Canadian Family Pharmacy
From Spamwiki
Contents |
[edit] Description
| Canadian Family Pharmacy is yet another Bulker.biz property selling fake pharmaceutical products, using domains promoted solely by illegally-sent spam messages. This site made its first appearance in August 2009.
We use the Secure Socket Layer (SSL) protocol which enables end-to-end data protection. As with every single Bulker.biz website, no such security is present, or ever has been present. When last tested (August 2010) the links to the American Red Cross, IMPac, CIPA, Pharmacy Checker, or the Better Business Bureau were all locally hosted, and did not link directly to any of these agencies or associations. Canadian Family Pharmacy, in common with all other Bulker.biz pharmacy operations, has no licenses, approval, quality guarantees, security or site awards.
Under "Our Address" the site lists two fake Canadian addresses (one in Ottawa, Ontario previously associated with another Bulker.biz property My Canadian Pharmacy, another in Winnipeg) and lists their warehouse address as being located in Bihar, India. Prominent use of the Canadian flag belies the fact that all of the domains used to host these fraudulent sites are registered in China. |
As with all other Bulker.biz properties, hosting is provided illegally by using a hijacked host. Images loaded into web pages, as is common with Bulker.biz hijacked servers, are pulled down from a variety of other hijacked hosts.
Each name server used to resolve the domain name to the IP address is also run on yet another hijacked host. These are all Unix servers which have had an exploit loaded on to them to act as a proxy web server or dns server. The owners of these servers are completely unaware that their servers are being used in this way.
[edit] Fake Doctors and Testimonials
Unlike most of the other Bulker.biz properties, Canadian Family Pharmacy has wisely chosen not to claim who their alleged "doctors" or "pharmacists" are. On all other sites these have been fake personas supported by easily-purchased stock photos of models posing as doctors. Also unlike all other Bulker.biz properties, there are no "testimonials" on this particular site either. Another wise choice, since these were also completely fake in the first place.
The picture of the staff on the "About Us" page is fake, and can be found on Getty Images
[edit] Fake Licenses
Like other fraud pharmacies, these fraudsters have printed their own version of a pharmacy license. Not being particularly adept, they have chosen to spell license in the US fashion, ignorant of the Canadian spelling of licence.
Version 1
They have referred to the college as "College of Pharmacists of Ontario" whereas the actual college refers to itself as "Ontario College of Pharmacists" - see http://www.ocpinfo.com/
The address that they have used for the fake license is 913 Montreal Road, Ottawa, ON, Canada. That is the same non-existent address that they use for their own headquarters.
They have put a watermark on the document to try to lend it authenticity. However, the watermark is not the logo of the actual Ontario College of Pharmacists depicted below.
Version 2
On some sites, they display another fake license, this time pretending it is from the Manitoba Pharmaceutical Association. Unlike a real license, it has spelling and grammatical errors, consistent with a fake produced by criminals who lack a good grasp of the English language. They have lifted the MPhA logo from their web site and placed it on the fake license.
Once again, the address that they have used for the fake license is 913 Montreal Road, Ottawa, ON, Canada. That is the same non-existent address that they use for their own headquarters.
The actual real address for the MPhA is
Manitoba Pharmaceutical Association
200 Tache Avenue
Winnipeg, MB, R2H 1A7
Phone: 204-233-1411
Fax: 204-237-3468
Email: info@mpha.mb.ca
Logo which was stolen, re-colored, and placed on the fake license.
[edit] Fake Offices
The "contacts" page includes the following addresses for their alleged "Canadian" offices:
Main Headquarters 913 Montreal Road, Ottawa, ON, Canada
This is a fake address. There is no 913 on Montreal Road in Ottawa. That address has been used for many years as the reported address for Canadian Health&Care Mall, another well-known Bulker.biz spammed property. The nearest address is 919 Montreal Road, which is the location of the Banc Sushi Restaurant. The image of the building can be found at Getty Images
The property at what would be 913 Montreal Road is shown in the picture taken from Google Maps
Office: 18/4 Centennial st., Winnipeg, Manitoba
This is also a fake address. This is further corroborated by visiting the actual Better Business Bureau report on this fake pharmacy:
Additional Locations and Phone Numbers Additional Addresses 4 Centennial Street, Unit 18 (Invalid Address) Winnipeg, MB . Canada
The third is their "warehouse" location, which appears to be a poorly Photoshopped stock photo of a nondescript warehouse building. That address is listed as:
Jaiswal Lane, Dakbunglow Road, Bihar, India
We have not yet confirmed that address, but given the track record of literally every other address they have used (previously in Toronto, Calgary, Louisiana and New Delhi) the probability is extremely low that this address would actually lead to the real "warehouses" for this operation.
[edit] Fake Registration
Like other Yambo family sites, Canadian Family Pharmacy uses identity theft to register its sites. Victims whose personal information has been used to register one of these sites should follow the steps outlined here.
[edit] Hijacked Servers
Like other Yambo sites, this one uses the tirqd Unix infection to hijack servers for hosting the websites, their images, and their nameservers. A given hijacked machine may be serving images to all sites in the Yambo family at one time:
- International Legal Rx Medications:
- http://88.255.90.42:8080/legalrx/images/powercharge.jpg
- My Canadian Pharmacy:
- http://61.166.124.12:8080/images/mcp/pp_general.jpg
- Men+ Health:
- http://88.255.90.42:8080/mh/images/logo.gif
- Canadian Healthcare and Mall:
- http://88.255.90.42:8080/e/ch/images/theme.jpg
- VIP Pharmacy ("Viagra + Cialis"):
- http://88.255.90.42:8080/e/cv/images/logo.gif
- US Drugs:
- http://88.255.90.42:8080/usd/images/theme_mc_left.jpg
- Canadian Family Pharmacy:
- http://218.206.175.216:8080/images/cfp/logo.gif
Similarly, the servers used to host the website and nameservers for Yambo sites are swapped around among sites during their frequent changes.
[edit] How to Report this Spam
The Complainterator is configured to report this spam to the registrars. It performs a "whois" lookup on the domain names used by the name servers that resolve access to the web site. It discovers the registrars that are sponsoring the access to the web site. It prepares a complaint to the sponsoring registrars.
Removal instructions
web site domains
- the registrar needs to set the status of the domain to
- clientHold
- clientUpdateProhibited
- clientDeleteProhibited
- clientTransferProhibited
name server domains
- the registrar needs to set the status of each of the name server domains to
- clientHold
- clientUpdateProhibited
- clientDeleteProhibited
- clientTransferProhibited
In addition, to remove them as name servers, the subdomain address records (eg for ns1 and ns2) need to be changed to a non-routable address, such as 0.0.0.0 or a blackhole address within their own address space.
[edit] Sponsor Organization
Bulker.biz is the sponsor organization behind this type of site. They pay spammers to promote it, and they don't shut down illegal spammers.
