[email] [drugs - American Pharmacy] (statinforum.com - dartnet.info - wizardup.info - lofhick.info - molefancy.info) Re:
TomezNet
IP 125.210.224.69
(at hzdtv.com / chinahcn.com)
Spamvert:
statinforum.com IP 60.248.85.221
(SBL44232 - ROK3095) (at vns2.hinet.net)
Yambo Financials drugs spam (Viagra / Cialis pills at Canadian
Pharmacy)
This time as an American Pharmacy aka USDrugs aka Canadian Pharmacy,
see more sightings:
http://groups.google.com/groups/search?q=%22American+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
Yambo Pharmacy image hosting:
http://80.86.83.166:8080/usd/images/
IP 80.86.83.166
>From web:
Copiright © 2003-2006 USDrugs. All Rights Reserved.
Yambo Financials drugs spam (Viagra / Cialis pills at Canadian
Pharmacy)
More info below:
====================
X-SID-PRA: Erotica P. Gunwale <mal...@grayfarms.com>
X-SID-Result: TempError
X-Message-Info: txF49lGdW40f06WBkxOhjzcDNOvecpn0YSg1T3+OV9A=
Received: from tomts21-srv.bellnexxia.net ([209.226.175.183]) by
bay0-pamc1-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sat, 12 Aug 2006 19:35:59 -0700
Received: from xx..xx..xx.net ([207.58.1....])
by toip7.bellnexxia.net with ESMTP; 12 Aug 2006 22:35:50 -0400
Received: (qmail 32297 invoked by uid 110); 12 Aug 2006 22:35:49 -0400
Delivered-To: xx..xx@xx..xx.com
Received: (qmail 32288 invoked from network); 12 Aug 2006 22:35:46
-0400
Received: from unknown (HELO -1219540688) (125.210.224.69)
by xx..xx..xx.net with SMTP; 12 Aug 2006 22:35:46 -0400
Received: from grayfarms.com (-1220067152 [-1224127624])
by geyve.com (Qmailv1) with ESMTP id C47E767D37
for <xx..xx@xx..xx.com>; Sat, 12 Aug 2006 21:36:46 -0700
Date: Sat, 12 Aug 2006 21:36:46 -0700
From: "Erotica P. Gunwale" <mal...@grayfarms.com>
X-Mailer: The Bat! (v2.00.8) Personal
X-Priority: 3
Message-ID: <0363863337.2...@grayfarms.com>
To: xx..xx@xx..xx.com
Subject: Re:
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.5; AVE:
6.17.0.2; VDF: 6.17.0.5; host: geyve.com)
Return-Path: mal...@grayfarms.com
X-OriginalArrivalTime: 13 Aug 2006 02:36:00.0305 (UTC)
FILETIME=[369E7210:01C6BE81]
we lcome to the best pharmacy http://statinforum.com/
-- END OF SPAM --
See also more USDrugs sightings:
http://groups.google.com/groups/search?q=USDrugs+group%3A*abuse&start=0&scoring=d&
See also more Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
More ICS International Certified Stocks sightings:
http://groups.google.com/groups/search?q=%22ICS+International+Certified+Stocks%22+group%3A*abuse
See:
IP 125.210.224.69
http://www.moensted.dk/spam/?addr=125.210.224.69
inetnum: 125.210.0.0 - 125.210.255.255
netname: WASU
descr: WASU TV & Communication Holding Co.,Ltd.
descr: 6/F, Jian Gong Building, NO.20 Wen San Road, Hangzhou,
descr: Zhejiang province, P.R.China 310012
country: CN
ASN: 24139
ASN Name: CNNIC-WASUNET-AP (WASU TV & Communication Holding Co.,Ltd.)
Country IP Range: 125.210.0.0 to 125.210.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=24139
See:
statinforum.com IP 60.248.85.221
ns1.dartnet.info [62.38.209.210 (NO GLUE)] [GR]
ns1.wizardup.info [212.52.166.78 (NO GLUE)] [HU]
ns2.lofhick.info [209.102.132.41 NO GLUE)] []
ns2.molefancy.info [201.6.155.6 (NO GLUE)] [BR]
ns1.statinforum.com A IN 600 60.248.85.221
ns2.statinforum.com A IN 600 60.248.85.221
ns3.statinforum.com A IN 600 109.51.200.45
statinforum.com has no MX records
http://www.moensted.dk/spam/?addr=60.248.85.221
http://www.spamhaus.org/query/bl?ip=60.248.85.221
More 60.248.85.221 sightings:
http://groups.google.com/groups/search?q=60.248.85.221+group%3A*abuse
60.248.85.221 PTR record: 60-248-85-221.HINET-IP.hinet.net
route: 60.248.0.0/16
descr: (HiNet) Chunghwa Telecom Co., Ltd.
origin: AS3462
member-of: RS-COMM_NSFNET
mnt-by: MAINT-AS3462
changed: cyk...@ms1.hinet.net
http://www.cidr-report.org/cgi-bin/as-report?as=3462
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL44232
60.248.85.221/32 is listed on the Spamhaus Block List (SBL/ROKSO)
08-Jul-2006 18:11 GMT | SR20
Yambo Financials
Yambo nameservers, web sites.
54 SBL/ROKSO listings for IPs under the responsibility of hinet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=hinet.net
Let see whois:
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COMDomain:
statinforum.com
Registrant
Missy Gillis
Gillis Missy
ssyplmbn[]yahoo.com
3228 Meadow Trail E
Dekalb, IL 60115 US
+1.8157878708
Administrative
Missy Gillis
Gillis Missy
ssyp...@yahoo.com
3228 Meadow Trail E
Dekalb, IL 60115 US
+1.8157878708
Billing
Missy Gillis
Gillis Missy
ssyp...@yahoo.com
3228 Meadow Trail E
Dekalb, IL 60115 US
+1.8157878708
Technical
Missy Gillis
Gillis Missy
ssyp...@yahoo.com
3228 Meadow Trail E
Dekalb, IL 60115 US
+1.8157878708
Record created on July 29, 2006
Record last updated on July 29, 2006
Record expires on July 29, 2007
Domain Name Servers:
NS1.WIZARDUP.INFO
NS2.MOLEFANCY.INFO
NS1.DARTNET.INFO
NS2.LOFHICK.INFO
See:
Yambo Pharmacy sites: image hosting
IP 80.86.83.166 fresno156.webperoni.de
(at ns02.webperoni.de)
80.86.83.166 PTR record: fresno156.webperoni.de
at ns02.webperoni.de
http://www.moensted.dk/spam/?addr=80.86.83.166
More 80.86.83.166 sightings:
http://groups.google.com/groups/search?q=80.86.83.166+group%3A*abuse
inetnum: 80.86.83.0 - 80.86.83.255
netname: WPROOT02
descr: webperoni GmbH server hosting
country: DE [Germany]
route: 80.86.80.0/20
descr: webperoni GmbH
origin: AS39928
mnt-by: WEBPERONI-MNT
mnt-routes: WEBPERONI-MNT
changed: ri...@webperoni.de
route: 80.86.80.0/20
descr: Webperoni via LambdaNet
origin: AS13237
mnt-by: LNC-MNT
mnt-routes: WEBPERONI-MNT
changed: regi...@undeliverable.lambdanet.net
ASN: 39928
ASN Name: WEBPERONI-AS (webperoni GmbH autonomous system)
Country IP Range: 80.86.80.0 to 80.86.95.255
http://www.cidr-report.org/cgi-bin/as-report?as=39928
3 SBL listings for IPs under the responsibility of lambdanet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=lambdanet.net
See:
ns1.dartnet.info IP 62.38.209.210 => SBL45162
62.38.209.210 PTR record: vdp209.ath02.dsl.hol.gr
More dartnet.info sightings:
http://groups.google.com/groups/search?q=dartnet.info+group%3A*abuse&start=0&scoring=d&
See:
ns1.wizardup.info IP 212.52.166.78 => SBL39594
212.52.166.78 PTR record: bongeszde.hu
at dns2.hu / qwertynet.hu
More wizardup.info sightings:
http://groups.google.com/groups/search?q=wizardup.info+group%3A*abuse&start=0&scoring=d&
See:
ns2.lofhick.info IP 209.102.132.41 => SBL44181
209.102.132.41 PTR record: 209-102-132-41.adsl.gulftel.net
at dns3.madisonriver.net
More lofhick.info sightings:
http://groups.google.com/groups/search?q=lofhick.info+group%3A*abuse&start=0&scoring=d&
See:
ns2.molefancy.info IP 201.6.155.6 => SBL42469
201.6.155.6 PTR record: c9069b06.static.spo.virtua.com.br
dns1.virtua.com.BR
More molefancy.info sightings:
http://groups.google.com/groups/search?q=molefancy.info+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/6d0dd68091b92ebf
And:
http://groups.google.com/group/news.admin.net-abuse.email/msg/f7e4e0c12acb25a6
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: