US shutters illegal medicine-selling sites mimicking Walmart

Phil Taylor, 27-Jul-2021

Two fraudulent websites that used Walmart branding and offered to sell medicines for COVID-19 and other diseases to the public have been taken offline by authorities in the US.

An investigation by Homeland Security Investigations (HSI), working with the US Attorney's Office for the District of Maryland, found that rather than supplying the medicines illegally, the websites were used to harvest personal information from users of the sites in order to carry out fraud, phishing attacks or to plant malware on the devices.

One site, pharmacywalmart.com was explicitly named to appear to be associated with the retail giant, while the other – called stromectol-ivermectin.com - redirected users to en.pharmacywalmart.com/buy-stromectol-usa.html.

A domain analysis conducted by HSI indicated that pharmacywalmart.com was created on November 4, 2019, from a registrant located in Russia.

Pharmacywalmart.com was offering a number of drugs for sale, including Stromectol (ivermectin), Aralen (chloroquine) and Kaletra (lopinavir/ritonavir), all of which have been proposed as having the potential to be used as treatment or prevention of COVID-19 since the start of the pandemic.

"When it comes to cyber fraudsters, dismantling their online platform is as good as destroying their business," commented James Mancuso of HIS's Baltimore field office.

"As soon as HSI identifies a malicious website we work to investigate the crime and pursue a criminal prosecution with the US Attorney's Office," he added. "By doing so we are denying these offenders the ability to commit more schemes and exploit more people."

The operation is part of Operation Stolen Promise, now in its second iteration, which as launched by HSI to combat the increasing and evolving threat posed by COVID-19-related fraud and criminal activity.

As of May 2021, the agency has seized more than $49m in illicit proceeds; made 281 arrests; executed over 200 search warrants and analysed more than 80,000 COVID-19 related domain names.