Clicky
Last visit was: Sat Jul 05, 2014 4:54 pm
It is currently Sat Jul 05, 2014 4:54 pm

Pharmacy Expressorator (tm)


All times are UTC - 5 hours [ DST ]


 [ 214 posts ]  Go to page Previous  1 ... 10, 11, 12, 13, 14, 15  Next
Author Message
 PostPosted: Fri Dec 01, 2006 6:31 pm   
Spam Observer
User avatar

Joined: Fri Nov 17, 2006 5:14 pm
Posts: 73
Ok, problem solved. I had the restriction on what javascript can do set too tight.
I had scripts prevented from:
-Disable or replace context menus
-Hide the status bar
-Change status bar text

Apparently one or more of these is required for the 'nator to run properly.


Top
 Profile  
 PostPosted: Fri Dec 01, 2006 6:46 pm   
Site Admin
User avatar

Joined: Tue May 09, 2006 9:18 am
Posts: 5022
Dark Angel wrote:
Ok, problem solved. I had the restriction on what javascript can do set too tight.
I had scripts prevented from:
-Disable or replace context menus
-Hide the status bar
-Change status bar text

Apparently one or more of these is required for the 'nator to run properly.


Actually none of the above, but it does dynamically write content to the browser, which it sounds like the context menu item would be responsible for. (They should be more broad.)

Thanx for this feedback!

SiL


Top
 Profile  
 PostPosted: Fri Dec 01, 2006 6:48 pm   
Spammer Killing Machine
User avatar

Joined: Mon Nov 13, 2006 6:02 pm
Posts: 463
spamislame wrote:
You'll want to use TOR on this. All of my genuine IP's are banned so I constantly see the "bank didn't authorize that card" message. Switch to TOR: that goes away.

I can't seem to get TOR to want to work on my 'puter... I'll have to keep trying.


Top
 Profile  
 PostPosted: Fri Dec 01, 2006 7:12 pm   
Site Admin
User avatar

Joined: Tue May 09, 2006 9:18 am
Posts: 5022
Interesting! It now always tries to download the final cart.asp page. They must be sensing these orders somehow.

This means I have to move to a firefox extension build or greasemonkey script.

This is excellent! I hope it cost them some $$$

Thanx folks.

SiL


Top
 Profile  
 PostPosted: Sun Dec 03, 2006 3:29 am   
Spam Reporter
User avatar

Joined: Sat May 27, 2006 5:15 am
Posts: 120
SpamH8R wrote:
I changed my identity with each order, but I couldn't check it with dnsstuff. They banned (?) me after a couple of refreshes. I was trying to see where my new identity was "from", so I could geographicly match my fake name as close as possible by refreshing the Expressorator page.
Try using Vidalia (a GUI for Tor). This allows you to view a network map with your current connections listing which nodes they are going through. You can have multiple routes active at once if you are sending a lot of traffic, but when accessing a single webpage, it is usually straightforward to see the exit node name and then look up its details.
SpamH8R wrote:
Only two times I got a Privoxy's 404 page "No such domain"... don't know why.
This will happen fairly frequently - when you're going through 3 nodes, a problem with any of them will result in a lost connection.


Top
 Profile  
 PostPosted: Sun Dec 03, 2006 1:59 pm   
Site Admin
User avatar

Joined: Tue May 09, 2006 9:18 am
Posts: 5022
Here's the current complete list of mirrored copies of the most recent Pharmacy Expressorator(TM)

http://www.mytempdir.com/1092153
http://www.mytempdir.com/1093721
http://www.mytempdir.com/1093732
http://www.mytempdir.com/1093733
http://www.mytempdir.com/1093735
http://www.mytempdir.com/1093737
http://www.mytempdir.com/1093740

Enjoy!

SiL


Top
 Profile  
 PostPosted: Sat Dec 09, 2006 12:11 am   
Spam Observer
User avatar

Joined: Fri Nov 17, 2006 5:14 pm
Posts: 73
A little thing I noticed ... when running this lovely toy I found the pages load slightly faster if I change the default setting in Privoxy so that instead of handing back the Pharm Ex site's own url as the refferer, I set it to something else, like www;herbalkings.net

Cuts the load time in half.


Top
 Profile  
 PostPosted: Sat Dec 23, 2006 10:29 am   
Spam Reporter
User avatar

Joined: Sat May 27, 2006 5:15 am
Posts: 120
Well PE seem to have altered their site so it's now using a URL parameter for the session ID, to block this script. Way to go arseholes, how about stop spamming us instead?


Top
 Profile  
 PostPosted: Sun Dec 24, 2006 6:44 am   
User avatar
Yes you are right I am unable to order any pills, and I can't find a "contact us" to send them some more abuse.
Can anything be done to make the expressorator work again? I really hope for something like greasemonkey which I have had delight in using against those other assholes My Canadian Pharmacy!


Top
  
 PostPosted: Mon Dec 25, 2006 5:49 pm   
Site Admin
User avatar

Joined: Tue May 09, 2006 9:18 am
Posts: 5022
crabby wrote:
Yes you are right I am unable to order any pills, and I can't find a "contact us" to send them some more abuse.
Can anything be done to make the expressorator work again? I really hope for something like greasemonkey which I have had delight in using against those other assholes My Canadian Pharmacy!


Hey it's Xmas, but in a break during baking I thought I'd check this out.

I'll work on a modification to this.

Keep in mind: this is an awesome shift to see. It must mean that they hate taking extra time to process these orders, so there must have been enough of them that they had to do something about it. Nice!

Should be a pretty straightforward modification.

I'm noticing a record number of spam messages for MCP and Pharmacy Express today (in the midst of ridiculous stock spams.)

They *are* assholes. :)

Thanx for reporting this change. Merry Xmas everyone.

SiL


Top
 Profile  
 PostPosted: Tue Dec 26, 2006 7:13 pm   
Spam Reporter
User avatar

Joined: Sat May 27, 2006 5:15 am
Posts: 120
spamislame wrote:
Keep in mind: this is an awesome shift to see. It must mean that they hate taking extra time to process these orders, so there must have been enough of them that they had to do something about it. Nice!
Not all PE sites have changed over - I suspect that the ones that have received the most "attention" (like rx555.com) have been given priority but www.kerunhandgunfandesikuntun.com and www.randesuikintungandesun.com are still on the old system so anyone needing some "extra shots" can place their orders using these domains.
spamislame wrote:
(in the midst of ridiculous stock spams.)
Hee hee - did you get any "PHYA had a pullback of 25% after some well-deserved profit taking on Thursday"? Looks like a spammer may have got caught out by a dump themselves! :D


Top
 Profile  
 PostPosted: Tue Dec 26, 2006 7:50 pm   
Site Admin
User avatar

Joined: Tue May 09, 2006 9:18 am
Posts: 5022
StrikeBack wrote:
spamislame wrote:
Keep in mind: this is an awesome shift to see. It must mean that they hate taking extra time to process these orders, so there must have been enough of them that they had to do something about it. Nice!
Not all PE sites have changed over - I suspect that the ones that have received the most "attention" (like rx555.com) have been given priority but www.kerunhandgunfandesikuntun.com and www.randesuikintungandesun.com are still on the old system so anyone needing some "extra shots" can place their orders using these domains.

Good to know (and weird. Maybe they're experimenting.)

I still haven't been near computers too much the past couple days. A much needed break, let me tell you.

StrikeBack wrote:
spamislame wrote:
(in the midst of ridiculous stock spams.)
Hee hee - did you get any "PHYA had a pullback of 25% after some well-deserved profit taking on Thursday"? Looks like a spammer may have got caught out by a dump themselves! :D


Hm... That's a stock I just have never even seen in my spam intake. I find that interesting. Clearly there is some sort of strategy behind which stocks are spammed, when, and how often. The ones I've been spammed with in the past four days are as follows:

CBFE (China Biolife Enterprises, Inc.) [2] (via a literally unreadable gif)
CTCX (Critical Care, Inc.) [1] (via mangled gif)
GDKI (Goldmark Industries) [1] (via a seemingly flat gif)
NNYG (Northamerican Energy Group Corp.) [1] (via really illiterate text)
GCME (Greater China Media & Entertainment) [1] (via fairly readable, market-savvy text)

I haven't bothered looking up any of the stats on these particular stock. I would not immediately assume that the spammers actually lost anything, as they likely had some automated means of performing their sale of the stock once it hit a predetermined threshold.

QUITE off-topic but it's interesting. Maybe we should start a stock-tracking thread? :)

Thanx again for this info.

SiL


Top
 Profile  
 PostPosted: Wed Dec 27, 2006 10:01 pm   
Spammer Killing Machine
User avatar

Joined: Mon Nov 13, 2006 6:02 pm
Posts: 463
spamislame wrote:
QUITE off-topic but it's interesting. Maybe we should start a stock-tracking thread? :)

My mate Angus does a great listing of what he receives, which I find to be more concrete than the amount I receive. He posts the website of the company involved and I've scoured up some of the contact information for these companies, to let them know that I'm on to them. ;)

http://www.spamnation.info/stocks/index.php


Top
 Profile  
 PostPosted: Fri Jan 05, 2007 11:38 am   
Site Admin
User avatar

Joined: Tue May 09, 2006 9:18 am
Posts: 5022
Well here we are: a new year, and apparently a drastically different methodology from the spammers behind Pharmacy Express.

This is a completely re-coded utility from the ground up, since they moved their entire operation to a new programming language (PHP) and server type (Apache, versus IIS / Windows.) They completely re-did their entire ordering system and appear to have added more products, so I've made sure the entire catalogue of their so-called "products" are made available here.

Please note that this particular version only works on the newer PHP versions of this website. Sites which have been spammed using this methodology include:

Code:
22rx.com
33rx.com
44rx.com


There have been others but they have all recently been shut down (and rightly so.)

There are a few extra steps to take, so please read carefully before placing orders. As always, the recommended environment for running this utility includes the following:

- Firefox
- TOR / Vidalia / Privoxy
- Enable javascript for local files (if you run the "NoScript" extension.)
- A desire to kill spammers. :twisted:

So without further ado, here are the downloads. Each of these are identical, I just wanted as many mirrors as possible due to the flakiness of mytempdir. Spread the word.

http://www.mytempdir.com/1150578
http://www.mytempdir.com/1150579
http://www.mytempdir.com/1150580
http://www.mytempdir.com/1150582
http://www.mytempdir.com/1150584
http://www.mytempdir.com/1150585
http://www.mytempdir.com/1150586
http://www.mytempdir.com/1150588
http://www.mytempdir.com/1150590

Also: if you find any new ones (or are spammed with them) which feature the new php setup, please post them in the targets thread.

Thanks as always for reading. They want the orders. Let's give them to them.

SiL :thumbup:


Top
 Profile  
 PostPosted: Fri Jan 05, 2007 12:54 pm   
New member
User avatar

Joined: Sat Dec 09, 2006 2:43 pm
Posts: 8
Hmm, for some reason I'm getting as far as the Check Out page but it won't automatically fill it in.

Any suggestions?


Top
 Profile  
 [ 214 posts ]  Go to page Previous  1 ... 10, 11, 12, 13, 14, 15  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Wayback machine, Yandex [Bot] and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  


Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
Style originally created by Volize © 2003 • Redesigned SkyLine by MartectX © 2008