DrugBuyers.Com: www.pillbox.com busted?

They shut this operation down years ago. Anyway, since the subject resurrected itself here, yesterday i visited www.thepillbox.com and the web page message below came up. All web servers will log the IP of the requester and the referring site that is DB. They can have fun going through the logs. Right now their server is not replying to HTTP, but a ping on the domain name shows the DNS request is redirected to a live server somewhere that responds to ping. Gee, if they want to hide their server's status, it's easy to turn off ping. Makes it easier to check and see if the machine is running.

C:\>ping thepillbox.com

Pinging web1.redirect.dea.gov [65.207.69.187] with 32 bytes of data:

Reply from 65.207.69.187: bytes=32 time=125ms TTL=115
Reply from 65.207.69.187: bytes=32 time=127ms TTL=115
Reply from 65.207.69.187: bytes=32 time=124ms TTL=115
Reply from 65.207.69.187: bytes=32 time=125ms TTL=115

Ping statistics for 65.207.69.187:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 124ms, Maximum = 127ms, Average = 125ms

-----
Maybe they let it ping because they have it on a commercial server:
-----
Domain Query Results

UUNET Technologies, Inc. UUNET65 (NET-65-192-0-0-1)
65.192.0.0-65.223.255.255
NVA Netsearch UU-65-207-69-128-D3 (NET-65-207-69-128-1)
65.207.69.128-65.207.69.191
-----

Traceroute didn't show much except that the server's location appeasr to be near Phoenix, AZ. They probably have a contract with UUNET to host all their seized domain names:

-----
Trace Route
The traceroutes shown below are from 3 distinct locations on the web as indicated by the respective headings. In each case, our address (or gateway) is hop #1, while the last hop corresponds to the network at your end.

Toronto, Canada

Hop Name IP AS# Times (ms)

--------------------------------------------------------------------------------

1 69.28.226.193 69.28.226.193 AS13768 2 2 2
2 tor-dis-2.ne.peer1.net 216.187.68.5 AS13768 2 2 2
3 GIG4-0.tor-core-b.peer1.net 216.187.68.69 AS13768 2 2 2
4 OC48POS1-0.tor-core-a.peer1.net 216.187.68.229 AS13768 2 2 2
5 OC48POS2-0.chi-gsr-a.peer1.net 216.187.68.58 AS13768 13 13 13
6 CHCGIL9LCX1.wcg.net 206.223.119.83 99 99 99
7 brvwil1wcx2-pos12-0-oc48.wcg.net 64.200.103.117 AS7911 99 99 99
8 brvwil1wcx3-pos12-0-1-a0.wcg.net 64.200.236.18 AS7911 99 99 99
9 hrndva1wcx2-pos15-3.wcg.net 64.200.210.81 AS7911 99 99 99
10 washdc5lcx1-pos5-0.wcg.net 64.200.240.194 AS7911 99 99 99
11 so-0-0-0.edge2.Washington1.Level3.net 4.68.127.25 AS3356 99 99 99
12 so-1-1-0.bbr1.Washington1.Level3.net 64.159.3.61 AS3356 99 99 99
13 so-0-1-0.mp2.Phoenix1.Level3.net 64.159.1.122 AS3356 99 99 99
14 so-9-0.hsa1.Phoenix1.Level3.net 4.68.113.254 AS3356 99 99 99
15 unknown.Level3.net 63.214.160.138 AS3356 99 99 99
16 192.168.15.102 192.168.15.102 99 99 99

Houston, Texas USA

Hop Name IP AS# Times (ms)

--------------------------------------------------------------------------------

1 64.246.0.1 64.246.0.1 AS5650/AS13749 1 1 1
2 ivhou-207-218-245-4.ev1.net 207.218.245.4 AS5650/AS13749 1 1 1
3 ivhou-207-218-223-14.ev1.net 207.218.223.14 AS5650/AS13749 1 1 1
4 hstntx1wce2-gige5-0.wcg.net 65.77.93.53 AS7911 1 1 1
5 dllstx1wcx2-pos5-0-pos5-0.wcg.net 64.200.240.73 AS7911 6 6 6
6 dllstx1wcx3-pos10-0.wcg.net 64.200.110.134 AS7911 6 6 6
7 dllstx9lcx1-pos9-0.wcg.net 64.200.232.210 AS7911 6 6 6
8 so-2-2-0.edge1.Dallas1.Level3.net 4.68.127.21 AS3356 6 6 6
9 so-1-2-0.bbr1.Dallas1.Level3.net 209.244.15.161 AS3356 6 6 6
10 so-0-0-0.mp1.Phoenix1.Level3.net 64.159.3.213 AS3356 40 40 40
11 so-10-0.hsa1.Phoenix1.Level3.net 4.68.113.242 AS3356 40 40 40
12 unknown.Level3.net 63.214.160.138 AS3356 40 40 41

London, UK

Hop Name IP AS# Times (ms)

--------------------------------------------------------------------------------

1 aggr1.rackspace.com 212.100.224.194 AS15395 1 1 1
2 vl130.edge2.lon.rackspace.net 212.100.227.19 AS15395 1 1 1
3 border6.fe5-1.rackspace-1.lon.pnap.net 212.118.242.133 AS15570 2 2 2
4 core2.ge0-1-bbnet2.lon.pnap.net 212.118.240.98 AS15570 16 16 16
5 ge-2-0-129.ipcolo2.London1.Level3.net 212.113.11.137 AS9057/AS3356 2 2 2
6 ae-0-51.mp1.London1.Level3.net 212.187.131.1 AS9057/AS3356 2 2 3
7 so-3-0-0.mp1.London2.Level3.net 212.187.128.46 AS9057/AS3356 3 3 3
8 as-0-0.bbr2.Washington1.Level3.net 4.68.128.102 AS3356 80 80 80
9 so-0-1-0.mp2.Phoenix1.Level3.net 64.159.1.122 AS3356 146 146 146
10 so-9-0.hsa1.Phoenix1.Level3.net 4.68.113.254 AS3356 143 143 143
11 unknown.Level3.net 63.214.160.138 AS3356 142 142 142
-----

Yesterday, this is what the site served up in my web browser:

-----------------------------------
[graphic of U.S. flag and DEA logo]
-----------------------------------

By application of the United States Drug Enforcement Administration, the website you are attempting to visit has been forfeited by the United States District court for the Western District of Texas, San Antonio Division, pursuant to Title 21 United States Code, Section 853(a)(2). The owner of this website was convicted of violating Title 21 United States Code, Section 841 illegally dispensing controlled substances. The dispensing of controlled substances without a legitimate medical purpose established by a valid physician-patient relationship is a federal offense punishable by a term of imprisonment of up to 20 years.
-----------------------------------

So there you have it. Apparently, this is how DEA takes over commercial web sites that they've closed down. The DEA did not let the registration lapse. www.pillbox.com is a different site entirely.

Trampy

--------------------
Your mileage may vary ...