No pharmacy other than a US based Online Pharmacy is worth its weight.
Generic meds in China, India and other countries have side effects.
Imagine generic viagra causes impotence due to increased errection
time.

Buy at US Online Pharmacy:
[url]http://www.top-ten-internet-gambling-online-casino-sites.com/online-pharmacy.html[
/url]





fhh <fhh@nospam.demon.invalid> wrote in message news:<10egifppn0mdd5@corp.supernews.com>...[
vbcol=seagreen]
> Contents:
> - HBE pharmacy is run by 6-10 Canadians
> - Spam broker of HBE pharmacy
> - Mailers of HBE pharmacy
> - Trojans used by HBE pharmacy
> - An angry customer of HBE pharmacy
>
>  ========================================
======================
>         HBE pharmacy is run by 6-10 Canadians
>  ========================================
======================
> Up to now I have identified more than 10 sponsors and mailers running an
> online pharmacy called "HBE Pharmacy". This pharmacy has bulletproof
> websites hosted in China. It's nameserver domains have been (among others)
> lifesmile.biz, nns1.net, nns2.net, nnse3.net, marketingg1.net, nsmarkk1.ne
t.
> Many of the persons working for this pharmacy appear to live in either
> Toronto or Montreal. To mention a few, I am pretty sure that
>
> Xavier Ratelle (simm.qc.ca,intersexe.com, Service Netvision, Montreal),
> Bertrand (Bert) Gravel (bertgravel.com, Montreal),
> Nate Poupko (slickcash.com, sexpromote.com, date.com, Toronto),
> Shannon Crane (piecash.com, Toronto)
> Guillaume Metayer (metayer.info, Montreal) and
> Alex Frigon (alexfrigon.com, Toronto)
>
> are involved. I found their names, domains and email addresses at several
> places, including whois information, sale statistics, files with details o
n
> affiliates and an email message.
>
>
>  ========================================
======================
>                 Spam broker of HBE pharmacy
>  ========================================
======================
> Shannon Crane has been working as a spam broker, ie she is an intermediary
> between the online pharmacy and mailers who are sending massive amounts of
> emails advertizing the online pharmacy. I believe members of the HBE
> pharmacy have been sending spam themselves as well. In fact back in May 20
04
> I logged spam attempts from IP 69.44.152.221 on a monitored computer
> infected by a trojan used by the HBE pharmacy. Shannon is a female
> webmaster from Toronto who is using nicknames like Trafficqueenxxx
> ( AT yahoo.com), Shann and Hootie. She has been working for piecash.com (a
> porn affiliate program) as well.
>
> She has posted messages on specialham.com using nickname "Hootie":
> (disable javascript in your browser when viewing these pages)
>
> [March 11 2004 ][Hootie has a new genitals enhancement sponsor]
> http://www.specialham.com/specialham/m_11065/tm.htm
>
> [April 21 2004][This sponsor is advertized one more]
> http://www.specialham.com/specialham/m_11857/tm.htm
>
> [April 22 2004]
> http://www.specialham.com/specialha...57/tm.htm#11878
> | I have 12 mailers sending to this product.
> |
> | I have been referring to this company for about 2 months, and I have bee
n
> | in this business for almost 5 years, not always doing referrals but
> | working with sites, adult, non adult and products.
>
> [June 8 2004]
> http://www.specialham.com/specialham/m_12171/tm.htm
> | Always looking for new mailers
>
> [June 8 2004][Hootie replies to a query of one of her mailers, may
or420]
> http://www.specialham.com/specialham/m_12202/tm.htm
>
> [Hootie has a DVD sponsor as well]
> http://www.specialham.com/specialha...00/tm.htm#11901
>
> [Hootie is looking for a casino sponsor]
> http://www.specialham.com/specialham/m_12366/tm.htm
>
> The mailers of Hootie/Shannon have sent hunderds of millions of spam
> messages. Perhaps you remember spamruns with referral IDs like
> shan03, shan05, shan06:
>
> http://tinyurl.com/225we  [Google search on refid=shan03+abuse]
> http://tinyurl.com/25rba [Google search on refid=shan05+abuse]
> http://tinyurl.com/34og8  [Google search on refid=shan06+abuse]
>
> Indeed these spamruns have been organized by Shannon/Hootie/trafficqueenxx
x.
> Later the referral ID's got a number:
>
> shan03 -> 35
> shan05 -> 36
> shan06 -> 37
>
> To appreciate the full exposure of the three earlier mentioned mailers
> you have to add these spamruns as well:
>
> http://tinyurl.com/24u8b [Google search on refid=35+abuse]
> http://tinyurl.com/2ow7m [Google search on refid=36+abuse]
> http://tinyurl.com/2332d [Google search on refid=37+abuse]
>
>
>  ========================================
======================
>                 Mailers of HBE pharmacy
>  ========================================
======================
> Who are the mailers?
>
> Affiliate no 37 uses nickname "kenchuks" . Probably this is
> Mr. Chukwuali (Toronto), who owns domain blackboxhosting.biz .
>
> Affiliate no 36 uses (nick)name "Francis Vallière" .
>
> Affiliate no 35 calls himself "Chang Peng Seong" and uses email address
> ronn77 AT streamyx.com (Malaysia) .
>
>
> There are more spamruns which can be related directly to Shannon:
>
> http://groups.google.com/groups?q=refid=56+abuse
> http://groups.google.com/groups?q=refid=58+abuse
> http://groups.google.com/groups?q=refid=59+abuse
> http://groups.google.com/groups?q=refid=61+abuse
> http://groups.google.com/groups?q=refid=72+abuse
> http://groups.google.com/groups?q=refid=86+abuse
> http://groups.google.com/groups?q=refid=117+abuse
> http://groups.google.com/groups?q=refid=179+abuse
>
> These mailings have been done by mailers who are explicitly mentioned as
> subaffiliates of Shannon in evidence files I have.
>
>
> Other affiliates include:
>
> Michael Guidry, phifli AT yahoo.com . He was the owner of domain
> easystyle.org . Check out his spam records: http://tinyurl.com/2zxq9 .
>
> gescenter.com, assafba AT gescenter.com.
> Spamruns: http://tinyurl.com/2yh5m4633  . This once more gives evidence th
at
> gescenter.com is involved in spam activities.
>
> "Schmokeseed", probably schmokeseed AT aol.com / schmokeseed
> AT yahoo.com . Spamruns in google: http://tinyurl.com/3y2mr .
>
> "Todd Moeller", trillsseeds AT aol.com, telephone-leads.com .
> Spamruns for HBE pharmacy: http://tinyurl.com/2cz8f
> Specialham.com contains evidence that someone using a telephone-leads.com
> account does phish sites as well: sean AT telephone-leads.com posted:
> http://www.specialham.com/specialham/m_6476/tm.htm
> http://www.specialham.com/specialha...09/tm.htm#11813
>
> Persons related to
>
> shiverMedia.com / xxxtremetraffic.com
> mistressnetbabe.com
> vxpromotions.com
> abraxasentertainment.com
> platinum-dollars.com
> e-carting.com
> cpadollars.com
> redbills.com
> youngdesire.com / b2netsolutions.com
> smoothbucks.com
> soulcash.com
> hausofporn.net
> wivesonline.com
> floridfusion.com
> xemails.com
> sexpromote.com
> blackshots.com
> sizzle.com
> mysmallcock.com
> imageination.com
> unordinary.biz
> girlsbangedup.net
>
>
>  ========================================
======================
>                 Trojans used by HBE pharmacy
>  ========================================
======================
> May 2004 I have logged attempts to spread HBE pharmacy trojans through spa
m
> messages:
> http://groups.google.com/groups?sel...p.supernews.com
>
> HBE pharmacy is spreading trojans through porn links as well: Currently
> marketing73.com (and mark8ting.biz) hosts a trojandownloader kopt32.exe" .
> This trojan gets constructed by a VB script on marketing73.com. A fully
> patched Windows system won't install this trojan automatically. However a
> Verisign software certificate signed by "Netvision" is presented to the
> user ( http://www.marketing73.com/IE_plugin.cab ). When the user accepts
> this certificate, the trojan is installed. A Windows system that has not
> been patched properly may load the trojan automatically. The trojanloader
> calls home to advancemtk.com or marketigntools23.com (an analysis of the
> trojan reveals bestmarketing245.com as well, but this domain has been
> deleted on April 24 2004) and downloads files from directory
> http://advancemtk.com/program .
>
>
> Relevant files:
>
> http://www.marketing73.com/index.html
> http://www.marketing73.com/IE_plugin.php
> http://www.marketing73.com/pre.php (refers to pre.hta)
> http://www.marketing73.com/pre.hta (contains the trojan)
> http://www.marketing73.com/IE_plugin.cab
>
> Marketing73.com is hosted on 218.65.86.41, 218.65.120.170 and
> 219.147.198.137. It's authoritative nameservers are ns1.nns1.net,
> ns1.nns2.net, ns1.nnse3.net . On these IP addresses dozens of HBE meds
> domains are hosted as well.
>
> The webpages
>
> http://www.marketing73.com/mp3
> http://www.marketing73.com/livecams
> http://www.marketing73.com/warez
>
> have been advertized on several pages of ranks.sextracker.com and
> elite.sextracker.com . Google has stored relevant pages in its cache:
> http://www.google.com/search?q="marketing73.com"
>
> These above mentioned links contain the same VB script as
> http://www.marketing73.com/ . This script tries to install a trojanloader.
>
> http://www.marketing73.com/mp3/index.html uses a counter:
> http:/counter4.sextracker.com/c30/id/0/370739
>
> $ dig sextracker.com
> [...]
> sextracker.com.         21563   IN      A       207.246.136.167
>
> ;; AUTHORITY SECTION:
> sextracker.com.         34261   IN      NS      ns1.flyingcroc.net.
> sextracker.com.         34261   IN      NS      ns2.flyingcroc.net
>
> The domain sextracker.com is registered by
>
> Flying Crocodile, Inc Flying Crocodile, Inc
> Flying Crocodile, Inc
> 417 Virginia St. #200
> Seattle, WA  98101
> US
>
> Apparently Flying Crocodile is assisting the HBE pharmacy in spreading
> trojans.  Note that possibly Flying Crocodile didnot know about this abuse
> beforehand.
>
>
>  ========================================
======================
>                 An angry customer of HBE pharmacy
>  ========================================
======================
> I have contacted a customer of HBE pharmacy. He told me that the medicines
> he ordered came from India. He also told me that he is checking these
> medicines at a laboratory. He gave me information where the money paid to
> HBE pharmacy goes. I want to double check this information before I publis
h
> the details of the person who possibly is getting the money paid to HBE
> pharmacy.[/vbcol]

[ Post a follow-up to this message ]