InBoxRevenge KS Forum

> 386-2437714
Indian Railway ticket number?
hXXp://irctc-pnr.com/status/3862437x/

Hopefully, I'm on topic.

I've been working on this off and on for awhile now
It's... overwhelming. Follow the money

I've been getting many 'secure-*.com' domains which root back up to: stimul-media.com

aka: RX-Partners
who IMO, are aka: RXprofits.com though I'm not entirely sure.

But I am sure that RX-Partners is aka:
"DFG DutyFree Power Group Ltd"
dfpowergroup.com - Duty free alcohol, tobacco, cosmetics, perfumes
affiliate sign-up site: directnetpartners.com
example phone numbers (for "duty free"):
1-347-7081664
1-888-2465608

Some sites, like this alcohol template: alcohol-sell.com
advertises in the Flash banner the domain: test-mall.com
see: shop.test-mall.com
payment processor: secure-paypage.com
which references a support email link pointing to: salezhelp.com
http://bgp.he.net/dns/salezhelp.com#_whois
references: stimul-media.com

ed-tablet-danmark.com
payment processor: secure-checkout-page.com
customer support: order-cs.com

I'm concentrating on the non-pharma domains ATM
Will post a new thread on WOT when I get more screen captures and possibly more domains to add to my list (current count: 119)

[Topic moved to separate thread]

Reference information on RX-Partners is at
http://www.xylibox.com/2011/11/rx-partnersbiz-huge-pharma-affiliate.html

Spamtrackers has some informations at
http://spamtrackers.eu/wiki/index.php/Trusted_Tabs

No doubt you will find hits from a Google search on phone numbers - "HAVE A QUESTION? CALL US: Toll Free: 1-888-2465608 Internationl: 1-347-7081664"

dutyfreecigarettes.net.tc [dead]
cigarettes2home.com
buyanelectroniccigarette.com

Secure checkouts and Help centers - all DNS = custns.com
checkout-page.com *
customer-ed.com
eu-customer.com
salez-help.com
secure-transaction-page.com *
securebilling-page.com *
securebillpage.com
securepaypage.biz
securepaypage.com *
yoursecurebilling.com *

* Some of those are DDOS protected under Prolexic

Keep posting more information as you find it.

@ Red Dwarf
Thank you for moving this into it's own thread; apologies for previous off-topic placement.

RX-Partners:

• [RU] Vitaly Petrov aka: Peter Clement
• [DE] Jason Mercer

salezhelp.com
http://bgp.he.net/dns/salezhelp.com#_whois

Alias used is:
http://bgp.he.net/dns/custns.com#_whois

this address is a student living complex according to:
http://www.foreignstudents.com/accommodation/listings/london-mile-end-scape-east

digifuel.net
http://bgp.he.net/dns/digifuel.net#_whois

When adopting a false name, it is a common practice to choose a famous person. Then the chosen name will be lost in the clutter of search results. This method invalidates Google tracking.
http://en.wikipedia.org/wiki/Vitaly_Petrov

I understand that, another example:
http://bgp.he.net/dns/securebilling-page.com#_whois
domain registered in 2010

Peter Clement was
Deputy Director CIA - Intelligence for Analytic Programs
http://www.c-spanvideo.org/peterclement

WOT topic created
https://www.mywot.com/forum/31870-duty- ... nd-tobacco