SPAM Email - Fake Pharmacies
*** Many URL links have been removed for your protection ***
Part of stopping SPAM is to understand how it works. These are two email messages that I have received this week.
This looks simple enough, it is simple SPAM that somehow managed to get through my SPAM filters.
If you look at this screengrab you can see that they added a ton of text that you can’t see or is hard to see.
This allows it to help sneak past the “dirty” word filters of most anti-SPAM scanners
Here is the body of the email to help illustrate how they did this:
On television, understanding sear very snaky, in front of olympic detainee. Between cellular, opposite graphical?
Ĉ L I C K H E R E
Before trifle encomium shall ricochet, at earth.
As you can see, they beat the SPAM scanner, by stuffing words at the start and end, and then in the middle, it is all formatted HTML so it can display the human-readable words, but to the scanner, it is all HTML, sneaky bastards.
If you were to click on the links in the email, it would take you to a website claiming to be Canadian Health & Care Mall a subsidiary of Canadian Health&Care Mall LTD.
Canadian Health&Care Mall LTD is a fake online pharmacy dispensing and selling a large variety of generic and non-prescription medication. With low, appealing prices and two reliable shipping methods, you’d think you’ll never need another online pharmacy. Canadian Health&Care Mall LTD is operating under the EvaPharmacy / Bunker.biz affiliate programs, which are part of the Pharmacy Express (dba Yambo Financials and now believed to be operating as Rx-Partners) all part of a huge rogue pharmacy affiliate marketing universe. Yambo Financials started around 2009 (and is believed to be linked directly to Alex Polyakov) and it is reported to have over 2,000 websites all selling rogue pharmaceuticals. Since 2009, it has become more difficult to track these organizations, due to things like Domain Name privacy/proxy and Cryptocurrency.
The fake/rouge online pharmacy is a huge business (in 2009 they sold an estimated $11 billion in counterfeit drugs). In 2011, Google lost $500 million in AdWord sales due to rogue online pharmacies. (source)The main selling points are that the prices are far less expensive than a regular pharmacy and most do not require a prescription. Legitimate pharmacies in the US and Canada will always (by law) require a prescription.
Buying prescription medicine from fraudulent online pharmacies can be dangerous, or even deadly. At best, counterfeit medicines are fakes of approved drugs and should be considered unsafe and ineffective. These medicines may be less effective or have unexpected side effects.
The first scenario is a counterfeit drug that contains no active ingredient or no harmful ingredients. In the case of a counterfeit drug that has no active ingredient, the drug fails to help the patient get better, which can ultimately harm the patient. In the case of antibiotics, for example, this can promote antibiotic resistance and the use of stronger antibiotics, because physicians would believe that the first-line drug was not working, not knowing that the patient had been taking a counterfeit drug.
A second scenario is that the counterfeit drug has no active ingredient and may have any number of harmful ingredients, including bacteria-laced water, toxic yellow paint, floor wax, colored dye, powdered cement, boric acid, and antifreeze. More than 500 children around the world died from counterfeit cough syrup that was tainted with ethylene glycol (i.e., antifreeze). In another case, counterfeit inhalers for the treatment of pediatric cystic fibrosis were found to contain contaminated bacteria that went directly into the lungs of unsuspecting children. Another case involved patients with cancer who used erythropoietin, in which the counterfeit intravenous drug was diluted with bacterially contaminated water and injected directly into the patients.
Another scenario is that of a wrong drug used by the counterfeit agent. Counterfeit versions of GlaxoSmithKline’s over-the-counter weight-loss medication orlistat (Alli) have been distributed in the United States. The counterfeit contained the controlled substance sibutramine instead of orlistat. The FDA reported that this counterfeit version could be dangerous for certain patient populations who unknowingly take it, and could potentially produce harmful interactions with other medications that patients may be taking.
One other scenario involves a counterfeit drug that contains the wrong concentration or wrong dose of the drug. One example of this is the case of a physician who was supplied with a research version of onabotulinumtoxinA (Botox) that was much more concentrated than the real medicine and is not intended for human use. This resulted in respiratory paralysis and near death for several patients, including the physician who was using it himself. In general, counterfeit drugs create uncertainty, confusion, and doubts about the value of the real drug and may lead to the use of alternative, less desirable drugs or therapies. (source)
In addition to health risks, most fraudulent online pharmacies may put your personal and financial information at risk. Some intentionally misuse the information you provide. These sites may infect your computer with viruses, and they may sell your information to other illegal websites and Internet scams. (source)
What are some of the warning signs of a fake online pharmacy?
