[email] [drugs - Trusted Meds] (zonecrest.info - tucows.com - mahoganydiva.com - forfastlove.com - rmexpression.com) Wanna know what I heard?
TomezNet
IP 124.130.79.115
(at ns.sdjnptt.net.cn / CNCGROUP-SD)
Spamvert:
www.zonecrest.info IP 216.40.47.17
(at dns2.tucows.com / managednsservice.com)
Frames Redirected to:
http://mahoganydiva.com/spurm/index.php
HOMEPAGE on SPUR-M by Trusted Meds Inc.
mahoganydiva.com IP 125.208.7.120
(SBL45301) (at primetelecom.cn)
www.forfastlove.com IP 63.251.92.195
(at internap.com / eNom.com)
More SPUR-M sightings:
http://groups.google.com/groups/search?q=%22SPUR-M%22+group%3A*abuse&start=0&scoring=d&
Also Much More Tucows sightings:
http://groups.google.com/groups/search?q=Tucows+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: kuj...@classicalradio.org
X-SID-Result: TempError
X-Message-Info: txF49lGdW41CoJjR4n1X4YaM4Kbq3BFpeTmcLk1A8tM=
Received: from tomts48-srv.bellnexxia.net ([209.226.175.192]) by
bay0-pamc1-f8.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Tue, 15 Aug 2006 23:31:04 -0700
Received: from [MUNGED]
by toip1.bellnexxia.net with ESMTP; 16 Aug 2006 02:30:55 -0400
Message-Id: <594q1v$5u...@toip1.bellnexxia.net>
Received: (qmail 24315 invoked by uid 110); 16 Aug 2006 02:30:54 -0400
Delivered-To: [MUNGED]
Received: (qmail 24300 invoked from network); 16 Aug 2006 02:30:52
-0400
Received: from unknown (HELO [MUNGED]) (124.130.79.115)
by [MUNGED] with SMTP; 16 Aug 2006 02:30:52 -0400
Received: from dunloppeternixon.net [52.216.74.96
Date: Wed, 16 Aug 2006 02:31:03 -0400
From: kuj...@classicalradio.org
Bcc:
Return-Path: kuj...@classicalradio.org
X-OriginalArrivalTime: 16 Aug 2006 06:31:04.0853 (UTC)
FILETIME=[8CD2EC50:01C6C0FD]
] (helo=dramatic.vergenet.net)
by smtp3.cistron.nl with esmtp (jag)
id 1AQ6iH-1071CR-00; Wed, 16 Aug 2006 01:27:50 -0600
Date: Wed, 16 Aug 2006 10:30:50 +0300
Message-ID: <4252B67C...@bauhaus.peternixon.net>
From: "Dolores Tolbert" <kuj...@classicalradio.org>
To: [MUNGED]
Subject: Wanna know what I heard?
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5)
Gecko/20031013 Thunderbird/0.3
X-Accept-Language: en-us, en
Icrease Your S''exual Desire and S''perm volume by 500%
L'onger o''rgasms - The longest most intense o''rgasms of your life
Multiple o''rgasms - Cum again and again
S'PUR-M is The Newest and The Safest Way
100% N''atural and No Side Effects - in contrast to well-known brands.
Experience three times longer o''rgasms
World Wide shipping within 24 hours
Clisk here http://www.zonecrest.info
serviceable beaten accelerometer sought browse guidepost cutthroat
aloof
utility mobile montevideo humble dereference ingenuous mouth extensor
-- END OF SPAM --
More Trusted Meds sightings:
http://groups.google.com/groups/search?q=%22Trusted+Meds%22+group%3A*abuse
See:
IP 124.130.79.115
http://www.moensted.dk/spam/?addr=124.130.79.115
inetnum: 124.128.0.0 - 124.135.255.255
netname: CNCGROUP-SD
descr: CNC Group Shandong province network
descr: China Network Communications Group Corporation
route: 124.128.0.0/13
descr: CNC Group CHINA169 Shandong Province Network
country: CN
origin: AS4837
ASN: 4837
ASN Name: CHINA169-Backbone (CNCGROUP China169 Backbone)
Country IP Range: 124.128.0.0 to 124.135.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4837
3 SBL/ROKSO listings for IPs under the responsibility of CNCGROUP-SD
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGROUP-SD
See:
www.zonecrest.info IP 216.40.47.17
dns2.registerfly.com [216.40.47.16 (NO GLUE)] [CA]
dns1.registerfly.com [216.40.47.15 (NO GLUE)] [CA]
NS records at nameservers are (at tucows.com):
ns3.mdnsservice.com [65.22.7.10]
ns1.mdnsservice.com [64.97.159.10]
ns2.mdnsservice.com [216.40.47.18]
216.40.47.17 PTR record: redirect.managednsservice.com
at dns3.tucows.com
More 216.40.47.17 sightings:
http://groups.google.com/groups/search?q=216.40.47.17+group%3A*abuse&start=0&scoring=d&
http://www.moensted.dk/spam/?addr=216.40.47.17
http://www.spamhaus.org/query/bl?ip=216.40.47.17
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL44852
216.40.47.17/32 is listed on the Spamhaus Block List (SBL)
25-Jul-2006 22:51 GMT | SR04
giveawaysblog.info - redirect (come on Tucows!)
