Operación Carrusel sets an example for fighting Child Pornography

The Spanish government last week reminded us how easy it is to catch large groups of online perverts who enjoy downloading child pornography. Last week in Spain, Manuel Vasquez, the chief of the national police's "Brigada de Investigación Tecnológica", announced the detention of 121 people, and brought charges against 96 of them. 800 police officials performed 210 searches in 42 Spanish provinces, leading to the seizure of 347 hard drives, 1,186 CDs and DVDs, and 36 laptop computers. Among those charged was a member of the CNI (Centro Nacional de Inteligencia) and an agent of the National Police who worked in Spain. Four underaged students were also detained.


(watch the video in Spanish)

"Operation Carrousel" is the largest coordinated effort in the history of la Policía Nacional. The investigation began in July of 2007 when the Federal Police of Brasil (la Policía Federal de Brasil) shared log files from a major child pornography distribution network with the government of 75 countries. The archives which they shared identified 18,000 IP addresses from which child pornography had been accessed, including 1,600 connections that had originated in Spain. Those IP addresses were turned over to the Brigade of Technological Research (BIT), who used them to identify 250 homes from a great deal of the activity had occurred.

Those investigated were all "distributers" -- those who could be shown to have ACCESSED the Brazilian stash and also to have SHARED at least three files via Peer to Peer (P2P) networks that made clear reference to underaged pornography in their file names. Terms such as "preteen" or "pcth" (which in Spanish is an abbreviation for "preteen hard core") were suspected, and contents were checked to determine whether the files were in fact what they were labelled.

The Spanish article describing these events, at rtve.es, closes by pointing out how the criminals in these situations are from all walks of life . . . taxi drivers, bank employees, police, commercial pilots, concierges, and teachers, . . . from all ages . . . 4 minors, 5 over the age of 60, 60 between the ages of 18 and 30, 74 from 31 to 40, 52 from 41 to 50, and 22 more between 51 and 60 . . .and from all parts of the country. 49 were arrested in Catalonia, 37 in Andalusia, 29 in Madrid, 22 in Valencia, 15 in Basque country, 13 in Castilla y Leon, 11 in Galicia, 8 in Castilla La Mancha, 7 in Canarias, 6 in Murcia, 5 in Aragón, 5 in Cantabria, 5 in Baleares, 4 in Extramadura, and 1 in La Rioja.

The crime is the same in most every country. We saw similar results in Australia this summer with Operation Centurion, which began when German authorities shared lists of IP addresses of those who visited a child porn website in Germany with other countries. In that case 1,500 Australian IP addresses were investigated -- so far as we can tell the ONLY country of the 170 with whom the Germans shared the information that did anything useful with it. In the opening raid in May, more than 70 Australians were arrested, and more than one million child exploitation images and videos were seized. Arrests in Australia now exceed one hundred people, with the most recent happening last week with the arrest of Robert Andrusiow in Wollongong.

The USA has not had a similar operations since the March 2002 Operation Candyman, which netted 89 offenders in 20 states after 266 searches were conducted. 27 of those arrested plead guilty to molesting more than 36 children.

In Operation Candyman, the Houston FBI's Child Exploitation Task Force set up a Yahoo "eGroup" at www.egroups.com/groups/thecandyman, and monitored the activities of visitors for nearly a year before the raids.

Like its predecessor, Operation Avalanche, which lead to 100 arrests in 37 states, there were some rather strong challenges and accusations of entrapment. The problems generated from CandyMan and Avalanche need to be studied, and compared with the results of Spain's Operación Carrusel and Australia's Operation Centurion.

The lesson we should be learning from the successes in Australia and Spain is that its not necessary to conduct undercover operations that may lead to charges of entrapment. We have technology on our side. Monitoring the highly trafficked child pornography websites of the world and determining where the visitors come from is a perfectly adequate way in which to scoop up large collections of online perverts. To be sure, some of those IP addresses will lead to open WiFi points, libraries, hotels, etc. But as we learned in Spain, many of the perverts are operating from their own homes, and using those same home addresses to do Peer to Peer "distribution". Searching their homes will certainly put officials on the trail to more badness, and will send an important message that is in need of an update: Child Pornography Is Not Tolerated in the United States of America.

Phishing Clue Needed in Ecuador

UPDATE: MISSION ACCOMPLISHED

After 26 days of continuous abuse, all of the ".ec" domains mentioned below were terminated within 1 day of the posting of this article. Thanks to those who saw this and helped bring it to the attention of our new friends in Ecuador...

End Update

Help! If you happen to know someone who works at NIC.EC, would you be willing to help translate a phishing problem to them?

The current longest-lived phishing campaign on the planet is currently abusing a group of domains in Ecuador, and its time for these domains to be terminated.

The domains in question are:

dll.ec
dll.com.ec
dll.net.ec
dllst.net.ec
dllst.ec

This campaign is part of the longest lived phishing campaign in the history of phishing, which has been continually plaguing Abbey Bank, a part of the Santander Group. Its long been obvious in the anti-phishing world that no one at Santander Group cares about phishing, so we pretty much just leave them alone. They don't answer emails, they don't have a visible level of participation in the Anti-Phishing Working Group, and they don't have a visible level of participation in the Digital PhishNet. They are also one of the few phishing-targeted banks on the planet that don't seem to use any external anti-phishing services. (Based on volume and longevity of phishing sites only -- if they are paying someone to shut down phishing sites, that company should find a new line of work.)

But this post isn't about Abbey. If Abbey were the only victim, I wouldn't be writing this. The problem is that the great success this phisher is having hosting his domains on ".ec" (Ecuador) domain space has caused him to branch out to target other brands.

The current Abbey path "/CentralFormWeb/Form/", has been in use since September 23rd. Since that date, I've received 64,473 alerts of phishing URLs on that path. The initial domains for the attack, dlstcks.com, dlstcks.net, and dlstcks.org were quickly terminated. dllst.ec was created on September 26th and has been used contantly since that time. dllst.com.ec, dllst.net.ec were added on September 27th, and dll.ec and dll.com.ec on September 30th.

Several other domains have come and gone during this campaign, including: dllstd.eu, dllstd.me.uk, ppt.net.kg, dlspot01.com, dllst.vu, dll-i.ph, dll-s.eu, dllsrv.co.uk, server.org.kg, dllstd.co.uk, dllsrv.co.uk.

For each of the domains above, one can do "path replacement" to demonstrate that there are several brands being targeted. As an example:

http://myonlineaccounts2.abbeynational.co.uk.dll.ec/CentralFormWeb/Form/



http://www.americanexpress.com.dll.ec/myca/form/serverstack/action



http://www.scotiaonline.scotiabank.com.dll.ec/online/form.jsp



http://online.lloydstsb.co.uk.dll.ec/customercare/serverid/cform.jsp



The machine name portion does not matter. Any machine name may be used with any of the four paths.

American Express was added to the attack on October 20th. That's EXTREMELY unusual, as we almost never see attacks against American Express!

Scotia Bank was next, added to the attack on October 23rd, using .dllst.com.ec, .dllst.ec since its first day.

Lloyds TSB is the newest victim brand, introduced to these paths only on October 25th. The Lloyds and Scotia attack paths have only used 9 domain names so far this time around, with the paths "/myca/form/serverstack/action" and "/online/form.jsp/" respectively:

dll.ec
dllst.com.ec
dllst.ec
dllst.net.ec

moder.ph

infod.tk
infodl.tk
mmdt.tk
tracklt.tk

I'm watching for new domains both in my phish pheeds, and by monitoring the Nameservers ns1.bestthetravel.net and ns1.alterdll.com, both being currently preferred by this phisher.

Because these are "proxy hosted" phish, they may temporarily not resolve for 90 seconds or so until it is noticed that one of the proxies is non-functional. When that is detected, the phisher's monitoring system automagically updates the nameserver resolution to point to a new available proxy. With a pool of thousands of potential proxy redirectors, this phish will continue to live until our friends in Ecuador terminate the domain names.

Thanks for any introductions you may have for us.

Oh - for any former CastleCops PIRT Handlers - I'm happy to report that the system seems "stable" and its time to report back to work! We've had a few die-hard PIRT Handlers who have worked straight through - most notably "Downie" and "s0tet". I hope to see many of the rest of you back there soon!

A sample PIRT ticket for the Abbey/AmEx/Scotia phish would be:

http://www.castlecops.com/Abbey_Bank_American_Express_Scotia_Bank_phish973790.html

Hopefully we'll have PIRT tickets for all nine of the active domains by this evening.

The demise of index1.php PornTube Video Malware

When a criminal finds a good thing, he stays with it. One criminal has been doing exactly that since May 17th. Every day since May 17th, the UAB Spam Data Mine has received spam messages with shocking, offensive titles promising to have videos of offensively described sex acts, which pointed to webpages ending in "index1.php". I started to write today's article saying that it had finally stopped, but unfortunately, a small batch trickled in just before I sat down to write. (Two domains were in that batch - estofadosgrando.com.br, which has already been fixed so that it is not able to deliver the malware - and rasini.it, which is still hosting a fake YouTube page showing a sexual act and attempting to infect visitors with their malware.)

What I can say is that something has happened this week to dramatically impact the volume of this malware-advertising spam. While there are times when the volume was more than 10% of all spam, for the month of October, this campaign averaged about 2% of the total spam volume per day. In May it was only a fraction of 1%, although present each day, in June it crossed 1%, peaking in mid-August where it was 3% of all spam we received.

During the course of this spam campaign, we received spam from more than 30,000 infected computers, which advertised malicious websites on more than 2,260 domains.

Each of those websites was an existing legitimate website, which was taken over by the criminals to allow them to post their malicious software on the site. Once their malware was in place, visitors would be invited to load software to view the movie (viewers with older browsers were infected even if they didn't ask to load the software). That malware in turn launched the installer for the then current fake Anti-Virus 2008 (currently calling itself AntiSpyware 2009).

A quick check of the 2,269 previously used domains shows that 166 of them are still hosting the malware.

Here are the links to the malware, in case someone would like to contact these webmasters and help them get this stuff removed.

We believe that the webmaster's own computer may be compromised. It appears that the criminal logs in to the websites using the administrator's userid and password, creates the directory where he is going to place his virus, and then uploads his files to it.

If you are a webmaster of one of these domains, we would very much like to see your server logs. Please email if you would be willing to share: gar@cis.uab.edu


!!DANGER!! IF YOU ARE NOT A PROFESSIONAL ANTIVIRUS RESEARCHER, THESE LINKS ARE NOT FOR YOU!!!!

