By True Pharma has been in operation since 1999 under various names, including the well-known “Canadian Pharmacy” label. They offer a broad range of prescription medications online—including products from leading pharmaceutical companies such as Pfizer, Merck, Johnson & Johnson, GlaxoSmithKline (GSK), Sandoz (Novartis), AbbVie/Abbot, AstraZeneca, Ranbaxy, Cipla, Lilly (Eli Lilly), Bayer, Novo Nordisk, as well as various generic options like ED packs, Teva, and Indian generics—all available without a valid prescription. This practice not only circumvents established medical oversight but also poses significant risks to consumer health, as it can lead to misuse, dangerous drug interactions, exposure to counterfeit medications, or the use of inappropriate treatments without proper diagnosis or supervision.
This expansive online pharmacy network generates hundreds of thousands of US dollars annually through a robust global supply chain and distribution network. Analysis of traffic and orders shows that their primary markets are the United States, Australia, the United Kingdom, Spain, and France. Among the most searched products are Viagra, Cialis, Propecia, Motilium, and Lasix.
In this investigation, we will take a deep dive into True Pharma’s operations, exploring their online infrastructure, supply chain, and revenue generation.
Our research indicates that, at the time of investigation, the network operated over 296 domains hosted by the Russian bulletproof hosting provider Proton66 OOO (AS198953). For more context on Proton66 OOO (AS198953), please refer to our previous article. The earliest domains discovered in this network were pharmacy-true[.]com and meds-true[.]com, both registered in August 2023. Since then, they have registered 6 domains in 2023, 62 in 2024, and 227 in 2025—with 111 domains registered in March 2025 alone—highlighting the intensification of their online activities.
As of 3 April 2025, the True Pharma network hosted its domains on Russian bulletproof hosting providers Proton66 OOO (AS198953) and PROSPERO OOO (AS200593). Both companies appear to be linked through shared upstream providers, which have varied over time.
Mapping Their Domain Infrastructure
Below is a detailed breakdown of their domain registrars.
In particular, 292 of these domains are configured with nameservers associated with dns-true[.]com and true-public[.]com, while the remaining four domains use different nameservers, as detailed in the table below.
| Domain | Registrar | Date Created | Date Expires | Nameservers |
| 7-drugs.com | GKG.Net, Inc | 11/17/2023 | 2025-11-17 | ns1.7-drugs.com; ns2.7-drugs.com |
| meds-true.com | GKG.Net, Inc | 8/8/2023 | 2025-08-08 | ns1.meds-true.com; ns2.meds-true.com |
| pharma-5.com | GKG.Net, Inc | 1/28/2025 | 2026-01-28 | ns1.pharma-5.com; ns2.pharma-5.com |
| pharmacy-true.com | GKG.Net, Inc | 8/8/2023 | 2025-08-08 | ns1.pharmacy-true.com; ns2.pharmacy-true.com |
Through OSINT investigations, we identified six additional domains. A summary is presented in the table below.
| Domain | Registrar | Registrant Name | Registrant Country |
| dns-true.com | CSL Computer Service Langenbach GmbH d/b/a joker.com | N/A | Germany |
| true-public.com | CSL Computer Service Langenbach GmbH d/b/a joker.com | N/A | Germany |
| true-secure-payments.com | CSL Computer Service Langenbach GmbH d/b/a joker.com | Alan Karjoe | Germany |
| true-client.com | CSL Computer Service Langenbach GmbH d/b/a joker.com | Alan Karjoe | Germany |
| true-nameserver.com | CSL Computer Service Langenbach GmbH d/b/a joker.com | Alan Karjoe | Germany |
| true-client-support.com | CSL Computer Service Langenbach GmbH d/b/a joker.com | Alan Karjoe | Germany |
| true-meds.net | CSL Computer Service Langenbach GmbH d/b/a joker.com | Alan Karjoe | Germany |
| true-help.com | DomainContext, Inc | Alan Karjoe | Germany |
About Alan Karjoe
An email address, lamesy@protonmail.com, was found to be linked to Alan Karjoe. This address has been associated with accounts registered on Microsoft (ID: 9C83331FA89259CF) and Skype (ID: live:.cid.9c83331fa89259cf).
