Pharmacy Expressorator(TM) 2.0

Discussion in 'other security issues & news' started by spamislame, Nov 30, 2006.

Thread Status:
Not open for further replies.
  1. spamislame

    spamislame Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    52
    In light of the recent upswing in spam for these websites, I decided I should just get the new version out there and see if people use it. This was originally conceived and deployed back in March 2006 and had an apparently devastating effect on their ability to process orders.

    Word might spread from here if I get it out to enough people. They're anticipating a ton more spam for these sites in the coming weeks. This setup is allegedly tied to Leo Kuvayev / BadCow.

    http://www.mytempdir.com/1092153

    Vastly modified and more compact. Now with expanded instructions and the ability to just enter a domain and get posting. (no hard-coded list of domains anymore. They change too quickly.)

    I'm seeing a javascript error notification in IE which I cannot get rid of but which is also not affecting functionality. As such I do recommend (of course) using a better browser. FireFox has no issues with this utility.

    Steps:

    - enter raw pharmacy express url. Do not enter http://, and don't include any slashes.
    - follow the rest of the instructions on the page, or read the included readme file.

    You'll want to use TOR on this. All of my genuine IP's are banned so I constantly see the "bank didn't authorize that card" message. Switch to TOR: that goes away.

    Feedback is welcome of course.

    Enjoy!

    SiL:thumbs-up
     
  2. spamislame

    spamislame Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    52
  3. spamislame

    spamislame Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    52
    Pharmacy Expressorator(TM)!

    Well here we are: a new year, and apparently a drastically different methodology from the spammers behind Pharmacy Express.

    This is a completely re-coded utility from the ground up, since they moved their entire operation to a new programming language (PHP) and server type (Apache, versus IIS / Windows.) They completely re-did their entire ordering system and appear to have added more products, so I've made sure the entire catalogue of their so-called "products" are made available here.

    Please note that this particular version only works on the newer PHP versions of this website. Sites which have been spammed using this methodology include:

    Code:
    22rx.com
    33rx.com
    44rx.com
    There have been others but they have all recently been shut down (and rightly so.)

    There are a few extra steps to take, so please read carefully before placing orders. As always, the recommended environment for running this utility includes the following:

    - Firefox
    - TOR / Vidalia / Privoxy
    - Enable javascript for local files (if you run the "NoScript" extension.)
    - A desire to kill spammers. :shifty:

    So without further ado, here are the downloads. Each of these are identical, I just wanted as many mirrors as possible due to the flakiness of mytempdir. Spread the word.

    http://www.mytempdir.com/1150578
    http://www.mytempdir.com/1150579
    http://www.mytempdir.com/1150580
    http://www.mytempdir.com/1150582
    http://www.mytempdir.com/1150584
    http://www.mytempdir.com/1150585
    http://www.mytempdir.com/1150586
    http://www.mytempdir.com/1150588
    http://www.mytempdir.com/1150590

    Also: if you find any new ones (or are spammed with them) which feature the new php setup, please post them here.

    Thanks as always for reading. They want the orders. Let's give them to them.

    SiL :thumb:
     
Thread Status:
Not open for further replies.