Home

Asprox - Canadian/European Pharmacy

December 8, 2008 - 02:05 — Rune

I earlier wrote that the domains hosted on the Asprox botnet redirected to Canadian/European sites.
That were domains using the usual "naming pattern" of Asprox hosted domains, like site60.co.uk, ioctl2.jp, ole55.us etc.

Now you find other domain names like bestpharmweb.com and alike directly hosted on the botnet.
They still redirect to Canadian Pharmacy sites.
And I have not been able to spot new domain names using the older "naming pattern" the last days.
But those older ones that still exist also redirects to the same as the new ones.

I have not been able to find malicious javascripts, mule scams or phishing setups the last days.

A list of new domains hosted on the Asprox botnet found so far:

* No whois info, dead

bestpharmweb.com
buyemeds.com *
charmedshopper.com *
futuremedshop.com
pharm-on-net.com
pharmacuti.com *
pharmrepnet.com *
pharmwebdirect.com *
supermedshop.com ** (parked? - oversee.net)
sutives.com
themedssite.com *
untamedshopping.com *
yourpharmweb.com

REDIRECTS TO:
http://painmedsguide.com 58.20.129.200
http://painmedsworld.com 58.20.129.200
http://suremedsdirect.com 58.20.129.200
http://yourmedspharmacy.com 58.20.129.200
http://ezcanadameds.com 58.20.129.200

Whois example

Domain Name: BESTPHARMWEB.COM
   Registrar: MARCARIA.COM, INTERNATIONAL, INC.
   Whois Server: whois.marcaria.com
   Referral URL: http://www.marcaria.com
   Name Server: NS1.BESTPHARMWEB.COM
   Name Server: NS2.BESTPHARMWEB.COM
   Name Server: NS3.BESTPHARMWEB.COM
   Status: clientTransferProhibited
   Updated Date: 03-dec-2008
   Creation Date: 03-dec-2008
   Expiration Date: 03-dec-2009


Registration Service Provided By: NOMINUS.COM
Contact: +1.3058538434

Domain Name: BESTPHARMWEB.COM

Registrant:
    N/A
    Damian Rivera        (edintor885@gmail.com)
    6144B Nebraska Court
    Camp Lejeune
    North Carolina,28547
    US
    Tel. +001.9103009218

Creation Date: 03-Dec-2008
Expiration Date: 03-Dec-2009

Domain servers in listed order:
    ns3.bestpharmweb.com
    ns2.bestpharmweb.com
    ns1.bestpharmweb.com

Administrative Contact:
    N/A
    Damian Rivera        (edintor885@gmail.com)
    6144B Nebraska Court
    Camp Lejeune
    North Carolina,28547
    US
    Tel. +001.9103009218

Technical Contact:
    N/A
    Damian Rivera        (edintor885@gmail.com)
    6144B Nebraska Court
    Camp Lejeune
    North Carolina,28547
    US
    Tel. +001.9103009218

Billing Contact:
    N/A
    Damian Rivera        (edintor885@gmail.com)
    6144B Nebraska Court
    Camp Lejeune
    North Carolina,28547
    US
    Tel. +001.9103009218

Status:ACTIVE

; <<>> DiG 9.3.5-P2 <<>> bestpharmweb.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18902
;; flags: qr rd ra; QUERY: 1, ANSWER: 14, AUTHORITY: 3, ADDITIONAL: 0

;; QUESTION SECTION:
;bestpharmweb.com.              IN      A

;; ANSWER SECTION:
bestpharmweb.com.       600     IN      A       24.151.161.136
bestpharmweb.com.       600     IN      A       24.158.43.208
bestpharmweb.com.       600     IN      A       24.216.181.139
bestpharmweb.com.       600     IN      A       66.30.105.228
bestpharmweb.com.       600     IN      A       67.219.72.242
bestpharmweb.com.       600     IN      A       68.58.0.197
bestpharmweb.com.       600     IN      A       68.121.246.214
bestpharmweb.com.       600     IN      A       75.14.2.240
bestpharmweb.com.       600     IN      A       75.140.65.220
bestpharmweb.com.       600     IN      A       76.223.10.255
bestpharmweb.com.       600     IN      A       98.21.234.37
bestpharmweb.com.       600     IN      A       99.163.104.28
bestpharmweb.com.       600     IN      A       206.72.19.27
bestpharmweb.com.       600     IN      A       24.99.40.14

;; AUTHORITY SECTION:
bestpharmweb.com.       172800  IN      NS      ns1.bestpharmweb.com.
bestpharmweb.com.       172800  IN      NS      ns2.bestpharmweb.com.
bestpharmweb.com.       172800  IN      NS      ns3.bestpharmweb.com.

;; Query time: 365 msec
;; SERVER: 217.13.7.140#53(217.13.7.140)
;; WHEN: Sun Dec  7 23:56:01 2008
;; MSG SIZE  rcvd: 312