arrow-left-endarrow-right-end

News & Updates

The Latest on Internet Pharmacies, Supplements, Designer Drugs,
and Other High-Risk Merchants

Rogues and Registrars: Top 10 List (October 2012)

On a periodic basis (we’ll aim for monthly), LegitScript will be releasing data on the top registrars serving as domain name registration platforms for rogue Internet pharmacies. These rankings are based on LegitScript’s global database of Internet pharmacies, which (as far as we know) is the largest such database in the world.

LegitScript posts this data in the hope that it will encourage registrars to take positive steps to prevent the use of their services in furtherance of criminal activity involving prescription drugs, and also as a means of highlighting how illicit Internet businesses “cluster” at registrars or ISPs they perceive as “safe.”

Previous LegitScript analyses (such as this report and this report) have shown how most domain name registrars out of the hundreds accredited by ICANN now refuse to allow their services to be used in furtherance of criminal activity. Currently, most leading registrars — including eNom, GoDaddy, Internet.bs, Directi, URL Solutions, Sibername, the Center for Ukrainian Internet Names, AZ.pl, Name.com, Dynadot and many more — suspend and lock domain names shown to be engaged in the illegal or fraudulent sale of prescription drugs via the Internet (e.g., by selling prescription drugs without a prescription). This is consistent with their responsibilities under ICANN’s Registrar Accreditation Agreement, which incorporates by reference the Uniform Dispute Resolution Policy (UDRP), which in turn requires registrars to prohibit the use of domain names for unlawful purposes. LegitScript works closely with registrars regarding rogue Internet pharmacy activity, and a growing number of registrars state in their terms and conditions that they will suspend and lock any domain name identified by LegitScript as being a rogue Internet pharmacy.

As we’ve previously noted, however, there are a few registrars — increasingly fewer — that turn a blind eye to rogue Internet pharmacy activity occurring on their platforms. Because the industry standard is to suspend domain names identified by LegitScript as rogue Internet pharmacies, there is a predictable clustering at the registrars that permit or ignore such behavior. In a small number of cases, the registrar might not be aware of it, but in most of the cases below, LegitScript has contacted the registrar in question at least once — and sometimes on multiple occasions — regarding the criminal activity, to no avail.

LegitScript is endorsed by the National Association of Boards of Pharmacy (NABP), which represents the government agencies that license and regulate pharmacies in the US, Canada, Australia and New Zealand, explicitly for the purpose of working with domain name registrars to identify rogue Internet pharmacies. We work closely with global regulatory agencies, such as INTERPOL in the context of Operation Pangea, as well.

In a report earlier this year, LegitScript identified the top 10 domain name registrars sponsoring rogue Internet pharmacies at that time. Since then, Internet.bs and Name.com have done an excellent job of cleaning up their platforms; the Center for Ukrainian Internet Names has made substantial progress as well. Although NetEarth One and OnlineNIC are no longer in the top 10, they remain in the top 15 and have not made observable progress. DirectNIC is No. 11 on our list and earns an “early warning” (a little like an honorable mention) below. Moniker, Joker and Tucows all continue to turn a blind eye to rogue Internet pharmacies on their platform despite being put on notice on multiple occasions.

We encourage the registrars on the list below, and on our future updated lists, to take affirmative steps to ensure that their platforms are no longer used by rogue Internet pharmacies. As long as a registrar is serious about suspending and locking such pharmacies, we’re happy to provide our assistance, and the list of the rogue Internet pharmacies, to the registrar at no charge.

There’s one exception: In one case, top-ranked AB Systems, we note that the registrar is so closely tied into the rogue Internet pharmacy network itself (commonly known as RxPayouts, although it includes several rogue Internet pharmacy affiliate programs that are all fundamentally part of the same larger network) that there is no acceptable or workable solution except de-accreditation of the registrar by Internet Corporation for Assigned Names and Numbers (ICANN).

As we have in the past, we think it’s important to offer the qualifier that because rogue Internet pharmacies tend to go offline and reappear online, or to practice geotargeting, there is a margin of error: For example, a registrar might have 1,000 rogue Internet pharmacies using its platform on one day and 950 the next day. However, the level of variation in our data is fairly small, and we can stand by our assessment that the registrars identified below are the primary registration platforms of choice for rogue pharmacy websites.

1. AB Systems, dba yournamemonkey.com (Philippines)

Prior notification: n/a (due to the fact that the registrar is part of the Internet pharmacy network itself)

AB Systems is a boutique domain name registrar that appears to exist for the sole or primary purpose of registering domain names affiliated with the mega-RxLimited rogue Internet pharmacy network (which encompasses RxPayouts, Pill Program, RxCashCow, PillChecks, NetBizBucks and other small arms of the network). The thousands of online pharmacies in this mega-network operate as “pill mills,” selling tramadol and other drugs without an in-person examination requirement. Because the registrar is actually part of the rogue Internet pharmacy network, domain names in these networks are registered with impunity, including throw-away domain names used to spam prior or existing customers.

Examples:

  • rxpayouts.com, pillprogram.com, rxcashcow.com (where affiliate marketers sign up to create their own online pharmacy, such as those in the bullet below)
  • onlinedrugwithoutprescription.net, medicationsnoprescription.com, fastovernightrx.com (sample online pharmacies in the network)
  • cartadmin.com, netordersys.com, netrxorder.com (where the payments are processed)

Historically, AB Systems can be documented as having falsified or permitting falsified WHOIS data for the rogue Internet pharmacies that are part of its network, using individual names, addresses and phone numbers that did not exist (e.g., the former domain name registration for rxcashcow.com, which specified a nonexistent address, company, individual and phone number in Fairview, Oregon). The company subsequently replaced the falsified WHOIS records with anonymous (“proxy”) information.

Because AB Systems is a “rogue registrar,” the responsibility for addressing this issue must ultimately fall to ICANN.

2. Moniker (United States)

Other than AB Systems (which, as noted, is part of the rogue Internet pharmacy network itself), LegitScript data indicates that Moniker is the leading domain name registrar for rogue Internet pharmacies in the world. Moniker was previously in our top 10 list, earlier this year. Moniker’s operations are run primarily out of Oregon, although the company also has corporate ties to California and Florida.

LegitScript has notified Moniker on numerous occasions (including via certified mail) about specific rogue Internet pharmacies going back as far as 2010. The company has consistently ignored and failed to act on our notifications. For example, despite being put on notice that meds-easy.com is offering oxycodone and hydrocodone without a prescription, Moniker has thereafter permitted re-registration of the domain name.

Examples:

  • meds-easy.com (offering Oxycodone, Vicodin and other drugs without a prescription)
  • buycaverta.org (selling an unapproved version of Viagra without a prescription)
  • femalecialis.org (selling an unapproved version of Cialis for women without a prescription)

3. The Momentous Group, primarily Rebel.com (Canada)

When domain name registrar Internet.bs cleaned up its rogue Internet pharmacy problem, the rogue Internet pharmacies that escaped prior to the implementation of the new policy migrated to several registrars, first and foremost Rebel.com, part of the Momentous Group, which also includes NameScout and other registrars. This shift collectively propelled the registrars in the Momentous Group into our top 10 list, with the bulk of those rogue Internet pharmacies registered with Rebel.com.

LegitScript contacted Rob Hall, CEO at Momentous, on Feb. 21, 2012 (prior to the migration of rogue Internet pharmacies to Rebel.com from Internet.bs), and noted that there were (at the time) a few hundred rogue Internet pharmacies utilizing the company’s domain name registration services. LegitScript never received a reply.

Following domain name registrar Fabulous’ decision to boot canadadrugs.com after the US FDA’s warning letter and numerous articles tying canadadrugs.com to the sale of counterfeit drugs, canadadrugs.com chose Rebel as its domain name registrar. Unlike Fabulous, Rebel has continued to permit canadadrugs.com to use its registration platform, where the website continues to target the US with prescription drug sales despite the FDA warning letter.

Examples:

  • drugstore4less.com, part of the Russia-based Rx-Partners rogue Internet pharmacy network selling prescription drugs without requiring a prescription
  • buy-tramadol-no-prescription.net, part of the RxPayouts rogue Internet pharmacy network marketing tramadol without requiring a physical examination by a physician
  • 33drug.com, also part of the Rx-Partners rogue Internet pharmacy network selling prescription drugs without requiring a prescription

4. Joker.com (Germany/Switzerland)

Joker.com has long been a top destination for rogue online pharmacies (and was also previously on our top 10 list), but it has risen to the No. 4 spot globally. Joker has continued to take the unsupportable position that it cannot suspend rogue Internet pharmacy domain names unless the WHOIS record has been shown to be inaccurate. This is provably incorrect — not only because most registrars suspend rogue Internet pharmacy domain names irrespective of the WHOIS records, but also in the plain language of ICANN’s contractual requirements, which mandate that registrars require customers not to use domain names for illegal purposes.

Despite being put on notice on multiple occasions regarding rogue Internet pharmacies, Joker continues to allow these criminal entities to use its registration platform.

Examples:

  • aboutpropecia.com (affiliate of the criminal GlavMed network, selling unapproved drugs without a prescription)
  • 1truepharmacy.com (selling unapproved prescription drugs without a prescription)
  • drugsfort.com (selling unapproved prescription drugs without a prescription)

5. Cloud Group Limited (United States)

Cloud Group Limited, which provides domain name registration via resell.biz, is the sole registrar in this group of 10 that has sometimes taken steps to ensure that its registration services are not utilized in furtherance of criminal activity involving the sale of prescription drugs.

LegitScript will reach out again to Cloud Group Limited, formerly better known as UK2Group, and request that they suspend the domain names using their platform that are engaged in illegal prescription drug sales.

Examples:

  • amlodipine.org (part of the Rx-Partners criminal network, selling prescription drugs without a prescription)
  • erectiondrugsonline.com (fake Canadian pharmacy selling prescription drugs without a prescription)
  • buycheaphydrocodoneonline30.com (promoting portals offering generic Vicodin without a prescription)

6. 0101 Internet/0101 Domain (Hong Kong, China)

0101 Internet is a new entrant to the top tier of rogue Internet pharmacy-sponsoring registrars. Based in Hong Kong, the registrar is operated by Alfred Mak, who recently received a warning letter from ICANN on unrelated issues (the company cured the breach). It may be that rogue Internet pharmacy operators targeting jurisdictions such as the US, EU, Japan and elsewhere believe that a China-based registrar will be “safe” and not responsive to LegitScript notifications.

LegitScript has reached out to 0101 Domain and looks forward to the company’s response. Update, October 31: LegitScript’s abuse team received word from 0101 Domain that the rogue pharmacies on its platform have had their domain names suspended. Indeed, the vast majority of those websites are now offline. We appreciate 0101 Domain’s quick response in helping shut down these illegal pharmacy websites.

Examples:

  • buy-cheapphentermine.com (marketing controlled substances without a prescription as part of the rogue Investra network)
  • buy-propecia.com (part of the GlavMed criminal network, selling prescription drugs without a prescription)
  • genericpillz.com (selling prescription drugs without requiring a prescription)

7. TodayNIC (China)

Like 0101 Internet, TodayNIC is China-based and is a new entrant into the top 10 list of registrars sponsoring rogue Internet pharmacies. LegitScript’s observation has been that as Internet.bs, the Center for Ukrainian Internet Names and other registrars began enforcing their terms and conditions, some rogue Internet pharmacy operators migrated over to both 0101 Domain and TodayNIC due to their presence in China.

LegitScript has reached out to TodayNIC and looks forward to the company’s response.

Examples:

  • approved-pharmacy-ltd.net (part of the criminal RxProfits affiliate network, selling unregulated drugs without requiring a prescription)
  • buycipronoprescription.com (promoting websites that sell Cipro and other prescription drugs without a prescription)
  • geniusmeds.com (part of the EvaPharmacy criminal network, displaying forged pharmacy licenses, selling unapproved drugs and not requiring prescriptions)

8. Tucows/OpenSRS (Canada)

Tucows has moved up from the No. 9 to the No. 8 position. LegitScript has notified Tucows on multiple occasions about multiple rogue online pharmacy domain names utilizing its platform over the course of the last several years. Despite these notifications, and even including some that originate from law enforcement, LegitScript has not observed Tucows taking meaningful action against rogue Internet pharmacies. (We note that Tucows is under an ICANN breach notice on an unrelated matter.)

Tucows operates largely on a reseller model (that is, ISPs and other third parties sign up to act as the portal through which domain names are registered with Tucows), and the company has stated that it prefers to simply pass on the information about illegal websites to its resellers without requiring them to take any action. This is a problematic policy for two primary reasons: First, in some cases, rogue online pharmacy operators have operated as resellers for registrars, so of course such resellers have no motive to take any action, and might simply claim that they are legitimate (as rogue Internet pharmacy networks tend to do). Second, it is Tucows — not the reseller — that is the accredited registrar and is accountable to ICANN via the RAA and UDRP. No other registrar, to LegitScript’s knowledge, passes the buck to its resellers. Tucows, not the reseller, is the accredited registrar, and we call on Tucows to enforce its terms and conditions rather than ignore the criminal activity on its platform. It is worth noting that Tucows is the third-largest ICANN-accredited registrar in the world; GoDaddy and eNom, the largest and second largest, take decisive action to prevent criminal activity on their registration platforms. Tucows is the largest registrar that fails to suspend rogue Internet pharmacy domain names.

Examples:

  • ambiengeneric.com (part of the RxCash criminal network selling controlled substances without requiring a prescription)
  • half-price-pharmacy.com (selling unapproved drugs without requiring a prescription)
  • rx-discount.net (part of the Medstore.biz rogue Internet pharmacy network, selling prescription-only medicines without requiring a prescription)

9. BizCN dba cnobin.com (China)

BizCN (dba cnobin.com, affiliated with the Longtop Group) has, according to LegitScript data, steadily been a top sponsoring registrar for rogue online pharmacies. In this analysis, it breaks into the top 10.

LegitScript has, on several occasions, contacted BizCN and provided the company with lists of rogue Internet pharmacies using its registration platform. On only one occasion as far as we can tell, a few years ago, did the company act; since then, the company has steadily declined to take any action.

Examples:

  • oxycodone.tv (redirecting to meds-easy.com affiliate meds-order.com, selling controlled substances without requiring a prescription)
  • allmedsnow.biz (part of the eWinPay rogue Internet pharmacy and tobacco network, selling unapproved prescription drugs without requiring a prescription)
  • cheapgenericplavix.com (part of the criminal RxCash network operating out of Israel and other locations, selling controlled substances without a prescription)

10. WebNIC.cc (Malaysia)

WebNic.cc of Malaysia has similarly long been a top sponsoring registrar for rogue Internet pharmacies, but was not previously in the top 10. LegitScript has, on several occasions, sent lists of rogue Internet pharmacies registered with WebNIC.cc to the company; they have steadily declined to take any action despite being notified that the websites are selling prescription drugs without a prescription, selling unapproved or falsified medicines and operating without valid pharmacy licenses.

Examples:

  • canadiangeneric.com (fake Canadian Internet pharmacy selling prescription drugs without requiring a prescription)
  • ebuyvalium.com (redirects to cheapscrips.com, selling controlled substances without requiring a prescription)
  • getrxprice.com (price comparison service exclusively for Internet pharmacies selling prescription drugs, including controlled substances, without a prescription; drugs are unapproved or falsified)

Early Warnings

This month’s early warnings go to:

  • DNC Holdings, formerly (or also) known as DirectNIC, is a close No. 11 on our list.
  • Argentinian registrar DATTATEC is on an upward swing and should suspend rogue Internet pharmacy domain names on its platform.
  • GMO Internet in Japan (onamae.com or お名前.com) continues to serve as a platform for rogue Internet pharmacies targeting Japan and elsewhere.
  • IP Mirror in Singapore similarly serves as a registrar for a smaller number of high-value rogue Internet pharmacies in the network known as MyRxCash (aka Pronet).
  • Realtime Register in the Netherlands similarly serves as a platform for a smaller number of high-value rogue Internet pharmacies.