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45242
216.40.47.16/31 is listed on the Spamhaus Block List (SBL)
06-Aug-2006 09:49 GMT | SR02
12 SBL/ROKSO listings for IPs under the responsibility of tucows.com
http://www.spamhaus.org/sbl/listings.lasso?isp=tucows.com
OrgName: Tucows International
OrgID: TUCOWS
NetRange: 216.40.32.0 - 216.40.47.255
CIDR: 216.40.32.0/20
NetName: TUCOWS-BLK1
NetHandle: NET-216-40-32-0-1
route: 216.40.32.0/20
descr: IBM
origin: AS19152
mnt-by: MAINT-AS19152
ASN: 19152
ASN Name: IBMCCH-TOR
Country IP Range: 216.40.32.0 to 216.40.47.255
http://www.cidr-report.org/cgi-bin/as-report?as=19152
Let see whois.afilias.info
Domain ID:D14387858-LRMS
Domain Name: ZONECREST.INFO
Created On:14-Aug-2006 02:28:58 UTC
Last Updated On:14-Aug-2006 02:28:59 UTC
Expiration Date:14-Aug-2007 02:28:58 UTC
Sponsoring Registrar: RegisterFly.com, Inc. (R318-LRMS)
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:tu9snCHEAog7BeS9
Registrant Name: steven jcook
Registrant Organization:jcook
Registrant Street1:7/29 russell st
Registrant Street2:
Registrant Street3:
Registrant City:south brisbane
Registrant State/Province:NA
Registrant Postal Code:4101
Registrant Country:AU
Registrant Phone:+1.61294171092
Registrant Phone Ext.:
Registrant FAX:+1.61294171092
Registrant FAX Ext.:
Registrant Email: stevenjcook[]fastmail.com.au
Admin ID:tu9snCHEAog7BeS9
Admin Name:steven jcook
Admin Organization:jcook
Admin Street1:7/29 russell st
Admin Street2:
Admin Street3:
Admin City:south brisbane
Admin State/Province:NA
Admin Postal Code:4101
Admin Country:AU
Admin Phone:+1.61294171092
Admin Phone Ext.:
Admin FAX:+1.61294171092
Admin FAX Ext.:
Admin Email: steve...@fastmail.com.au
Billing ID:tu9snCHEAog7BeS9
Billing Name:steven jcook
Billing Organization:jcook
Billing Street1:7/29 russell st
Billing Street2:
Billing Street3:
Billing City:south brisbane
Billing State/Province:NA
Billing Postal Code:4101
Billing Country:AU
Billing Phone:+1.61294171092
Billing Phone Ext.:
Billing FAX:+1.61294171092
Billing FAX Ext.:
Billing Email: steve...@fastmail.com.au
Tech ID:tu9snCHEAog7BeS9
Tech Name:steven jcook
Tech Organization:jcook
Tech Street1:7/29 russell st
Tech Street2:
Tech Street3:
Tech City:south brisbane
Tech State/Province:NA
Tech Postal Code:4101
Tech Country:AU
Tech Phone:+1.61294171092
Tech Phone Ext.:
Tech FAX:+1.61294171092
Tech FAX Ext.:
Tech Email: steve...@fastmail.com.au
Name Server: DNS1.REGISTERFLY.COM
Name Server: DNS2.REGISTERFLY.COM
See also more mdnsservice.com sightings:
http://groups.google.com/groups/search?q=mdnsservice.com+group%3A*abuse&start=0&scoring=d&
See frames source:
<html>
<frameset framespacing="0" rows="100%,*" cols="100%"
frameborder="no" border="0">
<frame name="XYZZY2" scrolling="auto"
src="http://www.forfastlove.com" noresize>
<frame name="XYZZY" scrolling="no" noresize>
<noframes>
<h1><a
href="http://www.forfastlove.com">http://www.forfastlove.com</a></h1>
<p>Please <a href="http://www.forfastlove.com">click here</a>
to view the non-framed version.</p>
</noframes>
</frameset>
</html>
See:
mahoganydiva.com IP 125.208.7.120
ns1.rmexpression.com [125.208.7.120] [TTL=172800] [CN]
ns2.rmexpression.com [125.208.7.120] [TTL=172800] [CN]
[mahoganydiva.com has 1 MX record mahoganydiva.com (0)]
More 125.208.7.120 sightings:
http://groups.google.com/groups/search?q=125.208.7.120+group%3A*abuse
http://www.spamhaus.org/query/bl?ip=125.208.7.120
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45301
125.208.7.120/32 is listed on the Spamhaus Block List (SBL)
14-Aug-2006 10:10 GMT | SR22
Spam webhosting - literatinorthwest.com
3 SBL listings for IPs under the responsibility of primetelecom.cn
http://www.spamhaus.org/sbl/listings.lasso?isp=primetelecom.cn
Let see whois:
Registrar: REGISTERFLY.COM, INC.