193.238.209.17\hot_video.exe
195.145.241.232\pornvideo815uw.exe
198.66.130.103\videopornu376x.exe
1pajda1.borec.cz\video435_porn.exe
66.36.231.223\videporn920ma.exe
69.73.158.27\news_usama_video.exe
74.50.89.140\usama_video.exe
999.gen.tr\pornotube\video1439654.exe
999.gen.tr\pornotube\video54582.exe
999.gen.tr\pornotube\video76566.exe
999.gen.tr\pornotube\video8657786.exe
aberturaslif.com.ar\pornotube\video1439654.exe
aberturaslif.com.ar\pornotube\video54582.exe
aberturaslif.com.ar\pornotube\video76566.exe
aberturaslif.com.ar\pornotube\video8657786.exe
acalon.es\news\video463847.exe
acalon.es\news\video6432434.exe
acalon.es\news\video7656532.exe
acalon.es\news\video9865565.exe
achdepannexpress.com\news_usama_video.exe
addressprint.ru\news_usama_video.exe
agriturismovillavittoria.it\pornivideo03y45i.exe
agroredenoticias.com.br\pornotube\video1439654.exe
agroredenoticias.com.br\pornotube\video54582.exe
agroredenoticias.com.br\pornotube\video76566.exe
agroredenoticias.com.br\pornotube\video8657786.exe
aisal.ru\videoPorn218hdy.exe
aisoftware.ro\tvideo_my_hot.exe
alcaphone.com.br\hot_video.exe
aloidiasimoveis.com.br\pornvideo815uw.exe
alrafah.net\pornotube\video1439654.exe
alrafah.net\pornotube\video54582.exe
alrafah.net\pornotube\video76566.exe
alrafah.net\pornotube\video8657786.exe
amadicarpets.com\news_usama_video.exe
amiram.org.il\shoking_video_news.exe
amphonesinh.info\videporn920ma.exe
andreadelvalle.com\pornvideo815uw.exe
antonianki.ofm.pl\pornotube\video1439654.exe
antonianki.ofm.pl\pornotube\video54582.exe
antonianki.ofm.pl\pornotube\video76566.exe
antonianki.ofm.pl\pornotube\video8657786.exe
antytusk.pl\tvideo_my_hot.exe
asaib.info\video79885.exe
asociace.euweb.cz\news\video463847.exe
asociace.euweb.cz\news\video6432434.exe
asociace.euweb.cz\news\video7656532.exe
asociace.euweb.cz\news\video9865565.exe
atatac.com\hot_video.exe
autocalunnictvojv.sk\pornotube\video1439654.exe
autocalunnictvojv.sk\pornotube\video54582.exe
autocalunnictvojv.sk\pornotube\video76566.exe
autocalunnictvojv.sk\pornotube\video8657786.exe
axonsrl.com\videporn920ma.exe
aziendaruggeri.it\pornwvideo3u96.exe
azoreil-yar.ru\pornnvideo238vf.exe
bakir.bel.tr\video4326xx.exe
bali-hotels-budget.com\my_video_hot.exe
baselangues.emme.fr\video432654xd.exe
bba.kbu.ac.th\pornwvideo3u96.exe
beatnikteacher.com\pornivideo396.exe
benhurantiguidades.com.br\videopornu376x.exe
betosom.com.br\pornnvideo238vf.exe
billoepallina.it\news\video463847.exe
billoepallina.it\news\video6432434.exe
billoepallina.it\news\video7656532.exe
billoepallina.it\news\video9865565.exe
bolats.com\videoPorn218hdy.exe
bubugrupo.com\tvideo_my_hot.exe
buenosairesltd.com\tvideo_my_hot.exe
bux666.com\pornivideo396.exe
cadorgames.xf.cz\news\video463847.exe
cadorgames.xf.cz\news\video6432434.exe
cadorgames.xf.cz\news\video7656532.exe
cadorgames.xf.cz\news\video9865565.exe
calimh.com\news\video463847.exe
calimh.com\news\video6432434.exe
calimh.com\news\video7656532.exe
calimh.com\news\video9865565.exe
castropaes.com.br\pornvideo815uw.exe
cdlourdes.com\news_usama_video.exe
cedacbrasil.com.br\videporn920ma.exe
celinakochen.com.br\videokl_ds4.exe
center-eno.com\vide839pornn.exe
charley.wz.cz\news_usama_video.exe
chennai.needindya.com\pornotube\video1439654.exe
chennai.needindya.com\pornotube\video54582.exe
chennai.needindya.com\pornotube\video76566.exe
chennai.needindya.com\pornotube\video8657786.exe
click-cargo.com\shokinng_video.exe
cobrahk.wz.cz\video25653.exe
collectedthoughts.co.uk\news_usama_video.exe
coralis.ro\video.exe
crazynails.pro24.pl\videoXXX76s3545.exe
crisracebook.com\videoxxx834j.exe
derggi.com\my_video_hot.exe
dipucu.com\pornmvideo6d19.exe
dominuscobrancas.com.br\video_usama.exe
dsl-uebersicht.de\video.exe
dyc-1.celingest.es\new_usama_video.exe
eltubio.com.ar\tvideo_my_hot.exe
emporio-uk.it\my_hot_video.exe
erolantik.com\pornyvideo194vf.exe
escola-allegro.com\videporn920ma.exe
eskapada.info\video.exe
estudiscunit.com\videoQe32.exe
evagino.net\pornivideo03y45i.exe
eyecatchinggear.com\videoPorn218hdy.exe
farfalle.es\news_usama_video.exe
ferrucasdeltrenrojo.com.ar\tvideo_my_hot.exe
fitonit.cl\pornotube\video1439654.exe
fitonit.cl\pornotube\video54582.exe
fitonit.cl\pornotube\video76566.exe
fitonit.cl\pornotube\video8657786.exe
freddyrock.com.ar\videopornu376x.exe
gargamel.com.tr\my_video_hot.exe
geoteam.sk\pornivideo03y45i.exe
giovani.donorione.it\secret_archive.exe
gorodok-band.de\pornotube\video1439654.exe
gorodok-band.de\pornotube\video54582.exe
gorodok-band.de\pornotube\video76566.exe
gorodok-band.de\pornotube\video8657786.exe
grafo.com.tr\video.exe
grupamc.com\vide839pornn.exe
guillaumenery.fr\news_usama_video.exe
hardcore-united.com\pornmvideo6d19.exe
hiperlab.com.br\pornotube\video1439654.exe
hiperlab.com.br\pornotube\video54582.exe
hiperlab.com.br\pornotube\video76566.exe
hiperlab.com.br\pornotube\video8657786.exe
hisaryapi.com.tr\pornovideo729lo.exe
holdispharma.com\videopornu376x.exe
holytrinity.com.ua\videporn920ma.exe
horsetrainingsuperstars.com\news_usama_video.exe
hotel-lebellevue.fr\my_hot_video.exe
hotelxibalba.com\news_usama_video.exe
hsmicro.co.kr\pornotube\video1439654.exe
hsmicro.co.kr\pornotube\video54582.exe
hsmicro.co.kr\pornotube\video76566.exe
hsmicro.co.kr\pornotube\video8657786.exe
i-bournemouth.com\pornotube\video1439654.exe
i-bournemouth.com\pornotube\video54582.exe
i-bournemouth.com\pornotube\video76566.exe
i-bournemouth.com\pornotube\video8657786.exe
imparbrasil.com.br\hot_video.exe
inspirace.ic.cz\video4335gfd3.exe
integratedlabelsoutlet.com\pornnvideo238vf.exe
integratedlabelsusa.com\videoPorn218hdy.exe
ipago.info\my_hotvideo.exe
irisotel.com\my_video_hot.exe
isvo.nl\videopornu376x.exe
ivoireweb.biz\pornwvideo3u96.exe
iyc.org.tr\pornotube\video1439654.exe
iyc.org.tr\pornotube\video54582.exe
iyc.org.tr\pornotube\video76566.exe
iyc.org.tr\pornotube\video8657786.exe
jegupi.com\antivir\AntivirusXP2008Installer.exe
jesusnolar.org.br\pornvideo815uw.exe
jorgelopezdj.com\pornivideo03y45i.exe
josiasgranito.com\install_antivirus.exe
kamenipitarimilas.hr\videopornu376x.exe
korviet.net\pornivideo396.exe
koshkindom.vio.ru\video245fgw22.exe
label-sheets.com\my_hots_video.exe
laccsa.com\pornvideo815uw.exe
ladrigan.com\antivir\AntivirusXP2008Installer.exe
lafabak.com\pornotube\video1439654.exe
lafabak.com\pornotube\video54582.exe
lafabak.com\pornotube\video76566.exe
lafabak.com\pornotube\video8657786.exe
lichter-loh.com\pornnvideo238vf.exe
litecrete.com\my_hots_video.exe
lolo16.com\my_video_hot.exe
loritritel.com\pornotube\video1439654.exe
loritritel.com\pornotube\video54582.exe
loritritel.com\pornotube\video76566.exe
loritritel.com\pornotube\video8657786.exe
magdatur.com.br\video83porn.exe
marklenders.com\pornyvideo194vf.exe
marwad.com\my_hotvideo.exe
maximelaplante.com\video23574fr41.exe
maximumassetshield.com\videoXXX76s3545.exe
mediamatika.wu.cz\pornmvideo6d19.exe
membersvcs.com\antivir\AntivirusXP2008Installer.exe
merchant.directaccess.ro\videosecrt927.exe
miavai.com\my_hots_video.exe
michcom.cl\my_hots_video.exe
millenniummobilya.com\video857porn.exe
mkz.unas.cz\pornotube\video1439654.exe
mkz.unas.cz\pornotube\video54582.exe
mkz.unas.cz\pornotube\video76566.exe
mkz.unas.cz\pornotube\video8657786.exe
mobila.yard.ru\video7346.exe
momoelectronic.com\pornivideo03y45i.exe
motorpost.com\pornivideo03y45i.exe
muranga.es\pornotube\video1439654.exe
muranga.es\pornotube\video54582.exe
muranga.es\pornotube\video76566.exe
muranga.es\pornotube\video8657786.exe
music2000.eu\videosecrt927.exe
musiquote.it\tvideo_my_hot.exe
neocodec.com\free_vid.exe
netmalakay.com\videonjk568.exe
nrss.com.br\video623porn.exe
oarsoaldea.net\tvideo_my_hot.exe
oempricing.com\videoPorn218hdy.exe
omalissi.com.ar\pornivideo03y45i.exe
opcionsp.com\videosecrt927.exe
orf.ru\pornotube\video1439654.exe
orf.ru\pornotube\video54582.exe
orf.ru\pornotube\video76566.exe
orf.ru\pornotube\video8657786.exe
orsoft.es\video23678fe3.exe
otromadrid.dmkhost.net\pornotube\video1439654.exe
otromadrid.dmkhost.net\pornotube\video54582.exe
otromadrid.dmkhost.net\pornotube\video76566.exe
otromadrid.dmkhost.net\pornotube\video8657786.exe
paoloterni.com\videopornu376x.exe
payalweb.cusiteonline.com\videoPorn218hdy.exe
pegasolar.com\videoPorn218hdy.exe
penzion-hradsky.cz\video354rporn.exe
perezmu.com\news_usama_video.exe
pfmsindia.biz\hot_video.exe
pichelariadias.com\my_hot_video.exe
polatenerji.com\my_video_hot.exe
portaledonna.org\news_usama_video.exe
ppctotal.com\my_hotvideo.exe
precision.needindya.com\pornovideo729lo.exe
previarch.com\pornotube\video1439654.exe
previarch.com\pornotube\video54582.exe
previarch.com\pornotube\video76566.exe
previarch.com\pornotube\video8657786.exe
pro-heni.hr\pornotube\video1439654.exe
pro-heni.hr\pornotube\video54582.exe
pro-heni.hr\pornotube\video76566.exe
pro-heni.hr\pornotube\video8657786.exe
quintametalica.com\my_hots_video.exe
regv.net\videosecrt927.exe
remcovandermeide.nl\pornovideo729lo.exe
ringrajeradio.com.ar\video3468ht34.exe
rollarampiberica.com\my_hots_video.exe
rovinj.ch\videopornu376x.exe
rubblemaster.pl\pornnvideo238vf.exe

Ryan Goldstein: Digerati Faces ?Justice?

