there is a common thread to all of the md internet convections.
1. there is always other illeagal activity going on. such as diversion of money, insuarnce fraud etc.

2. there is always an excessive amount of a certin drug which can not be explained. ie the totals go from (just an example) 100 c3 scripts to the next month 10000 scripts for c3.

3. the nrop/phamacy is found not to be in a 'real' location such as from the mds house.
the red falgs come from other activities which lead the dea to the internet activity. it seems the greed kicks in and the nrop starts trying to incress there take and that raises the flags. not the internet activity it is only found while they are looking at the other items.