One week later: Rustock and Pharmacy Express still flatlined

Filed Under: Law & order, Microsoft, SophosLabs, Spam

One week after the much publicized Rustock botnet command and control take down, and subsequent drop in spam volumes, SophosLabs can confirm Rustock has not come back from the dead. "Dawn of the Dead" analogies need not apply.

To illustrate this, the graph below displays weekly spam volumes going back to the start of February (red line is the average volume prior to the take down). Notice the lighter blue line, which highlights the spam volume in the week since the take down:

Weekly Spam Volume

With the specific messages tied to Rustock remaining flatlined:

Rustock Spam Volume

For those wondering exactly what type of spam is no longer filling the pipes of networks worldwide, here are two recent examples of spam sent in the days prior to the take down:

Rustock Spam Example1

Rustock Spam Example2

Clicking the links or images in these messages will direct the recipient to one of a number of varying criminal "Pharmacy Express" website templates. The "Pharmacy Express" referred to here is not a legitimate online pharmacy, but a well known criminal affiliate spamming operation.

These sites are believed to be run by none other than long time ROKSO listed spammer Leo Kuvayev. For example:

Pharmacy Express Example

We should all commend the efforts of those involved with this investigation and take down, and hope enough evidence had been gathered to eventually prosecute those involved.

For more information on what motivates these spammers and the methods used to propagate this spam download our technical paper "The Partnerka - What is it, and why should you care?".

, , , ,

You might like

4 Responses to One week later: Rustock and Pharmacy Express still flatlined

  1. rod · 812 days ago

    what exactly is the scam? do they fail to send you viagra, or do they send viagra that doesn't work? or is the accusation of it being a scam actually the scam? if i was selling viagra for $16 per pill, i'd accuse anyone selling it for $1 of being a scammer, simply to destroy my competition, regardless of if they are actually a scam or not.

  2. Olen1009 · 507 days ago

    I appreciate Rod's comment...but Pharmacy Express is a true spammer. There is no record of them ever filling a drug order. They just take the money & run...and steal the identity of the credit car holder!

    And, by the way...Pharmacy Express is back, worse than ever...I am getting 30-40 spam emails a day!

  3. think i have just been taken after a week of no reply I have googled and come up with your page and report showing the web page above ;-( I paid by Visa do you know if there is any way to get money back or am i screwed?

  4. Neal · 354 days ago

    I attempted to place an order with them. As soon as Is submitted payment and it took me to a blank page, I knew it was a scam. I quickly called a service number to report my card as compromised. Then searching for it afterwards made it clear, I'll search before next time.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Brett is a Technical Lead in the AntiSpam Operations team within SophosLabs. He has been working for Sophos since their acquisition of ActiveState in 2003.