This will be brief. I promise.

You'll recall my frustration when New Zealander hacker, Owen Thor Walker, AKA "AKILL", was indicted as a "super hacker" back in April (see AKILL Convicted Are We Safer Now?, and my even greater frustration when he got off with no jail time and only having to pay $11,000 in restitution (which was only about 1/5th of what we could PROVE he had stolen!)

I'm back in frustration mode over the sentencing of Ryan Goldstein. Goldstein was finally sentenced yesterday in the East District of Pennsylvania, after being indicted more than eleven months ago (November 1, 2007) for "18 USC 371 - Conspiracy to Commit Computer Fraud".

Ryan traded favors such as "an undetected, unreleased bifrost beta with 100% antivirus and firewall bypass", as well as passwords to various forums to incentive AKILL to DDOS groups which had bothered Ryan, including TAUNET, ssgroup, and others. No one probably would have noticed or cared if it weren't for the fact that Ryan decided to host a malware update on some servers at University of Pennsylvania, where he is a student. When Walker instructed his 50,000 compromised computers to update themselves with code from the UPenn server, it caused an "accidental" Denial of Service, disabling some of the network services at UPenn.

Ryan's lawyer, Ronald Levine of Post & Schell, got an extension until March 10th, but they decided to plea out, and did so on February 29th. Since then, sentencing was scheduled for June 10, August 5, August 19, and finally October 21st.

Ryan was finally sentenced yesterday to 90 days in jail, followed by 90 days in a halfway house, and 180 days of house arrest. He will also not be allowed to use a computer "other than for work or school activities" for five years.

The prosecution failed to bring any charges regarding the more than 1,000 child pornography images found on his computer. They then agreed that he could schedule the 90 days at his convenience, so as not to conflict with his class schedule. He'll probably serve them during summer vacation.

I'm not sure what kind of school wants to have a convicted computer criminal and child pornography collector as one of their students. I guess he'll get his degree and go find a job, after his brief visit to jail.

The judge apparently shared my frustration at the lack of serious charges, based on his remarks reported in the Philadelphia Inquirer yesterday. U.S. District Judge Michael Baylson completed the sentencing of Goldstein, and then turned to his next case, where he sentenced Derrick Williams to two years for possession of Child Pornography. The judge thought it worth noting that "It seems very unfair. . . . I want to note for the record that Mr. Goldstein is white and Mr. Williams is African American and that adds to my discomfort". According to the Philadelphia Inquirer, both men possessed roughly 1,000 images of child pornography.

According to the sentencing guidelines, Williams should have received an 8 to 10 year sentence.

FTC stops AffKing and SanCash, so is Pill Spam Gone?

In yesterday's blog, we shared information about the FTC and New Zealand police's Takedown of AffKing and SanCash. As soon as I posted, people started asking, "Have you seen a decrease in pill spam?" So, this morning we went to Starbuck's and checked out the morning spam over a few espressos.

To make sure we were using fresh spam, we looked only at spam from midnight until 6 AM for October 16, 2008. To begin, we sorted our spam into two big buckets: Pill Spam, and Everything Else. Then, we did some simple checking of what was in the Everything Else bucket, to reveal this graph:



We then opened up the "Pill Spam" data and started digging into the clusters. The emails in this category contained 12,040 URLs, of which 1,231 were unique. The most common URL was for the website http://www.includeisland.com/ which occurred 1,118 times, followed by http://www.mostbody.com/ with 960 occurrences and http://indatzayrce.com/ which was present in 570 emails.

Twenty-Eight URLs accounted for 50% of the pill spam emails.

Eighty-seven URLs accounted for 75% of the pill spam emails.

179 URLs accounted for 90% of the pill spam emails.

The graphic below shows the top Sixty-five URLs in the Pill Spam category which each contained at least .25% of the volume of emails.



In each case, all of the domains from each provider were hosted on a single ISP. The domains were:



31% - 78.157.143.160
http://aspirationhelp.com
http://fractionwhich.com
http://observeclock.com
http://leftsit.com
http://yourhappen.com/
http://nounmount.com
http://spiritualityegg.com
http://www.houseprosperity.com
http://settlecotton.com/
http://thesyllable.com/
http://segmentcapital.com/
http://mappoem.com
http://purposehear.com
http://purposehear.com/
http://frontsoon.com
http://butvalue.com
http://tonesuch.com
http://allowsong.com/
http://www.mostbody.com
http://www.includeisland.com




14% - 118.216.29.89
http://pillslovefelt.com
http://loverxmelody.com
http://www.optimismmeasure.com/
http://www.courageanimal.com/
http://placemedpopulate.com
http://lovepharmsea.com
http://qualitycanadiansearch.com
http://placepharmscolor.com
http://medicalloversagree.com
http://newrxroad.com
http://www.determineagain.com/
http://www.gathercourage.com/
http://pharmsitefact.com
http://www.responsibilitymatter.com/
http://www.integritycar.com/


8% - 201.65.181.178
http://buyirishhealth.sg
http://buyitdoctor.sg
http://coldtherapyonline.sg
http://combuymeds.sg
http://columbiainternationalmed.sg
http://coloradorecoveryguide.sg
http://carmedscripts.sg
http://collegeclubstore.sg
http://collinsamericanmeds.sg



6% - 58.20.154.162
http://objectdecimal.com/
http://propertydefinition.com/
http://madeingenuity.com/
http://reflectionsell.com/
http://welltotal.com/
http://actdefinition.com/
http://spiritualitywhere.com/
http://reflectionteach.com/
http://specialallow.com/
http://experiencerealization.com/
http://syllableharmony.com/
http://breadsave.com/
http://probablenumber.com/
http://optimismchief.com/
http://separatesolution.com/
http://doesage.com/
http://respectroot.com/

No Image Available - Site Offline

5% - 218.64.218.4
http://lewiwdenne.com
http://indatzayrce.com



1% - 74.53.96.178
http://iemoriah.com.br/rf.html



0.3% - 220.248.185.97
http://largeindependence.com/

We'll revisit the topic of pill spam in two weeks time to see if there has been any significant change in the field. It may be that the implications of the recent decision have not yet set in, or it may be some of the spammers are so bold that they just switched affiliates and kept right on spamming!

For now, I'll leave you with the even worse truth about these spammers. They have dozens or even thousands of other domains already registered and ready to send spam. Each of these IP addresses above also hosts a plethora of other domain names which are sitting in reserve for future spam purposes. Some of these may be valid domains, I am not claiming they are all pill sites, but every one that I have checked so far was hosting a pill site:

VDHost of Latvia - 78.157.143.160
=====================================
Abilitylot.com
Aboveingenuity.com
Achievementhalf.com
Advocacycan.com
Advocacyever.com
Advocacyorder.com
Advocacystead.com
Afterteam.com
Allowsong.com
Appreciationmany.com
Appreciationnow.com
Appreciationtire.com
Appreciationwing.com
Arrangepurpose.com
Aspirationprobable.com
Aspirationthough.com
Atomgenerosity.com
Atomthere.com
Ballshape.com
Beatapple.com
Bobava.com
Bookdear.com
Bottomtrain.com
Boughtsail.com
Branchlearn.com
Branchsingle.com
Carryrespect.com
Characterachievement.com
Checksister.com
Columnarrive.com
Columnyellow.com
Compassionhurry.com
Conditionoptimism.com
Conditionprepare.com
Containterm.com
Couragefinger.com
Cutreciprocity.com
Decidewisdom.com
Definitionbefore.com
Definitiongrew.com
Didresponsibility.com
Differsalt.com
Dividebell.com
Dividemain.com
Doorachievement.com
Drywrote.com
Duringseveral.com
Eachparagraph.com
Eightintuition.com
Eitherreflection.com
Elseagain.com
Especiallyknow.com
Eyecompassion.com
Eyeoriginal.com
Famousbird.com
Finalpattern.com
Firstaspiration.com
Forgivenesscount.com
Forgivenessearth.com
Forgivenessregion.com
Fourease.com
Fourstrength.com
Fractionwhich.com
Gardenstring.com
Generosityprocess.com
Gotpose.com
Grayhard.com
Grouprealization.com
Groupwild.com
Guessyour.com
Happinessmight.com
Happinessweather.com
Hardexcite.com
Harmonythere.com
Harmonythis.com
Hasusual.com
Hatwit.com
Herintuition.com
Hotintuition.com
Housecome.com
Houseprosperity.com
Housestraight.com
Independenceknew.com
Independencewhy.com
Ingenuityappear.com
Ingenuityfor.com
Instrumentrespect.com
Integritygentle.com
Intuitionthese.com
Keptlegacy.com
Legacykept.com
Legacymilk.com
Lengtharm.com
Lineprosperity.com
Lovethus.com
Machinejoin.com
Masterenough.com
Meatcount.com
Melodywisdom.com
Metalappreciation.com
Minuteachievement.com
Motivationanimal.com
Motivationexcite.com
Nextwritten.com
Noonability.com
Observeclock.com
Otherdefinition.com
Pageingenuity.com
Paintlegacy.com
Paragraphwisdom.com
Patternstrength.com
Populategroup.com
Postresponsibility.com
Poundstrength.com
Powercourage.com
Progresscompare.com
Progressspoke.com
Properoptimism.com
Purposehear.com
Purposesing.com
Quarttrust.com
Racejoin.com
Rathercow.com
Reachreflection.com
Realizationexcite.com
Reasonhappiness.com
Representdiffer.com
Resolutionmany.com
Respectbring.com
Respecttoward.com
Responsibilitymoney.com
Responsibilityride.com
Richmass.com
Ringreciprocity.com
Rubfight.com
Rubjoin.com
Rubrealization.com
Saverather.com
Seedforgiveness.com
Sendhold.com
Sendoccur.com
Settlecotton.com
Shinechord.com
Signtradition.com
Sisterhappiness.com
Speechresolution.com
Speechwisdom.com
Speedcome.com
Spellindependence.com
Straightweek.com
Strengthfig.com
Strengthmouth.com
Strengthsmell.com
Systemwant.com
Tenlegacy.com
Thoughperiod.com
Throughlength.com
Tonespirituality.com
Townarrive.com
Traditionneighbor.com
Traditionroad.com
Traditionsyllable.com
Traditionweather.com
Triangledefinition.com
Valleystead.com
Varymaterial.com
Varywrote.com
Wallchance.com
Washdefinition.com
Wherescience.com
Whitefavor.com
Witlate.com
Wouldsame.com

