• “Online Pharmacy” Spam Stalks Internet Forums/Boards

    Malicious hackers have, for many years, been offering services to unscrupulous individuals and companies for monetary compensation. With the growth of Email Spam advertising everything from medical supplements to cars and lottery tickets, email scrubbers and filters have taken the game up a notch by implementing ever increasing layers of complexity to cut down on such spam. In turn, hackers have started to focus on advertising spam, such as medication and fraudulent scams by compromising web-based message boards and forums.

    Hackers employ two basic techniques:

    • Creating large numbers of users on forums. These accounts are then used to post spam on the message boards.
    • Exploiting Web Application vulnerabilities in the software used to run the forum.

    Approximately two weeks ago, Lenny Zeltser, from ISC SANS, posted an informative article about online pharmacy ads popping up on message boards. In this vein we have conducted a limited experiment with about 14,000 websites which contain spam announcing online pharmacies.

    The aim of the experiment:

    • What percentage of websites which advertise online pharmacies are message boards and Internet forums?
    • What Web Applications, e.g. CMS packages, are used on the message boards that are compromised?

    We believe this will provide us with a rough estimate of how focused are hackers toward using message boards and forums on the Internet to advertise spam. From another perspective, it will provide us some idea of how vulnerable websites are if it hosts a message board or forum from being abused by hackers.

    Testing methodology:

    We have used Google to mine the websites which contain certain keyword patterns such as “buy zocor online”, or “buy brand kamagra online” etc. Once the links suggested by Google were mined, each of the websites was tested against Google’s Safe Browsing List to determine if they had hosted malware (according to Google). Next, an analysis was done to determine if the link(s) mined from Google pointed to a forum or message board. This was done by identifying the presence of multiple strings inside a link. For example, if a link has the keywords “topic”, “view”, “thread” or similar keywords, including characters associated with dynamic page generation, it is probably hosting a message board or forum.

    The test was conducted between January 21st and January 23rd, 2010.

    Popular software packages installed on compromised forums and message boards.

    Popular software packages installed on compromised forums and message boards.

    We present the most interesting results below:

    • 47.9% of websites displaying “online pharmacy” spam are message boards and forums.
    • None of the websites advertising “online pharmacy” spam were listed on Google Safe Browsing List.
    • 20.28% of forums displaying “online pharmacy” spam were using Jquery.
    • 15.73% of forums displaying “online pharmacy” spam were using phpBB.
    • 11.54% of forums displaying “online pharmacy” spam were using WordPress.
    • 10.84 % of forums displaying “online pharmacy” spam were using Mootools.

    These results and other software packages, helper-scripts, tracking-code are depicted in the graph presented above.

    This small experiment shows that a high percentage of websites displaying online spam campaigns are message boards or forums. This indicates that there are many unsecured software installations and older software packages still in use which are often exploited by malicious individuals to post spam. Further, it seems that most sites which were hacked are using jQuery. This supports our previous observations regarding jQuery scripts being used to push malware to unsuspecting visitors.


    Below we present some sample links which lead to “online pharmacy” spam ads:

    We strongly suggest that you do not visit the below sites.

