product (Viagra Soft Tabs), choose a quantity (60 pills) and "check out", you're presented with the following URL:

• https://rxcheckoutnow.com/cart/checkout/

or

• https://SECURERXSHOPPING.COM/cart/checkout/

Notice that there was SSL formatting for this URL (https:// appears instead of http://.)

The certificate for rxcheckoutnow.com was issued on Sept 1 2013 by RapidSSL CA from the GeoTrust Inc. organization. The details of the secure checkout server:

Domain Name: RXCHECKOUTNOW.COM
Registrar: CJSC REGISTRAR R01
Whois Server: whois.r01.ru
Referral URL: http://r01.ru
Name Server: TEMPNS.R01.RU
Status: pendingDelete
Updated Date: 16-nov-2014
Creation Date: 02-sep-2013
Expiration Date: 02-sep-2014

And for the other checkout domain:

 Domain Name: SECURERXSHOPPING.COM
 Registrar: CJSC REGISTRAR R01
 Whois Server: whois.r01.ru
 Referral URL: http://r01.ru
 Name Server: TEMPNS.R01.RU
 Status: pendingDelete
 Updated Date: 16-nov-2014
 Creation Date: 02-sep-2013
 Expiration Date: 02-sep-2014

previously

Domain Name: SECURERXSHOPPING.COM
Registrar: CJSC REGISTRAR R01
Whois Server: whois.r01.ru
Referral URL: http://r01.ru
Name Server: NS506.SECURERXSHOPPING.COM
Name Server: NS724.SECURERXSHOPPING.COM
Status: clientRenewProhibited
Status: clientTransferProhibited
Updated Date: 25-sep-2013
Creation Date: 02-sep-2013
Expiration Date: 02-sep-2014

The details of the redirection target server:
No entries found for the selected source(s).
Last updated on 2014.11.21 03:01:32 MSK

Formerly

domain:        HEALTHRXSHOP.RU
nserver:       ns1.healthrxshop.ru. 217.68.34.147
nserver:       ns2.healthrxshop.ru. 61.30.23.175
state:         REGISTERED, DELEGATED, VERIFIED
person:        Private Person
registrar:     NAUNET-REG-RIPN
admin-contact: https://client.naunet.ru/c/whoiscontact
created:       2013.08.23
paid-till:     2014.08.23

From the location of the registrars, it is safe to assume that this is a Russian operation, consistent with the other EvaPharmacy family members.

healthrxshop.ru has been judged to be a rogue pharmacy at LegitScript.

On November 7 2013, healthrxpharmcycare.ru had address 193.107.89.251, located in Poland.

Redirections

Other redirection targets sharing the same host IP address at the same time found in November 2014 were

c100.hotcareshop.ru	R01.RU	Canadian Health&Care Mall
c102.medicalcaregroup.ru	R01.RU	Canadian Health&Care Mall
e100.thedruginc.ru	R01.RU	RxExpressOnline
e101.pilldrugstablets.ru	R01.RU	RxExpressOnline
e102.canadapillgroup.ru	R01.RU	RxExpressOnline
e102.bestpharmacydirect.ru	R01.RU	RxExpressOnline
e244.yourtabstrade.ru	R01.RU	RxExpressOnline
m100.hotcareshop.ru	R01.RU	Canadian Health&Care Mall
m102.magicrxsale.ru	R01.RU	My Canadian Pharmacy
o100.safetabletpurchase.ru	R01.RU	RxMedications
o101.pillhealthcaretenet.ru	R01.RU	RxMedications
o102.goodtabletvalue.ru	R01.RU	RxMedications
o244.luckyrxtrade.ru	R01.RU	RxMedications
orders.safeaidassist.ru	R01.RU	RxExpressOnline
private.bestrxgrouponline.ru	R01.RU	RxExpressOnline
refills.themedicalstore.ru	R01.RU	RxExpressOnline
rx.canadianprivateinc.ru	R01.RU	RxExpressOnline

From this table it is clear that RxMedications is yet another of the illegal EvaPharmcy fraud operations.

Their postal address

They do not provide a postal address. This demonstrates that they do not want to be traced.

Their Owners and Operators

They provide no information on their web site. Another demonstration that they are avoiding being traced.

Sponsor Organizations

Registrars who accept payment for their domain names are

• R01.RU
• BIZCN.COM, INC.
• HTTP.NET INTERNET GMBH
• NAMESILO, LLC
• NAUNET-REG-RIPN
• NETLYNX, INC.
• PSI-USA, INC. DBA DOMAIN ROBOT
• TRUNKOZ TECHNOLOGIES PVT LTD.

These are the top registrars commonly selected by the EvaPharmacy operation

Sample sites and registrars sponsoring them

By April 2018 these were all suspended, with one exception

firstfirstsupply.ru with registrar:     R01-RU

Historical List

BIZCN.COM, INC.

doreennert.xyz
selenabathsheba.xyz
vernanessie.xyz

Key-Systems GmbH

adelacharlene.be
aerielasusan.eu
anselmashelly.be
camilleviolette.be
leannlillian.be
opheliakipfawne.be

R01-RU

bestmedicinaldeal.ru
bestwelnessquality.ru
canadianfirsttrade.ru
familytabsmall.ru
fastcaresale.ru
fastfastsupply.ru
firstfirstsupply.ru
firstherbstrade.ru
genericmedicaredeal.ru
globalbestsale.ru
goodmedicativeeshop.ru
healingfastsale.ru
healingglobalinc.ru
herbalsmartpurchase.ru
hotcuringstore.ru
hotherbssale.ru
luckygenericsupply.ru
magichealingsale.ru
marshaemelita.ru
medicalaidtrade.ru
medicalfamilyassist.ru
medicalherbwebmart.ru
medicativeaidoutlet.ru
medicativemedsvalue.ru
medicinaldrugssale.ru
medicinalrxservice.ru
medicinaltrustedinc.ru
mygenericsstore.ru
naturalfamilyoutlet.ru
naturalmedsgroup.ru
newcuringsale.ru
newgenericsupply.ru
newpilloutlet.ru
onlineherbsmart.ru
organicfirstsupply.ru
organicmedsservices.ru
organictabscompany.ru
perfectherbwebmart.ru
privateherbsquality.ru
pureorganiccompany.ru
purepillsinc.ru
remedialsecureeshop.ru
safefirsttrade.ru
safehealthpurchase.ru
safetabletquality.ru
securehotbargain.ru
theherbswebmart.ru
yourmedicamentsale.ru

Webiq Domains Solutions Pvt. Ltd. (R131-AFIN)

homeherbprogram.in

Related spam operations

See: Bulker.biz