Hanaro Telecom in Korea on 118.216.29.89

Courageanimal.com
Determineagain.com
Gathercourage.com
Integritycar.com
Lovepharmsea.com
Loverxmelody.com
Medicalloversagree.com
Newrxroad.com
Optimismmeasure.com
Pharmnewsystem.com
Pharmsitefact.com
Pharmsplaceboy.com
Pharmvip.com
Pillslovefelt.com
Placemedicalheat.com
Placemedpopulate.com
Placepharmscolor.com
Qualitycanadiansearch.com
Qualitymedsroad.com
Qualitypillgirl.com
Responsibilitymatter.com
Toppharmacyhunt.com
Viagra-club-m1.com
Viagra-club-m2.com
Viagra-club-m3.com
Viagra-club-m4.com
Viagra-club-m5.com
Viagra-club-m6.com
Viagra-club-m7.com
Viagra-club-m8.com

Megaplan on 201.65.181.178:

365anniversary.com
Ableweight.com
Accesscanadadrugs.com
Accesscanadapharmacy.com
Accessmedicalonline.com
Accessmedicalsitex.com
Acoxgiftsworld.com
Addcustomersonline.com
Adddoconline.com
Addeasy3inch.com
Addknowmore.com
Addmedirect.com
Addmoread.com
Addmoreplaces.com
Addmoreram.com
Addsitelite.com
Addtravelsite.com
Advanceddiscountpharmacys.com
Advanceedhealth.com
Aedprescription.com
Airpotmap.com
Alcoholdrugdirect.com
Alexandermedicalbeds.com
Allaboutadd.com
Allindiabulkdrugguides.com
Allthedrugsx.com
Allyeardirect.com
Allyearetc.com
Allyearhome.com
Allyearonline.com
Allyearsite.com
Allyeartan.com
Alotonline.com
Altmedjobss.com
Amedicalschool.com
Amedonlinex.com
Americaneddrugstor.com
Americanmedicalclub.com
Americanmedicalconcept.com
Americanmedicaljob.com
Americanmedicalnet.com
Americanpharmacyjobs.com
Americanspharmacyonline.com
Americapharmacyschools.com
Angellmedicalcenter.com
Annumyear.com
Antipsychoticdrugsonline.com
Antipsychoticeddrugsonline.com
Anybodyonlies.com
Anyonebutsite.com
Apharmacysite.com
Apothecarydiscount.com
Apothecarydiscounts.com
Apothecaryguidex.com
Apothecaryprescription.com
Apothecaryschools.com
Apothecarytechnicians.com
Apothecarytechnicianx.com
Arealot.com
Arlenmeded.com
Atlanticcityreal.com
Austinpharmacyschools.com
Australianpharmacyonline.com
Australiapharmacyonline.com
Axismedicalsupply.com
Babygotheat.com
Backlotusa.com
Bankallyear.com
Bankschevorlet.com
Bargaindrugsonline.com
Bargaindrugspharmacy.com
Bargainerdrugsonline.com
Bargainpharmacydirect.com
Bargainpharmacyguide.com
Bargainprescriptiondrug.com
Baysideprop.com
Bayvoteyes.com
Bcfoc.com
Bdecontainer.com
Becamegot.com
Behealthysite.com
Bestaddware.com
Bestanticancerdrugs.com
Bestanticancereddrugs.com
Bestantiviraleddrugs.com
Bestbeachpharmacy.com
Bestbeautyhealthy.com
Bestbigfatx.com
Bestbobesponja.com
Bestbutcanada.com
Bestbutsports.com
Bestbuyondrugsx.com
Bestbuyspharmacys.com
Bestcitygov.com
Bestdepressiondrugs.com
Bestdepressiondrugsx.com
Bestdepressioneddrugs.com
Bestdietpharmacy.com
Bestdirectpharmacys.com
Bestdrugsbargain.com
Bestdrugsbiz.com
Bestdrugscard.com
Bestdrugscards.com
Bestdrugsforme.com
Bestdrugsmart.com
Bestdrugstoday.com
Bestdrugstor.com
Bestedchen.com
Besteddrugaddiction.com
Besteddruglawyer.com
Bestelectrolytedrugs.com
Bestelectrolyteeddrugs.com
Bestglobalpharmacy.com
Bestgoodink.com
Bestgotweb.com
Besthealthywealthy.com
Bestheartdrugs.com
Bestimpotencedrugs.com
Bestinexpensivepharmacys.com
Bestinfertilitydrugs.com
Bestjobspharmacys.com
Bestjobspharmacyx.com
Bestkettle.com
Bestlandvip.com
Bestlifescience.com
Bestlifesystems.com
Bestlikeborscht.com
Bestlikefree.com
Bestlocalpharmacys.com
Bestlottryx.com
Bestmedconss.com
Bestmedconxx.com
Bestmedcoxx.com
Bestmedgroups.com
Bestmedicalconsultants.com
Bestmedicaldirect.com
Bestmedicalgear.com
Bestmedicalmall.com
Bestmedicalrate.com
Bestmedicalts.com
Bestmedmarts.com
Bestmedmartx.com
Bestmedonlines.com
Bestmedonlinex.com
Bestmedpreps.com
Bestmedprepx.com
Bestmedworlds.com
Bestmedworldx.com
Bestnarcoticdrugs.com
Bestofdrug.com
Bestpastapot.com
Bestpetmedxx.com
Bestpetsdrugs.com
Bestpharmacycard.com
Bestpharmacycards.com
Bestpharmacycenters.com
Bestpharmacycenterx.com
Bestpharmacycentrals.com
Bestpharmacydiscountx.com
Bestpharmacydiscountxx.com
Bestpharmacyeuropes.com
Bestpharmacyinfo.com
Bestpharmacyla.com
Bestpharmacylink.com
Bestpharmacynewsletters.com
Bestpharmacynewsletterx.com
Bestpharmacytechnician.com
Bestpharmacywebs.com
Bestpharmacyworld.com
Bestplatinumdrugs.com
Bestpricecanadadrugs.com
Bestpricecanadadrugsx.com
Bestratemedical.com
Bestseniorpharmacy.com
Bestusadental.com
Bestusalending.com
Bestusamtg.com
Bestusarate.com
Bestvaluecanada.com
Bestvaluecanadadrugs.com
Bestvoiceusa.com
Bestwatchsurvey.com
Bestwebpharmacy.com
Bestyukon.com
Betterbuyuk.com
Bettereuro.com
Bettereye.com
Betterrocks.com
Betterset.com
Bfdpasses.com
Bigdaddyblackx.com
Bigfatgaryx.com
Bigfathuge.com
Bigfatnetx.com
Bigfatsportsxx.com
Bigfatstuffx.com
Bigfatwhatx.com
Biggiantheadbandx.com
Biggiantheads.com
Biggiantradiox.com
Bighugeshop.com
Biglotcellx.com
Bigmailonlinex.com
Bigriverlot.com
Bigwayonline.com
Bigwhiteworldx.com
Bigwigvip.com
Bigworlddvdx.com
Bigworldltd.com
Biomeded.com
Biomedgenes.com
Biomedincx.com
Bioparapharma.com
Biopropharmax.com
Bizdiscountdrugs.com
Bluemedtechx.com
Bobhopemovies.com
Bondoddlotx.com
Bonfoc.com
Bookthelot.com
Bostonmeded.com
Bowllightx.com
Bowltry.com
Brazilgovguide.com
Brazilianpharmacyonlinex.com
Brazilpharmacyonlines.com
Brazilpharmacyonlinex.com
Bunchmachine.com
Bunoh.com
Businessmeded.com
Buydrugsdirectat.com
Buyeddrugsdirectat.com
Buyeddrugsonlinehere.com
Buyhomemedical.com
Buywisedrugs.com
Cachecus.com
Californiahealh.com
Californiarealsite.com
Callthepharmacy.com
Canadachristianpharmacys.com
Canadadrugorder.com
Canadadrugsclub.com
Canadadrugsorder.com
Canadiandrugservices.com
Canadiandrugsutah.com
Canadianexpressdrug.com
Canadianfreedomdrugsx.com
Canadianpharmacygateways.com
Canadianpharmacyguidess.com
Canadianpharmacyguidex.com
Canadianpharmacyreviewx.com
Canadianpharmacyshoppers.com
Cancerpharmacyonline.com
Canjoindirect.com
Canwesue.com
Caremedicalsystems.com
Carepharmacyguide.com
Carepharmacyreliefs.com
Carlotpro.com
Carpenterspharmacydirect.com
Casinosload.com
Centerdrugsonline.com
Chaudfoc.com
Chaudrideau.com
Cheapdrugscard.com
Cheapeddrug.com
Cheapedhealth.com
Cheapedmedicinesx.com
Cheapedprescription.com
Cheapestedmedicines.com
Cheapestedmedicinesx.com
Cheapestedmeds.com
Cheapestedmedsx.com
Cheapestpharmacyguides.com
Cheapmeded.com
Cheappharmacyguides.com
Cheappharmacyschools.com
Cheaptoppharmacys.com
Checkyourpharmacy.com
Chedirecto.com
Chetierra.com
Cheyx.com
Chinacitygov.com
Chinamedicinedrug.com
Chinamedworlds.com
Chinamedworldx.com
Cholesteroldrugsonline.com
Choosegenericdrugs.com
Citiesbestgot.com
Citygovonline.com
Citymedicalworld.com
Cityrealstates.com
Clubmedbestprice.com
Clubvipcam.com
Cnfoc.com
Coastclubvip.com
Compoundingcarepharmacy.com
Containertry.com
Cookwarepotx.com
Coolmeproject.com
Cosmolotron.com
Couponslotonlinex.com
Crackfaggot.com
Crankthedrugs.com
Cutoffyourco.com
Cyberpharmacysite.com
Darksidenetwork.com
Designpromeds.com
Designpromedx.com
Determiningmedicalneeds.com
Dietdrugdamage.com
Dietdrugrecalls.com
Dietdrugsclaims.com
Dietdrugshelp.com
Dietdrugsreport.com
Diethealthynow.com
Diethealthysite.com
Dietrobust.com
Dietsdrugonline.com
Diopharma.com
Directwinbig.com
Discountdrugcity.com
Discountdrugsale.com
Discountdrugsaver.com
Discounteddrugsaver.com
Discounteddrugsdepot.com
Discounteddrugsofcanada.com
Discountededdrugsofcanada.com
Discounthivdrugs.com
Discountpharmacycenters.com
Discountpharmacydepots.com
Discountpharmacylink.com
Discountwholesaledrugs.com
Discountwholesaleeddrugs.com
Discreetdrugsonline.com
Disposablepottie.com
Doctorbedshop.com
Doctorbledsoe.com
Doctordesignedsite.com
Doctormedsupply.com
Doctorpharmacymeds.com
Doctorprescribesmeds.com
Dontlikedebt.com
Dotallyear.com
Dotgovdirectory.com
Driverseddrug.com
Drugalternativesonline.com
Drugdiscoverydirect.com
Drugeguide.com
Drugfreecelebrities.com
Drugfreecertificatess.com
Drugfreefitness.com
Druggamesonline.com
Drugpackagingonline.com
Drugsbizonline.com
Drugscriponline.com
Drugsfreeworld.com
Drugsonlineus.com
Drugspharmacybizx.com
Drugstoreschool.com
Drugstoreurope.com
Drugtestmyth.com
Dryeyesdirect.com
Dryeyesinfo.com
Dysfunctionsdrug.com
Dysfunctionsdrugs.com
Earthmedicalls.com
Easycanadaeddrugs.com
Easydiethealthy.com
Easydnssite.com
Easygiftguide.com
Easypetmedication.com
Eathealthystayfit.com
Ecstasythedrugsx.com
Edalcoholdrug.com
Edcanadadrugs.com
Edcanadadrugsx.com
Edcanadiandrug.com
Edcarprescription.com
Edcarsprescription.com
Edchenonline.com
Eddiscountdrugsx.com
Eddrugaddiction.com
Eddrugdirect.com
Eddrugguide.com
Eddrugmart.com
Eddrugsbargainx.com
Eddrugsdirectx.com
Eddrugsworld.com
Eddrugsworldx.com
Edhampills.com
Edipharma.com
Ediscountdrug.com
Edkoopworld.com
Edlawtonhealth.com
Edlonghealth.com
Edmedicinesite.com
Edmedsup.com
Edmedsupx.com
Ednethealth.com
Edonlinedrug.com
Edonlinemedicine.com
Edpillsguide.com
Edprescriptiondrugs.com
Edprescriptiondrugsx.com
Edprescriptionguide.com
Edsdrug.com
Edwarmedicine.com
Edwarmeds.com
Edwarmedsx.com
Edwarsite.com
Eightyearolds.com
Electriclothesx.com
Electriclothingx.com
Elevenyearolds.com
Emailaddchange.com
Emergencymedsite.com
Englandpharmacyonlines.com
Englandpharmacyonlinex.com
Englishdiscountpharmacy.com
Englishoutthere.com
Enormousbigx.com
Enormousgiant.com
Epharmacyprescription.com
Erdrugtest.com
Ethniclothes.com
Eubud.com