    hxxp://agingparents.com/blog/wp-comments.php?id_comments=1041
    hxxp://agnitech.net/forums/viewtopic.php?f=2&t=426
    hxxp://altlingo.com/community/members/zocor+online+24q.aspx
    hxxp://aslansin.com/members/zocor-package-insert-26i/default.aspx
    hxxp://beanbol.com/purchase-zocor-(simvastatin)-40-mg.html
    hxxp://beanbol.com/zocor-(simvastatin)-20-mg.html
    hxxp://blog.firestats.cc/
    hxxp://blog.firestats.cc/49
    hxxp://blogs.bet.com/music/soundOff/about/?cp=13
    hxxp://blogs.greenpeace.ca/?proto=713
    hxxp://blogs.greenpeace.ca/?proto=715
    hxxp://blogs.inquirer.net/happynest/2009/10/09/just-sing/
    hxxp://boards.tx-outdoors.com/viewtopic.php?f=2&t=467
    hxxp://buy-cheap-zocor.hi5.com/
    hxxp://cheapzocor.com/
    hxxp://cheapzocor.com/about/
    hxxp://coilhouse.net/?deppsa=710
    hxxp://coilhouse.net/?deppsa=715
    hxxp://community.burton.com/members/zocor+interaction+10a.aspx
    hxxp://en.netlog.com/clan/BuyZocorOnline
    hxxp://en.netlog.com/clan/zocor
    hxxp://eostrava.cz/post-80523-cheap-zocor/
    hxxp://f5fest.com/?p=50
    hxxp://fans.askaninja.com/profiles/blogs/buy-zocor-no-prescription-buy
    hxxp://feedblogger.net/members/cost-zocor-68l.aspx
    hxxp://foros.canaljuegos.com/index.php?topic=1067891.0
    hxxp://foro.toplatino.net/viewtopic.php?f=3&t=17031
    hxxp://forsale.oodle.com/view/buy-zocor-online-and-treat-the-cholesterol-problems/1763399272-seattle-wa/
    hxxp://forum.asian-autoparts.eu/viewtopic.php?p=4234&sid=82d1fc8ea8bf7189150dda0674d1d9b0
    hxxp://forum.atiz.com/index.php?topic=362.msg665;topicseen
    hxxp://forum.autonews.fr/index.php?showtopic=43369&view=getlastpost
    hxxp://forum.jiwang.org/index.php?showtopic=44638
    hxxp://forum.lugarcerto.com.br/viewtopic.php?f=13&t=1022
    hxxp://forum.ronatvan.com/index.php?action=printpage;topic=3171.0
    hxxp://forum.ronatvan.com/index.php?topic=3171.0
    hxxp://forums.solmetra.com/viewtopic.php?f=2&t=67911
    hxxp://forums.solmetra.com/viewtopic.php?f=3&t=48102
    hxxp://forum.tag-board.com/showthread.php?p=70359
    hxxp://forum.tarad.com/index.php?action=printpage;topic=23901.0
    hxxp://forum.vachealait.com/viewtopic.php?f=3&t=123806
    hxxp://forum.vachealait.com/viewtopic.php?f=5&t=124103
    hxxp://forum.vladimirmedvedev.com/index.php?topic=190.0
    hxxp://forum.vortue.com/showthread.php?p=114540
    hxxp://gallopinghillcaterers.com/?page=buy-online-zocor&f=1262906101
    hxxp://gameinformer.com/blogs/members/b/buy_zocor_warnings_blog/archive/2009/12/18/buy-zocor-warnings-pu4.aspx
    hxxp://gameinformer.com/members/zocor_2D00_online/default.aspx
    hxxp://gfestival.com/?pages=157
    hxxp://gfestival.com/?pages=65
    hxxp://grabhot.com/index.php?topic=2537.0
    hxxp://groups.adobe.com/posts/534b2ec31b
    hxxp://harvardcitizen.com/?zine=1144
    hxxp://harvardcitizen.com/?zine=4200
    hxxp://historias.masoportunidades.com.ar/?page_navg=3879
    hxxp://ibls.com/cs/members/zocor+pricing+44n.aspx
    hxxp://identi.ca/andres250
    hxxp://identi.ca/zachery328
    hxxp://innfromthenight.com/forum/viewtopic.php?f=28&t=57971&p=60406
    hxxp://jackpenate.com/forum/viewtopic.php?pid=16485
    hxxp://leegibbons.com/formbuilder/web/pharmacy/zocor/p=tricor-zocor.html
    hxxp://letterheadforemail.com/Zocor.html
    hxxp://mabonline.net/tablets-zocor-(simvastatin)-5-mg.html
    hxxp://mabonline.net/zocor-(simvastatin)-for-sale.html
    hxxp://matadornetwork.com/
    hxxp://my.superbasket.gr/viewtopic.php?f=4&t=1562&p=2139
    hxxp://naturalpet-com.safepages.com/showthread.php?t=1071
    hxxp://networking.bizjournals.com/Jonny2
    hxxp://noprescriptiononlinepharmacy.ca/zocor.html
    hxxp://pastebin.ca/1743811
    hxxp://pornknight.com/zocor-depression-t14855.html
    hxxp://posterous.com/people/37qTcxHC297r
    hxxp://punkrock.org/buyzocoronline1075&v=comments
    hxxp://ranahan.dephan.go.id/forum/viewtopic.php?f=2&t=6803
    hxxp://responsiblemarketing.com/blog/?generic=3880
    hxxp://room.vicman.net/viewtopic.php?f=2&t=147874
    hxxp://room.vicman.net/viewtopic.php?f=4&t=147047
    hxxp://technorati.com/blogs/zocorlinks.blogspot.com
    hxxp://thebristolfestival.org/README.php?tbf=746
    hxxp://theevonyforum.com/online-zocor-purchase-buy-cheap-zocor-t433.html?sid=c64462e6e1214d18ea22e365c76aa13d
    hxxp://thisis50.ning.com/forum/topics/buy-zocor-from-a-usa-pharmacy
    hxxp://tk-twk.nets.hk/viewtopic.php?f=42&t=11427
    hxxp://tohanschik.ru/viewtopic.php?t=1380&view=previous&sid=5ccac30f7095c3421d89b8a3c16a23a4
    hxxp://twit88.com/home/node/10289
    hxxp://virb.com/rushots/posts/text/6881665
