Tag Archives: pharma spam

Google Translate used by spammers to bypass Anti-Spam filters

Google Translate is a free service created by Google that translates any web page, content or document from native language to a language specified by the user that is using the service. We have noticed that some spam messages contain links to websites that use the service Google Translate to translate their page content, but those links are used to promote fraudulent pharmaceutical products, and they seem to use Google Translate to masquerade the malicious website.

In short, when you translate an URL with Google Translate, it appends the URL of the web page in the HTTP query string, but the initial domain name remains translate.googleusercontent.com, so the anti-spam filters may be bypassed because the URL of Google Translate is classified as legitimate.

To get a better idea about what I am talking about, check this image:

translate-google-used-for-spam

We have extracted some URLs from the spam messages and they are all subdomains of yolasite(dot)com, they are used to promote selling of fake pharmaceutical products and subscriptions to fraudulent casino websites:

hxxp:// myonlinestore1. yolasite.com/shop
hxxp:// onlineshop63. yolasite.com/shop
hxxp:// onlinecasino27. yolasite.com/casino2

Never click on links that start with the domain “translate.googleusercontent.com”, because they may use Google Translate to translate a malicious website and exploit vulnerabilities in your web browser or other applications installed in your system (such as Adobe Flash, PDF Readers, Java) to infect your PC.

If you want to translate a website, you should visit directly with your browser the website of Google Translate and type the URL that you want to translate. Avoid clicking on links related to Google Translate, present in emails or in other unknown websites.

Canadian pharmacy spam is back again

We logged a new massive spam campaign using Yahoo Groups’s users accounts to display clickable images of pharmaceutical products and to redirect users in the fraudolent website. This kind of technique is most probably used to bypass security filters of anti-spam software.

Few links extracted:

hxxp://groups.yahoo .com/group/alandpenberthygy/message
hxxp://groups.yahoo .com/group/yehoshuacobazw/message
hxxp://groups.yahoo .com/group/mcculloughabeitao/message
hxxp://groups.yahoo .com/group/boddusteptoesm/message
hxxp://groups.yahoo .com/group/seennlovelykn/message
hxxp://groups.yahoo .com/group/zevmacconnelldl/message
hxxp://groups.yahoo .com/group/joulouncapperm/message
hxxp://groups.yahoo .com/group/rajeshrelphb/message
hxxp://groups.yahoo .com/group/ilantrevathanny/message
hxxp://groups.yahoo .com/group/dorrelltrinklea/message
hxxp://groups.yahoo .com/group/tebibmatopebj/message
hxxp://groups.yahoo .com/group/danlanaganu/message
hxxp://groups.yahoo .com/group/xenetotsimpkinsqe/message
hxxp://groups.yahoo .com/group/kerncogero/message
hxxp://groups.yahoo .com/group/exrsrlsr/message

All these links contain the same image:

Image

And the malicious pharmaceutical sites promoted are:

hxxp://medicaltopatom .com:8080/
hxxp://superdrugsudden .com:8080/
hxxp://perfectpillcool .com:8080/

Image

Medicaltopatom.com WHOIS:

Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Whois Server: whois.dns.com.cn
Referral URL: http://www.dns.com.cn
Status: clientTransferProhibited

Expiration Date: 2011-07-21
Creation Date: 2010-07-21
Last Update Date: 2010-08-05

Name Servers:
ns1.medicaltopatom.com
ns2.medicaltopatom.com
ns3.medicaltopatom.com
ns4.medicaltopatom.com

Organisation Name…. hong zhongzhen
Organisation Address. shichengdadao29
Organisation Address.
Organisation Address. hangzhou
Organisation Address. 315029
Organisation Address. ZJ
Organisation Address. CN

Admin Name……….. hongzhongzhen
Admin Address…….. shichengdadao29
Admin Address……..
Admin Address…….. hangzhou
Admin Address…….. 315029
Admin Address…….. ZJ
Admin Address…….. CN
Admin Email………. juiajl@yeah.net
Admin Phone………. +86.57158905471
Admin Fax………… +86.57158905471