Euromedareas.com
Everythingattractive.com
Exche.com
Expresscanadianpharmacy.com
Expressdiscountpharmacy.com
Extendedhealthed.com
Externaloff.com
Eyemedicationonline.com
Ezgamex.com
Facilevoile.com
Faggotonline.com
Familymedicalusa.com
Faroutonlinex.com
Fastprescriptiondrug.com
Fdapharmacyprescriptions.com
Fedgovcenter.com
Fedgovguide.com
Feelgoodair.com
Fenme.com
Fieldmeded.com
Findgoodlife.com
Findprescriptiondrugs.com
Firefitkids.com
Firstannum.com
Firstbigagencyx.com
Firstbigmallx.com
Firstlifeonline.com
Fitandhealthylife.com
Fitlinemed.com
Fityethealthy.com
Flche.com
Floridacomreal.com
Floridarealdirect.com
Floridarealweddings.com
Flusgreat.com
Flushotonline.com
Flyclubmeds.com
Flyclubmedx.com
Flyingfaggot.com
Foced.com
Focenligne.com
Focnouveau.com
Focusalens.com
Focusamenus.com
Focusemc.com
Footcarepharmacy.com
Francediscountpharmacys.com
Freeadddirect.com
Freecomputergift.com
Freedrugspharmacy.com
Freehomelife.com
Freehotdirect.com
Freeonlinepharmacyx.com
Freetrademedical.com
Freetrialjoin.com
Freezonemedical.com
Frenchdiscountpharmacy.com
Frontierpharmacyonline.com
Frontlinepharmacy.com
Frontsideonline.com
Gamespotall.com
Gamespotcentral.com
Gamespotheaven.com
Gamespotservers.com
Gamespotshopper.com
Geekybutnice.com
Genemedicalcenter.com
Genericcarepharmacy.com
Genericdrugsflorida.com
Genericeddrugsflorida.com
Georgescheapeddrugs.com
Getbestmedical.com
Getdrugsdirect.com
Getfittechnology.com
Gethealthyabc.com
Gethealthybusiness.com
Gethealthyfitmall.com
Gethealthyhawaii.com
Gethealthynetwork.com
Gethealthyworld.com
Getmedonlinex.com
Getmedpross.com
Getmedproxx.com
Getseahealthy.com
Giftdepotshop.com
Giftsitestores.com
Giftslikehome.com
Glaucomadrugsonline.com
Gobabygift.com
Gomeded.com
Gonetopotsite.com
Goodlifegift.com
Goodnewsfood.com
Goodtimedvd.com
Goodvaluepharmacyonlines.com
Gotanonline.com
Gotaxiworld.com
Gotdomainsite.com
Gotdotgame.com
Gotenworld.com
Gotgamejob.com
Gotgamenow.com
Gotgameusa.com
Gotgasonline.com
Gotheredirect.com
Gotheretours.com
Gotinterland.com
Gotjobssite.com
Gotkeymail.com
Gotlandsguide.com
Gotmarkonline.com
Gotmoonland.com
Gotmoremail.com
Gotmusicdirect.com
Gotourdirect.com
Gotstockworld.com
Govteamsite.com
Greataddurl.com
Greatamericanpharmacy.com
Greatbeautyyes.com
Greatbigbrother.com
Greatbigmag.com
Greatbritainpharmacy.com
Greatbutthole.com
Greatcanadianpharmacy.com
Greatchinamedical.com
Greatdrugrehabx.com
Greatdrugsguide.com
Greatdysfunctionsdrug.com
Greateddrugscanada.com
Greateddrugscanadax.com
Greatfitplanet.com
Greatgiftsyes.com
Greatgoodcharlotte.com
Greatgothere.com
Greathealthyweight.com
Greatmeddirects.com
Greatmeded.com
Greatmedguides.com
Greatmedicalgroup.com
Greatmedicalschool.com
Greatmedicationpain.com
Greatnorthernpharmacy.com
Greatpharmacyonlinex.com
Greatpharmacyschool.com
Greatpharmacyschools.com
Greatpharmacyschoolx.com
Greatpharmacytech.com
Greatpotland.com
Greatwallmount.com
Greatwhiteeddrugs.com
Greenmedtechs.com
Greenmedtechx.com
Groupmachinesx.com
Groupron.com
Growingpotonline.com
Guipromeds.com
Halflifesite.com
Happyable.com
Harrypottie.com
Healcareguide.com
Healinsurancesite.com
Healmen.com
Healta.com
Healthpromeds.com
Healthpromedx.com
Healthyable.com
Healthycareworld.com
Healthychefguide.com
Healthyfitandrich.com
Healthyfitbars.com
Healthyfitbodies.com
Healthyfityoungstore.com
Healthyhomecafe.com
Healthyhomenews.com
Healthyhomestar.com
Healthyhomeway.com
Healthyhomezone.com
Healthykidshow.com
Healthykidsinc.com
Healthylifebook.com
Healthylifecorp.com
Healthyproductguide.com
Healthyproductsite.com
Healthystartsite.com
Healthystudentbody.com
Healthytandirect.com
Healthythirdworld.com
Healthywaterwell.com
Healthyworldmarket.com
Healthyworldmarketplace.com
Healthyworldmed.com
Healthyworldmedical.com
Healum.com
Heartdiseasedrugsonline.com
Heartdiseaseeddrugsonline.com
Hearthealthydoc.com
Herbalhealthydiet.com
Hitallyear.com
Homelifesite.com
Homemedicaldesign.com
Homemedicaltechnology.com
Homesyearround.com
Honeypotvideo.com
Hostrackdnsx.com
Hotcybersite.com
Hotdotworld.com
Hotlotonline.com
Hotohstore.com
Hotspotcommunity.com
Hotspotsnet.com
Hottoysite.com
Hundredsofdrugs.com
Hundredsofdrugsx.com
Hypertensiondrugsonline.com
Ibayside.com
Ihealthychoice.com
Ihealthysite.com
Ilikesite.com
Impotencesdrug.com
Impotencesdrugs.com
Impotencesdrugsx.com
Improvea.com
Improveh.com
Improveinfo.com
Improvelifestyles.com
Improvemom.com
Indiagiftsite.com
Indiamedicalcenter.com
Indianpottry.com
Ineedsomepills.com
Ineedsomepillsx.com
Inexpensiveeddrugsonline.com
Iniceprice.com
Injoinonline.com
Integradedmedicine.com
Intermednets.com
Intermednetx.com
Ipotunity.com
Irauk.com
Irelandpharmacyonlines.com
Irelandpharmacyonlinex.com
Irishdiscountpharmacy.com
Irishlocalgov.com
Ispoh.com
Israelpharmacyonlines.com
Israelpharmacyonlinex.com
Italypharmacyonlinex.com
Itsgoodsite.com
Ivche.com
Ivegotdirect.com
Ivegotheart.com
Ivegothomework.com
Iwantthebestdrugs.com
Iwantthebestdrugsx.com
Jimbobhog.com
Jobfitworld.com
Joblotworldx.com
Joinkidsclub.com
Jointhejoint.com
Joinwebguide.com
Jovoh.com
Joycekitche.com
Justaddbaby.com
Justaddlinux.com
Justaddnet.com
Justaddsales.com
Justaddwap.com
Justaddwax.com
Justgotup.com
Justlikehuman.com
Justlikemum.com
Justlikeproducts.com
Justsmeh.com
Kettlelight.com
Keyallyear.com
Kidsgotherex.com
Kitcheetc.com
Leadingmedication.com
Leadingpharmacyguide.com
Leemedtechs.com
Leemedtechx.com
Lifecarevisa.com
Liferepairguide.com
Likablenice.com
Likehomecare.com
Likenewcarsdirect.com
Likenewhomesonline.com
Likeyourselfguide.com
Lineapothecary.com
Linepharmacyguides.com
Linepharmacyguidex.com
Livemedworlds.com
Loanyesyes.com
Localdiscountpharmacy.com
Localdrugsofcanada.com
Lohproject.com
Lotapronsite.com
Lotcarx.com
Lotlizardonline.com
Lotronusax.com
Lotsixonlinex.com
Lottoriesonlinex.com
Makethenice.com
Malotgroupsells.com
Manlifeworld.com
Manmedcares.com
Marcdiscountdrugs.com
Marcdiscounteddrugs.com
Marijuanacarepharmacy.com
Masmedicinaalternativa.com
Matewg.com
Mcfoc.com
Medbestlay.com
Medbizbest.com
Medcanseeds.com
Medcarecard.com
Medcentertoped.com
Meddirectlinks.com
Meddotprox.com
Meddriversed.com
Meddysfunctions.com
Mededcar.com
Mededcast.com
Mededcore.com
Mededslide.com
Mededstat.com
Mededsupplies.com
Mededsynergy.com
Medengdirects.com
Medengdirectx.com
Medfirstcorp.com
Medfirstvalet.com
Medfirstwellness.com
Medhighested.com
Mediajobfit.com
Medicalcenterblvd.com
Medicalcityonline.com
Medicaldirectusa.com
Medicalglovesonline.com
Medicalgroupdigest.com
Medicalhealthbeauty.com
Medicalhealthconsulting.com
Medicalhealthwatch.com
Medicalknowledgesite.com
Medicalmastersite.com
Medicalmegasite.com
Medicalneedsdirect.com
Medicalneedsnetwork.com
Medicalshareonline.com
Medicalsurgicaldealers.com
Medicationside.com
Medicinadirecto.com
Medicinasitio.com
Medicinatm.com
Medicinesmedication.com
Medimpotences.com
Mediredsummaries.com
Medlabtechs.com
Medlawfirst.com
Medmedsoc.com
Medmeeds.com
Medneds.com
Medonlinetechs.com
Medpaed.com
Medpitstop.com
Medprogear.com
Medproindias.com
Medproindiax.com
Medprojob.com
Medprotopsite.com
Medredworldss.com
Medredworldxx.com
Medsitepluss.com
Medsourcedrug.com
Medsourcedrugs.com
Medsourcedrugsx.com
Medsourceprox.com
Medspatoponline.com
Medspitstop.com
Medstepguides.com
Medstepguidex.com
Medstyleonlines.com
Medstyleonlinex.com
Medtopdysfunctions.com
Medtopeddirect.com
Medtopedguide.com
Medtopedworld.com
Medtopimpotences.com
Medtradeonlines.com
Medtradeonlinex.com
Medusedsystems.com
Medwaydirect.com
Medwayradios.com
Medwayradiox.com
Medwayshops.com
Medwayshopx.com
Medwisemeds.com
Medworldindias.com
Medworldindiax.com
Medworldnets.com
Medworldnetx.com
Meend.com
Megamestore.com
Meltingcontainer.com
Meltingpotsingles.com
Merckdrugguide.com
Mexicopharmacyguide.com
Miamipharmacyschools.com
Miamipharmacystore.com
Millenniumyearsite.com
Misude.com
Mobilepharmacyschool.com
Mobilepharmacyschoolss.com
Mofoc.com
Mrfoc.com
Mshotspot.com
Musicjoinnow.com
Mypharmacydirectx.com
Mysmeh.com
Napharmax.com
Napsterlikesite.com
Nationalpharmacytech.com
Nationoh.com
Naturalhealh.com
Naturesbestpharmacy.com
Naturesdietdrug.com
Nedsmedsx.com
Needsomepills.com
Nefoc.com
Netdrugsdirect.com
Netmedicalschool.com
Newemailadd.com
Newlifegifts.com
Newmedicalonline.com
Newmedsolutionpills.com
Newmedsolutionpillsx.com
Newpharmacyschool.com
Nextbestyear.com
Nicecarsgroup.com
Nicecarssite.com
Nicechatonline.com
Nicedaygift.com
Nicedayuk.com
Nicegoodday.com
Niceguycam.com
Nicejobonline.com
Nicepricedesign.com
Nightexpose.com
Nipponprescriptiondrug.com
Northsidepharmacyonlines.com
Norwaypharmacyonline.com
Nowrealtime.com
Nymeltingpot.com
Oddlotonline.com
Ofbigbearxx.com
Ohiopharmacyschools.com
Onecarepharmacyx.com
Oneyearsite.com
Onlinebargaindrugs.com
Onlinedrugsnorth.com
Onlineherbalpharmacy.com
Onlinemedicalcenters.com
Onlinepharmacyclub.com
Onlinepharmacydot.com
Onlyvipsite.com
Onthenetdrugs.com
Opencorpusa.com
Openeddrugstor.com
Opiumthedrugsx.com
Orderingprescriptiondrug.com
Organizeyourdrugsx.com
Osteoporosisdrugsonline.com
Ourbayside.com
Ourmeded.com
Ourmedicsites.com
Outcallflorida.com
Overthenetdrugs.com
Oxnut.com
Palmgamespot.com
Parkingbunch.com
Parteffect.com
Passpotworld.com
Paylessdrugsonline.com
Pdqlothes.com
Peripherybeach.com