    hxxp://visualstudiogallery.msdn.microsoft.com/it-IT/4ec90b81-93e4-4435-b627-4410e6028af9?persist=True
    hxxp://webradiocharts.eu/forum/viewtopic.php?f=4&t=376
    hxxp://wiki.pylonshq.com/display/~heetley/BUY+Zocor+LOWEST+prices+NOW
    hxxp://wiki.pylonshq.com/display/~heetley/BUY+Zocor+LOWEST+prices+NOW?showComments=true&showCommentArea=true
    hxxp://www.247-pharmacy.com/buy/zocor.php
    hxxp://www.abbeyproperties.co.uk/config.php?set_user=1&s=1264
    hxxp://www.abbeyproperties.co.uk/config.php?set_user=1&s=1996
    hxxp://www.aldaracreamonline.co.uk/buy-zocor.htm
    hxxp://www.antidepressantscheaper.com/
    hxxp://www.aperitto.com/support/forum/12-emr-suite/511-meridian-two-bit-pharmacy-appraiser-it
    hxxp://www.articlesbase.com/health-articles/online-pharmacy-offers-the-most-competitive-prices-on-zocor-869351.html
    hxxp://www.atalasoft.de/cs/members/zocor+400+mg+53b.aspx
    hxxp://www.avatarpress.com/2010/01/22/post-80540-buy-zocor/
    hxxp://www.blogged.com/topics/zocor/
    hxxp://www.bowlofcereal.net/viewtopic.php?f=5&t=99
    hxxp://www.brbooks.co.uk/zocor-(simvastatin)-10-mg-free-shipping.html
    hxxp://www.canadianhealthcaremall.net/drug-zocor123.shtml
    hxxp://www.canamericaglobal.com/products/Zocor/20/
    hxxp://www.chemistdirect.co.uk/zocor-simvastatin-10-mg-tablets_4_12038.html
    hxxp://www.chemistdirect.co.uk/zocor-simvastatin-40-mg-tablets_4_12040.html
    hxxp://www.chop.edu/forum/user/profile/12110.page
    hxxp://www.clockworkpharmacy.com/zocor-heart-pro-tablets-10mg.html
    hxxp://www.copykatchat.com/
    hxxp://www.cruisersforum.com/forums/members/inxgwo32-30799.html
    hxxp://www.daanbantayan.gov.ph/dbforums/viewtopic.php?f=26&t=43370
    hxxp://www.daanbantayan.gov.ph/dbforums/viewtopic.php?f=28&t=43373
    hxxp://www.divingleisurelondon.co.uk/forum/online-zocor
    hxxp://www.drugs-s.com/product-35-prd_12.html
    hxxp://www.elakiri.com/forum/showthread.php?p=6341304
    hxxp://www.europeanirish.com/index.php?med_id=buy-zocor-(simvastatin)-10-mg
    hxxp://www.europeanirish.com/index.php?med_id=buy-zocor-(simvastatin)-40-mg
    hxxp://www.fastcompany.com/tag/pharmacy
    hxxp://www.feld.com/blog/archives/2007/02/buy-zocor-online.html
    hxxp://www.feld.com/blog/archives/2007/02/online-buy-zocor-without-a-prescription.html
    hxxp://www.fioricetpharmacy.info/product.php?prod=Zocor
    hxxp://www.flexyx.com/Z/Zocor.html
    hxxp://www.folkd.com/go/zocor+lipitor
    hxxp://www.forkncork.com/?p=80540
    hxxp://www.forkncork.com/?p=80544
    hxxp://www.freecodesource.com/user/profile-354708.html
    hxxp://www.freecodesource.com/user/profile-354802.html
    hxxp://www.genbrand-rx.com/Zocor.html
    hxxp://www.genericmedsfromcanada.com/
    hxxp://www.genericmedsfromcanada.com/ZOCOR_80_mg_GENERIC_SIMVASTATIN_80_mg_28_Tabs_p/sim0753b.htm
    hxxp://www.genericsmed.com/buy-cheap-generic-zocor-simvastatin-p-21.html
    hxxp://www.genv.net/en-us/node/10875
    hxxp://www.giustiziere.org/viewtopic.php?f=7&t=10277
    hxxp://www.globaltrainingcenter.com/news.php?node=1412
    hxxp://www.globaltrainingcenter.com/news.php?node=682
    hxxp://www.goprocamera.com/admin/_js/tiny_mce/themes/advanced/files/buying-zocor-legally.html
    hxxp://www.goprocamera.com/admin/_js/tiny_mce/themes/advanced/files/buy-zocor-without-a-prescription.html
    hxxp://www.gradcats.org/index.php?option=com_content&view=section&layout=blog&id=1&Itemid=2&node=2156
    hxxp://www.gradcats.org/index.php?option=com_content&view=section&layout=blog&id=1&Itemid=2&node=3753
    hxxp://www.gripenet.pt/blog/?p=80521
    hxxp://www.gripenet.pt/blog/?p=80528
    hxxp://www.hcs.harvard.edu/~salient/site/?menus=715
    hxxp://www.hip-hop.net/profile/buyzocorG9FG
    hxxp://www.hip-hop.net/profile/Fredmd
    hxxp://www.hkcd-team.net/viewtopic.php?f=7&t=284
    hxxp://www.ibiblio.org/agray/brushd/cheapest-price-for-zocor-40-mg.html
    hxxp://www.ibiblio.org/agray/brushd/does-effect-have-libido-womens-zocor.html
    hxxp://www.inansurucukursu.com/inan/forum/index.php?topic=2153.0;wap2
    hxxp://www.inyoursuburb.com.au/forum/viewtopic.php?f=25&t=12069
    hxxp://www.ipetitions.com/petition/buy_ambien_online_480/
    hxxp://www.kucasnova.net/index.php?topic=1911.0
    hxxp://www.kucasnova.net/index.php?topic=2378.0
    hxxp://www.last.fm/user/zocor7103
    hxxp://www.lerpg.com/forum/index.php?topic=1716.0
    hxxp://www.livestrong.com/zocor-side-effects/
    hxxp://www.mahalo.com/answers/drugs/where-can-you-buy-lipitor-online-is-it-cheaper
    hxxp://www.makingthings.com/wiki/document.zocor-online-order
    hxxp://www.masterseek.com/q/Zocor/0/1/Zocor.htm