Past Registrant Data and Patterns
An analysis of the historic WHOIS records for 292 domains hosted with Proton66 OOO revealed that the registrant country “Russian Federation” appears at least 19 times. While many of the registrant names and email addresses appear to be false or misleading, the repeated mention of Russia as the registrant country suggests a likely geographic origin for the network’s operators.
Infrastructure Analysis of 6 Extra Identified Domains
Analysis of the six additional domains identified the infrastructure providers listed below.
| Domain | IP Address | ISP | Geolocation Country | Name Server records |
| dns-true.com | N/A | N/A | N/A | x.ns.joker.com z.ns.joker.com y.ns.joker.com |
| true-public.com | N/A | N/A | N/A | z.ns.joker.com y.ns.joker.com x.ns.joker.com |
| true-secure-payments.com | 185.225.114.56 | IP Fiber Inc | Sweden | ns2.dns-true.com ns1.dns-true.com |
| true-client.com | 80.82.76.51 | IP Volume Inc | The Netherlands | y.ns.joker.com z.ns.joker.com x.ns.joker.com |
| true-nameserver.com | N/A | N/A | N/A | z.ns.joker.com y.ns.joker.com x.ns.joker.com |
| true-client-support.com | 80.82.76.51 | IP Volume Inc | The Netherlands | y.ns.joker.com x.ns.joker.com z.ns.joker.com |
| true-meds.net | 194.88.107.82 | WorldStream B.V. | The Netherlands | x.ns.joker.com z.ns.joker.com y.ns.joker.com |
| true-help.com | 80.82.76.51 | IP Volume inc | The Netherlands | ns2.true-public.com ns1.true-public.com ns1.dns-true.com n s2.dns-true.com |
Online Accounts Insights
An investigation into the website true-meds[.]net uncovered the following associated online accounts.
| Platform / Type | Username | Notes |
| Telegram Channel @truemoneymakers | truemoneymakers | 240 subscribers Admins @johnmeds & @andmeds |
| Telegram Bot | @TrueMedsBot | |
| Telegram Admin | Johnmeds (ID: 5624001192) | |
| Telegram Admin | Andmeds (ID: 6011428273) | |
| Jabber | john@tjabb.com | |
| Jabber | andy@tjabb.com |
The Telegram channel @truemoneymakers was created on 13 February 2023 and primarily features content in Russian.
On 28 February 2023, the channel shared an image showcasing their webmaster statistics, highlighting a week’s worth of traffic from the United States. A screenshot is included below.
The Telegram channel also hosts content contests, offering cash prizes to winners. Additionally, it promotes a pharmaceutical affiliate program, as illustrated in the screenshot below.
On 21 June 2023, the channel shared insights highlighting the top countries placing orders through their websites, along with the most frequently purchased products. A screenshot is included below.
On 2 August 2023, they shared revenue statistics based on orders originating from the United States and Australia. A screenshot is included below.
On 9 August 2023, they shared revenue statistics from orders placed in the United States, Canada, New Zealand, Australia, the United Kingdom, and France. A screenshot is provided below.
On 13 September 2023, they shared revenue statistics derived from orders placed exclusively in the United States. A screenshot is provided below.
On 29 November 2023, they released revenue statistics from the US, mixed traffic, and EU orders. A screenshot is provided below.
Supply Chain Analysis
Investigations into the supply chain of True Pharma uncovered that their warehouse(s) are located in India. The medicines are shipped by Movid Impex from the following physical address:
- Office No.2 &3, 1st Floor, Affinwala Building, 77 Mint Road, FO, Mumbai, Maharashtra, India, 400001; The address seems to be located near Geo Chem Laboratories Private Limited. A screenshot is provided below.
Movid Impex was found to be operated as a sole proprietorship by IRFAN AMEER HUSAIN ANSARI (GST number: 27ADWPA9288P1ZC), with the legal entity registered in July 2017. For the financial year 2023-2024, the company reported revenue between Rs. 1.5 Cr and Rs. 5 Cr, which translates to approximately $183K to $610K USD. Prior to this, Irfan Ameer Husain Ansari held GST number 27ADWPA9288P2ZB, under the trade name “VELOCITY HEALTHCARE”, which was registered in April 2020 and later cancelled upon application. According to his Facebook profile, Irfan Ameer Husain Ansari appears to have a connection to a company called “Delta Enterprises”, with medicines featured in the cover photo.
The website justanswer.com provides information about orders / tracking numbers associated with Movid Impex.
During our investigation, we found that consumers who ordered branded medications were sometimes supplied with generic drugs marketed under the name “Delta Enterprises” (Fort, Mumbai, 400001).
Further searches for IRFAN AMEER HUSAIN ANSARI on zaubacorp.com revealed another company, FINA HEALTHCARE PRIVATE LIMITED (CIN: U85300MH2021PTC368153), which was registered in December 2021 in Mumbai. IRFAN AMEER HUSAIN ANSARI and SHARIQUE LAKHANI are listed as directors of this company. The company is located at the following physical address:
- 1005, Floor 10th, Plot-12-12C, CS 639, Ramnimi, Cawasji Patel Road, Fort, Mumbai, Maharashtra, India, 400001.
Further investigation into the GST 27ADWPA9288P1ZC (Movid Impex) revealed two IndiaMart accounts registered under the name “Delta Enterprises”. The first account does not list any products but displays the HSN Codes for medicines. The second account, however, lists generic medicines. On their page, they state:
“We offer a wide range of Pharmaceutical Drug, Ayurvedic Medicines, Generics of Cialis, Levitra, Propecia & Proscar and various FDA & WHO approved Pharma Products to offshore online pharmacies. These medicines are supplied to worldwide, especially in USA and Europe. We have also established a wide distribution network in India and supplying our medicines to Indian companies with customized drop shipping options as per the client requirements. Presently, we are supplying more than 5000 generics and branded medicines. Further, to suit the varied requirements of the clients, we also offer contract supplies to Offshore Online Pharmacies”.
They also claim to have distribution centers in India, the UK, and Spain. The physical address listed on the second IndiaMart account closely matches the one provided earlier for Fina Healthcare:
- 2, Kolsawala Building, 16, Cawasji Patel Street, Fort, Mumbai, Maharashtra, India, 400001
According to eximpedia.app, Movid Impex is linked to 438 medicine export shipments. They also offer statistics on export destinations, ports, and medicines. A screenshot of the export countries is provided below.
Approximately 99.71% of shipments were exported via Bombay Air Cargo. The top 5 export buyers are displayed in the screenshot below.
According to data from trademo.com collected between 1 January 2021 and 29 February 2024, Movid Impex has completed 6,580 shipments, accumulating a trade value of $32.7K USD. The top importing countries are similar, including Singapore, Belgium, UAE, and Malaysia.
Trademo.com also gathered data for “Delta Enterprises” from 1 January 2021 to 30 November 2024, which recorded 72,700 shipments with a total trade value of $7.2M USD. The primary importing countries in 2024 were UAE, Nepal, Singapore, and Belgium. Between 1 January 2021 and 30 November 2024, Delta Enterprises imported 565 shipments with a cumulative trade value of $3.09M USD. In 2024, the top importing countries were Singapore, France, Japan, Italy, and the United Kingdom.
tradeindata.com provides similar statistics for Movid Impex, with data extending back to 2020. Between January 2020 and December 2023, Movid Impex conducted 45,650 shipments and also offers more detailed information regarding the exported medicines.
Additionally, our investigation revealed that Movid Impex, Fina Healthcare, and Delta Enterprises share the same accountant based in Mumbai, India.
Regarding Fina Healthcare, historical data from Volza shows that the company has exported 1,070 shipments to 20 buyers. The main markets for these exports were Malawi (66.36% of shipments), Burundi (27% of shipments), and Mozambique (2.71% of shipments).
Payment Channels and Transaction Methods
The True Pharma network advertises various payment options, but during the actual checkout process, customers can only use debit/credit cards or one of eight supported cryptocurrencies.
Backlink Analysis and Black Hat SEO Tactics
We conducted a backlink analysis of the 296 domains initially identified to understand the marketing and advertising strategies employed by True Pharma.