Peterspharmacyonline.com
Petlifeworld.com
Petmedmart.com
Petmednycs.com
Petsvipclub.com
Pharmacyaffiliatesdirect.com
Pharmacydepotonlinex.com
Pharmacydirectinc.com
Pharmacydirectsydney.com
Pharmacydrugdiscountss.com
Pharmacyguideonline.com
Pharmacyjobstoday.com
Pharmacymedicationguides.com
Pharmacynetonline.com
Pharmacy-online-39.com
Pharmacyrxdirect.com
Pharmacysavingsonline.com
Pharmacyskateboardstore.com
Pharmacytechniciantimess.com
Philippinepharmacyonline.com
Pills-and-drugs.com
Placelikeonline.com
Planetachedirecto.com
Planterroast.com
Platinumdrugonline.com
Plazadiscountpharmacys.com
Pocketpottie.com
Popularprescriptiondrug.com
Portugalpharmacyonline.com
Potalworld.com
Potandcontainer.com
Potbuyersguide.com
Potfaceworld.com
Potimportsonline.com
Potlandweed.com
Potpourmore.com
Potroasthost.com
Potroastrentals.com
Potseedsonline.com
Potshoponline.com
Pottiecam.com
Pottiepackage.com
Pottieparty.com
Pottryban.com
Pottrybar.com
Powermedtechs.com
Prednisone-medicine-group.com
Premierfoc.com
Premierpharmacyonline.com
Prescriptionanddrug.com
Prescriptiondrugagent.com
Prescriptiondrugamerica.com
Prescriptiondrugcenter.com
Prescriptiondrugchoice.com
Prescriptiondrugcom.com
Prescriptiondrugdepot.com
Prescriptiondrugfraud.com
Prescriptiondruggroups.com
Prescriptiondruglinks.com
Prescriptiondrugregister.com
Prescriptiondrugremedies.com
Prescriptiondrugreport.com
Prescriptiondrugreview.com
Prescriptiondrugtimes.com
Prescriptiondruguk.com
Prescriptiondrugus.com
Prescriptiondruguses.com
Priceyourdrugs.com
Probusmeds.com
Progamemeds.com
Progamemedx.com
Prolifecoach.com
Promedaids.com
Promedasias.com
Promedasiax.com
Promeddvds.com
Promeddvdx.com
Promeded.com
Promedicalerts.com
Promedinfo.com
Promedrecords.com
Promedrentx.com
Propharmaventures.com
Pukhome.com
Puknation.com
Pukwizard.com
Qualityprescriptiondrug.com
Quickgiftworlds.com
Razasude.com
Realcanadiandrugs.com
Realdrugstor.com
Reallylikable.com
Realmedsitexx.com
Realniceautos.com
Realnicehome.com
Realnicehouse.com
Realnicephotos.com
Realtyrealtime.com
Realworldcases.com
Realworldoffice.com
Redhotman.com
Redhotplay.com
Redhotrave.com
Redsideguide.com
Rehapromedss.com
Reliantmeded.com
Renopharmacyschool.com
Rideautory.com
Ridgetoppharmacy.com
Ringotworld.com
Robusthealthy.com
Robustwell.com
Roundtheyear.com
Royalcanadiandrug.com
Ruraltechcorp.com
Rxpharmacyguide.com
Rxpharmacyworld.com
Sameasbig.com
Sanespharma.com
Seekpotlight.com
Sellbestgifts.com
Sellsideonline.com
Shesgot.com
Shopniceguy.com
Shoppersdrugworld.com
Sidejobdirect.com
Silverslotmachine.com
Since365.com
Sirmedicalsupply.com
Sizzlingsultry.com
Skymedicenters.com
Smartdrugsofcanada.com
Smartmedicalcenter.com
Smehhome.com
Smellssameas.com
Soundcoffee.com
Southsidearts.com
Southsidehelp.com
Spainpharmacyonline.com
Spanishdiscountpharmacy.com
Sportinggooddirect.com
Sportsfaggot.com
Sportsmedresourcex.com
Sqlouterjoin.com
Stanpropharma.com
Starhomemedical.com
Starlikeonline.com
Starmedsitess.com
Starmedsitexx.com
Stategovsites.com
Stocklotcityx.com
Stocklotshop.com
Storeprescriptions.com
Storetechnician.com
Sudemodelhane.com
Sultryair.com
Superaddmore.com
Superbiomed.com
Superbutoden.com
Superchempharmacy.com
Superdrugabusex.com
Superdrugoptical.com
Superdrugrehab.com
Superdrugsonline.com
Supereddrugtreatment.com
Supergoten.com
Superhealthyhome.com
Superhotpages.com
Superlothes.com
Supermeddirects.com
Supermeded.com
Supermedguides.com
Supermedicalcenter.com
Supermedicalgroupx.com
Supermedicalkid.com
Supermedicationlist.com
Supermedicenters.com
Supermedjobs.com
Supermedsupplyxx.com
Supermedworlds.com
Supernetmeds.com
Superpharmacyjobsx.com
Superpharmacyprescription.com
Superpharmacyschool.com
Superpharmacyschoolx.com
Superpharmacytechnician.com
Superpharmacytechnicianx.com
Superpharmacyworlds.com
Superpotball.com
Superpotlotto.com
Superrealtekx.com
Superritedrugs.com
Supersavedrugs.com
Supersavingspharmacy.com
Supersmeh.com
Supersurgical.com
Surfallyear.com
Surfthedrugs.com
Talentgift.com
Tampapharmacyschools.com
Tandemmedicalsupplies.com
Techbaycorp.com
Texaspharmacyjobs.com
Texasrealsite.com
Texasrealwedding.com
Theaddbook.com
Theasiapharmacys.com
Theautumnyear.com
Thebanneryear.com
Thebargainpharmacyx.com
Thebeerflowslikewater.com
Thebestdrugssite.com
Thebestyes.com
Thebetterpharmacyx.com
Thebigalertx.com
Thebigsounds.com
Thebigspasx.com
Thebitterside.com
Thecardlot.com
Thecheapmedx.com
Thecolorbob.com
Thecommunitypharmacy.com
Thedetailspot.com
Thednsprojectx.com
Thedraftyear.com
Thedragonyear.com
Thedrugbusinesss.com
Thedrugden.com
Thedrugonline.com
Thedrugsout.com
Thedrugsoutx.com
Thedrugstop.com
Thedrugsxoutlet.com
Theeclipseside.com
Theeddrug.com
Theeddrugs.com
Theedham.com
Theedonline.com
Theexpotsite.com
Thefatside.com
Thefitdiet.com
Thefitplan.com
Thegoodbite.com
Thegoodherbs.com
Thegoodsalt.com
Thegotboy.com
Thegotdirectory.com
Thegotgroup.com
Thegotideas.com
Thegotland.com
Thegotlandgroup.com
Thegotour.com
Thegovalley.com
Thegovservices.com
Thegreekmed.com
Thegreenpot.com
Theholisticpharmacy.com
Thehotland.com
Thehotrate.com
Theinternationalpharmacys.com
Theirishpharmacy.com
Thejewishpharmacy.com
Theleadingdrug.com
Thelikewho.com
Thelothouse.com
Thelotinfox.com
Thelotkingx.com
Thelotmusicx.com
Themedicalimagex.com
Themedicalmalpractice.com
Themedicalnet.com
Themedicalreference.com
Themillennialyear.com
Themosaicpot.com
Thenicefit.com
Thenicevice.com
Theolderyear.com
Theoutdesk.com
Theoutworlds.com
Thepalmsmed.com
Thepeepot.com
Theperfectpharmacy.com
Thepharmacyclub.com
Thepharmacyjobs.com
Thepharmacykey.com
Thepharmacyline.com
Thepharmacylot.com
Thepharmacymusics.com
Thepharmacytech.com
Thepharmacyworld.com
Thepharmacyzone.com
Thepicturemedics.com
Thepotplant.com
Thepottie.com
Thepotvote.com
Therapidpharmacy.com
Therealmeds.com
Therealpatchwork.com
Therealperformance.com
Therealrally.com
Therealside.com
Therightmed.com
Theshoplot.com
Thesitepot.com
Thesmartpot.com
Thesportsmed.com
Thestonepot.com
Thesweetyear.com
Thethinkpot.com
Thetreelot.com
Thetrophyyear.com
Thevillagesdrugs.com
Thevintageyear.com
Thevipbar.com
Thevipbox.com
Thewantedadd.com
Thewashpot.com
Thewebing.com
Theweburbs.com
Thewellmeds.com
Thewellmedx.com
Thewinmeds.com
Theworldpharmacyguides.com
Theyearanniversary.com
Theyeardot.com
Theyeargroup.com
Theyearround.com
Todosmedicina.com
Topallyear.com
Topapothecary.com
Topedsite.com
Topharmacyguide.com
Toppharmacyworld.com
Toprichvip.com
Totaldrugstor.com
Totaleddrugstor.com
Trucklotonlinex.com
Tvdiscountdrugs.com
Tvlikeadsonline.com
Twinscarepharmacy.com
Twsme.com
Ukdrugsdirect.com
Uklotterry.com
Ukprescriptiondrug.com
Ulcereddrugsonline.com
Ultimatepharmacyguidex.com
Uniteddiscountpharmacy.com
Uniteddrugspharmacy.com
Unitedmedtechs.com
Urbanfaggot.com
Urgentcarepharmacy.com
Usadrugclub.com
Usdrugclub.com
Vailsportsmed.com
Verygoodbar.com
Verygoodlee.com
Veryniceart.com
Verynicebook.com
Verynicefamily.com
Verynicenet.com
Vipboxonline.com
Vipskyclub.com
Vipsupersite.com
Vipworldmarketplace.com
Vipworldnet.com
Virtualbiomeds.com
Virtualdrugsstore.com
Virtualpuk.com
Virtualsmeh.com
Vivadietdrugs.com
Voileken.com
Votrecache.com
Walgreensdrugsstore.com
Walgreenseddrugsstore.com
Walgreenspharmacyonline.com
Wantaddworld.com
Wayoutdirect.com
Webmedicalworld.com
Websfurnituremedic.com
Wecananswer.com
Wecanbank.com
Wecandwell.com
Wedealworld.com
Weersite.com
Weirdbutnice.com
Wellnessclinical.com
Wemedsmedsx.com
Wepaysite.com
Werateonline.com
Westcarepharmacy.com
Wewesite.com
Wewillrisex.com
Whitelinepharmacy.com
Whogotguide.com
Wholeyearonline.com
Wildslotmachines.com
Winbighostingx.com
Winbigredx.com
Wisegiftworld.com
Worldhotworld.com
Worldmedicalworld.com
Worldpharmacyworld.com
Worldpotguide.com
Worldpottry.com
Wwwbestpharmacy.com
Wwwdrugguide.com
Wwwhomepharmacydirects.com
Wwwlivehealthy.com
Wwwmedbeds.com
Wwwmedneeds.com
Wwwpharmacydirectx.com
Wwwpharmacyschools.com
Xmedicalpharmacyx.com
Xsuperpharmacyschool.com
Xvzzbvznhz.com
Yearbargain.com
Yearlyrics.com
Yearroundcpa.com
Yearroundfilms.com
Yearroundfootball.com
Yearroundhit.com
Yearroundhousing.com
Yearroundyards.com
Yearworld.com
Yescarparts.com
Yesworldwatch.com
Yougotsitex.com
Youraddlife.com
Youraddspace.com
Yourbetterh.com
Yourbowl.com
Yourcornerpharmacy.com
Yourdrugist.com
Yourdrugrehab.com
Yourdrugsdelivered.com
Yourdrugsrx.com
Yourdrugstor.com
Youreddrug.com
Youreddrugsdelivered.com
Youreddrugsrx.com
Youremailadd.com
Yourfaggot.com
Yourgoodintentions.com
Yourgotmail.com
Yourguidetodrugs.com
Yourguidetodrugsx.com
Yourhealthydays.com
Yourhealthyhost.com
Yourhealthyonline.com
Yourhealthytime.com
Yourhealthyvision.com
Yourimpotencesdrug.com
Yourkettle.com
Yourlikebig.com
Yourmedbookx.com
Yourmedicalbill.com
Yourmedicalprox.com
Yourmedicationpharmacy.com
Yourmedlinks.com
Yourmedlinkx.com
Yourmedtoped.com
Yourmexicanpharmacy.com
Yourmindoneddrugs.com
Yourmobilemedication.com
Yournameyear.com
Yourpcpharmacy.com
Yourpharmacycentrals.com
Yourpharmacydepot.com
Yourpharmacyschool.com
Yourpharmacytechnician.com
Yourrealtekx.com
Yourrecoveryed.com
Yoursameas.com
Yourseniorvip.com
Yourstarlife.com
Yourxbigdigx.com
Youvegotbooks.com
Youvegotdeals.com
Youvegotdna.com
Youvegotstars.com
Youvegotwork.com
Youvehas.com


CNC Group on 58.20.154.162:

Ableunit.com
Advocacymine.com
Agotradition.com
Airadvocacy.com
Angerthousand.com
Answerwild.com
Appearbegin.com
Appearprocess.com
Appearsteam.com
Appreciationanswer.com
Appreciationgrow.com
Appreciationrange.com
Batlong.com
Bedweather.com
Bellstood.com
Birdmass.com
Bodytall.com
Bothreflection.com
Branchtradition.com
Broughtfarm.com
Busyexpect.com
Buttheir.com
Catchice.com
Catchvary.com
Cellprogress.com
Centeraspiration.com
Characterfood.com
Chordstood.com
Claimcat.com
Climbsuccess.com
Comedefinition.com
Completeblack.com
Continentnumber.com
Cornerrespect.com
Costbread.com
Courageable.com
Couragesmell.com
Coursehear.com
Crossdefinition.com
Crowdkept.com
Crowdresponsibility.com
Dancefew.com
Dependcolor.com
Describecoat.com
Describeend.com
Describesong.com
Determineisland.com
Dictionaryfell.com
Differgreen.com
Dollarrealization.com
Donemorning.com
Doorusual.com
Downyet.com
Easefight.com
Eitherresponsibility.com
Entercharacter.com
Exactgot.com
Figtogether.com
Fillcompassion.com
Findcent.com
Firstnoun.com
Fiveround.com
Footmeat.com
Forgivenessform.com
Forgivenessrest.com
Forgivenesswave.com
Foundallow.com
Generalexample.com
Generalhard.com
Generosityopposite.com
Generositystream.com
Gentlegather.com
Grewat.com
Grewhuman.com
Handdefinition.com
Happinessbroad.com
Happinessduring.com
Happinesssolve.com
Harmonyespecially.com
Harmonyold.com
Hatreflection.com
Heavyright.com
Highoptimism.com
Hillcount.com
Hundredhas.com
Includedivision.com
Includeend.com
Industryvery.com
Ingenuityespecially.com
Instanttire.com
Integritydictionary.com
Integritymountain.com
Ironcourage.com
Lateedge.com
Laughwant.com
Leadnoun.com
Ledfour.com
Legduring.com
Legforgiveness.com
Lengthplease.com
Listlarge.com
Locatewhite.com
Louddiscuss.com
Loveindicate.com
Massrespect.com
Meanpiece.com
Middleprosperity.com
Mileingenuity.com
Milksymbol.com
Mostwent.com
Motionany.com
Muchcharacter.com
Muchpoem.com
Namemotivation.com
Nearcold.com
Nearforgiveness.com
Neighboragree.com
Notewash.com
Occurbottom.com
Ofbetter.com
Officeobject.com
Oldarrive.com
Overdecide.com
Ownresolution.com
Paintcall.com
Pairsure.com
Patternplural.com
Phrasetwo.com
Planhappen.com
Pleasefarm.com
Posehole.com
Positionrequire.com
Pressclock.com
Prosperitybat.com
Prosperityoffice.com
Provelegacy.com
Purposeking.com
Purposesharp.com
Quickleast.com
Railprotect.com
Realizationcover.com
Realizationshall.com
Reciprocitystep.com
Reciprocityweather.com
Replymotivation.com
Respectyear.com
Responsibilityuse.com
Rootappreciation.com
Ropecatch.com
Roundadvocacy.com
Saltcatch.com
Scaleis.com
Scorewit.com
Seathough.com
Seemanger.com
Separateand.com
Settlewould.com
Severallaugh.com
Shapelittle.com
Shapetall.com
Shapethem.com
Sheetmethod.com
Shipsurprise.com
Shorehunt.com
Sincecut.com
Smileopposite.com
Solveneighbor.com
Soonchildren.com
Soresult.com
Specialprosperity.com
Spendfrom.com
Spiritualityfather.com
Spiritualityspeak.com
Spiritualitystep.com
Spreadsuggest.com
Standchance.com
Storyhundred.com
Streamyellow.com
Strengthdictionary.com
Studyrespect.com
Sugarsail.com
Supplyhand.com
Surfacethe.com
Syllablegenerosity.com
Systemyet.com
Takeheld.com
Teachan.com
Thatcommon.com
Theircolor.com
Theirprogress.com
Thesereflection.com
Thirdearly.com
Thosebar.com
Threeoriginal.com
Thusforgiveness.com
Towardfree.com
Traditionmotion.com
Trustgrand.com
Trustmajor.com
Trustreceive.com
Underreflection.com
Userealization.com
Valueverb.com
Voiceold.com
Watchpurpose.com
Waydivide.com
Weekdistant.com
Westwrote.com
Womanabove.com
Womenweather.com
Wrongbread.com
Yardresponsibility.com
Yesbed.com
Younggone.com

ChinaNet on 218.64.218.4:

Borecometin.com
Calitureleit.com
Canadapharmstore.info
Caredilfs.com
Cigarokurok.info


The Planet on 74.53.96.178:

Agenciamb.com
Alvoradaexport.com
Bancariosrioclaro.org
Bocadamatafm.org
Comprapublica.net
Comunidaderochaeterna.com
Cursopalavraescrita.com
Extreme-rssr.com
Fabriciogoncalves.com
Jumpbrazil.com
Marcoscora.com
Radioecologia.com
Redemasterderadio.com
Zabbixbrasil.org

SanCash (Affking) taken down in New Zealand

It was great of the Federal Trade Commission to up an arrest that can be announced at this years eCrime Researchers Summit that I'm attending this week in Atlanta. Right after the afternoon break, a spam researcher from McAfee shared the good news with me: the New Zealand government and the Federal Trade Commission had both taken action againt AffKing / SanCash.