    hxxp://www.mathleagueforum.com/viewtopic.php?f=2&t=41
    hxxp://www.menieresforum.com/?q=node/132
    hxxp://www.michwine.com/index.php?Itemid=148&option=com_jcalpro&Subitem=3562
    hxxp://www.michwine.com/index.php?Itemid=148&option=com_jcalpro&Subitem=773
    hxxp://www.mister-wong.com/topics/zocor/
    hxxp://www.mombu.com/hdtv/hdtv/t-buy-lipitor-online-no-prescription-needed-3828654.html
    hxxp://www.mypage.com/buyzocor862/extendedprofile
    hxxp://www.nfu.org/forum/archive/index.php?t-20956.html
    hxxp://www.numberstemplates.com/forums/showthread.php?t=977
    hxxp://www.offshorerx.com/drug/buy_generic_zocor.htm
    hxxp://www.online-drugstore-usa.com/cheap_cardiovascular_prices/buy_generic_zocor_pills
    hxxp://www.onlinepillspro.com/buy/zocor.html
    hxxp://www.oxygenoverkill.com/forum/viewtopic.php?f=2&t=15
    hxxp://www.pharmacyescrow.com/s3737-s-ZOCOR.aspx
    hxxp://www.pharmacyescrow.com/s41524-s-ZOCOR.aspx
    hxxp://www.photography-now.net/help/index?no-rx=1475
    hxxp://www.photography-now.net/katja_oluscha_grunther/index?no-rx=3348
    hxxp://www.pillsforall.com/cholesterol-lowering/zocor-40mg-generic-x-60/prod_57.html
    hxxp://www.pillwatch.com/product/zocor/
    hxxp://www.postnewsline.com/2009/04/the-post-new-website.html
    hxxp://www.praktikum.de/forum/online-zocor-purchase-prescription-zocor-t12436.html
    hxxp://www.psicologico.cl/?favorite=4356
    hxxp://www.pyzam.com/profile/3304209
    hxxp://www.pyzam.com/profile/3304382
    hxxp://www.rfidtalk.com/showthread.php?p=19119
    hxxp://www.rottentomatoes.com/vine/showthread.php?p=16528906
    hxxp://www.rottentomatoes.com/vine/showthread.php?t=709353
    hxxp://www.scribd.com/doc/25364786/buy-cheap-Generic-Zocor-Simvastatin-20mg-online-without-prescription
    hxxp://www.server2go-web.de/forumng/index.php?topic=111147.0
    hxxp://www.spurs11.com/forum/showthread.php?t=69947
    hxxp://www.teamhallpass.com/2010/01/post-80522-buy-zocor/
    hxxp://www.teamhallpass.com/2010/01/post-80527-about-zocor/
    hxxp://www.technieuws.org/?p=83598
    hxxp://www.technieuws.org/?p=83620
    hxxp://www.tempuspharmacy.org/zocor-drug-information.html
    hxxp://www.theartofthepossible.net/?p=83620
    hxxp://www.theunforsaken.com/viewtopic.php?f=3&t=7668&p=8971
    hxxp://www.thisis50.com/xn/detail/784568:Topic:18648223?xg_source=activity
    hxxp://www.travelersnation.com/forum/post774.html
    hxxp://www.tumblr.com/tagged/saints+&amp%3B+sinners
    hxxp://www.twit88.com/home/node/10117
    hxxp://www.valuepharmaceuticals.com/medicine/index.php
    hxxp://www.wehopres.org/?p=83620
    hxxp://www.wikio.com/article/122956318
    hxxp://www.wikio.com/sports/football/football_players/michael_koenen
    hxxp://www.wizard101.pl/forum/buy-zocor-drugs-online-zocor-t296.html
    hxxp://www.world-drugs.net/order_generic_zocor.php
    hxxp://www.xlpharmacy.com/
    hxxp://www.xlpharmacy.com/generic-zocor/
    hxxp://www.zenpharmacy.com/Zocor/buy-prescription-Zocor-online.html
    hxxp://zocoronline130.typepad.com/blog/2010/01/buy-zocor-estrogen.html
    hxxp://36poker.ru/forum/index.php?topic=2188.0
    hxxp://ad-bu.chavalar.com/forum/index.php?topic=124.0
    hxxp://alexatutor.com/viewtopic.php?f=2&t=838&p=915
    hxxp://articlet.com/article7179.html
    hxxp://bb.obscurusfio.com/index.php?topic=279.msg406
    hxxp://bb.peak2010.org/viewtopic.php?f=2&t=31619
    hxxp://bbs.qqcipher.com/viewtopic.php?f=2&t=51
    hxxp://benthanhgold.com/forum/viewtopic.php?f=8&t=1487
    hxxp://biblioteca.uniminuto.edu/index.php/biblioteca-en-cifras/1297?task=view&page=975
    hxxp://bigcuzinent.com/forum/index.php?topic=29.0
    hxxp://blog.see3.net/?p=484
    hxxp://blogs.inquirer.net/m-ph/2008/08/29/nikon-d90-official-1st-dslr-with-hd-video-recording/
    hxxp://boards.tx-outdoors.com/viewtopic.php?f=2&t=343
    hxxp://buycheapviagra.ca/kamagra.html
    hxxp://buycialis20mg.com/buy-kamagra-soft-tabs.htm
    hxxp://buy-kamagra-online.net/
    hxxp://carolinadelnorte.jomc.unc.edu/?optin=com_pharma&rr=buy-kamagra-viagra-india.php
    hxxp://carolinaweek.jomc.unc.edu/?option_pharma=viagra-uk-kamagra.php
    hxxp://centovacast.com/viewtopic.php?f=9&t=182
    hxxp://centovacast.com/viewtopic.php?f=9&t=218
    hxxp://chemisaxli.gov.ge/forum/viewtopic.php?id=76060
    hxxp://citkim.phpbboy.com/viewtopic.php?f=2&t=734&p=734
    hxxp://community.bonnaroo.com/service/displayKickPlace.kickAction?u=13803616&as=12058
    hxxp://community.essence.com/forum/topics/how-to-buy-online-kamagra
    hxxp://cooperation-of-benzin.de/viewtopic.php?f=2&t=3726
