[email] [drugs - MyCanadianPharmacy] [84.28.184.176] (kvasa.hk - grisaillesag.com - transitstars.com - perceivablenut.com - ourboycot.com - 217.170.77.210) fwd:Online store offers special discounts.
TomezNet
IP 84.28.184.176 cp636693-b.gelen1.lb.home.nl
(at ns3.home.nl)
Spamvert:
lgkpmj.kvasa.hk IP 213.85.227.50
(SBL49934 - ROK3095) (at cnt.ru)
Yambo Pharmacy image hosting:
http://217.170.77.210:8080/p/images/verisign.gif
IP 217.170.77.210
(SBL50632 - ROK3095) (at ns2.spaceweb.ru / eltel.net)
More Yambo MyCanadianPharmacy aka MyCanadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22MyCanadianPharmacy%22+group%3A*abuse&start=0&scoring=d&
Plenty of Forged Certificates and logos as always.
More info below:
====================
X-SID-PRA: Clare Moran <dweti...@etimark.de>
X-Message-Info: txF49lGdW43yrMoRTsFbF5oV4xQDJLYqAES/vPnOzL8=
Received: from tomts30-srv.bellnexxia.net ([209.226.175.104]) by bay0-
pamc1-f7.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sun, 18 Feb 2007 09:43:42 -0800
Received: from [MUNGED]
by toip24.srvr.bell.ca with ESMTP; 18 Feb 2007 12:43:27 -0500
Received: (qmail 8059 invoked by uid 110); 18 Feb 2007 12:43:26 -0500
Delivered-To: [MUNGED]
Received: (qmail 8051 invoked from network); 18 Feb 2007 12:43:26
-0500
Received: from cp636693-b.gelen1.lb.home.nl (84.28.184.176)
by [MUNGED] with SMTP; 18 Feb 2007 12:43:26 -0500
Return-Path: <dweti...@etimark.de>
Received: from 212.77.224.121 (HELO etimark.de)
by [MUNGED] with esmtp (69NU45HY,45 .)81)
id 0)K);Q-+45+M*-1)
for [MUNGED]; Sun, 18 Feb 2007 17:43:26 -0060
From: "Clare Moran" <dweti...@etimark.de>
To: [MUNGED]
Subject: fwd:Online store offers special discounts.
Date: Sun, 18 Feb 2007 17:43:26 -0060
Message-ID: <01c75384$4b2bf930$6c822ecf@dwetimarkm>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C7538C.ACF06130"
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807
Thread-Index: Aca6Q11<0;EA3AZ3+AY91<3>-).//9==
X-OriginalArrivalTime: 18 Feb 2007 17:43:42.0751 (UTC)
FILETIME=[54D6F2F0:01C75384]
This is a multi-part message in MIME format.
------=_NextPart_000_0006_01C7538C.ACF06130
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit
Dear,I know that you purchase expensive American drugs and are looking
for possibility to save on them. I advise you to buy medications in
Canada.I understand your fears to be scammed or receive counterfeit
medications. Don't worry! Canadian medications are manufactured
according to the same strict medical standards followed in the United
States! We have a wide range of modern pharmaceutical products, low
prices, high level of service, friendly and helpful staff. Fast
delivery!For further information visit our site: http://lgkpmj.kvasa.hk/?73096211&menDonít
forget to ask for discount!Best regards,Clare Moran
------=_NextPart_000_0006_01C7538C.ACF06130
Content-Type: text/html;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<html xmlns:o=3D"urn:schemas-microsoft-com:office:office"
xmlns:w=3D"urn:sc=
hemas-microsoft-com:office:word" xmlns=3D"http://www.w3.org/TR/REC-
html40">
<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html;
charset=3DWindows-1252">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered
medium)">
</head>
<body>
<html>
<body bgcolor=3D"#FFFFFF" link=3D"#6F7AC8">
<p><font face=3D"Verdana" size=3D"2" color=3D"#000000"><b>Dear</b>,</
font><=
/p>
<p><font face=3D"Verdana" size=3D"2">I know that you purchase
expensive Ame=
rican drugs and are looking for possibility to save on them. I advise
you t=
o buy medications in Canada.<br>I understand your fears to be scammed
or re=
ceive counterfeit medications. Don't worry! <a href=3D"http://
lgkpmj.kvasa.=
hk/?73096211&men">Canadian medications</a> are manufactured according
to th=
e same strict medical standards followed in the United States! </
font></p>
<p><font face=3D"Verdana" size=3D"2">We have a wide range of modern
pharmac=
eutical products, low prices, high level of service, friendly and
helpful s=
taff. Fast delivery!</font></p>
<p><font face=3D"Verdana" size=3D"2"><a href=3D"http://
lgkpmj.kvasa.hk/?730=
96211&men"><b>For further information visit our site:</b></a><br>
<b>http:/=
/lgkpmj.kvasa.hk/?73096211&men</b></font></p>
<p><font face=3D"Verdana" size=3D"2">Don=92t forget to ask for
discount!</f=
ont></p>
<p><font face=3D"Verdana" size=3D"2">Best regards,<br>Clare Moran</
font></p>
</body>
</html>
</body>
</html>
------=_NextPart_000_0006_01C7538C.ACF06130--
-- END OF SPAM --
See:
IP 84.28.184.176 cp636693-b.gelen1.lb.home.nl
http://www.moensted.dk/spam/?addr=84.28.184.176
inetnum: 84.28.128.0 - 84.28.199.255
netname: ATHOME-GELEEN-1
route: 84.24.0.0/13
descr: @Home Benelux
origin: AS9143
mnt-by: IPMGMT-RIPE
changed: JV...@corp.home.nl
ASN: 9143
ASN Name: AtHome-Benelux-BV
Country (per IP registrar): NL [Netherlands]
Country IP Range: 84.24.0.0 to 84.31.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=9143
11 SBL/ROKSO listings for IPs under the responsibility of home.nl
http://www.spamhaus.org/sbl/listings.lasso?isp=home.nl
See:
kvasa.hk IP 213.85.227.50
NS2.TRANSITSTARS.COM [64.94.117.200 (NO GLUE)] [US]
NS2.GRISAILLESAG.COM [210.34.0.101 (NO GLUE)] [CN]
NS1.PERCEIVABLENUT.COM [63.223.11.14 (NO GLUE)] [US]
NS1.OURBOYCOT.COM [63.223.11.14 (NO GLUE)] [US]
[kvasa.hk has 1 MX record mail.kvasa.hk (10)]
http://www.moensted.dk/spam/?addr=213.85.227.50
http://www.spamhaus.org/query/bl?ip=213.85.227.50
inetnum: 213.85.227.48 - 213.85.227.55
netname: cpcompany-net
descr: JSC "Central industry company"
notify: n...@cnt.ru
e-mail: pave...@newmail.ru
changed: ip-...@nic.ru
nic-hdl: PK2997-RIPE
changed: vv...@cnt.ru
route: 213.85.128.0/17
descr: CNT-network BLOCK
origin: AS8615
mnt-by: CNT-MNT
changed: n...@cnt.ru 20020723
route: 213.0.0.0/8
descr: SES Americom Customer Prefix
origin: AS11908
remarks: SES Americom Customer Prefix
notify: nmcsu...@ses-americom.com
mnt-by: SESAMERICOM-MNT
changed: john....@ses-americom.com
ASN: 8615
ASN Name: CNT-AS (CNT Autonomous System)
Country (per IP registrar): RU [Russian Federation]
Country IP Range: 213.85.0.0 to 213.85.255.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=8615
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49934
213.85.227.50/32 is listed on the Spamhaus Block List (SBL/ROKSO)
10-Jan-2007 15:03 GMT | SR20
Yambo Financials
Yambo botnet: webhost/nameserver (compromised system)
3 SBL/ROKSO listings for IPs under the responsibility of cnt.ru
http://www.spamhaus.org/sbl/listings.lasso?isp=cnt.ru
Let see whois.hkdnr.net.hk:
Domain Name: KVASA.HK
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): KSOJK KIOLAQ
Holder Chinese Name:
Email: cand.mcm...@gmail.com
Domain Name Commencement Date: 2007-02-10
Country: US
Expiry Date: 2008-02-10
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1813797T
Technical Contact:
First name: JOHN
Last name: SMITH
Company Name: KSOJK KIOLAQ
Name Servers Information:
NS1.PERCEIVABLENUT.COM
NS2.TRANSITSTARS.COM
NS1.OURBOYCOT.COM
NS2.GRISAILLESAG.COM
See:
Yambo Pharmacy image hosting:
http://217.170.77.210:8080/p/images/cipa2.gif
IP 217.170.77.210
217.170.77.210 PTR record: db2.sorenssystem.com
at ns2.spaceweb.ru / eltel.net
More 217.170.77.210 sightings:
http://groups.google.com/groups/search?q=217.170.77.210+group%3A*abuse&start=0&scoring=d&
http://www.spamhaus.org/query/bl?ip=217.170.77.210
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL50632
217.170.77.210/32 is listed on the Spamhaus Block List (SBL/ROKSO)
30-Jan-2007 19:03 GMT | SR20
Yambo botnet image proxying/hosting (compromised sytems)
=> for 3 weeks, it has to be really compromised?!