SiL from I Kill SPammers did a column in his blog back on March 3, 2008 called On The Trail of SanCash and Infinity Secure. At the end, he mentions his evidence linking SanCash to GenBucks, Tulip Labs, and Elite Herbal. He mentions that besides SanCash in India, there were representatives located in Christchurch, New Zealand, and issues a warning:

SanCash: your days as a sponsor of illegal spammers are numbered. Spammers in the SanCash Program: we will find you and you will lose everything.

Apparently SiL was right. According the FTC and New Zealand documents, the ring was actually run from Australia and the United States, but had links to ChristChurch. Here's the FTC's intro to the topic from their "Memorandum Supporting Plaintiff's ex parte Motion for a Temporary Restraining Order with Asset Freeze, Other Equitable Relief, and Order to Show Cause Why a Preliminary Injunction Should not Issue":

The FTC asks the Court to take immediate action to shut down an international "spam" enterprise that deceptively markets and sells bogus "male enhancement" pills and "generic" prescription drugs that are falsely claimed to be FDA-approved. Defendants' ongoing deceptive product sales are defrauding consumers out of millions of dollars, and the network of "spammers" that they pay to promote their product is causing considerable harm. Despite taking great efforts to avoid detection, the evidence shows that Australia-based Lance Atkinson and U.S.-based Jody Smith control, and profit from, this operation.

This enterprise -- which operates on the Internet under the name "AffKing" -- is responsible for likely billions of illegal commercial e-mail messages and is one of the largest spam organizations in the world. The FTC has received over three million complaints regarding spam messages connected to this operation. The spam messages sent on behalf of the operation falsify information that would identify the true sender in violation of the federal CAN-SPAM law regulating e-mail marketing. The messages also illegally fail to offer a mechanism by which consumers can opt-out from receiving further email messages.

The FTC had previously placed a permanent injunction ordering Lance Atkinson to cease making false claims about "herbal" products and utilizing illegal spam messages. If the name Lance Thomas Atkinson was familiar, it should! He and his colleague Michael John Anthony Van Essen were charged in the Global Web Promotions Pty Ltd case in 2004, which was called, on April 29, 2004, in this FTC Press Release, "the first criminal action under CAN-SPAM". The FTC had, at that time, received 399,000 email messages that they linked back to Global Web Promotions. Global Web was at that time selling a diet patch and a "Natural Human Growth Hormone" product, which sold at $80 and $74.95 each. Files related to that case may be found Under FTC File No 042-3086, which ended on September 20, 2005 with an order for the pair to pay $2.2 Million dollars. ($490,280 for selling bogus products, and $1,709,982.74 for sending illegal spam).

The current FTC case, FTC File No 072 3085, is against Lance Thomas Atkinson, Inet Ventures Pty Ltd, an Australian proprietary company, Jody Michael Smith, Tango Pay Inc., a Delaware corporation, Click Fusion Inc., a Delaware corporation, and TwoBucks Trading Limited, a Cyprus limited liability company.

The players in the case and their roles, seem to break down like this:

Lance Atkinson, aka "SanCash", sold herbal products and hired spammers to promote them from October 2006 through December 2007. He controlled the website "sancash.com", where his "affiliates" could log in to check their earnings.

The New Zealand Police have many chat logs of Lance talking with his co-conspirators, including one where he recruits Roland Smits to help him run Global Web Promotions. In the chat, Atkinson says "well hopefully it doesn't end in the FTC again."

Other excerpts from the log include Shane telling Lance things like "I have a dude in India who employs 50 people to manually spam people from gmail / hotmail" and "The Russians want to do some serious spamming this weekend".

Just in his ePassporte account, Atkinson received over $1.7 million from the Genbucks account, and transferred over $1.8 Million to others to cover their commissions.

Despite living in Australia, Lance logged in regularly to his "sancash@gmail.com" email address from his home IP.

Things started heating up in December 2007, when an intercepted chat message reveals Shane telling Lance "I had bbc world call my home. i think you need to stop spamming asap."

The Archive.org Wayback machine has archives of sancash from June 29, 2007 to December 11, 2007.

After that time period, Lance partnered with his new US buddy, Jody Smith, to form "affking.com", which replaced the sancash site. Affiliates were paid for their spam services on behalf of "King Replica" and "VPXL" male enhancement pills, as well as "Target Pharmacy" and "Canadian Healthcare".

Revenues for the new operation exceeded $500,000 per month only in payments from Visa. MasterCard charges would presumably make the payment even higher.

Tango Pay received $3.3 Million between September 2007 and May 2008.

Jody Smith ran Tango Pay and Click Fusion operations, using the fake names "Gerald Causey" and "Nicholas Santos"

In addition to the FTC charges, Lance and Shane Atkinson and Roland Smits, are being fined $200,000 by the New Zealanders. More details from New Zealand can be found in this Scoop Politics article.

Chat logs obtained by the New Zealand police reveal that Lance's brother Shane contorlled the company Genbucks.

This weekend, we'll examine our UAB Spam Data Mine to see what types of volumes we may have been dealing with, and some of the domains that were used in the scam.

Need help with your debt? Ask the Panamanian Russians for help!

Has the current economic crisis caused you personal debt problems? As a cybercrime researcher I'd like to make one recommendation. If you need help with your debt, please DO NOT turn to Russian spammers who use Chinese domain name registrars to create domains they claim to host in Panama.

Today I decided to choose one of the more prevalent spam campaigns and see what was behind it. For some time now we've been seeing a spam campaign that has random words forming the Subject line, one of which will be "debt" or "credit", such as:

reducing debt
science of debt elimination
secured debt consolidation
south carolina debt consolidation
student debt consolidation
student loan debt
student loan debt consolidation
tax debt
tenant debt consolidation
the best way to get out of debt
third world debt
tips on how to get out of debt
tips to get out of debt
to get out of debt

There are three main variations of this spam currently. The first has messages that look like this, and point to a real domain name:

---

Its time to completely eradicate your debts!

ELIMINATE your carddebts and ALL other unsecured debts

Visit www.kneeddawpresent.com

* NO more payments to creditors
* YOUR long term credit will NOT be affected.
* NO confrontation's

Visit www.kneeddawpresent.com


* 10K minimum combined debts required for eligibility.
* US residents only.

---

This family, which I call the "Visit group", is currently spamming these websites, some of which have to be typed, because the criminal has placed [DOT] in the website name, such as www.bdstfirstcredit[DOT]com.

www.bastfirstcredit.com - 220.248.185.10 - ONLINENIC
www.bbstfirstcredit.com - 220.248.185.10 - ONLINENIC
www.bcstfirstcredit.com - 220.248.185.10 - ONLINENIC
www.bdstfirstcredit.com - 220.248.185.10 - ONLINENIC
www.bfstfirstcredit.com - 220.248.185.10 - ONLINENIC
www.expatpenpresent.com - 200.63.43.3 - XIN NET
www.gustyekeliving.com - 200.63.43.3 - 35 Technology Co., Ltd
www.kneeddawpresent.com - 200.63.43.3 - HICHINA ZHICHENG TECHNOLOGY
www.scotsoffserious.com - 200.63.43.3 - HICHINA ZHICHENG TECHNOLOGY
www.smokyoleclean.com - 200.63.43.3 - XIN NET
www.stonezitequal.com - 200.63.43.3 - XIN NET
www.tonesprogreat.com - 200.63.43.3 - HICHINA ZHICHENG TECHNOLOGY
www.vineswarloose.com - 220.248.185.10 - XIN NET
www.wipedeonearly.com - 200.63.43.3 - XIN NET
www.zestfirstcredit.com - 220.248.185.10 - ONLINENIC

So, this group of domains, all linked by common spam bodies, uses four different ICANN Registrars, but only one DNS server pair (NS1.WELDNS.COM / NS2.WELDNS.COM) and only two hosting IP addresses. 200.63.43.3 is hosted on Panamaserver.com and 220.248.185.10 is hosted in China on a network that is listed as "Changde-cdcnczxjdia".

Those registered on ONLINENIC and hosting in Changde, Hunan province of China, are registered to the name Shestakov Yuriy, who uses the email address alexvasiliev1987@cocainmail.com and the phone number +7.9218839910

Those registered on XIN NET and hosting on Panamaserver.com were registered by FANJIE in fujiansheng, china with an email of li_xiang253@tom.com.

Those registered on HICHINA and hosting on Panamaserver were registered by HANXIAOWEN with the email 2514862@qq.com - but they still use the DNS "NS1.WELDNS.COM" which is also used by the XIN NET and the ONLINENIC domain names!

That's the "Visit Group".

The second group is the "LiveFileStore.com" group. These emails all contain a spam body that looks like this:

---

Clear all your Debt. Save $1000s.Free Debt Analysis. No obligation.

http://tfe7ta.bay.livefilestore.com/y1pFg8blopfnoudOpHPXbKKZztaQP5QODFIxxBDAuUB0xO_hdJoJ33CGzn6hEFg8itiAyBpm7oDoSs

---

With many different "line one" texts, such as:

Prompt Debt Collection Services We are professional, Contract Now!
Get debt relief & start fresh!Helped thousands of clients
Get rid of credit card debtStop garnishments and calls
We sell debt portfolios and workwith new buyers daily
Eliminate Your Debt!Credit Cards, Medical Bills, Loans.

etc. etc.

The URLs point to a page on LiveFileStore.com which does an "autoforward" to another domain. All of them I reviewed today forwarded to this location:

http://platydeyember.com/

So, let's see what that domain is all about:

Registered on XIN NET TECHNOLOGY, this domain was registered to WANGQIHOW using the email "limian_changshi@sina.cn". Its hosted on the IP address 200.63.43.3, Panamaserver.com.

We're actually receiving many "non-debt" spams that use the LiveFileStore.com auto-forwarding trick. Some other examples would be,

Online Casinos, such as pages forwarding to:
http://zombileimound.com/
which was registered on XIN NET TECHNOLOGY and is hosted on PanamaServer.com on the IP address 200.63.43.3, and was registered by limian_changshi@sina.cn.

King Replica watch spam, such as pages forwarding to:
http://lookmyal.com/
which is unrelated to the others, and uses javascript obfuscation to hide its redirection point.


The third group of "debt spam" are the ones using advertisements on "live.com". This group uses spam that points to a "spaces.live.com" url, which contains an advertisement such as this one:



Clicking on these visual ads takes us to domains such as "windstensafe.com", which was registered on XIN NET TECHNOLOGY, is hosted on 200.63.43.3 on PanamaServer.com, and is regsitered to "li_xiang253@tom.com", using the DNS servers NS1.WELDNS.COM and NS2.WELDNS.COM.

Research into PanamaServer.com shows that they are hosting a wide assortment of criminal domains. Qualified researchers are welcome to request a list of more than 2700 domain names hosted there, including many domains registered by Russian named individuals, and using Nameservers ending in ".ru".

I'll let you know if PanamaServer gives me any answer to my queries about these domains:


abuse@panamaserver.com
El cangrejo, 49
Panama
+507 263.3723