    hxxp://district9140ng.org/index.php?topic=11.0
    hxxp://ekkanisayoluganda.org.uk/furum/index.php?topic=19289.0
    hxxp://essenceonline.ning.com/forum/topics/buy-kamagra-drugsorder-chep
    hxxp://fahrerservice.org/viewtopic.php?f=2&t=1830
    hxxp://fanclub.darabubamara.eu/viewtopic.php?f=3&t=2701
    hxxp://fanclub.darabubamara.eu/viewtopic.php?f=4&t=2687
    hxxp://feelmaldives.com/forum/viewtopic.php?f=2&t=36
    hxxp://foorum.kundaliniyoga.ee/viewtopic.php?f=2&t=5526
    hxxp://fora.an-archos.com/viewtopic.php?t=134335&sid=f3287141aaa40ea1970e3e8d53279b27
    hxxp://forocientifico.com/viewtopic.php?f=2&t=179
    hxxp://foros.comfusion.es/index.php?topic=675.0
    hxxp://forum.acme.nu/index.php?topic=12.0
    hxxp://forum.ampirstyle.ru/viewtopic.php?f=6&t=53
    hxxp://forumas.vtv.lt/index.php?topic=4192.0
    hxxp://forum.atlaspronet.net/showthread.php?t=80150
    hxxp://forum.autonews.fr/index.php?showtopic=42109&view=getlastpost
    hxxp://forum.auto.ro/showthread.php?t=505005
    hxxp://forum.cudaswiata.pl/viewtopic.php?f=6&t=488
    hxxp://forum.cudaswiata.pl/viewtopic.php?f=7&t=485
    hxxp://forum.dayment.com/viewtopic.php?f=14&t=19
    hxxp://forum.delifisek.net/index.php?topic=6.0
    hxxp://forum.djlanka.com/viewtopic.php?f=2&t=20547
    hxxp://forum.egypt.com/enforum/programming-languages-f84/buy-cheap-generic-kamagra-online-kamagra-no-prescription-39580.html
    hxxp://forum.faazmagazine.com/index.php?topic=153.0
    hxxp://forum.familyguy.cz/viewtopic.php?f=6&t=1215
    hxxp://forum.fsbw.de/viewtopic.php?f=1&t=543
    hxxp://forum.geotorrents.com/index.php?showtopic=455183&view=getnewpost
    hxxp://forum.gwteambuilder.de/index.php?topic=1516.0
    hxxp://forum.im1music.net/index.php?topic=13695.0
    hxxp://forum.jurutera.net/viewtopic.php?f=5&t=6
    hxxp://forum.jzip.com/archive/index.php/t-194030.html
    hxxp://forum.livetoride.cz/viewtopic.php?f=2&t=5
    hxxp://forum.masseriadelpino.it/viewtopic.php?f=2&t=850
    hxxp://forum.matura.pl/viewtopic.php?f=4&t=17054
    hxxp://forum.matura.pl/viewtopic.php?f=7&t=17150
    hxxp://forum.montages-electroniques.com/viewtopic.php?t=5824&sid=a19708674cddb891449e7c154a5fbaaa
    hxxp://forum.muzsweet.com/viewtopic.php?f=4&t=3502&p=23454
    hxxp://forum.opensourceassets.com/index.php?topic=10.0
    hxxp://forum.parrucchieritalia.it/viewtopic.php?f=3&t=1374
    hxxp://forum.plovdivairport.com/index.php?topic=8792.0
    hxxp://forum.pngarnet.ac.pg/viewtopic.php?f=2&t=36593
    hxxp://forum.pngarnet.ac.pg/viewtopic.php?f=2&t=36701
    hxxp://forum.polymus.ru/index.php?topic=2345.0;wap2
    hxxp://forum.rimsketoplice.net/viewtopic.php?f=5&t=721
    hxxp://forums.beerke.nl/viewtopic.php?f=4&t=4319
    hxxp://forums.deviationsonline.com/viewtopic.php?f=7&t=407
    hxxp://forums.deviationsonline.com/viewtopic.php?f=7&t=421
    hxxp://forum.sibautobroker.ru/viewtopic.php?f=5&t=4
    hxxp://forums.salug.org/index.php?action=printpage;topic=286.0
    hxxp://forums.stevengould.org/viewtopic.php?t=37126&sid=964c4c68b15e636529dbd54f2ab791a3
    hxxp://forum.ti.itb.ac.id/index.php?topic=2844.0
    hxxp://forum.toniderassi.com/viewtopic.php?f=5&t=25
    hxxp://forum.transimagovideo.com/index.php?topic=34.0
    hxxp://forum.ultravnc.fr/index.php?topic=2274.0
    hxxp://forum.wayfinder.com/index.php?topic=40.0;wap2
    hxxp://generics-sale.com/product/kamagra-soft-flavoured.html
    hxxp://generic-viagra-kamagra.com/
    hxxp://generic-viagra-kamagra.com/kamagra.php
    hxxp://habbo-aktuell.net/forum/viewtopic.php?f=5&t=1640
    hxxp://heldentaten-gilde.com/viewtopic.php?f=6&t=41
    hxxp://innfromthenight.com/forum/viewtopic.php?f=14&t=52817
    hxxp://jeepinohio.com/forum/viewtopic.php?f=8&t=3712
    hxxp://khaz.de/viewtopic.php?f=2&t=1051
    hxxp://knolstuff.com/forum/topics/buy-kamagra-online-1
    hxxp://laissezfaire.ru/viewtopic.php?f=3&t=4282
    hxxp://laser-inkjet-labels.com/viewtopic.php?f=2&t=228
    hxxp://laser-inkjet-labels.com/viewtopic.php?f=2&t=57
    hxxp://legalrxlist.com/
    hxxp://letterheadforemail.com/Kamagra.html
    hxxp://medicine.bizrate.co.uk/oid651048929.html
    hxxp://medicine.bizrate.co.uk/oid651048949.html
    hxxp://messageboard.wrolc.org/index.php?action=printpage;topic=2811.0
    hxxp://messageboard.wrolc.org/index.php/topic,2811.msg2826.html
    hxxp://my.superbasket.gr/viewtopic.php?f=4&t=1592
    hxxp://online-pill-store.com/
    hxxp://paintballtokod.hu/forum/viewtopic.php?f=2&t=6
    hxxp://permai.gov.my/forum/viewtopic.php?f=3&t=22558
    hxxp://picpost.rootsee.com/index.php?topic=150.0
    hxxp://pokerqc.ca/viewtopic.php?f=4&t=667
    hxxp://poradny.rodinaaja.cz/viewtopic.php?f=4&t=703
    hxxp://pravoedelo-spb.ru/forum/viewtopic.php?f=2&t=5
    hxxp://program.kralchat.net/kamagra.html
    hxxp://realmomsguide.sheknows.com/?q=kamagra
    hxxp://redrum-demos.net/forum/index.php?topic=672.0;wap2
    hxxp://registrar.fiu.edu/typo3_cache/a/index.html
    hxxp://rozbeans.com/forum/viewtopic.php?p=15276
    hxxp://sietereinos.com/viewtopic.php?f=8&t=10
    hxxp://sitagu.info/community/index.php?topic=49.0
    hxxp://slowebdev.net/viewtopic.php?f=4&t=6
    hxxp://snsdfan.com/forum/viewtopic.php?f=2&t=4
    hxxp://socbaytravel.com/forum/viewtopic.php?f=4&t=603
    hxxp://socbaytravel.com/forum/viewtopic.php?f=4&t=697
    hxxp://sonsofanarchyboards.com/viewtopic.php?f=2&t=12
    hxxp://sorsogon.gov.ph/discussion/viewtopic.php?f=2&t=47576
    hxxp://southernorcleague.com/forums/index.php?topic=149.0
    hxxp://spainleds.com/viewtopic.php?f=2&t=965
    hxxp://tatilyorum.net/viewtopic.php?f=2&t=7
    hxxp://techexchange.packeteer.com/viewtopic.php?f=4&p=18467
    hxxp://theevonyforum.com/post1915.html
    hxxp://thememoryhole.org/?s=kandu+v
    hxxp://thewallsoflove.com/forums/viewtopic.php?f=4&t=8
    hxxp://thisis50.ning.com/xn/detail/784568:Topic:18422720?xg_source=activity
    hxxp://thisis50.ning.com/xn/detail/784568:Topic:18869853?xg_source=activity
    hxxp://tra.tools4noobs.com/support-f2/where-buy-kamagra-online-the-lowest-drugs-online-offers-t88.html
    hxxp://twit88.com/home/node/9933
    hxxp://velociteen.com/forum/index.php?action=printpage;topic=1643.0
    hxxp://virb.com/cialiss91m
    hxxp://vitsearkiv.net/viewtopic.php?f=9&t=34
    hxxp://waltham2.financialchat.com/blogs/online-generic-kamagra-without-prescription
    hxxp://web.kc.ac.th/viewtopic.php?f=2&t=1454
    hxxp://web.kc.ac.th/viewtopic.php?f=2&t=1578
    hxxp://www.365pharmacy.co.uk/
    hxxp://www.3tabs.com/viagra/kamagra.html
    hxxp://www.acauch.com/foro/viewtopic.php?f=2&t=4
    hxxp://www.alismed.com/
    hxxp://www.arvuroma.it/forum/viewtopic.php?f=2&t=2131
    hxxp://www.bacila.com/forum/viewtopic.php?f=3&t=3925
    hxxp://www.backyardsteamtrains.com/viewtopic.php?f=2&t=659
    hxxp://www.bellspharmacy.com/
    hxxp://www.bellspharmacy.com/category/4/kamagra.html
    hxxp://www.bestpharmacy4u.com/kamagra/
    hxxp://www.blogcatalog.com/topic/buy+kamagra+oral+jelly+uk/
    hxxp://www.blogcatalog.com/topic/kamagra+100mg/
    hxxp://www.britishsteelcollection.org.uk/index.php?option=com_contact&view=contact&id=6:community&catid=45:sponsors&Itemid=59
    hxxp://www.bvkportal.com/phpbb3/viewtopic.php?f=4&t=20
    hxxp://www.carolinamartialartsforum.com/viewtopic.php?f=7&t=39
    hxxp://www.caverta-silagra.com/
    hxxp://www.cheapest-prescription-drugs.biz/
    hxxp://www.classicrockmagazine.com/forum/viewtopic.php?f=4&t=733&p=8913
    hxxp://www.classicrockmagazine.com/forum/viewtopic.php?f=9&p=8914
    hxxp://www.clubprivedesire.com/forum/viewtopic.php?f=6&t=257
    hxxp://www.coffeeshopnieuwvennep.nl/viewtopic.php?f=2&t=471
    hxxp://www.columbusunderground.com/wonder-bread-bakery-in-italian-village-to-close
    hxxp://www.daanbantayan.gov.ph/dbforums/viewtopic.php?f=9&t=1419
    hxxp://www.devourofmugthol.com/forums/index.php?topic=109.0
    hxxp://www.drontlen.com/forum/viewtopic.php?f=4&t=253&p=374
    hxxp://www.drontlen.com/forum/viewtopic.php?f=4&t=259
    hxxp://www.ekaport.ru/forum/showthread.php?t=14099
    hxxp://www.ekaport.ru/forum/showthread.php?t=14127
    hxxp://www.family-online-pharmacy.com/purchase_men___s_health_generic/
    hxxp://www.family-online-pharmacy.com/purchase_men___s_health_generic/buy_cheap_brand_kamagra_oral_jelly_online.html
    hxxp://www.folkd.com/go/kamagra+ajanta+pharma
    hxxp://www.forodevinos.com/viewtopic.php?f=3&t=55
    hxxp://www.forum4voip.com/viewtopic.php?f=1&t=38125
    hxxp://www.forum.tripudiolatino.it/viewtopic.php?f=2&t=165
    hxxp://www.freewebs.com/costaescorts/
    hxxp://www.geistheiler24.de/forum/viewtopic.php?f=11&p=5217
    hxxp://www.generatedata.com/forums/index.php?topic=2351.msg2495
    hxxp://www.getdarker.com/forums/viewtopic.php?f=3&t=5797&start=0
    hxxp://www.gourmet.com/forums/message.jspa?messageID=1481
    hxxp://www.healthpharmarx.com/
    hxxp://www.hollywood.com/Forums/Home.aspx?plckForumPage=ForumDiscussion&plckDiscussionId=Cat%3ACelebsForum%3A41Discussion%3Ac7c7096b-9895-497f-bb0d-a79fd53fc8f1
    hxxp://www.homegrow.me/where-to-buy-mestinon-online-fast-worldwide-shipping-the-m-t504.html
    hxxp://www.hunglay.com/webboard/index.php?action=printpage;topic=26.0
    hxxp://www.hunglay.com/webboard/index.php?topic=26.0
