TOKYO (MacHouse) – As we reported several hours ago, spam posts circulated by an organized cyber criminal group suggested that two seemingly unrelated websites, those of Antioch University (http://antiochsb.edu) and Spinal Injuries Association, have been hacked and/or exploited. (See Screenshot 01-2.) They are exploited in the same way the website of President University (poss.president.ac.id) is exploited. All three websites are installed with a spam package containing a number of webpages to send Internet users to a junk online pharmacy website.
 Screenshot 01 – Source: MacHouse |
 Screenshot 02 – Source: MacHouse |
 Screenshot 03 – Source: fastcanadianpharmacy.com |
We don’t know who exactly is responsible for installing the spam packages at these three websites. What we know is the sponsor behind this spam campaign. These websites are exploited to send Internet users to a junk pharmacy website at fastcanadianpharmacy.com. Although it looks to us as if there were no website accessible at this domain, using a proxy server reveals that there is a junk website titled VIAGRA + Cialis. (See Screenshot 03.)
The following is a list of URLs advertised in the spam posts shown in Screenshot 01-2.
http://antiochsb.edu/flex/pharmacy/Wellbutrin-Online
http://antiochsb.edu/flex/pharmacy/Lamisil-Online
http://antiochsb.edu/flex/pharmacy/Prozac-Online
http://antiochsb.edu/flex/pharmacy/Prilosec-Online
http://antiochsb.edu/flex/pharmacy/Xenical-Online
http://antiochsb.edu/flex/pharmacy/Zoloft-Online
http://antiochsb.edu/flex/pharmacy/Levitra-Online
http://antiochsb.edu/flex/pharmacy/Zyrtec-Online
http://antiochsb.edu/flex/pharmacy/Zovirax-Online
http://antiochsb.edu/flex/pharmacy/Diflucan-Online
http://antiochsb.edu/flex/pharmacy/Flomax-Online
http://antiochsb.edu/flex/pharmacy/Protonix-Online
http://antiochsb.edu/flex/pharmacy/Propecia-Online
http://antiochsb.edu/flex/pharmacy/Zithromax-Online
http://antiochsb.edu/flex/pharmacy/Viagra-Online
http://antiochsb.edu/flex/pharmacy/Valtrex-Online
http://antiochsb.edu/flex/pharmacy/Imitrex-Online
http://antiochsb.edu/flex/pharmacy/Aciphex-Online
http://antiochsb.edu/flex/pharmacy/Tramadol-Online
http://antiochsb.edu/flex/pharmacy/Ultram-Online
http://antiochsb.edu/flex/pharmacy/Singulair-Online
http://antiochsb.edu/flex/pharmacy/Lipitor-Online
http://antiochsb.edu/flex/pharmacy/Effexor-Online
http://antiochsb.edu/flex/pharmacy/Cialis-Online
http://antiochsb.edu/flex/pharmacy/Lexapro-Online
http://antiochsb.edu/flex/pharmacy/Zantac-Online
http://antiochsb.edu/flex/pharmacy/Paxil-Online
http://antiochsb.edu/flex/pharmacy/Orlistat-Online
http://antiochsb.edu/flex/pharmacy/Nexium-Online
http://antiochsb.edu/flex/pharmacy/Allegra-Online
http://www.spinal.com.au/pharmacy/Cialis-Online
http://www.spinal.com.au/pharmacy/Valtrex-Online
http://www.spinal.com.au/pharmacy/Zyrtec-Online
http://www.spinal.com.au/pharmacy/Wellbutrin-Online
http://www.spinal.com.au/pharmacy/Protonix-Online
http://www.spinal.com.au/pharmacy/Xenical-Online
http://www.spinal.com.au/pharmacy/Paxil-Online
http://www.spinal.com.au/pharmacy/Lipitor-Online
http://www.spinal.com.au/pharmacy/Allegra-Online
http://www.spinal.com.au/pharmacy/Ultram-Online
http://www.spinal.com.au/pharmacy/Zoloft-Online
http://www.spinal.com.au/pharmacy/Prilosec-Online
http://www.spinal.com.au/pharmacy/Singulair-Online
http://www.spinal.com.au/pharmacy/Tramadol-Online
http://www.spinal.com.au/pharmacy/Flomax-Online
http://www.spinal.com.au/pharmacy/Zovirax-Online
http://www.spinal.com.au/pharmacy/Aciphex-Online
http://www.spinal.com.au/pharmacy/Imitrex-Online
http://www.spinal.com.au/pharmacy/Levitra-Online
http://www.spinal.com.au/pharmacy/Diflucan-Online
http://www.spinal.com.au/pharmacy/Zantac-Online
http://www.spinal.com.au/pharmacy/Zithromax-Online
http://www.spinal.com.au/pharmacy/Viagra-Online
http://www.spinal.com.au/pharmacy/Lamisil-Online
http://www.spinal.com.au/pharmacy/Nexium-Online
http://www.spinal.com.au/pharmacy/Propecia-Online
http://www.spinal.com.au/pharmacy/Effexor-Online
http://www.spinal.com.au/pharmacy/Prozac-Online
http://www.spinal.com.au/pharmacy/Lexapro-Online
http://www.spinal.com.au/pharmacy/Orlistat-Online
Accessing any of the URLs, we can only see a blank webpage due to our geographical location or IP address. (See Screenshot 04-5.) Nonetheless, we can see where one can be redirected to after accessing these spam webpages.
 Screenshot 04 – Source: Antioch University |
 Screenshot 05 – Source: Spinal Injuries Association |
Furthermore, just as the website at poss.president.ac.id is exploited, the folder permissions of http://antiochsb.edu/flex/pharmacy/ and http://www.spinal.com/au/pharmacy/ are both intentionally or not intentionally set to 755 so that directory content is viewable and downloadable. (See Screenshot 06-7.)
 Screenshot 06 – Source: Antioch University |
 Screenshot 07 – Source: Spinal Injuries Association |
We reported a few days ago that the junk pharmacy website at fastcanadianpharmacy.com was hosted by a disgraced German hosting company, which is behind many malicious websites. The server hosting this online pharmacy store is still traced to the IP address of 89.149.228.102. It’s hosted by netdirekt (netdirekt.de) of Frankfurt, Germany. Furthermore, the domain of fastcanadianpharmacy.com is still registered for
Anton Nikiforov
Smolnaya str. d.21 kv.360
Moscow 193741
Russia
We know that Europeans depend on Russians for natural gas. Perhaps, they also need Russians for wellburtrin, lamisil, prozac, zenical, levitra and other drugs?
Related stories:
Seemingly Unrelated Websites of Antioch University & Spinal Injuries Association Exploited with Spam Package Installation – Part 1
Indonesian University Website Used to Redirect Internet Users to Online Pharmacy Store Website – Part 2
Indonesian University Website Used to Redirect Internet Users to Online Pharmacy Store Website – Part 1
