The International Narcotics Control Board, the independent, quasi-judicial control organization that monitors the implementation of the United Nations drug control agreements, released their annual report last week. It includes a serious discussion about rogue Internet pharmacies, noting that:

“…more and more online drug retailers…use targeted marketing strategies that respond rapidly to users’ demands and to changing legal and market situations.”

Among the little-noted statements was a very interesting tidbit:

“The (INCB), convinced that a coordinated global response is needed to address the illegal sale of drugs on Internet pharmacies and websites, has developed the Guidelines for Governments on Preventing Illegal
Sales of Internationally Controlled Substances through the Internet.”

Inserted in a footnote: these Guidelines will be subsequently released by the United Nations.

Although “guidelines” are (by definition) not binding, it will be interesting to read these guidelines, which may have the effect of providing some needed structure and standards to the international approach to how governments identify and dismantle rogue Internet pharmacy networks.

We’re pleased to welcome kaypharmacy.com to our list of approved pharmacy websites.

kaypharmacy.com is the Internet presence of Kay Pharmacy, a licensed pharmacy in Michigan. The pharmacy has been in the family for three generations. (Unsurprisingly, when the current owner’s grandfather opened the pharmacy in 1945, he didn’t offer his customers the ability to refill prescriptions online.)

Kay Pharmacy refills prescriptions through its website and primarily serves customers located in Michigan. The pharmacy also provides home medical equipment.

Kay Pharmacy’s website meets LegitScript standards as a safe and transparent online pharmacy. LegitScript is glad to welcome the pharmacy and its website to our list of approved online pharmacies.

Sometimes we receive threatening emails from Internet drug dealers. Just yesterday, the apparent registrant of www.thaisteroids.com, a website that offers steroids to US residents, emailed us regarding our LegitScript entry for www.thaisteroids.com, as a rogue Internet pharmacy.

“Greg” from www.thaisteroids.com writes:

You leave our company no choice but to seek legal action.

Actually, Greg, you do have a choice: stop selling drugs over the Internet.

Okay, let’s see. Steroids are controlled substances. Buying controlled substances without a valid prescription is both illegal in the US and dangerous. Shipping any prescription drug to a US resident from outside of the US, but especially a controlled substance, is also illegal. We’re entirely comfortable designating the website www.ThaiSteroids.com as a rogue Internet pharmacy. (Note that “thaisteroids.com”, without the “www.”, sells model airplane parts. Go figure. Perhaps the steroids are smuggled into the US in model airplane parts?)

And what if the website claims to not ship to the US? Look to their shipping page:

Estimated time of delivery for our Shipment is max. 8-12 business days within Europe, and 8-21 business days to the U.S. and the rest of the world. We have only one method of shipping. Shipping costs 10-40 GBP to USA, Canada, Europe and rest of the world. (Emphasis added.)

Some of these Internet drug dealers appear to believe that because steroids are not regulated in a few countries, such as Thailand, that as long as they hide behind the shield of shipping the steroids from Thailand, they aren’t doing anything wrong.

That’s incorrect, of course. These websites are illegal scams that put their customers in danger. We urge US residents to avoid purchasing anything at all from www.thaisteroids.com.

The sudden jump in our rogue Internet pharmacy numbers are mainly due to the addition of about several thousand rogue Internet pharmacies operating out of Russia, commonly known as affiliates in the notorious GlavMed rogue Internet pharmacy affiliate network. Sometimes referred to as “Canadian Pharmacy,” the websites in this network are not actually pharmacies; nor are they actually Canadian. A host of information about these sites indicates that they are generally linked to individuals in Russia, Kazakstan, China, the Ukraine, and other parts of Eastern Europe.

The general method of operation of these sites is to either:

1. Take your money and run, or
2. Send a fake (counterfeit) product, if they send anything at all.

What’s notable about the GlavMed network is the sheer number of websites involved. Is it 10,000…or 100,000? Anybody’s guess, but a common tactic is to leave the website up for just a few days, send out a few million spam emails, and shut down the website after a few orders come in. As a result, even though there are probably a few hundred thousand websites that have been part of this network at one time or another, the number of “active” GlavMed websites is typically much smaller.

(Notice the snake in GlavMed’s logo. Entirely appropriate.)

We’ve finally arrived at the last LegitScript standard for safe online pharmacies. Our eleventh standard is sort of a catch-all that says any pharmacy website up for LegitScript approval cannot be affiliated with other websites that do not meet LegitScript standards.

LegitScript Standard 11: Affiliated websites. The pharmacy, website, pharmacy staff, domain name registrants, and any person or entity that exercises control over, or participates in, the pharmacy business must not be affiliated with or control any other website that violates these standards.

Why are affiliations important? You may be wondering why the affiliations of a website matter. Shouldn’t we only be concerned with the content of the website in question, not other websites? In a word, No. One of the common characteristics of “rogue” Internet pharmacies is that they do not operate alone. Rather, these sites are part of "networks", sometimes of thousands of websites, that are linked in some way. For instance, it is not unusual for multiple rogue Internet pharmacies to advertise prescription drugs, and once a user clicks on a given drug, redirect the user to a central payment website that processes the order. In this way, many rogue pharmacy websites function as cyber-storefronts that link back to centrally controlled websites. It’s like a drug-dealer franchise!

Of particular concern to LegitScript are rogue Internet pharmacy networks that share a seemingly legitimate storefront site. Many rogue networks will maintain one online pharmacy that appears to be legitimate, and use the business as a front for the network of other websites that violate one or more of the LegitScript standards. If you read our recent blog about a CNN expose, you already know a little about this. CNN exposed a scam where an Internet pharmacy (registered with the State Board of Pharmacy and everything) was redirecting orders to rogue networks. This is why we believe it is so important that all of a pharmacy website’s affiliations be investigated before granting LegitScript approval. It’s not just whether the Internet pharmacy itself is legitimate: it’s whether the organization or network (if any) that the Internet pharmacy is part of is legitimate.

In the same regard, we look to see what other websites are controlled by the individual or entity that controls the Internet pharmacy in question. If the Internet pharmacy seems legitimate, but the owner has registered other websites that don’t require valid prescriptions for prescription drugs, LegitScript won’t approve the Internet pharmacy.

You can be sure that LegitScript investigates and verifies the affiliations of all of the pharmacy websites in our database. If any of those affiliations are with websites that violate our standards, the website will not be LegitScript approved.

Spam-fighting organization KnujOn released it’s annual report on the top-ten domain name registrars sponsoring spam. As noted in the Washington Post:

Nearly 83 percent of all Web sites advertised through spam can be traced back to just 10 domain name registrars.

Those ten domain name registrars, according to KnujOn, are:

1. XinNet Cyber Information Company Limited
2. eNom
3. Network Solutions
4. Register.com
5. Planet Online
6. Regtime Ltd.
7. OnlineNIC Inc.
8. Spot Domain LLC
9. Wild West Domains
10. Hichina Web Solutions

LegitScript is particularly interested in this, because an 80% or 90% of spam tends to hawk pharmaceutical products.

We’ve almost made it all the way through the eleven LegitScript Standards. We’re continuing the discussion today with Standard #10. This one gets a little technical, but we’ll try to put it in non-geek terms as much as possible.

LegitScript Standard 10: Domain name registration. The domain name registration information of the pharmacy must be accurate, and the domain name registrant must have a logical nexus to the dispensing pharmacy. Absent extenuating circumstances, pharmacy websites utilizing anonymous domain name registration services will not be eligible for approval.

What is a domain name? A domain name is, in layman’s terms, the name of a website (e.g., legitscript.com, or drugstore.com). In order to get a domain name, you go to a domain name registrar like GoDaddy, Directi or Moniker, check the availability, and pay an annual registration fee to the registrar.

When you buy a domain name, you have to register your information: name, address, phone number, email, and other contact information. This is sometimes called WhoIs information. The problem is, there’s a huge loophole: domain name registrars require you to provide your contact information, but they don’t check to make sure that it’s accurate. And there’s a second loophole: accurate or not, you can pay an extra fee to make your domain name registration anonymous.

How do rogue Internet pharmacies misuse the domain name registration system? It’s difficult to imagine a good reason that a legitimate Internet pharmacy business would ever need anonymity. Think about it: part of being a legitimate Internet pharmacy involves making sure that a pharmacist is available to answer any questions you have, and that there is transparency about the source of the drugs. Why would any legitimate Internet pharmacy hide their identity? Most often, rogue Internet pharmacies entities register fraudulently or anonymously, making it harder for the customer or law enforcement to track them down. It’s just another tool they use to remain in the shadows of the Internet.

Approached from the reverse perspective, we feel completely comfortable declining an Internet pharmacy application if we ask the Internet pharmacy to make their WhoIs information public, and they refuse. We have seen several situations where the individual or entity that controls the website, and that has actually registered the website, is not the entity displayed in the “Contact Us” section of the website.

Does that mean that the website registrant actually has to be the Pharmacist-in-Charge? No. It’s great if it is, but actually, our standards require that the domain name registration have a “logical nexus” to the dispensing pharmacy. To give a great example of what that means, look at the WhoIs registration information for amberpharmacy.com. The pharmacy isn’t the registrant; rather, it’s CSTG, which provides the design, development and hosting for the Internet pharmacy. Because we confirmed that this company controls the website on Amber Pharmacy’s behalf, is in the same neighborhood and is a legitimate hosting company, it meets our standards as having a “logical nexus” to the pharmacy. After all, we don’t expect that pharmacists are also website programmers, so it’s perfectly permissible for a pharmacy to outsource development of the website to a third company, as long as it is open and transparent, and can be verified.

How do I know if a pharmacy is registered anonymously or not? It’s fairly simple. Go to a website like WhoIs or Domain Tools and type in the website you want to know about. A page will appear with information about the website, and if you scroll down you will see the “Whois Record” which displays registration information for that site.

LegitScript requires all of its approved pharmacy sites to maintain transparency by listing accurate and valid registration information that has some sort of logical relationship to the dispensing pharmacy.

CNN aired a piece a few days ago identifying pharmnet.com, a Pharmacy-Checker approved Internet pharmacy as involved in the sale of controlled substances like Xanax from India without a prescription.

Here are the facts. PharmNet.com is licensed in Texas. PharmacyChecker has approved pharmnet.com through its online pharmacy evaluation program. But according to CNN, pharmnet.com was selling controlled substances like Xanax without a prescription. (That’s illegal, of course.) Our analysis is that pharmnet.com took the orders and redirected to another checkout website for processing and payment. CNN showed the drugs, which came from India. (Importing controlled substances from outside of the US to patients or customers is also illegal.)

LegitScript also received an application from Pharmnet.com, and we declined to approve them. But it didn’t take rocket science to decline the application: pharmnet.com offers to ship to 50 states, but is only licensed in Texas. If an online pharmacy ships to most states (45, in fact) without being licensed there, that is a violation of their regulations…good enough reason for LegitScript to decline the application without looking much further.

After all, if an Internet pharmacy is willing to ignore some laws, it’s likely that they’ll ignore others as well.

The CNN piece indicated that Pharmnet’s online pharmacy was deceiving customers as to the source of the drugs and putting its users at risk.

Update (2/6/06): Pharmnet.com appears to have now been removed from the PharmacyChecker approval program.