The MalwareLab Blog
Пришёл, увидел, и поблоговал
Friday, August 24, 2012
Pharma is Dead. Long Live Pharma.
He doesn't have an office. He doesn't make house calls. He doesn't take insurance. But he's always open for business.
Dr. Bucks (DRBUCKS.COM) is your friendly neighborhood doctor who offers in excess of 3,000 different types of prescription
medication...illegally of course. The affiliate program's big sellers are boner pills -- Cialis and Viagra.
The Dr. Bucks affiliate
program is advertised, among other places, on everyone's favorite forum: GOFUCKBIZ.COM. In the advertisement posted by the user DrBucks for an affiliate program of the same name, participants
are promised a commission of 40-50%, depending on the quantity of sales they
generate -- the doctor is a giver.
In order to gain access to
the prestigious Dr. Bucks School of Medicine, any interested party must contact one of the lovely Dr. Bucks enrollment agents via ICQ 532938 and 532939 (or drbucks.support.1@jabber.no, drbucks.support.2@jabber.no), who, in turn, evaluate whether or not the candidate would
contribute sufficiently to boner pill sales. The evaluation questions the individual's techniques and success
rates with any previous experience in the “industry.” Passing the evaluation will earn an
invitation code, a username, and, of course, the address of the affiliate
homepage:
The program allows
affiliates to build websites from scratch, select products to sell, adjust pricing,
etc. Hosting and domain registration services are readily available, and payment
processing (for Visa, MasterCard, American Express, et al.) is provided.
All affiliate doctors can use the following child name
servers for their websites:
94.102.55.100
173.192.194.78
If a given registrar does
not allow the use of child name servers, members can use the following domains:
NS1.DNS-SERVICE.BIZ (173.192.194.78)
NS2.DNS-SERVICE.BIZ (94.102.55.100)
NS3.NS-HOSTING.ORG
NS4.NS-HOSTING.ORG (94.102.55.100)
Looky here at all these other name servers resolving to
the IP’s 173.192.194.78 and 94.102.55.100 – my exceptional powers of deduction lead me to believe that they may be associated with Dr. Bucks:
NS2.ONLINE-MEDICINE.ME
NS1.NS-HOSTING.ORG
NS3.NS-HOSTING.ORG
NS1.HEALTHNHARMONY.ORG
NS1.HEALTHNSAFETY.ORG
NS2.MY-HEALTH-24.COM
NS2.NORTH-WEST-PHARMACY-CANADA.COM
NS1.CANADA-PHARMACY-LTD.COM
NS2.CANADIAN-PHARMACY-LTD.COM
NS2.ABCMEDLINE.COM
NS1.EURO-MED-ONLINE.COM
NS1.DRUGS-STORE-ONLINE.COM
NS2.PHARMACY--STORE.COM
NS1.EURO-MED-STORE.COM
NS2.WESTDRUGSTORE.COM
NS2.IPHARMACYSTORE.COM
NS1.CARD-BILLING.COM
NS1.PHARMA-24H.COM
NS3.PHARMA-24H.COM
NS2.CANADAMED-24H.COM
NS2.PH-24H.COM
NS1.CANADA-PHARMACY-24H.COM
NS1.CANADIAN-PHARMACY-24H.COM
NS1.CANADAPHARMACY24H.COM
NS2.DO-NOT-GET-SICK.COM
Members who do not want to
build and maintain independent infrastructure have the option to generate
income by simply directing paying customers to main websites maintained by Dr.
Bucks itself:
CANADA-PHARMACY-24H.COM
CANADAPHARMACY24H.COM
DRUGS-MEDSHOP.COM
DRUGS-STORE-ONLINE.COM
EURO-MED-ONLINE.COM
EURO-MED-STORE.COM
Below is a screenshot of a
main Dr. Bucks website, CANADA-PHARMACY-24H.COM, pushing the “Online Pharmacy”
brand:
No rogue pharmacy is complete without a help desk! Attendants are standing by:
US: +1-760-284-3222
EU: +4420-3286-3820
All participating members
– both those operating independent websites or directing traffic to the main
group – use the same payment processing services: CARD-BILLING.COM. Can you say Panama? Yes, yes I can: Panama.
CARD-BILLING.COM NS 94.102.55.100
CARD-BILLING.COM NS 173.192.194.78
CARD-BILLING.COM A 200.35.145.116
NetRange: 200.0.0.0 - 200.255.255.255
CIDR: 200.0.0.0/8
OriginAS:
NetName: LACNIC-200
NetHandle: NET-200-0-0-0-1
Parent:
NetType: Allocated to LACNIC
Comment: This IP address range is under LACNIC responsibility for further
Comment: allocations to users in LACNIC region.
Comment: Please see http://www.lacnic.net/ for further details, or check the
Comment: WHOIS server located at http://whois.lacnic.net
RegDate: 2002-07-27
Updated: 2010-07-21
Ref: http://whois.arin.net/rest/net/NET-200-0-0-0-1
Note that this payment processing service accepts the following currencies: USD, EUR, AUD, CAD and GBP. And check it out! I got 2 extra 100 MG Viagra pills free with my order...not that I need them .__.
Subscribe to:
Posts (Atom)