Superdrugsudden.com WHOIS:

Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Whois Server: whois.dns.com.cn
Referral URL: http://www.dns.com.cn
Status: clientTransferProhibited

Expiration Date: 2011-07-21
Creation Date: 2010-07-21
Last Update Date: 2010-08-04

Name Servers:
ns1.superdrugsudden.com
ns2.superdrugsudden.com
ns3.superdrugsudden.com
ns4.superdrugsudden.com

Organisation Name…. lin xinhao
Organisation Address. xuchangshiliuyilu15hao
Organisation Address.
Organisation Address. xuchang
Organisation Address. 461691
Organisation Address. HA
Organisation Address. CN

Admin Name……….. linxinhao
Admin Address…….. xuchangshiliuyilu15hao
Admin Address……..
Admin Address…….. xuchang
Admin Address…….. 461691
Admin Address…….. HA
Admin Address…….. CN
Admin Email………. dvbdsbebvdb@126.com
Admin Phone………. +86.3742661510
Admin Fax………… +86.3742661510

Perfectpillcool.com WHOIS:

Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Whois Server: whois.dns.com.cn
Referral URL: http://www.dns.com.cn
Status: clientTransferProhibited

Expiration Date: 2011-07-21
Creation Date: 2010-07-21
Last Update Date: 2010-08-06

Name Servers:
ns1.perfectpillcool.com
ns2.perfectpillcool.com
ns3.perfectpillcool.com
ns4.perfectpillcool.com

Organisation Name…. wang jitai
Organisation Address. jiningshichangqinglu7hao
Organisation Address.
Organisation Address. jining
Organisation Address. 273500
Organisation Address. SD
Organisation Address. CN

Admin Name……….. wangjitai
Admin Address…….. jiningshichangqinglu7hao
Admin Address……..
Admin Address…….. jining
Admin Address…….. 273500
Admin Address…….. SD
Admin Address…….. CN
Admin Email………. betty999_cool@yeah.net
Admin Phone………. +86.5372226919
Admin Fax………… +86.5372226919

100 spam links found in compromised webpage

An user has recently submitted us a link of a compromised website used to host a webpage full with pharmaceutical spam links, here is the full list of the suspicious links extracted from the malicious page:

acompliarimonabant.com95.211.27.234
buyavapro.org95.211.27.234
buyrimonabant.biz95.211.27.234
cialis10.net95.211.27.234
cialispaypal.com95.211.27.234
cialispaypal.net95.211.27.234
cialisprice.ca95.211.27.234
cialisprice.co.uk95.211.27.234
generic-tadalafil.net95.211.27.234
propeciageneric.net95.211.27.234
propeciahairloss.net95.211.27.234
sildenafilviagra.net95.211.27.234
tadalafil-20mg.net95.211.27.234
tadalafilcialis.com95.211.27.234
viagra-vs-cialis.com95.211.27.234
buycoreg.net95.211.27.234
buyfrumil.com95.211.27.234
online-propecia.net95.211.27.234
cialis5.com95.211.27.234
20mg.genericcialistadalafil.net95.211.27.234
50mg.sildenafilviagra.net95.211.27.234
onlinecialis.ca95.211.27.234
viagrabuy.ca95.211.27.234
purchasecialisonline.net95.211.27.234
cialis-price.net95.211.27.234
cialisdailyuse.net95.211.27.234
genericcialistadalafil.net95.211.27.234
costofcialis.com95.211.27.234
5mgcialis.net95.211.27.234
dosagecialis.com95.211.27.234
cialisprofessionalvscialis.com95.211.27.234
costcialis.com95.211.27.234
pricecialis.com95.211.27.234
lowdoseviagra.com95.211.27.234
viagratabletsforsale.com95.211.27.234
cheapviagrapills.net95.211.27.234
viagra100mgdose.com95.211.27.234
viagratablets.biz95.211.27.234
onlinebuyviagra.com95.211.27.234
cialis-online.ca95.211.27.234
cialis-canada.ca95.211.27.234
cialiscanada.eu95.211.27.234
orderviagraonline.eu95.211.27.234
purchaseviagraonline.eu95.211.27.234
buyviagrasoft.biz95.211.27.234
buyviagrasoftonline.com95.211.27.234
cialispro.com95.211.27.234
cialiscena.com95.211.27.234
howmuchdoescialiscost.com95.211.27.234
buylevitra.eu95.211.27.234
cialis5mgprice.com95.211.27.234
cialisnextdaydelivery.com95.211.27.234
withoutprescription.acompliarimonabant.com95.211.27.234
cialistadalafil.co.uk95.211.27.234
buycialisfromindia.com95.211.27.234
buyviagrasoftonline.net95.211.27.234
viagrasofttablets.com95.211.27.234
viagrasoftpills.net95.211.27.234
buycialisonline.me.uk95.211.27.234
cialisdailyuse.co.uk95.211.27.234
amoxil500mg.net95.211.27.234
celexadrug.net95.211.27.234
clomidformen.com95.211.27.234
cytotec100mg.com95.211.27.234
levitra20.com95.211.27.234
buylevitrawithoutprescription.com95.211.27.234
cialiserection.co.uk95.211.27.234
celebrexmedication.net95.211.27.234
deltasonemedication.com95.211.27.234
doxycyclinedosage.com95.211.27.234
nexiummedication.net95.211.27.234
clomidovulation.com95.211.27.234
clomidsuccess.net95.211.27.234
diflucandosage.com95.211.27.234
flomaxrelief.net95.211.27.234
lasixpills.com95.211.27.234
dailycialis.co.uk95.211.27.234
cialisinformation.co.uk95.211.27.234
levaquindosage.com95.211.27.234
inderaldrug.com95.211.27.234
inderalsideeffects.net95.211.27.234
levaquinuses.com95.211.27.234
cialisvsviagra.ca95.211.27.234
viagraincanada.com95.211.27.234
lexapro10mg.net95.211.27.234
lipitor20mg.net95.211.27.234
neurontinsideeffects.com95.211.27.234
buycialisincanada.com212.48.8.140
cheapcialisaustralia.com212.48.8.140
cheapcialispills.net212.48.8.140
cheapcialisprices.com212.48.8.140
cheapcialistablets.com212.48.8.140
cipro500mg.net95.211.27.234
doxycyclinehyclate100mg.com95.211.27.234
lasixdrug.net95.211.27.234
nizoral200mg.com95.211.27.234
nolvadex10mg.com95.211.27.234
norvasc5mg.net95.211.27.234
paxildosage.com95.211.27.234
plavixdrug.com212.48.8.140
prednisoneuses.com95.211.27.234
premarintablets.com212.48.8.140
stratteraonline.net95.211.27.234
synthroidonline.net95.211.27.234
tenorminonline.com95.211.27.234
topamaxdosage.com95.211.27.234
weightlossalli.com95.211.27.234
xenical120mg.net95.211.27.234
zithromaxdosage.com95.211.27.234
buyaccutane.ca95.211.27.234
buynexium.ca95.211.27.234
buyzithromax.ca95.211.27.234
buyzovirax.ca95.211.27.234
cialisviagra.ca95.211.27.234
lipitorcanada.ca95.211.27.234
viagradose.ca95.211.27.234
viagranoprescription.ca95.211.27.234
cialisdrug.ca95.211.27.234
cialisincanada.ca95.211.27.234
cialistadalafil.ca95.211.27.234
cialis20mgdosage.com212.48.8.140
cialis5mgcanada.com212.48.8.140
cialis5mgonline.com212.48.8.140
cialisaustralia.net212.48.8.140
cialisovernightdelivery.com212.48.8.140
cialus.net95.211.27.234
genericsofttabs.com95.211.27.234
genericviagraindia.com95.211.27.234
tadalafilo.net95.211.27.234
cialiscalgary.com212.48.8.140
cialisdailycost.com212.48.8.140
cialisindia.net95.211.27.234
cialisoverthecounter.net212.48.8.140
cialisprofessionalonline.com212.48.8.140
cialisvancouver.com212.48.8.140
genericcheap.net95.211.27.234
genericcheap.net95.211.27.234
genericcheap.net95.211.27.234
genericcheap.net95.211.27.234
top10weightloss.net95.211.27.234

Here is a list of the text used in the title tag of the href of these links:

pills acomplia rimonabant
cheap buy avapro
cheapest buy rimonabant
discount cialis 10
cheap cialis paypal
best cialis paypal
buy cialis price
brand cialis price
pharm generic tadalafil
order propecia generic
drugs propecia hair loss
with no Prescription sildenafil viagra
online tadalafil 20mg
buy tadalafil cialis
discount viagra vs cialis
buy buy coreg
with no Prescription buy frumil
discount online propecia
purchase cialis 5
generic generic cialis tadalafil 20mg
drugs viagra sildenafil 50mg
pills online cialis
with no Prescription viagra buy
fast delivery purchase cialis online
generic cialis price
tablets cialis daily use
discount generic cialis tadalafil
generic cost of cialis
tablets cialis 5mg
here cialis dosage
now cialis professional vs cialis
low prices cialis cost
prices cialis price
best low dose viagra
cheap viagra tablets for sale
rx cheap viagra pills
buy viagra 100 mg dose
generic viagra tablets
fast delivery buy viagra online
buy cialis online
online cialis canada
buy cialis canada
drugs order viagra online
pills purchase viagra online
buy buy viagra soft
prices buy viagra soft online
pills cialis pro
discount cialis cena
with no Prescription how much does cialis cost
order buy levitra
with discount cialis 5mg price
pharmacy cialis next day delivery
generic acomplia rimonabant without prescription
with discount cialis tadalafil
purchase buy cialis from india
drugs buy viagra soft online
low prices viagra soft tablets
buy viagra soft pills
drugs buy cialis online
purchase cialis daily use
best amoxil 500 mg
fast delivery celexa drug
tablets clomid for men
cheap cytotec 100 mg
now levitra 20
with discount buy levitra without prescription
with no Prescription cialis erection
pharmacy celebrex medication
purchase deltasone medication
now doxycycline dosage
low prices nexium medication
discount clomid ovulation
with no Prescription clomid success
now diflucan dosage
prices flomax relief
brand lasix pills
pharmacy daily cialis
drugs cialis information
prices levaquin dosage
here inderal drug
cheapest inderal side effects
cheap levaquin uses
generic cialis vs viagra
pharmacy viagra in canada
pharmacy lexapro 10 mg
online lipitor 20 mg
best neurontin side effects
prices buy cialis in canada
with discount cheap cialis australia
order cheap cialis pills
here cheap cialis prices
drugs cheap cialis tablets
tablets cipro 500mg
generic doxycycline hyclate 100mg
with no Prescription lasix drug
pills nizoral 200mg
buy nolvadex 10mg
pharmacy norvasc 5mg
tablets paxil dosage
purchase plavix drug
pharm prednisone uses
with no Prescription premarin tablets
buy strattera online
with discount synthroid online
best tenormin online
now topamax dosage
fast delivery weight loss alli
prices xenical 120mg
now zithromax dosage
fast delivery buy accutane
cheap buy nexium
buy buy zithromax
here buy zovirax
prices cialis viagra
brand lipitor canada
buy viagra dose
brand viagra no prescription
tablets cialis drug
with discount cialis in canada
tablets cialis tadalafil
rx cialis 20mg dosage
here cialis 5mg canada
here cialis 5mg online
rx cialis australia
prices cialis overnight delivery
rx cialus
with no Prescription generic soft tabs
purchase generic viagra india
with discount tadalafilo
pills cialis calgary
buy cialis daily cost
cheapest cialis india
low prices cialis over the counter
purchase cialis professional online
prices cialis vancouver
pharmacy generic cheap
tablets generic viagra
rx generic cialis
pills generic levitra
with discount top 10 weight loss