Registrant:
dory
rue de la hausche 18
rossart, - 6880
BE
Domain name: MAHOGANYDIVA.COM
Administrative Contact:
Gerd Mueller, - Mue...@legalaxis.org
Haldenpfad 7
Halle, NA 86456
DE
493452307003 Fax: 493452307003
Technical Contact:
dory, michael mich...@pacificrimemail.com
rue de la hausche 18
rossart, - 6880
BE
+1.3227062109 Fax: +1.3227062109
Registrar of Record: REGISTERFLY.COM, INC.
Record last updated on 15-Aug-2006.
Record expires on 22-Mar-2007.
Record created on 22-Mar-2006.
Domain servers in listed order:
NS1.RMEXPRESSION.COM 125.208.7.120
NS2.RMEXPRESSION.COM 125.208.7.120
Domain status: REGISTRAR-LOCK
See:
ns2.rmexpression.com IP 125.208.7.120
Let see whois:
Registrar: REGISTERFLY.COM, INC.
Registrant:
dory
rue de la hausche 18
rossart, - 6880
BE
Domain name: RMEXPRESSION.COM
Administrative Contact:
Gerd Mueller, - Mue...@legalaxis.org
Haldenpfad 7
Halle, NA 86456
DE
493452307003 Fax: 493452307003
Technical Contact:
dory, michael mich...@pacificrimemail.com
rue de la hausche 18
rossart, - 6880
BE
+1.3227062109 Fax: +1.3227062109
Registrar of Record: REGISTERFLY.COM, INC.
Record last updated on 15-Aug-2006.
Record expires on 22-Mar-2007.
Record created on 22-Mar-2006.
Domain servers in listed order:
NS1.RMEXPRESSION.COM 125.208.7.120
NS2.RMEXPRESSION.COM 125.208.7.120
Domain status: REGISTRAR-LOCK
See:
www.forfastlove.com IP 63.251.92.195
dns1.name-services.com [69.25.142.1] [TTL=172800] [US]
dns2.name-services.com [216.52.184.230] [TTL=172800] [US]
dns3.name-services.com [63.251.92.193] [TTL=172800] [US]
dns4.name-services.com [64.74.96.242] [TTL=172800] [US]
dns5.name-services.com [70.42.37.1] [TTL=172800] [US]
www.forfastlove.com has no MX records -> forfastlove.com has no MX
records
http://www.moensted.dk/spam/?addr=63.251.92.195
No PTR records exist for 63.251.92.195 at ns1.wdc.pnap.net
More 63.251.92.195 sightings:
http://groups.google.com/groups/search?q=63.251.92.195+group%3A*abuse&start=0&scoring=d&
Internap Network Services NETBLK-PNAP-11-99 (NET-63-251-0-0-1)
63.251.0.0 - 63.251.255.255
eNom INAP-WDC002-ENOM-1942 (NET-63-251-92-192-1)
63.251.92.192 - 63.251.92.255
CustName: eNom
NetRange: 63.251.92.192 - 63.251.92.255
CIDR: 63.251.92.192/26
NetName: INAP-WDC002-ENOM-1942
NetHandle: NET-63-251-92-192-1
route: 63.251.80.0/20
descr: PNAP-WDC
InterNAP
origin: AS10913
mnt-by: INAP-MAINT-RADB
changed: jo...@internap.com
ASN: 10913
ASN Name: INTERNAP-BLK
Country IP Range: 63.251.0.0 to 63.251.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=10913
34 SBL/ROKSO listings for IPs under the responsibility of internap.com
http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com
4 SBL listings for IPs under the responsibility of eNom.com
http://www.spamhaus.org/sbl/listings.lasso?isp=eNom.com
Let see whois:
Registrar: ENOM, INC.
Registration Service Provided By: NameCheap.com
Contact: sup...@NameCheap.com
Visit: http://www.namecheap.com/
Domain name: forfastlove.com
Registrant Contact:
romnews
markus knudsen (knudsen[]newnn.org)
+49.1797507845
Fax: +1.5555555555
simon von utrecht strasse 85
hamburg, S 20359
DE
Administrative Contact:
romnews
markus knudsen (knu...@newnn.org)
+49.1797507845
Fax: +1.5555555555
simon von utrecht strasse 85
hamburg, S 20359
DE
Technical Contact:
romnews
markus knudsen (knu...@newnn.org)
+49.1797507845
Fax: +1.5555555555
simon von utrecht strasse 85
hamburg, S 20359
DE
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
Creation date: 02 Aug 2005 20:05:48
Expiration date: 02 Aug 2007 20:05:48
More forfastlove.com sightings:
http://groups.google.com/groups/search?q=forfastlove.com+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/70f498748f7fc998
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/3357e7ac07741cdf
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: