xree.ru and the persistent pharma spam

Do doubt sent out by the same crew who are pushing malware, this pharma spam seems to have hit new highs.

Date:      Tue, 15 Jan 2013 05:35:04 -0500 (EST)
From:      Account Mail Sender [invoice@erlas.hu]
Subject:      Invoice confirmation

Hello. Thank you for your order.

We greatly appreciate your time and look forward to a mutually rewarding business relationship with our company well into the future.

At present, our records indicate that we have an order or several orders outstanding that we have not received confirmation from you. If you have any questions regarding your account, please contact us.

We will be happy to answer any questions that you may have.

Your Customer Login Page

Customer login: [redacted]

Thanking you in advance for your attention to this matter.

Sincerely, Justa Dayton

The link in the email goes through a legitimate hacked site to [donotclick]xree.ru/?contactus but then it redirects to a seemingly random fake pharma site. However, the redirect only works if you have the referrer set correctly.

The landing sites are on:
199.59.56.59 (Hostwinds, Australia)
209.236.67.220 (WestHost Inc, US)

I can't find any malware on these sites, but you may as well block them if you can as they seem to have a lot of domains on them:

birthmed.com
canadapharmcanadian.net
caregiverskicare.net
centerlinedrugstore.net
cialisviagrapetraeus.com
cialiswelloch.net
cizaqussish.com
climbedwelness.com
contabmedicine.eu
cucy.ru
dietpillpepsi.eu
dietprescriptionpharmacy.net
dietwelness.com
djyfammerco.com
drugenericsmeds.com
drugprescriptionmedical.com
drugstoremedicalsrx.ru
drugstorepharmacycenterline.com
drugstorerxfitness.ru
exerciseprescriptiondiet.com
fitnessdrugstorepharmacy.ru
genericswelnesspharmaceutical.eu
healthcarelnessmedical.net
healthdrugstorepharmacy.ru
healthwiblackwell.com
israeltrapharm.com
levitratab.com
levitraviagraron.net
mail.tabletsdrugstoredrugstore.ru
marijuanarxmedicine.com
medicaredrugstoreprescription.eu
medicarewitax.com
mytabhealth.com
nislevitra.com
northwesternlevitrapills.net
nutritiondrugstorepharmacy.ru
parisdrugstore.ru
patientsharmedical.com
patientsharmedical.eu
pillcent.nl
pillmedicalhospital.pl
prescriptioncialteens.com
prescriptiondrugwalmart.com
prescriptionryan.eu
rxnutrition.ru
tabcalories.com
tabletdrugshealth.ru
tabletdrugstoretabs.ru
tabletlevitrapp.com
tabletpharmacypharmacy.ru
tabletpillspills.ru
tabletsdrugstoredrugstore.ru
tabletspharmacyjobs.ru
tabletspharmacypharmacy.ru
tabletspillsshop.ru
tabrxtablets.ru
thecaretab.com
viagraprogene.net
xree.ru
zury.ru