{"id":13270,"date":"2013-06-05T12:00:53","date_gmt":"2013-06-05T19:00:53","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=11319"},"modified":"2018-01-30T12:34:28","modified_gmt":"2018-01-30T19:34:28","slug":"pharmaceutical-scammers-impersonate-facebooks-notification-system-entice-users-into-purchasing-counterfeit-drugs","status":"publish","type":"post","link":"https://www.webroot.com/blog/2013\/06\/05\/pharmaceutical-scammers-impersonate-facebooks-notification-system-entice-users-into-purchasing-counterfeit-drugs\/","title":{"rendered":"Pharmaceutical scammers impersonate Facebook’s Notification System, entice users into purchasing counterfeit drugs"},"content":{"rendered":"

By Dancho\u00a0Danchev<\/strong><\/p>\n

Opportunistic pharmaceutical scammers are currently spamvertising tens of thousands of bogus emails impersonating Facebook’s Notification System in an attempt to trick users into clicking on the links, supposedly coming from a trusted source. Once users click on the links found in the fake emails, they’re exposed to counterfeit pharmaceutical items<\/strong><\/a> available for purchase without a prescription.<\/p>\n

More details:<\/p>\n

<\/p>\n

Sample screenshot of the spamvertised email:<\/strong><\/p>\n

\"Facebook_Notification_Fake_Bogus_Pharmaceutical_Scam_01\"<\/a><\/p>\n

Counterfeit pharmaceutical URL:<\/strong> hxxp:\/\/medicinetabreckitt.com<\/em> – 69.64.37.9 – Email: davis@medicinetabreckitt.com<\/p>\n

Sample screenshot of the landing URL:<\/strong><\/p>\n

\"Facebook_Notification_Fake_Bogus_Pharmaceutical_Scam\"<\/a><\/p>\n

Known to have responded to the same IP, are the following fraudulent domains\/subdomains:<\/strong>
\nbizmowerstore.com<\/em>
\nwhiv.ru<\/em>
\nwiskicare.eu<\/em>
\nwlptab.pl<\/em>
\nsalerxhighest.nl<\/em>
\nmedpillped.pl<\/em>
\nbrennanlisprescription.nl<\/em>
\nbulimic.marijuanapharmedical.com<\/em>
\ncanadaviagracanadas.com<\/em>
\ncanadaviagracent.com<\/em>
\nmail.medicarepillscms.com<\/em>
\nmail.mymedicalpill.com<\/em>
\nmail.newpharmedicine.com<\/em>
\nmdnowbe.pl.ua<\/em>
\nmdnowtiny.pl.ua<\/em>
\nmdnowtoe.pl.ua<\/em>
\nmdnowtune.pl.ua<\/em>
\nmedicalpharmacists.com<\/em>
\nmedicarepharmdeficit.com<\/em>
\nmedpillped.pl<\/em>
\nmehervato.com<\/em>
\nmentalrx.pl<\/em>
\nnewpharmedicine.com<\/em>
\nnrytgyxvom.com<\/em>
\nns2.neslyngei.com<\/em>
\npharmticker.com<\/em>
\nrxcarestore.com <\/em>
\nweightdietrx.pl<\/em>
\nshortlisted.welnesscanadalberta.com<\/em>
\nsmoothtongued.welnesscanadalberta.com<\/em>
\nspheroid.welnesscanadalberta.com<\/em>
\nraining.welnesscanadalberta.com<\/em>
\ntelevisual.welnesscanadalberta.com<\/em>
\nreactionaries.welnesscanadalberta.com<\/em>
\nstipples.welnesscanadalberta.com<\/em>
\nvenders.welnesscanadalberta.com<\/em>
\ntabletmedicineipad.com<\/em>
\nquavered.thetabletmedicine.com<\/em>
\nunbracketed.thetabletmedicine.com<\/em>
\ntsetse.thetabletmedicine.com<\/em>
\nweatherproof.thetabletmedicine.com<\/em>
\nwhitish.thetabletmedicine.com<\/em>
\nwoodmen.thetabletmedicine.com<\/em>
\nprioritisation.thetabletmedicine.com<\/em>
\nstrider.thetabletmedicine.com<\/em>
\nunderlinings.thetabletmedicine.com<\/em>
\nruinations.thetabletmedicine.com<\/em>
\nprojects.thetabletmedicine.com<\/em>
\nsatirically.thetabletmedicine.com<\/em>
\nrotator.viagrahealthcarebiotech.com<\/em>
\ntaffeta.viagramedbosch.com<\/em>
\nuncapped.viagramedbosch.com<\/em>
\nreunited.viagramedbosch.com<\/em>
\nroommate.viagramedbosch.com<\/em>
\nunderlying.viagramedbosch.com<\/em>
\nwildfowl.viagramedbosch.com<\/em>
\nwoodpecker.viagramedbosch.com<\/em>
\ntwiddles.viagramedbosch.com<\/em>
\nreshapes.viagramedbosch.com<\/em>
\nteat.viagramedbosch.com<\/em>
\nunaffectedly.viagramedbosch.com<\/em>
\ntorontocanadapharm.com<\/em>
\nviagrahealthcarebioportfolio.com<\/em>
\nsequins.torturelismeds.com<\/em>
\npyromaniac.torturetabcialis.com<\/em>
\nproofed.torturetabcialis.com<\/em>
\nsurcharged.torturetabcialis.com<\/em>
\nsword.torturetabcialis.com<\/em>
\nscythe.torturetabcialis.com<\/em>
\nunalterable.torturetabcialis.com<\/em>
\ntruffle.torturetabcialis.com<\/em>
\nproceeding.torturetabcialis.com<\/em>
\nrustling.torturetabcialis.com<\/em>
\nthrottling.torturetabcialis.com<\/em>
\nspringclean.torturetabcialis.com<\/em>
\nunmasks.torturetabcialis.com<\/em>
\nrepeals.torturetabcialis.com<\/em>
\nprophetess.torturetabcialis.com<\/em>
\nsoft.torturetabcialis.com<\/em>
\npurview.torturetabcialis.com<\/em>
\nregretful.viagraphysicians.com<\/em>
\nstrangles.viagraphysicians.com<\/em>
\nshutup.vitaminherbalwelness.com<\/em>
\nviagralevitratax.com<\/em>
\nswitcher.viagralevitax.com<\/em>
\nvictims.viagralevitax.com<\/em>
\nslippery.viagralevitax.com<\/em>
\nrequisitioned.welnessmedicineveterinary.com<\/em>
\nunimaginable.welnessmedicineveterinary.com<\/em>
\nslurring.welnessmedicineveterinary.com<\/em>
\nrug.welnessmedicineveterinary.com<\/em>
\ntough.welnessmedicineveterinary.com<\/em>
\nunbeaten.welnessmedicineveterinary.com<\/em>
\nsquirms.welnessmedicineveterinary.com<\/em>
\nraisins.welnessmedicineveterinary.com<\/em>
\nrearmament.welnessmedicineveterinary.com<\/em>
\ntoffy.welnessmedicineveterinary.com<\/em>
\nsignally.welnessmedicineveterinary.com<\/em>
\ntensity.welnessmedicineveterinary.com<\/em>
\ntabletspharmacytabs.ru<\/em><\/p>\n

Earning revenue while participating in a pharmaceutical affiliate network<\/strong><\/a>, the scammers behind these campaigns have a proven record of impersonating legitimate and trusted brands in an attempt to trick users into clicking on the links. The ultimate question – is someone actually buying these counterfeit drugs? The answer is surprisingly, yes, with the U.S accounting for 72% of pharmaceutical orders<\/strong><\/a>, according to research published last year.<\/p>\n

Users are advised to avoid interacting with such Web sites, and to consider reporting them as fraudulent immediately.<\/p>\n

You can find more about Dancho\u00a0Danchev at his\u00a0LinkedIn Profile<\/a><\/strong>.\u00a0<\/em>Y<\/em>ou can also\u00a0follow him on Twitter<\/a><\/strong>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

By Dancho\u00a0Danchev Opportunistic pharmaceutical scammers are currently spamvertising tens of thousands of bogus emails impersonating Facebook’s Notification System in an attempt to trick users into clicking on the links, supposedly coming from a trusted source. Once users click on the links found in the fake emails, they’re exposed to counterfeit pharmaceutical items available for purchase […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[4037,10299,14869,12793,9781,12795,9677,5735,4459,14879,5613,14877,14873,5605,11051,12771,14871,3529,14875,3471],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/13270"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=13270"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/13270\/revisions"}],"predecessor-version":[{"id":23818,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/13270\/revisions\/23818"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=13270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=13270"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=13270"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=13270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}