[email] [drugs - Pharmacy Express] [91.4.174.72] (rx555.com - hertunjinkdastion.com - vckionldesunjas.com) Re: disgus
TomezNet
IP 91.4.174.72 p5B04AE48.dip0.t-ipconnect.de
(at dns51.t-ipnet.de / telekom.de)
Spamvert:
www.rx555.com IP 221.11.114.66
(OLD IP 210.51.37.50, 61.163.200.186, 61.31.214.78)
(SBL48539 / SBL48682) (NOW at CNCGROUP-SN)
Web title: Pharmacy Express
© 2006 PharmacyExpress.com All Rights Reserved.
See also plenty forged site certificates and logos served from the same
domain this time.
More spammer sightings:
http://groups.google.com/groups/search?q=%22Pharmacy+Express%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.170; Sun, 17 Dec 2006
02:55:20 -0800
X-Originating-IP: [91.4.174.72]
Return-Path: <str...@waipas.org.nz>
Authentication-Results: mta366.mail.re4.yahoo.com from=waipas.org.nz;
domainkeys=neutral (no sig)
Received: from 91.4.174.72 (HELO waipas.org.nz) (91.4.174.72) by
mta366.mail.re4.yahoo.com with SMTP; Sun, 17 Dec 2006 02:55:20 -0800
Message-ID: <01c721c9$d843bed0$1873a8c0@Ole>
Reply-to: "Julian Getchell" <str...@waipas.org.nz>
From: "Julian Getchell" <str...@waipas.org.nz>
To: [MUNGED]
Subject: Re: disgus
Date: Sun, 17 Dec 2006 11:55:20 +0100
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative";
boundary="----=_NextPart_000_0001_01C721D2.1D678200"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Content-Length: 7095
<html><head>
<meta http-equiv="Content-Type">
<meta>
<style></style>
</head>
<div><font face="Arial" size="2"><div><font face="Arial" size="2">
Since we cannot kill them we-and you realize only the
highest</font></div></font></div>
<div><img
src="http://attach.mud.mail.yahoo.com/us.f905.mail.yahoo.com/ym/us/ShowLetter?box=Inbox&MsgId=5131_6030722_101420_1271_7095_0_18341_11202_1069620701&bodyPart=2&YY=40535&y5beta=yes&y5beta=yes&order=down&sort=date&pos=0&view=a&head=f&Idx=1"></div>
<div><font face="Arial" size="2"><div><font face="Arial"
size="2">tachyons-or we reach the north pole and freeze to
death.</font></div><div><font face="Arial" size="2"> Floyd had
strolled on ahead; he called out. Right as rain. Here
is</font></div><div><font face="Arial" size="2">and the bullet thudded
into it. A briefcase.</font></div><div><font face="Arial"
size="2">speech can we understand each others
thoughts.</font></div><div><font face="Arial" size="2"> Excellent. If I
have only thirty days to go shouldnt you be
telling</font></div><div><font face="Arial" size="2"> Take the
prisoners to Interview nine at once.</font></div><div><font
face="Arial" size="2">clamps had swung into position to secure my
legs; motors whirred and</font></div><div><font face="Arial" size="2">
I still feel sorry for the dog, he said.</font></div><div><font
face="Arial" size="2">place?</font></div><div><font face="Arial"
size="2">it might bringing with it a surge of nausea and a sensation
of great</font></div></font></div></html>
Decoded image text:
BEST PRICE
$3.33
ON THE NET
www.rx555.com
- END of decoded text -
-- END OF SPAM --
Filter evasion tactic. Gif image.
Google also the same tactics sighting for drugs domains like
kvakrx.com or fonfel.com
See:
IP 91.4.174.72 p5B04AE48.dip0.t-ipconnect.de
http://www.moensted.dk/spam/?addr=91.4.174.72
http://cbl.abuseat.org/lookup.cgi?ip=91.4.174.72
http://www.spamhaus.org/query/bl?ip=91.4.174.72
inetnum: 91.0.0.0 - 91.23.255.255
netname: DTAG-DIAL22
descr: Deutsche Telekom AG
mnt-by: DTAG-NIC
changed: ripe...@telekom.de
abuse[]telekom.de is listed in rfc-ignorant.org database
route: 91.0.0.0/10
descr: Deutsche Telekom AG, Internet service provider
origin: AS3320
member-of: AS3320:RS-PA-TELEKOM
mnt-by: DTAG-RR
changed: lir...@t-com.net
ASN Name: 3320
Country (per IP registrar): DE [Germany]
Country IP Range: 91.0.0.0 to 91.63.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=3320
More t-ipconnect.de sightings:
http://groups.google.com/groups/search?q=t-ipconnect.de+group%3A*abuse&start=0&scoring=d&
postmaster and abuse[]t-ipconnect.de are listed in rfc-ignorant.org
database
4 SBL/ROKSO listings for IPs under the responsibility of telekom.de
http://www.spamhaus.org/sbl/listings.lasso?isp=telekom.de
1 SBL listings for IPs under the responsibility of t-ipconnect.de
http://www.spamhaus.org/sbl/listings.lasso?isp=t-ipconnect.de
See:
www.rx555.com IP 221.11.114.66
ns0.hertunjinkdastion.com [60.12.193.40] [TTL=172800] [CN]
ns0.vckionldesunjas.com [210.51.162.161] [TTL=172800] [CN]
(rx555.com OLD IP 210.51.37.50, 61.163.200.186, 61.31.214.78)
ns0.hertunjinkdastion.com [121.36.124.62] [TTL=172800] [CN]
ns0.vckionldesunjas.com. [210.51.37.50] [TTL=172800] [CN] => see old IP
61.31.214.78, 203.86.5.34
www.rx555.com has no MX records -> [rx555.com has 1 MX record
mail.rx555.com (10)]
mail.rx555.com claims to be non-existent host localhost.localdomain:
220 localhost.localdomain ESMTP Sendmail 8.13.1/8.13.1; Mon, 18 Dec
2006
mail.rx555.com [TTL=3600] IP=221.11.114.66 [TTL=3600] [CN]
SOA record [TTL=3600] is:
Primary nameserver: ns0.vckionldesunjas.com
Hostmaster E-mail address: ns0.hertunjinkdastion.com
Serial #: 2004042904
IP 210.51.37.50 No PTR records, stuck in a loop
at pns.cnc-idc.net / sns.cnc-idc.com
http://www.moensted.dk/spam/?addr=221.11.114.66
http://www.spamhaus.org/query/bl?ip=221.11.114.66
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48539
221.11.114.66/32 is listed on the Spamhaus Block List (SBL/ROKSO)
05-Dec-2006 01:25 GMT | SR02
Leo Kuvayev / BadCow.
bulletproof hosting spammer/phishers
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48682
221.11.114.0/24 is listed on the Spamhaus Block List (SBL)
01-Dec-2006 23:01 GMT | SR04
Dirty block - months of spammer hosting
3 SBL/ROKSO listings for IPs under the responsibility of cncgroup-sn
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-sn
inetnum: 221.11.0.0 - 221.11.127.255
netname: CNCGROUP-SN
descr: CNC Group Shannxi province network
descr: China Network Communications Group Corporation
descr: No.156,Fu-Xing-Men-Nei Street,
descr: Beijing 100031
remarks: service provider
changed: hm-ch...@apnic.net
route: 221.11.0.0/17
descr: CNC Group Shanxi1 Network
origin: AS4837
mnt-by: MAINT-AS4837
changed: I...@cnc-noc.net
route: 221.11.0.0/17
descr: CNC Group CHINA169 Shanxi Province Network
country: CN
origin: AS4837
mnt-by: MAINT-CNCGROUP-RR
changed: ab...@cnc-noc.net => ????
whois, postmaster and abuse[]cnc-noc.net are listed in rfc-ignorant.org
database
ASN: 4837
ASN Name: CHINA169-Backbone (CNCGROUP China169 Backbone)
Country (per IP registrar): CN [China]
Country IP Range: 221.8.0.0 to 221.11.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4837
Much More rx555.com sightings:
http://groups.google.com/groups/search?q=rx555.com+group%3A*abuse&start=0&scoring=d&
More hertunjinkdastion.com sightings:
http://groups.google.com/groups/search?q=hertunjinkdastion.com+group%3A*abuse&start=0&scoring=d&
See also more vckionldesunjas.com sightings:
http://groups.google.com/groups/search?q=vckionldesunjas.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/2c19d5ba91db928e
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: