BizCN, its hand in the rogue Internet pharmacy cookie jar
Most domain name registrars are good corporate citizens. But there are a few that turn a blind eye to their customers’ criminal activity, or — as in the case of BizCN — actively solicit illegal business.
As background, LegitScript’s internal data has indicated that Chinese domain name registrar BizCN, despite only having less than 0.2% of the total domain name market, has an exponentially larger share of the rogue Internet pharmacy market (depending on the month, between 2% and 10% on average over the last few years). Why is this — is it just happenstance?
Since 2010, LegitScript has submitted over 30 abuse complaints to BizCN regarding no-prescription-required websites like buytramadolonlinerx.com, medsjoy.biz, and cheapmeds4u.com. In nearly all cases, the company either ignored these or found some excuse as to why they were unable to take action — not only in response to our complaints, but as the Wall Street Journal noted last week, in response to those submitted by law enforcement authorities.
But in fact, BizCN has had its hand in the rogue Internet pharmacy cookie jar for a while, actively soliciting the illegal business on the one hand, but telling anti-abuse advocates as well as law enforcement that they “could not do anything” about the illegal websites.
The head of BizCN’s abuse department — one Mao Guang Wang (mgwang[at]bizcn.net), the person who was charged with interfacing and responding to the FDA’s, INTERPOL’s, LegitScript’s and other abuse complaints about illegal online pharmacies — has been running a separate website, cndomainsite.com, that markets BizCN in “black hat” forums as a safe place for illicit Internet pharmacies. It’s a little like a police chief who was found selling drugs from the evidence locker: while BizCN has been making excuse after excuse about why it couldn’t do anything about rogue Internet pharmacies using its services (e.g., “We need a court order from the Chinese government”), the company’s own abuse director has been posting in BlackHat forums and offering illicit online pharmacies targeting countries other than China safe domain name registration with BizCN. (After we submitted a complaint to ICANN, many of the posts in Black Hat forums have disappeared, but LegitScript has retained screenshots.)
How do we know? Several reasons. As a starting point, domain names registered with cndomainsite.com end up registered with BizCN. But this fact, standing alone, would give BizCN plausible deniability: they could argue that cndomainsite.com was just a rogue “domain name reseller” that was soliciting rogue Internet pharmacies without BizCN’s knowledge.
BizCN, the ICANN-accredited registrar, and cndomainsite.com, the website marketed as a safe place for rogue Internet pharmacy registrations, can be linked in several ways.
First, as background, BizCN’s website is in Chinese, but it maintains an English-language version, cnobin.com, for non-Chinese (especially English) speakers. Technically, CNobin is set up as a domain name reseller for BizCN, but the companies are the same: both share the address No. 61 Wanghai Road, Xiamen Software Park, in China and phone number (see, e.g., this BizCN page and this CNobin page; CNobin’s registration agreement indicates that CNobin and BizCN are the same; abuse complaints are interchangeably processed by BizCN and [email protected], and so on).
Critically, however, when domain names are registered via cnobin.com, a WHOIS record identifies “CNOBIN Technology HK Limited” as the reseller. Similarly, when a domain name is registered via cndomainsite.com, the reseller also shows up as being "CNOBIN Technology HK Limited” — a critical piece of information that establishes CNobin and cndomainsite.com as the same entity from ICANN’s vantage point. (We confirmed this by registering domain names with both.) And, the WHOIS records for bizcn.com and cndomainsite.com post the same phone number, +86.5922577888 -- also the phone number for CNobin. Domain names registered with cndomainsite.com are directly registered with BizCN. And, if you create an account with either cndomainsite.com or cnobin.com, and then try to create an account with the other using the same email address, you can’t: either website will tell you that an account in that name has already been created.
And so on.
If BizCN and CNobin are the same entity, and CNobin and cndomainsite.com are the same entity, then it follows that all three are the same organization.
Even more compelling, however, is what happens when you track the money. As shown in the image to the left, when you buy a domain name via the rogue Internet pharmacy-friendly cndomainsite.com, the money ends up directly in the pocket of Mao Guang Wang — the anti-abuse chief for BizCN. (LegitScript went undercover and registered a test rogue Internet pharmacy domain name with the company.)
But Wang, who often goes by “Michael” in English-language correspondence, may have had help: the master email on the PayPal account for cndomainsite.com is michaelsunny[at]gmail.com according to PayPal. In that vein, it’s important to identify the other person we most commonly dealt with at BizCN: Easy Huiping (hpyi[at]bizcn.net), BizCN’s Legal Affairs Commissioner, who goes by “Sunny” in her (?) email correspondence with non-Chinese speakers, and is the registrant for BizCN.com as well as cnobin.org.
It’s compelling, troubling evidence, a little like a police chief who says he can’t do anything about the drug epidemic in his community, but is selling drugs from the evidence locker. BizCN’s anti-abuse chief, potentially aided by the company’s legal affairs commissioner, telling drug safety authorities that they simply can’t do anything about the hundreds of illegal online pharmacies on their system, all the while actively soliciting and offering paid protection for that very illegal activity out the back door.