4 SBL/ROKSO listings for IPs under the responsibility of eltel.net
http://www.spamhaus.org/sbl/listings.lasso?isp=eltel.net
See:
NS2.TRANSITSTARS.COM IP 64.94.117.200
NS2.TRANSITSTARS.COM has no MX records -> TRANSITSTARS.COM has no MX
records
http://www.moensted.dk/spam/?addr=64.94.117.200
No PTR records exist for 64.94.117.200
ns2.sef.pnap.net / ns2.pnap.net / internap.com
More 64.94.117.200 sightings:
http://groups.google.com/groups/search?q=64.94.117.200+group%3A*abuse&start=0&scoring=d&
No PTR records exist for 64.94.117.200
at ns1.sef.pnap.net / ns2.pnap.net / internap.com
Internap Network Services PNAP-05-2000 (NET-64-94-0-0-1)
64.94.0.0 - 64.95.255.255
DOTSTER INC INAP-SEF-DOTSTER-7067 (NET-64-94-117-192-1)
64.94.117.192 - 64.94.117.223
OrgName: DOTSTER INC
OrgID: DOTST-1
NetRange: 64.94.117.192 - 64.94.117.223
CIDR: 64.94.117.192/27
NetName: INAP-SEF-DOTSTER-7067
NetHandle: NET-64-94-117-192-1
Parent: NET-64-94-0-0-1
NetType: Reassigned
route: 64.94.112.0/20
descr: PNAP-SEF
SEF PNAP
origin: AS14744
mnt-by: INAP-MAINT-RADB
changed: dun...@internap.com
ASN: 14744
ASN Name: INTERNAP-BLOCK-4
Country (per IP registrar): US [United States]
Country IP Range: 64.94.0.0 to 64.95.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=14744
1 SBL listings for IPs under the responsibility of dotster.com
http://www.spamhaus.org/sbl/listings.lasso?isp=dotster.com
25 SBL/ROKSO listings for IPs under the responsibility of internap.com
http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com
More transitstars.com sightings:
http://groups.google.com/groups/search?q=TRANSITSTARS.COM+group%3A*abuse&start=0&scoring=d&
No PTR records exist for 64.94.117.200
at ns1.sef.pnap.net / ns2.pnap.net / internap.com
See:
NS2.GRISAILLESAG.COM IP 210.34.0.101 (OLD IP 199.243.242.9)
NS2.GRISAILLESAG.COM has no MX records -> [GRISAILLESAG.COM has 1 MX
record mail.GRISAILLESAG.COM (10)]
http://www.moensted.dk/spam/?addr=210.34.0.101
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48902
210.34.0.101/32 is listed on the Spamhaus Block List (SBL/ROKSO)
10-Dec-2006 15:44 GMT | SR20
Yambo Financials.
Yambo nameserver (compromised system)
4 SBL/ROKSO listings for IPs under the responsibility of net.edu.cn
http://www.spamhaus.org/sbl/listings.lasso?isp=net.edu.cn
More grisaillesag.com sightings:
http://groups.google.com/groups?q=GRISAILLESAG.COM+group%3A*abuse&start=0&scoring=d&
See:
NS1.PERCEIVABLENUT.COM IP 63.223.11.14
NS1.PERCEIVABLENUT.COM has no MX records -> [PERCEIVABLENUT.COM has 1
MX record mail.PERCEIVABLENUT.COM (10)]
http://www.moensted.dk/spam/?addr=63.223.11.14
No PTR records exist for 63.223.11.14
at ns1.wvfiber.net / ns.cais.com / pccwglobal.com
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49084
63.223.11.14/32 is listed on the Spamhaus Block List (SBL/ROKSO)
02-Feb-2007 00:49 GMT | SR21
Yambo Financials.
Spam DNS Server
14 SBL/ROKSO listings for IPs under the responsibility of
pccwglobal.com
http://www.spamhaus.org/sbl/listings.lasso?isp=pccwglobal.com
More perceivablenut.com sightings:
http://groups.google.com/groups/search?q=PERCEIVABLENUT.COM+group%3A*abuse&start=0&scoring=d&
See:
NS1.OURBOYCOT.COM IP 63.223.11.14
NS1.OURBOYCOT.COM has no MX records -> [OURBOYCOT.COM has 1 MX record
mail.OURBOYCOT.COM (10)]
http://www.moensted.dk/spam/?addr=63.223.11.14
More ourboycot.com sightings:
http://groups.google.com/groups/search?q=OURBOYCOT.COM+group%3A*abuse&start=0&scoring=d
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/24da9e288403b880
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/99a63d1bed30f253
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: