Knujon Weekly Reports

AlphaCentauri · **Joined:** Thu Mar 01, 2007 3:01 am **Posts:** 5915

Knujon wrote:

Search Engine Ad-Linked Pharmacist Arrested

A Pharmacist in California was arrested last week for removing drugs
from the pharmacy and other related charges. Websites advertised through
search-engines profiled in reports released by KnujOn and LegitScript
were among the online presence of this illicit operation.

This is an important reminder that any online criminal operation has a
real-world, flesh-and-blood, brick-and-mortar presence. These operations
also thrive on lax enforcement by various layers of Internet service
providers. The underground pharmaceutical market is at least a $100
billion illicit industry that now depends on Internet transactions and
marketing. However, U.S.-based ISPs, Registrars, and online advertisers
continue to sponsor rogue pharmacy sites reported to them.

http://www.alpenhornnews.com/default.as ... ws&he=.com

roberto7888 · **Joined:** Tue Jan 02, 2007 11:04 am **Posts:** 842

Quote:

Hello,

We are seeing the beginning of a new chapter in Internet compliance that is
the result of months of work. Codenamed Operation Pangea II: sweeps,
seizures, raids, as well as the termination of hundreds of core transaction
websites have occurred in 26 countries. Illegal web pharmacies advertised in
spam, dealing in counterfeit versions of drugs that harm consumers have been
terminated in the real world as well as the virtual. As part of this
activity, Registrars and ISPs have been warned about the illegal nature of
these businesses.

Read the INTERPOL release here:
http://www.interpol.int/Public/ICPO/Pre ... 009111.asp

Read the FDA release here:
http://www.fda.gov/NewsEvents/Newsroom/ ... 191330.htm

In conjunction with this, KnujOn has initiated a number actions that
unfortunately we cannot discuss at this time. However, the goal of all this
is to create a permanent change at the Internet provider level and not to
merely shut down a number of websites. We have been working with
LegitScript.com and will continue to do so for the benefit of the consumer.
More details here:
http://voices.washingtonpost.com/securi ... t_pha.html

This illicit traffic is very harmful as the criminals use current events to
target consumer health for fast cash by selling phony flu medicine:
http://blogs.wsj.com/digits/2009/11/18/ ... flu-fears/.

You can follow our explanation of the problem as it relates to spam and the
Registrars here:
http://www.circleid.com/posts/20091119_ ... g_traffic/

Knujon news: http://www.knujon.com/news.html
Knujon Discussion Group at LinkedIn:
http://www.linkedin.com/groups?gid=1870205
Knujon forum at inboxrevenge.com:
viewtopic.php?f=9&t=1666

KnujOn is an all volunteer, un-funded initiative. Our responsibilities have
grown exponentially in the last year and our pay is still zero. We are
committed to this solution and appreciate your patience while we work our
way through the maze of Internet bureaucracy to reduce illicit traffic and
spam.

Thank you for your continued support!

spamislame · **Joined:** Tue May 09, 2006 9:18 am **Posts:** 5022

This is... wow.

Between this action and the slowdown of at least one botnet: this is a decidedly bad month for criminal spammers promoting fake pharma.

I know we're not 100% out of the woods yet but this is great news.

It appears that ever since 2007, October and November are the two key months in terms of public, visible action against these criminals. Good to see.

SiL

Red Dwarf · **Joined:** Tue Jun 27, 2006 2:01 am **Posts:** 9227

Hello,

Policy Change at Godaddy

One line, 14 words may signal the beginning of the end for pill spammers in the U.S. and elsewhere. Last week we witnessed the modification of Godaddy's Terms of Use (TOS) to include a specific prohibition against sites selling drugs without a prescription. This is the first such policy we are aware of and may soon become normal policy at U.S. Registrars and possibly all Registrars. This is clearly the result of constant pressure from KnujOn and other groups. Godaddy is following through with its policy by dumping hundreds of core illegal pharmacy sites and the spammers are already complaining in their underground forums. You can follow our explanation of the problem as it relates to spam and the Registrars here:
http://www.circleid.com/posts/20091211_ ... ar_policy/

XinNet Imploding?

