The Who’s Who of Rogue Registrars

As more registrars move toward voluntary compliance, the walls continue to close in on rogue pharmacy operators. In a world without Nanjing Imperiosus Technology Co., Ltd., whose accreditation agreement was terminated in February 2017, rogue pharmacy operators are desperate to find long-term partners to sponsor their illicit activities.

In recent months, we have identified thousands of rogue internet pharmacies that have migrated en masse to a handful of registrars.

There are currently around 900 accredited registrars. We found that of the identified illegal online pharmacies:

  • About 40% are registered with 10 registrars.
  • About 65% are registered with 40 registrars.
  • About 80% are registered with 100 registrars.

The remaining 800 or so registrars represent 20% of the share of known rogue pharmacies.

Which are the rogue registrars that willfully accept payment in exchange for providing domain name registration services to these illicit internet pharmacies? We’re glad you asked.

These safe-haven registrars are the same that refuse to respond to our abuse notifications. Unlike the vast majority of the industry (and contrary to ICANN’s specific guidance), these registrars incorrectly state that a court order is necessary to take action against the registrant of a domain name used as a rogue internet pharmacy. With great power comes great responsibility, and it’s a mystery why doing the right thing and acting in the best interest of the public should require a judicial order, especially in the age of information where word can travel both quickly and globally.

Of these noncompliant registrars, here are five that earned a spot on our “who’s who” list.

#1: Rebel Ltd.

Rebel is a registrar based in Barbados with operational branches in Canada, Turks and Caicos, and the UK, among other locations. Rebel continues to consistently sponsor thousands of domain names used by registrants that sell unapproved and counterfeit drugs. This figure includes more than 3,600 rogue internet pharmacies affiliated with CanadaDrugs, whose founder was arrested and extradited to the US on charges including conspiracy and international money laundering in June 2017. As noted in our testimony before the US House Judiciary Committee (see pages 15-16), Rebel has refused to take action against rogue pharmacies even after receiving photographic evidence of unapproved drugs purchased without a prescription.

#2: Hosting Concepts B.V. dba OpenProvider.

OpenProvider is a Netherlands-based registrar with operational branches in India, Spain, and Russia. During the past two years, OpenProvider has taken minimal action against rogue pharmacies included in our abuse notifications, despite lengthy correspondence with staff at the Netherlands branch. In February 2016, OpenProvider was informed via email that it was providing domain name services to more than 1,400 known rogue internet pharmacies. As of October 2017, this number has nearly doubled, and many of these are Nanjing Imperiosus refugees. Measured by unique registrants (as opposed to those like CanadaDrugs with multiple domain names under management), OpenProvider is the world’s leading safe haven for rogue internet pharmacies.

#3: Gransy s.r.o.d/b/a subreg.cz. 


Gransy is a largely noncompliant registrar based in the Czech Republic that responds slowly — if at all — to our abuse notifications. Gransy tends to suspend domain names containing falsified or erroneous registration data, irrespective of its customers obvious facilitation of criminal activity. This unfortunate attitude toward compliance provides a natural safe haven for various rogue networks. Many previously notified domains are still registered with Gransy and actively facilitating illicit sales.

#4: Epik, Inc.

Epik is a noncompliant registrar based in Seattle, Washington. Epik’s CEO, Rob Monster, refuses to take action against rogue internet pharmacies without a court order. Epik’s portfolio consists of a few hundred rogue pharmacies affiliated with RxProfits – DirectNet Partners (also known as OnlinePayMaster). In fact, many of the rogue internet pharmacies affiliated with this network that were included in an abuse notification to Rebel Ltd. in October 2016 transferred to Epik shortly before the complaint was closed. The majority of these websites are still online and actively selling prescription medications today.

#5: GKG.net

GKG is another US-based registrar in Bryan, Texas, that refuses to terminate domain name registration services to rogue internet pharmacy operators, including affiliates of spammy networks like Rx-Partners and Glavmed Affiliate Pharmacy Network. GKG is unique in that it doesn’t even follow its own abuse reporting standards and processes, which states that “other inappropriate content … performing obviously illegal activities” is considered abuse and will be handled accordingly. Most notably, when we provided them with a list of 183 rogue internet pharmacies using their services, they could “not determine any illegal act occurring with said domain(s)” and suggested we address our complaint with the hosting provider or obtain a court order. This thorough analysis transpired in record time — 19 minutes. Meanwhile, we were left in astonishment wondering how a website like this could be considered legal:

It isn’t clear what the future holds for these rogue registrars, but we will continue to apply pressure to them in the hope they shift toward valuing consumer safety above profit margins and adopt a policy of voluntary, proactive compliance.

  • Terry-on-disqus

    Cute that the web page .norxonlineproducts.com/contact.html depicts the Johnson & Johnson building, with the name photo-shopped and replaced with their own, as seen here: https://tineye.com/search/8ff6758bcf94373277ae8b86e3836f1cda59983b/
    Click on “[Compare match]” then click on “[Switch]” to see how it was done!

  • sol_ly

    Any knowledge of shutting down Internet Service Provider hosting to a
    Registrar? For example, at least two of the registrars are hosted by
    American ISPs, rather-very-well known ones–Amazon and Suddenlink. To
    me, if they are notified and take no action of discontinuing their
    hosting when notified, then (and before notification) they are “drug
    distributors” acting as corporations which are “people” distributing
    illegal chemicals–illegal drug distribution which people go to jail
    for.

    The Registrars are drug distributors too, especially after notification–drug distributor kingpin organizations.