    hxxp://www.infotop.ro/forum/viewtopic.php?f=2&t=4
    hxxp://www.inox.tarrea.cl/foro/index.php?showtopic=68&view=old
    hxxp://www.ireallywantviagra.com/2009/11/cheap-kamagra-oral-jelly.html
    hxxp://www.jamespot.com/a/188474-Buy-Kamagra-Online.html
    hxxp://www.jobsstack.com/forum/index.php?action=printpage;topic=4405.0
    hxxp://www.jomc.unc.edu/
    hxxp://www.joomlatemplatesearcher.com/forum/index.php?action=printpage;topic=7362.0
    hxxp://www.joomlatemplatesearcher.com/forum/index.php?topic=7362.msg%msg_id%
    hxxp://www.kamagra.in/India-Kamagra.htm
    hxxp://www.kamagra-online.co.uk/aurogratablets.asp
    hxxp://www.kamagrastore.co.uk/
    hxxp://www.kamagratop.com/
    hxxp://www.led-tv-fernseher.de/forum/viewtopic.php?f=4&t=4
    hxxp://www.makinem.net/forum/index.php?topic=952.0
    hxxp://www.malerxpharmacy.com/product/sildenafil-kamagra.html
    hxxp://www.minco.com/community/members/Dr+Levitra.aspx
    hxxp://www.mister-wong.com/topics/buy+cheapest/
    hxxp://www.mister-wong.com/topics/kamagra/
    hxxp://www.mypage.com/viagralive/weblog
    hxxp://www.nnenyy-cs.info/viewtopic.php?f=8&t=943
    hxxp://www.oktmilya.ru/viewtopic.php?p=13782
    hxxp://www.onlinemedicalstore.net/
    hxxp://www.online-pharmacy-usa.com/men___s_health_drugs/buy_propecia_online
    hxxp://www.oxygenoverkill.com/forum/viewtopic.php?f=2&t=4
    hxxp://www.partyoffers.co.uk/forum/read.php?19,400,400
    hxxp://www.pdsanlazzaro.it/forum/viewtopic.php?f=3&t=2878
    hxxp://www.perlenhimmel.at/viewtopic.php?p=16661
    hxxp://www.photoactions.co.uk/Discount-Kamagra.htm
    hxxp://www.photoactions.co.uk/Jelly_Kamagra_Liquid.htm
    hxxp://www.phtclub.be/viewtopic.php?f=8&t=253
    hxxp://www.pills2go.com/
    hxxp://www.pioneer-physicaltherapy.com/buy-generic-kamagra+soft-online.html
    hxxp://www.portaldocuidador.com/forum/viewtopic.php?f=6&t=4212
    hxxp://www.promiana-bg.com/forum/index.php?action=printpage;topic=3072.0
    hxxp://www.promiana-bg.com/forum/index.php?topic=2777.0
    hxxp://www.ps3planet.it/forum/viewtopic.php?f=4&t=10090
    hxxp://www.pyzam.com/profile/3318196
    hxxp://www.pyzam.com/profile/3318197
    hxxp://www.realpharmacyrx.com/
    hxxp://www.reasonfrontier.com/index.php?action=printpage;topic=2791.0
    hxxp://www.redleafwands.com/ehsrp/index.php?action=printpage;topic=14534.0
    hxxp://www.rfidtalk.com/showthread.php?p=18965
    hxxp://www.rhettmiller.com/forum/viewtopic.php?f=3&t=1449
    hxxp://www.rottentomatoes.com/vine/showthread.php?p=16465556
    hxxp://www.rugbyveneto.org/phpbb//viewtopic.php?t=59630
    hxxp://www.scribd.com/doc/23935277/Buy-Kamagra-Online-Without-Prescription-Best-Place-to-Buy-Kamagra
    hxxp://www.scribd.com/doc/25069184/buy-Brand-Kamagra-oral-jelly-Sildenafil-citrate-100mg-online-without-prescription
    hxxp://www.sharpmeds.com/
    hxxp://www.simpy.com/user/mastsiagoel/tag/generic4all
    hxxp://www.skaly.sk/viewtopic.php?f=6&t=3009
    hxxp://www.skydsl.org/forum/viewtopic.php?p=12035&sid=594e5b80965d00e1ae83a04c1ee6eb5c
    hxxp://www.skydsl.org/forum/viewtopic.php?t=5999&sid=2254d3872dbd467413cde299664fd2a8
    hxxp://www.somalinet.com/forums/viewtopic.php?f=8&t=231252
    hxxp://www.songstowearpantsto.com/forum/viewtopic.php?f=3&t=118055
    hxxp://www.ssteve.nl/forum/viewtopic.php?f=2&t=105
    hxxp://www.stalkerzone.de/forum/viewtopic.php?f=3&t=2568
    hxxp://www.stalkerzone.de/forum/viewtopic.php?f=5&t=2642&p=22695
    hxxp://www.surcentro.com/en/info/www.kamagrarx.com
    hxxp://www.tebene.de/Members/Kamagra/buy-kamagra-online-paypal-payment
    hxxp://www.thegeneric-viagra.net/
    hxxp://www.thegreatpotdebate.com/forum/topic48.html?sid=ac9e1defb50abca2e1cff33a76d91bdb
    hxxp://www.theviagrastore.com/kamagra-generic-store-1095.html
    hxxp://www.thewealthacademy.co.uk/index.php?topic=1135.0
    hxxp://www.tuneando.es/index.php?action=printpage;topic=1705.0
    hxxp://www.tuneando.es/index.php?topic=1705.0
    hxxp://www.vertifight.com/forum/viewtopic.php?f=3&p=63126
    hxxp://www.vibeystars.nl/index.php?topic=35.0
    hxxp://www.vinilkosmo-mp3.com/forum/index.php?topic=201.0
    hxxp://www.wbahealth.com/product_brand_kamagra_soft_online.html
    hxxp://www.wordcountbuddies.com/wcb_forum_test/viewtopic.php?f=4&p=286
    hxxp://www.worstpreviews.com/forums/showthread.php?p=42881
    hxxp://www.xlpharmacy.com/ed-jelly/
    hxxp://www.xlpharmacy.com/Kamagra/
    hxxp://www.xmaspharmacy.com/kamagra-oral-jelly-100mg-p-59.html
    hxxp://www.xmaspharmacy.com/resource/index.html
    hxxp://www.your-best-drugstore.com/
    hxxp://www.zeroegg.cn/viewtopic.php?f=4&t=10674
    

    UPDATE: On 3/9/2010, hxxp://runbetterpoker.com/viewtopic.php?f=4&t=887 was removed from the list at the owner’s request. Software used to run the forum whose vulnerability led to the recent abuse has been removed.

    • Forum spam by fake pharmacies, online gambling, adult dating site, etc is nothing new. There are forum spam trackers that proffer spammer blacklists to forum admins.

      The URL’s you referenced are for the most part harmless sites, there are a couple I’ve recognized that could be “dangerous” but most of the links are victim sites, albeit poorly moderated, but none the less harmless.

      It’s always a good idea for people, when seeing *any advertisement* to be weary of clicking on the link(s), as would be the case if these links were presented in emails.

      I suppose my question is: How or with what would you suggest to prevent forums and blogs from being victimized in such a way?

      I’ve replied to your post on the WOT Forum with a quick dig resulting from one domain name obtained by visiting one of the referenced URL’s

      http://www.mywot.com/en/forum/5404–online-pharmacy-spam-a-brief-analysis

      Posted by g7w on January 26th

    • “The URL’s you referenced are for the most part harmless sites” agreed, and good observation.

      Most forums and blogs can be secured to a high degree by simply “keeping up to date”, WordPress for example consistently patches and improves upon known issues in each release. Unfortunately most admins seem to not be able to upgrade as quickly as they should, thereby leaving open doors for code-injection attacks.

      Furthermore, new attacks are always leveraging 0-day flaws, and unpublished weaknesses. There is little one can do to protect against them, even WAFs can’t be bullet-proof. Regular Monitoring and adherence to established good-security-practices should help though.

      Thanks for the reply on the WOT forum, much appreciated.

      Posted by anirban on January 26th

    • 247-pharmacy.com does not send spam! Also this site has been update and is certified McAfee Secure so I do not know why you have placed our site on here?!

      Posted by Heidi on March 4th

    • @Heidi
      ALL PHARMACY RELATED WEBSITES ARE CRAP AND SPEW TONS OF SPAM

      Posted by PharmacySitesSuck on March 12th

    • How do yo stop the spam advertising. My blog comments are being used as a way to leave advertisement for xlpharmacy. I contacted them and they claimed they have nothing to do with it. OH course the person I talk to was some poor sale person that had no idea.

      Posted by Jannese on June 4th

    • There are multiple ways to stop this: (1) using plugins like akismet for WP (2) blacklisting the IPs (used to post the spam ) using access to the web server (.htaccess etc..) (3) using a monitoring service which intimates you if a spam link has been posted to your blog.

      Of course the details will depend on the kind of CMS, configurations that you have.

      Hope this helps,
      -A

      Posted by anirban on June 4th

    • @Jannese
      The only way to avoid comment spam when using blogger seems to be to enable “Word Verification” (a captcha) or enable comment moderation. I recommend using both.

      More information from Blogger:
      Preventing Unwanted Comments and Comment Spam

      If you are using WordPress, you have the option of signing up for Akismet. Akismet is a free plug-in that automatically blocks common spam. Of course, even with WordPress, they only surefire way to avoid posting of spam is to moderate all comments.

      Posted by admin on June 4th

    • Its a great post. Just one question-How do you stop the spam advertising.

      ************

      Alyssa

      Posted by Pharmacy Guide on July 8th

    • If you are using a CMS like wordpress and such, there are free plugins like Akismet which try to weed out spam comments. Unfortunately due to the complex ways in which spam can be inserted, it should be assumed that a blog/board will always have some amount of spam in it. If a monitoring service can point out the spam in the pages then a webmaster can easily delete the offending comments and ban the IP and user, or something similar.

      Posted by anirban on July 9th

    • Spam trackers should find more ways to track down fake pharmacies, online gambling, adult dating sites, etc.
      How can we protect against hackers?

      Posted by Jenifer26 on July 10th

    • thanks for sharing such a great information with people like us. Keep posting..

      Regards
      Sharon baker, NY

      Posted by online drug pharmacy on January 26th

    • Useful piece

      Posted by LamuzNick on October 10th