Wednesday, October 28, 2009

Google Feedproxy Abuse

Well, just as the Yahoo Groups Spam becomes less overwhelming, along comes a new abuse: feedproxy.google.com URLs that redirect to the following Canadian Pharmacy domains:

pharmsstockmeant.com
caringbread.com

As InboxRevenge.com members know well, "Canadian Pharmacy" (CPh) is a scam.

The site has nothing to do with Canada. The phone number they list, +1(650)452-6975, has a Texas area code but is a voice-over-internet number which connects to an overseas operator -- if it gets answered at all. The address listed on their sites belongs to a legitimate Canadian pharmacists' organization that denies any relationship to CPh. Why doesn't that organization make them stop? Because CPh sites are part of an affiliate program run by criminals in Russia, out of reach of Canadian or US law enforcement.

The pills they sell are counterfeit generic versions of drugs that aren't legally available in generic version. A drug can't be sold generically until its patent has expired -- but again, they're out of reach of law enforcement.

CPh markets them like some late night infomercial for Ginzu Knives, throwing in free tabs of their counterfeit "Viagra" with every order -- even when that would be a potentially fatal combination. So either people are dying or the drugs are completely fake. Clearly no pharmacist has had any input into the operation, either way. And they're out of reach of law enforcement

It's extremely stupid to give the operators of CPh your name, address, phone number, and/or credit card number. It's extremely stupid to wait however long they tell you to wait for delivery, allowing the time limit to file a complaint with your credit card company to expire. And it's even more stupid to swallow pills of unknown makeup from an unknown country made under unknown conditions of sanitation, should anything actually show up in your mailbox.

That, and the fact that smuggling drugs is a federal crime. And you're not out of reach of law enforcement.

There's more information on the spamwiki:
http://spamtrackers.eu/wiki/index.php/Canadian_Pharmacy

4 comments:

  1. As you have stated: "As InboxRevenge.com members know well, "Canadian Pharmacy" (CPh) is a scam". It uses a phone number of +1(650)452-6975.

    Worst still this company has been stealing email addresses from my companies (Cronkite Realty)and from (Maine Aquarium) to pose as legitimate companies to promote its purported pharmaceutical products (email addresses from your company may be next).

    If you check some of their links you will find they link to: http://sayserene.ru .

    Cronkite Realty is a legitimate, respectable real estate company and Maine Aquarium is working hard to develop a public aquarium to promote an awareness of aquatic animal life and neither of these companies can afford the theft and misuse of their good names.

    If you find you have received an email with an email address having "cronkiterealty" or "maineaquarium" in its email address and it is attempting to sell anything other than "real estate" or the "educational and cultural" benefits of a public aquarium (respectively) and instead is attempting to sell you pharmaceutical products, etc., etc., than "delete" it because it is a scam.

    I hope this forum has the ability to get my message out because there is no possible way I am able to notify all the people around the world who have received emails from this apparently, and highly likely, illegitimate company.
    Respectively,
    R.C.

    ReplyDelete
  2. Thanks for helping make our point. These are not victimless crimes. Since these websites are illegal, they aren't going to use their real email address in the "from" field. They don't want you to be able to know their real identity, and they don't want spam filters to be able to block them by blocking everything from their address. Anyone who knows anything about spam reporting quickly learns to ignore what is in the "from" field, but occasionally an irate newbie sends an abusive email to an innocent party whose email address was used that way.

    There are actually two ways your email address could be used. They really may have used it as the "from" for every email address in a big spam run. If so, you will know it because you will suddenly get a lot of "backscatter." That's misaddressed spam that is bounced back to you because the receiving email system was misconfigured. That won't happen very often, because if they used the same address in the "from" fiels, spam filters would start to recognize the pattern. It's a case of them just randomly choosing an email address and it randomly being yours.

    But you say they are using *two* of your addresses. That's not random. It's probably the more common situation where they are putting the same email address in the "from" and "to" of every email they send. That's because a person's own email address is usually whitelisted by his spam filters. So you get spam that appears to come from your own address, but everyone else is getting spam that appears to come from his or her own address, not yours.

    There's more information in the SpamWiki:
    http://spamtrackers.eu/wiki/index.php/Your_own_email_address_in_the_"from"_field_of_spam

    I also invite you to register on our forum
    http://ksforum.inboxrevenge.com/
    where there are lots of people who will help you learn how to take action against these criminals.

    ReplyDelete
  3. http://bestpillfinest.com/

    How do you get this scam website to be banned. This fraudester floods us with emails!!!

    ReplyDelete
  4. Hi, K,

    We invite you to register on the forums at inboxrevenge.com.

    The domain bestpillfinest.com is registered with the Turkish registrar Alantron.com. There is a discussion thread in the registered members section of IBR regarding the responses they have given to various members' reports. Alantron has so far refused to shut down criminal websites, even though their registration agreement gives them the right to do so at their discretion:
    http://bit.ly/azPMdR

    Recently, the registrar accrediting body, ICANN, has declared them in breach of their registrar accreditation agreement:
    http://bit.ly/ceKy4p

    You probably want to read the entire discussion thread at IBR to determine how you want to go about reporting the spam you are getting.

    ReplyDelete