Avoid online pharmacies that:
- Allow you to buy drugs without a prescription or by completing an online questionnaire
- Offer discounts or cheap prices that seem too good to be true
- Send unsolicited emails or other spam offering cheap medicine
- Ship prescription drugs worldwide
- State that the drugs will be shipped from a foreign country
- Are located outside of the United States
- Are not licensed by a state board of pharmacy in the United States (or equivalent state health authority)
What are some tips to identify safe online pharmacies?
To identify a safe online pharmacy, make sure that the online pharmacy:
- Requires a valid prescription
- Provides a physical address in the United States
- Is licensed by the state board of pharmacy in your state and the state where the pharmacy is operating
- Has a state-licensed pharmacist to answer your question
Now back to Canadian Health&Care Mall LTD, the entire company is a fraud, everything they do is fake and shouldn’t be trusted. Now, I’m not slamming them because I ordered from them before and they didn’t deliver, I’m writing this based on all the evidence I have found.
I’m going to go a little out of sequence in order to try to organize things, but I started with the URL in the email and discovered a company name, address, and phone number. Using Google, I was able to discover other businesses that had the same name address, or phone number.
It all starts with the umbrella of Canadian Health&Care Mall LTD
Canadian Health&Care Mall
Canadian Health&Care Mall LTD seems to operate several different versions of the same website.
Canadian Health Care Mall Official Website Since 2001
SSL Issuer: Sectigo Limited SSL
Domain name register – Registrar URL: http://www.webnames.ru (Registered in Russia 10/2014)
The IP address of the server hosting website: 37.1.210.100 (IP Block belongs to CLOUD-NETWORK-US) – also hosts – mojohead.org
https://nalanipenelope.ru/ – (the one that I received email from)
SSL Issuer: Let’s Encrypt Free SSL
Domain name register – R1 Registrar 1 (https://www.r01.ru/) Which means the domain name was registered in Russia on 6/2021
The IP address of the server hosting website: 103.139.42.59 (IP Block belongs to Nguyen Ngoc Thanh Trading Limited Company) – hosts 6,034 other domains
- amibabbvale.ru DNS Error
- angelinesteffi.ru (MyCanadianPharmacy)
- breenalanny.ru (Canadian Health&Care Mall)
- xn--d1ahnwdwto1b.xn--p1ai (MyCanadianPharmacy)
- xn--i1agserk4d.xn--p1ai (CanadianPharmacy)
- xn--90ae7ae6a5agx.xn--p1ai (MyCanadianPharmacy)
- rhettacarolynn.ru (MyCanadianPharmacy)
- thehotmarket.su (Canadian Health&Care Mall)
For the sake of this post, I randomly select eight entries out of the 6,034 to ensure that they are all Pharmacy related.
IP address of server hosting website (secondary): 185.227.136.205 (IP Block belongs to DigiTurunc) – hosts 19 domains (including nalanipenelope.ru)
- onlinerxelement.su (Canadian Health&Care Mall)
- rhettacarolynn.ru (MyCanadianPharmacy)
- safepharmvalue.su (Canadian Health&Care Mall)
- smartbestbargain.com (CanadianPharmacy)
- smartbestbargain.su (CanadianPharmacy)
- smartnaturalinc.su (CanadianPharmacy)
- smarttabletshop.su (Canadian Health&Care Mall)
- stormibeverie.com (Canadian Health&Care Mall)
- theprivateinc.su (Canadian Health&Care Mall)
- xn--90aa7ajbc3cakr.xn--p1ai (CanadianPharmacy)
- xn--90am9bzam.xn--p1ai (MyCanadianPharmacy)
- xn--c1aclir8g.xn--p1ai (Canadian Health&Care Mall)
- xn--e1aeca3gwa.xn--p1ai (CanadianPharmacy)
- xn--f1afb6ad2a.xn--p1ai (CanadianPharmacy)
- xn--g1acby3c.xn--p1ai (Canadian Health&Care Mall)
- xn--o1ahbjfy.xn--p1ai (Canadian Health&Care Mall)
- yourgenericeshop.su 404 Error
- yourherbalgroup.su (Canadian Health&Care Mall)
But really, none of the IP information matters, as it has been proven that, Yambo Financials / RX-Partners never pay for a server, instead they host their sites on other people’s services. They do this by first identifying unsecured servers and hijacking them with Trojan horses. A clever system of switching sites and servers helps hide their tracks. However, it does help to confirm the brands that they sell under:
- CanadianPharmacy (https://mycanadastore.com/)
- AWCCanadianPharmacy (https://awccanadianpharmacy.org/)
- World Pharmacy Store
- My Canadian Pharmacy (https://my-canadianpharmacy.com/)
- Canadian Neighbor Pharmacy (RxCanadaPharmacy.com)
- Canadian Family Pharmacy
- Toronto Drugstore
- Online Pharmacy
- RxExpressOnline
- RxMedications
- Men’s Health
- Trust Pharmacy (https://trust-pharmacy.world/)
- Max Healthcare (https://max-healthcarerx.com/)
- Secure Tabs (https://securetabs.live/)
Location and Phone
Now let’s look at all the addresses that Canadian Health&Care Mall LTD uses or has used.
- Main Office: 2425 Matheson Blvd E, Mississauga, ON, L4W 5K4, Canada
- This is the address of the Toronto Airport Corporate Centre is a 16-story office building that looks like most of it is rent by the hour/day/week/month spaces (Virtual Office Space), offered by Regus
- A virtual office is just a mailbox to use at that address
- Address search reveals dozens of companies using this address as their office space (all legitimate companies)
- The Allemano Group Ltd
- Marriott Hotels of Canada Ltd
- Ericsson Canada
- MG Renewable Energy
- To name a few, a more comprehensive list is https://opengovca.com/corporation?q=2425+Matheson+Blvd.+East
2. The USA Branch Office: 5501 Lyndon B Johnson Fwy, Dallas, TX, 75240, USA
- This is the address of The Crossings II office building an 8-story office building which looks like it is owned by Holliday Fenoglio Fowler, LP (“HFF”) and HFF Securities LP (“HFFS”) are owned by HFF, Inc.
- Address search reveals dozens of companies using this address as their office space (all legitimate companies)
- Dynamex
- Wingstop Restaurants
- GO Federal Credit Union
- Pinnacle Technical Resources
- Milestone Management
- To name a few, a more comprehensive list is https://opengovca.com/corporation?q=5501+Lyndon+B+Johnson+Fwy%2C+Dallas%2C+TX
3. Warehouses: Level 12, Tower C, Building 8, DLF Cyber City Complex, DLF City Phase II, Gurgaon, 122002, India
- This is the address of the building in the Cyber City Complex, which looks like most of it is rent by the hour/day/week/month spaces (Virtual Office Space), offered by Regus
- A virtual office is just a mailbox to use at that address
4. Address used prior to 2018: 343 Preston Street, Ottawa, ON K1S 1N4 Canada
- This is the address of Adobe Tower II, which is an 11 story office building that looks like most of it is rent by the hour/day/week/month spaces (Virtual Office Space), offered by Regus
- A virtual office is just a mailbox to use at that address
- Address search reveals dozens of companies using this address as their office space
- Adobe Systems Canada Inc.
- Apex Skating
- LiquidSpace
- Community Grass Treatment Canada
5. 913 Montreal Road, Ottawa, ON
- This address does not exist
6. 1822 Boulvar Dr., Montreal, RC B4U 5U2, Canada
- This address seems to be the operations for CanadianPharmacy according to Google Maps or Bings
- This postal code does not exist according to http://www.zip-codes.com/canadian/city.asp?city=MONTREAL&province=QC
- Being used by the following domains (this is not a complete list)
- CanadianRxMedsOnline.com
- MyHealthMedcare.com
- ProMedPills.com
- Mymedicstar.com
- HerbalHerbSmart.ru
- MedsOffers.net
- RXMedsscanada.com
- Canadian-online-pharm.net
- canadianpharm.org
- meds-store-24h.com
- canadianpharmacy.ru
Alright, let’s look at the phone numbers used by Canadian Health&Care Mall LTD
(864) 610-3116
(Landline Travelers Rest / Greenville South Carolina US) – David Harvell (likely an unknowing victim or incorrect data in the database)
A quick Google of this number shows that it is associated with dozens of online pharmacies including:
- Canadian-FamilyPharmacy.com (Canadian Family Pharmacy) (https://drugstorereviews.com/canadian-familypharmacy-com-reviews/)
- MyCanadaStore.com (CanadianPharmacy) – 1822 Boulvar Dr., Montreal, RC B4U 5U2, Canada (https://scam-or-legit.com/mycanadastore-com-reviews/)
- 1-864-610-3116.com (World Pharmacy Store) – Reported offline starting in August 2020 (http://canadianmedssupport.com/?lang=en)
- Pillstoronto.net (Canadian Health&Care Mall) – 2425 Matheson Blvd E, Mississauga, ON, L4W 5K4, Canada (https://rxadviser.net/reviews/pillstoronto-net-reviews/)
- ProMedPills.com (CanadianPharmacy) – 1822 Boulvar Dr., Montreal, RC B4U 5U2, Canada (https://pharmareviewer.com/promedpills-com-reviews/)
- RxCanadaPharmacy.com (Canadian Neighbor Pharmacy) – 4170 Still Creek Dr, Burnaby, BC V5C 6C6, Canada (https://pharmacyreviews.press/rxcanadapharmacy-com-reviews/) **************************
- HerbalHerbSmart.ru (CanadianPharmacy) – 1822 Boulvar Dr., Montreal, RC B4U 5U2, Canada (https://scam-or-legit.com/herbalherbsmart-ru-reviews/)
- Myhealthmeds.net (CanadianPharmacy) – 1822 Boulvar Dr., Montreal, RC B4U 5U2, Canada
- Just to name a few – there are many more
(289) 724-1850
A quick Google of this number shows that it is associated with dozens of online pharmacies including:
- ProMedPills.com (CanadianPharmacy) – 1822 Boulvar Dr., Montreal, RC B4U 5U2, Canada
- Canadian-FamilyPharmacy.com website is offline
- MyMedicStar.com (CanadianPharmacy) – 1822 Boulvar Dr., Montreal, RC B4U 5U2, Canada (https://scam-or-legit.com/mymedicstar-com-reviews/)
- ProMedPills.com (CanadianPharmacy) – 1822 Boulvar Dr., Montreal, RC B4U 5U2, Canada (https://pharmareviewer.com/promedpills-com-reviews/)
- Just to name a few – there are many more
Fake Testimonials
This is the very first testimonial on one of the websites. I took this testimonial to work with
I am grateful to the creators of this amazing medicine as it ridded me of many problems in my personal life. I was simply unable to have normal sexual relationship with women. When I started using this drug my potency improved noticeably. If it were not for Viagra, my personal life would be broken. But now I have a steady girlfriend and she is proud of the sex we have. Actually, she doesn’t know about the problems I had before. Viagra is my little but powerful secret
Viagra — A. J. Morrison, 28 LA
Took the first part of the first sentence and started Googling
“I am grateful to the creators of this amazing medicine as it ridded me of many problems in my”
I also took the first part of this testimonial:
“Viagra Professional is claimed to be extra-strong but I thought it was nothing more than a usual advertising technique.”