First off you should know that KnujOn does not support the wholesale denial of free speech frequently seen in China, but the government there is finally taking a close look at Xinnet activities and not liking what they see there:
http://www.pcworld.com/businesscenter/a ... eanup.html Xinnet has been at the top of the KnujOn naughty list for some time: http://www.knujon.com/registrars/#xinnet and
http://www.knujon.com/news2009.html#02052009E. Because of the extreme volume of abuse at Xinnet, the Chinese coordination center has suspended Xinnet's ability to sell .CN domains. This is in effect what KnujOn requested ICANN do to Xinnet in terms of .COM some time ago:
http://www.thestandard.com/Will-ICANN-t ... -registrar

Illicit U.S. Host Cleaned By KnujOn

In another silent victory, the KnujOn process identified a U.S.-based company that was hosting 85 pharmacy spam template sites. These sites would not have been identified by other anti-spam blacklisting services because of the low-level nature of their support for large illicit networks. These were in-effect content stores for spam domains that could be accessed and used over and over without being exposed. Because this company cooperated with us
we are not releasing details at this time. In a related story, HostExplot has published their 50 worst ISPs, 20 of whom are in the U.S.:
http://hostexploit.com/index.php?option ... itemid=106

Red Dwarf · **Joined:** Tue Jun 27, 2006 2:01 am **Posts:** 9227

Xinnet domains with Registration Date: 2009-12-10 00:05

paplive.cn
panslad.cn
panqlam.cn
advmnn.cn
paggdea.cn
etc

Maybe December 10 was the final day :-)

spamislame · **Joined:** Tue May 09, 2006 9:18 am **Posts:** 5022

Holy crap that Knujon report is dynamite!

GoDaddy: about friggin' time. That's excellent news.

I can't find any public press (or other) release regarding that change. Another great addition to the year end synopsis.

Thanks Red.

SiL

ahoier · **Posted:** Tue Dec 22, 2009 2:19 am

Great addition to the prescription deal @GoDaddy.........I'm sure these criminals find new hoops to jump though....for example, the whole "Acai Berry scam" going around, it's technically not a "controlled substance" per se, and so no prescription is necessary....

Likewise with other over the counter "supplements" - requiring no prescription. Perhaps we'll see two brances of Canadian Pharmacy? LOL....the GoDaddy friendly "supplement store" (VPXL, Acai, etc whatever else they can peddle.....); and then the China/Russia-friendly "drug store" with the Viagra, Cialis, etc.....

trobbins · **Joined:** Thu Apr 12, 2007 6:55 pm **Posts:** 2549

Knujon seems to be experiencing technical difficulties.
I have tried to load the site for the last 5 hours.
After I tried to refresh the news.html page, the url changed from hXXp://www.knujon.com/news.html to hXXp://www.knujon.com/SdnRP/SdnRP/news.html then to hXXp://www.knujon.com/SdnRP/news.html

AlphaCentauri · **Joined:** Thu Mar 01, 2007 3:01 am **Posts:** 5915

Knujon is up for me now. I see a new graphic on the home page, so perhaps they were in the process of updating things. (They still need to reorganize their news page, which has gotten so long over time that it's hard to find the good stuff that's there.)

trobbins · **Joined:** Thu Apr 12, 2007 6:55 pm **Posts:** 2549

Strange, I can't even load the root domain (home page).
Now the url in the address bar after refreshing the old news page I had open returned www.knujon.com/UQmjQ/news.html

AlphaCentauri · **Joined:** Thu Mar 01, 2007 3:01 am **Posts:** 5915

trobbins wrote:

Strange, I can't even load the root domain (home page).
Now the url in the address bar after refreshing the old news page I had open returned hXXp://www.knujon.com/UQmjQ/news.html

And that's a 404 page for me.

Red Dwarf · **Joined:** Tue Jun 27, 2006 2:01 am **Posts:** 9227

The latest item in News linked from the front page is
Operation Pangea II
November 21, 2009

Preceding articles are dated for every day (20th, 19th, 18th etc) - which indicates that there has been a problem with updating the news page.

ahoier · **Posted:** Tue Dec 29, 2009 10:43 pm

Knujon indeed has been quite quiet lately.....not sure what's up. Their news site has always been "backwards" - newest news at the top/front, older news at the bottom, etc....but yea, their last real "news" post was November 21st ...hopefully it's a "silent but deadly" kind of silent ;) lol...

Figures, lol. Now I go and load the page and it's not loading, fails with a redirect knujon.com --> knujon.com/ZbVmK/

And the home page still shows http://www.knujon.com/images/pharmaspamdomainmoney.png (The ICANN, old people, skull and bones Rx, etc. "spam circle" diagram) at least for me anyways.

And my reports are quite dated, last report date was 12/20/09 - but it could be just them "catching up" with the big sum of spam I've forwarded recently.

AlphaCentauri · **Joined:** Thu Mar 01, 2007 3:01 am **Posts:** 5915

I guess the discussion forums on LinkedIn have been slow lately, too. The last post hinted that there was something in the works they couldn't discuss yet, though.

trobbins · **Joined:** Thu Apr 12, 2007 6:55 pm **Posts:** 2549

Knujons site is finally working for me.

Yesterday I even tried it at work and it gave me the same problems.
Trying to post about it from work led me to discover their IP address
is blacklisted in CBL. So today I'll be on the hunt for an infected spam
spewing machine(s).

InBoxRevenge KS Forum

Knujon Weekly Reports

Who is online