It may be the largest organized crime network that you have never heard of, and it deals in counterfeit drugs. So says the U.S. Food and Drug Administration, which seized and shut down 1,677 illegal pharmacy Web sites last month as part of the largest Internet-based counterfeit drug sting yet.

The shuttered Web sites all claimed to be “Canadian pharmacies” but the FDA says that not a single drug shipment actually came from the U.S.’s northern neighbor. And testing on the multiple undercover purchases of drugs made by FDA offices in Colorado, New Hampshire and western Pennsylvania—described in official court documents reviewed by Scientific American—found that the drugs were actually not cheap, generic versions of the drugs; they were all counterfeits.

The bust is expected to be a major blow to a complex web of online drug distribution that “appears to be highly nimble,” according to the agency. The FDA agent leading this operation believes that the Web sites are part of a major online drug distribution affiliate network that calls itself EvaPharmacy. That network processes roughly 30,000 orders and grosses around $2.7 million—monthly, according to earlier research (pdf) from of the University of California, San Diego. All the Web sites shut down by the FDA were displaying fake licenses and certifications to convince potential U.S. customers that the “FDA approved” and “brand name” drugs were legitimate.

The agency found “a clear linkage and presence of a large, organized online drug distribution network,” according to the affidavit of Daniel Burke, special agent in the FDA’s Office of Criminal Investigations. The crime network identified by the agency included 6,263 Web sites that all used one of at least eight site templates. Researchers believe the large international crime network is based in Russia and the Middle East, and that the seized Web sites were marketing directly to the U.S.

Most of the sites were slight adaptations of templates the network created, Burke said in his affidavit. (The agency declined to comment for this article.) They were carefully constructed to appear to be from real pharmacies like CVS, Walmart or Walgreens, according to the affidavit. In reality the shipments of counterfeit drugs came from India or Singapore instead of pharmacies in Canada. Federal agency warning banners displayed across Web sites like “www.walgreens-store.com” and “http://www.c-v-s-pharmacy.com/” now indicate that they are fraudulent and illegal. The U.S. government says it seized the domain names of the sites to prevent third parties from acquiring the Web site URLs and using them to commit additional crimes.

The FDA’s sting, which was carried out in conjunction with international partners, built on the work of academic researchers who have been carefully identifying these sites for the past several years. It took a coalition of computer scientists several years to identify the pages, as they worked through tracking which were legitimate Canadian pharmacies and which were illegal and did not ask for prescriptions. The only sure-fire test was to order drugs (pdf) and see how the Web site performed. “Making the call” about whether a site was from a real Canadian pharmacy or was a fake “requires a little internet detective work,” says Chris Kanich, professor of computer science at the University of Illinois at Chicago, who led some of the research in this area.

Creating a complex computer algorithm that could capture all these sites is impossible, he says, because it remains too challenging to distinguish legitimate online pharmacies from fraudulent sites without making some online purchases. The FDA provides consumers with advice on how to find an online pharmacy through BeSafeRx: Know Your Online Pharmacy.

For this crime investigation there were no meetings in back alleys or surreptitious hand offs—just online purchases akin to what a consumer might do sitting at home. In one instance an FDA special agent purchased $105.45 of the diabetes drug Actos and arthritis medication Celebrex, and had them shipped to a U.S. address. As a free “bonus” the site offered to throw in four free pills of Viagra, according to official records. At no point during the purchase was the agent asked to provide a prescription from a licensed medical practitioner, complete a medical questionnaire or consult with a health professional.

Two weeks later, an agent received the purported drugs with a package postmarked from India. They were not the branded drugs as advertised; they were drugs that are illegal to sell in the U.S., and that purportedly contained the same active ingredient as the advertised drug. Some of the drugs came in a package simply labeled “sample-hermless [sic] medicine for personal use—‘Not for sale.’” Moreover, no directions for use or package inserts were included with the shipment.

Shutting down this slice of EvaPharmacy’s business amounts to a significant blow to the faux firm’s infrastructure, Kanich says. “They would need a really resilient business to recover from this.”