Backlink analysis involves examining all incoming links from external websites that point to a target site—in this case, domains associated with True Pharma. This helps reveal how the network builds visibility and drives traffic through search engines.
Our findings indicate that True Pharma heavily relies on Black Hat SEO techniques to manipulate search engine rankings and attract users. Key tactics observed include:
- Doorway Pages
True Pharma deploys keyword-heavy pages targeting search terms such as “buy Adderall online” or “cheap Viagra without prescription”. These pages are designed solely to rank in search results and redirect users to the main illegal storefront. They are often distributed across dozens or even hundreds of domains.
- Keyword Stuffing & Hidden Text
Pages are overloaded with repetitive keywords—sometimes hidden via styling (e.g., white text on white background)—to rank for specific queries like “cheap Viagra without prescription”.
- Comment Spam & Forum/Classifieds Spam
The network floods comment sections, forums, and Q&A platforms with spammy, keyword-rich links (e.g., “Click here to buy Nizagara online right now!!!”), all pointing back to their rogue pharmacy sites. This strategy targets both visibility and link-building.
- Link Farms & Private Blog Networks (PBNs)
True Pharma uses interconnected networks of low-quality or compromised websites to pass artificial “link juice” and inflate the search authority of their primary domains.
- Link Shorteners & Coupon Baiting (Redirection Manipulation)
The operation increasingly utilizes link shorteners (e.g., cutt.ly, shorturl.at) and fake promotional offers to:
- Conceal the actual destination of the link
- Evade detection by spam filters on social media, email, and forums
- Drive clicks using deceptive offers like “50% off Viagra – click here!” or “Low Prices Today Only”
- Build urgency and trust through fake countdowns, reviews, or limited-time messaging
- Content Scraping & Spinning
True Pharma replicates content from legitimate sources and rewrites it algorithmically to appear unique, allowing them to scale low-effort pages that still rank on search engines.
- Fake Reviews & Testimonials
To build false credibility and manipulate user trust, the network generates fabricated testimonials and review content, often embedded directly on product pages.
The table below lists the top 20 domains ranked by total number of backlinks.
| Target Domain | Total Backlinks |
| healthcare-24×7.com | 86,303 |
| pharmacy-true.com | 13,118 |
| buycheaponline247.com | 8,735 |
| pharm-247.com | 8,408 |
| rx-elife-pharmacy.com | 4,325 |
| trustedtablets.net | 3,802 |
| gesundeliebe.com | 3,668 |
| dailypharmapills.com | 2,630 |
| pharmacywiki.org | 2,205 |
| 50-pluspharmacy.com | 1,651 |
| europeanmdsolution.com | 856 |
| rx-medz.com | 853 |
| bestfasttabs.com | 833 |
| ciplabestmdbrand.com | 637 |
| pharmacy-care.net | 462 |
| urmedicalprovider.com | 436 |
| rxstore24x7.com | 416 |
| fast-pharmacy.com | 379 |
| sky-pharmacy-online.com | 345 |
| buyviagrapharmacy.com | 315 |
Recommended Actions
- For Pharmaceutical Brands
- Monitor brand abuse and domain spoofing tied to rogue pharmacies.
- File takedown requests for infringing domains and unauthorized product listings.
- Collaborate with threat intelligence providers to track the adversary’s digital footprint — including domain/IP infrastructure, social media activity, and Black Hat SEO tactics — to support early detection and attribution.
- For Internet Infrastructure Intermediaries
- Identify and suspend domains involved in illegal pharmacy activity.
- Block IPs and ASNs linked to known bulletproof hosting providers used by True Pharma.
- Enforce ToS violations related to pharmaceutical sales without licenses.
- Flag and restrict payment processing associated with identified rogue pharmacy infrastructure.
- For Law Enforcement
- Coordinate internationally to disrupt the illicit pharmaceutical supply chain, including points of origin, transit channels, and distribution hubs.
- Pursue asset seizure and financial tracing, especially across cryptocurrency wallets and laundering mechanisms.
- Work with cross-border partners to dismantle associated infrastructure and apprehend key actors behind the network.