This uncovered a ton more fake websites all using the exact same testimonial
CanadianPharmacy
- Address: 1822 Boulvar Drive, Montreal, RC B4U 5U2, Canada
- Phone: (864) 610-3116
- URL: medsoffers.net
- URL: canadianpharmacy.su
SecureTabs Ltd
- Address: N/A
- Phone: (718) 487-9792
- URL: Securetabs.live
- URL: PharmacyMall-Online.com (offline)
- URL: CheapestPriceGenerics.com (offline)
- URL: PharmacyMall.com (offline)
- URL: Canadian-Generics.com (offline)
AWCCanadianPharmacy
- Address: 1822 Boulvar Drive, Montreal, RC B4U 5U2, Canada
- Phone: (864) 610-3116
- URL: awccanadianpharmacy.org
Pain Relief Pharmaceuticals
- Address: 1465 E. William Street, Carson City, NV 89701 (Walgreen’s Pharmacy)
- Phone: (775) 244-5328 (Manta) (owned by Ben Gargo)
- URL: painreliefpharmaceuticals.com (172.67.192.77 – CloudFlare)
OnlineMed-Store
- Address: 5 Illinois Ave., San Francisco, CA 94122 (There is no Illinois Ave in San Franciso)
- Phone: (862) 231-5146 (phone number does not appear on Google or Bing except for OnlineMed-Store) (This is a New Jersey area code)
- URL: onlinemeds-shop.com (46.30.45.143 – used by one other web site – my-canadianpharmacy.com)
MyCanadianPharmacy
- Address: 675 Cochrane Dr., Markham, ON, L3R 0A3, Canada (Regus virtual office space)
- Phone: (864) 610-3116 (phone number appears in Google and Bing for this and other pharmacy websites)
- URL: my-canadianpharmacy.com (46.30.45.143 – used by one other web site – onlinemeds-shop.com)
HOT-MED.com
- Address: N/A
- Phone: (888) 724-0475 (phone number does not appear on Google or Bing)
- URL: hot-med.com (172.67.173.139 – CloudFlare)
Under World Plugin
- Address: N/A
- Phone: (859) 903-5880 (phone number does not appear on Google or Bing except for Under World Plugin)
- URL: underworldplugin.com (51.89.48.112 – Hosting 1,418 domains on a shared web server)
I’m not stating that the above “companies” are the same company, I’m just stating that they have several things in common, in this case, the testimonials. All domain names for the above also use Private domain name registration (Registered person is not visible)
Strange Behaviors
Interestingly several of the websites ask for a credit card on their customer support form “The credit card number is required to identify your order correctly in our certified secure network”
Who Is Behind All This?
Some sources state that Dr. Edward B. Armington – CEO of Canadian Health&Care Mall, including their own About Us page.
How Long Has This Been Going On?
Early 90s
Canadian Mall came into existence almost 15 years ago, when our CEO Dr. Edward B. Armington launched a pharmacy chain in Toronto and Ottawa in the beginning of 90s. Star Trek and Deep Space 9 were all the hype on the telly, and Canadian Health Mall was beginning to have the hype of the day among connoisseurs of pharmacy shopping.
Back then, we made it to be such a huge hit as a family-friendly Health & Care store by pinning cut-rate, dime-a-dozen price tags to the most needed drugs approved by The Canadian Pharmaceutical Association (CPA).
A fact that left many jaws on the floor was our smooth transition from bricks to clicks. By the late 90s we discovered a way to come up with even more steal buys and mark down the price for every single drug we had in store by skipping the rent and other expenses involved in running an actual pharmacy chain. That was the beginning of Canadian Health Care online as all of you know it today.
The Aughts
…Well, not exactly as you know us today. We’ve been evolving at a fast pace, and before too long we became the news with our unmatched far-flung delivery of affordable drugs all around the world. But the concept of making personal and medical care products more attainable has been our companion and a signature style throughout our entire history.
We have been aligning ourselves with the reputable cutting-edge drug manufacturers quartered internationally. We brainstormed to set to going a complicated system of logistics that cut our delivery costs by half, making our products still cheaper for you. We never stinge on raising our personnel’s wages to keep them happy, motivated and charged with the energy to perform (and this is exactly our dirty little secret behind softly-assistive customer support, if you’ve been wondering as to why all this indulgence they show to you).
2006-Until now
Canadian Mall is still going gangbusters in 2015, all with a self-reinventive vein that made us known in the first place. We’ve made it until now by realizing that this is not about perfection, but about progress. Believing that you’ve reached the top will prompt you to rest and stagnate, and to ultimately lose the race with the time. Instead, we believe that we can get better with every new day.
Today we’ve added an ample choice of generics to appeal to customers of different means and needs. We are aware of the fact that many consumers struggle to kick the ever-growing list of overpriced pharmacy care items out of their homes. Canadian Mall online is an essential standby for such aware customers.
We are thankful too all of you who’ve made this journey with us through the years, and we welcome the first-timers to partake of our experience, care and high standards of quality.
Regards,
Canadian Health&Care Mall Team
Bogus Certifications
They boast a handful of accreditations and certifications (all are fake)
Province of Ontario College of Pharmacists of Ontario
The certificate is 100% bogus, the real Province of Ontario College of Pharmacists of Ontario, doesn’t issue certificates to Pharmacies, just Pharmacists and this isn’t their actual certificate
VISA
The Visa validation is 100% fake. When VISA was running this program a business was given an icon to place on the business website with a unique URL that led to a unique validation page on VISA’s web site. What they did here was just make up an “official” looking page and hosted it on their own website, how cute.
AphA
The American Pharmacists Association (AphA), like the Province of Ontario College of Pharmacists of Ontario, does not issue certifications to Pharmacies, just Pharmacists
FDA #18278780458
FDA registration number of 18278780458, is bogus too, ironically, their certification is for FDA Registration Corp, which isn’t the FDA and actually has nothing to do to do with the U.S. Food and Drug Administration (FDA), but was founded in 2003 to help businesses comply with U.S. Food and Drug Administration (FDA) regulations.
APA
Their International License Number is identical to the the The American Pharmacists Association #02724941
There are several Pharmacy organizations that review online pharmacies
Validation
LegitScript
LegitScript is a Portland, Oregon-based internet and payments compliance company that provides solutions[buzzword] for merchant monitoring, platform monitoring, and certification in high-risk industries. The company also performs investigative analyses for government agencies around the world regarding cybercrime, and offers brand monitoring for intellectual property infringement. Some of LegitScript’s partners include Google, Facebook, Amazon, Bing, and Visa. LegitScript also works with the U.S. Food and Drug Administration to monitor and investigate websites marketing FDA-regulated products.
They reviewed the following:
- healthcaremallofficial.com = (Is a rogue Internet Pharmacy website)
- Canadian Health&Care Mall = (0 RESULTS FOUND FOR “CANADIAN HEALTH&CARE MALL“)
- MyCanadianPharmacy = (0 RESULTS FOUND FOR “MYCANADIANPHARMACY”)
- CanadianPharmacy = (0 RESULTS FOUND FOR “CANADIANPHARMACY”)
- Canadian Health&Care Mall LTD = (0 RESULTS FOUND FOR “CANADIAN HEALTH&CARE MALL LTD”)
An example of a legitimate pharmacy review on LegitScripts = CVS
CIPA
Canadian International Pharmacy Association (CIPA) the Canadian International Pharmacy Association is a Canadian association of licensed pharmacy businesses offering mail order pharmacy services to Canadian and international patients. CIPA members sell pharmaceuticals and maintenance medications to individuals upon receipt of a valid prescription.
CIPA lists Canadian Health&Care Mall LTD as a Rogue Pharmacy website. The “License #06211095” is not only fictitious, it’s not even in the right format for their registration numbers. They don’t offer “licenses” to pharmacies. They merely approve or disapprove of existing pharmacies.
PharmacyChecker
PharmacyChecker helps people find the lowest prices on prescription medication among licensed U.S. and international pharmacies. We are the only independent company monitoring and verifying the credentials of international online pharmacies and comparing prices of the prescription drugs available from these licensed pharmacies.
PharmacyChecker has a validation portal where you can check to see if an online pharmacy is a legitimate company. None of these sites were accredited, shocking right!
Better Business Bureau
The Better Business Bureau is nonprofit organization whose self-described mission is to focus on advancing marketplace trust,[2] consisting of 106 independently incorporated local BBB organizations in the United States and Canada, coordinated under the International Association of Better Business Bureaus (IABBB) in Arlington, Virginia.
The BBB does not have Canadian Health and Care Mall as being accredited.
Rest assured that this is not the only criminal organization that does this, Pharmacy Express (PE) believed to be operated by Russian criminal spammer Leo Kuvayev, and several of his colleagues and affiliates has been doing the exact same thing since 2004.
Here is an archive of the Fraud-Report Wiki page for Canadian Health&Care Mall (they removed their copy of the page last week) – Links do not work on the archive
