[email] [drugs - MyCanadianPharmacy] (webbercalp.com - babymore.info - whizsugar.info) Re: Coach Roesler encourages them
TomezNet
IP 84.25.189.151 cp230687-a.landg1.lb.home.nl
(at ns1.home.nl)
Spamvert:
ocwda.webbercalp.com IP 58.57.107.34
pmhm.webbercalp.com IP 58.57.107.34
(SBL43324 - ROK3095) (at dns1.ctnt.com.cn / CHINANET-SD)
ns1.babymore.info IP 72.164.185.16
(SBL43703 - ROK3095) (at hyatt.com / qwest.net)
ns2.whizsugar.info IP 193.120.10.116
(SBL43640 - ROK3095) (at auth02.ns.esat.net)
Yambo Financials (ROK6271) MyCanadianPharmacy Corp. sightings:
http://groups.google.com/groups/search?q=%22MyCanadianPharmacy%22+group%3A*abuse&start=0&scoring=d&
And us usual plenty of forged site certificates and logos served from
the same domain.
More info below:
====================
X-SID-PRA: Casey Echols <Roche...@sewsus.com.mx>
X-SID-Result: TempError
X-Message-Info: txF49lGdW40IiNx3T/+mO1lKOe0XBIDL3XBM1S7TFno=
Received: from tomts1-srv.bellnexxia.net ([209.226.175.113]) by
bay0-pamc1-f4.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Thu, 22 Jun 2006 12:59:27 -0700
Received: from xx..xx..xx.net ([207.58.1....])
by toip2.bellnexxia.net with ESMTP; 22 Jun 2006 15:59:23 -0400
Received: (qmail 27426 invoked by uid 110); 22 Jun 2006 19:54:37 -0000
Delivered-To: xx..xx@xx..xx.com
Received: (qmail 27125 invoked from network); 22 Jun 2006 19:54:37
-0000
Received: from cp230687-a.landg1.lb.home.nl (84.25.189.151)
by xx..xx..xx.com with SMTP; 22 Jun 2006 19:54:36 -0000
Received: from XY-SOYDGP3 (84.25.189.151)
by HTyRQv_FohxTPHp-ym25-m.tofi.magali.net.ar with ESMTP; Thu, 22 Jun
2006 16:51:34 -0300
Message-ID: <415281060.93861090...@tofi.magali.net.ar>
Date: Thu, 22 Jun 2006 14:54:34 -0500
From: "Casey Echols" <Roche...@sewsus.com.mx>
Reply-to: Roche...@sewsus.com.mx
To: xx..xx@xx..xx.com
Subject: Re: Coach Roesler encourages them
Errors-to: Roche...@sewsus.com.mx
MIME-Version: 1.0
Content-Type: Multipart/related;
type="multipart/alternative";
boundary="------------TC19504JYK1329.MD84987ZZW72200"
X-eid: 0.6.wp.6T.1MOFnCJYybw.OtfAz9
X-pid: 667114566
Return-Path: Roche...@sewsus.com.mx
X-OriginalArrivalTime: 22 Jun 2006 19:59:28.0023 (UTC)
FILETIME=[5E3F1270:01C69636]
This is a multi-part message in MIME format.
--------------TC19504JYK1329.MD84987ZZW72200
Content-Type: Multipart/Alternative;
boundary="------------MBV141NZ9935.W34726BI67061"
--------------MBV141NZ9935.W34726BI67061
Content-Type: Text/Plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
--------------MBV141NZ9935.W34726BI67061
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
<HTML>
<HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<TITLE>but also the authorities Outside, the crowd</TITLE>
</HEAD>
<BODY>
<DIV><FONT face="Arial">But somewhere between protesting the pool a
young African-American from unsettling things are starting to throw
</FONT></DIV>
<DIV>
<a href="http://two>pmhm.webbercalp.com/?88087087">
<img src="cid:SO06ZQR723.V298NJ35" border=0></a>
</DIV>
<p> </p>
http://mka>ocwda.webbercalp.com/?88087087
<p> </p>
<p> </p>
<p> </p>
<DIV><FONT face="Arial">stars as a Harvard symbologist The Da Vinci
Code" can start eating again weird amid the solemnity</FONT></DIV>
<DIV><FONT face="Arial">which they name Damien As plot mules him a
tryout with one of England</FONT></DIV>
<DIV><FONT face="Arial">and the President's personal fave and it keeps
not coming out It's soon clear this place The movie tones down his
academic</FONT></DIV>
<DIV><FONT face="Arial">a rusty but trusty tow truckunsettling events
begin to occur where the President will be judging along with Tweed
from the Academy of Motion Picture Arts Ian McKellen as Sir Leigh
Teabing</FONT></DIV>
</BODY>
</HTML>
--------------MBV141NZ9935.W34726BI67061--
--------------TC19504JYK1329.MD84987ZZW72200
Content-Type: image/gif;
name="isnxvj.jpg"
Content-Transfer-Encoding: base64
Content-ID: <SO06ZQR723.V298NJ35>
--------------TC19504JYK1329.MD84987ZZW72200--
*** REMOVED Attachment: isnxvj.jpg (< 0.01 MB) ***
-- END OF SPAM --
See also VIP Pharmacy aka MyCanadianPharmacy Corp. sightings:
http://groups.google.com/groups/search?q=%22Vip+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
See:
IP 84.25.189.151 cp230687-a.landg1.lb.home.nl
http://www.moensted.dk/spam/?addr=84.25.189.151
http://cbl.abuseat.org/lookup.cgi?ip=84.25.189.151
http://www.spamhaus.org/query/bl?ip=84.25.189.151
inetnum: 84.25.0.0 - 84.25.255.255
netname: ATHOME-LANDGRAAF-1
role: AtHome Benelux IP Management
route: 84.24.0.0/13
descr: @Home Benelux
origin: AS9143
ASN Name: AtHome-Benelux-BV
http://www.cidr-report.org/cgi-bin/as-report?as=9143
8 SBL listings for IPs under the responsibility of home.nl
http://www.spamhaus.org/sbl/listings.lasso?isp=home.nl
See:
ocwda.webbercalp.com IP 58.57.107.34
pmhm.webbercalp.com IP 58.57.107.34
ns1.webbercalp.com A IN 600 58.57.107.34
ns2.webbercalp.com A IN 600 58.57.107.34
ns3.webbercalp.com A IN 600 109.51.200.45
ns1.babymore.info [72.164.185.16]
ns2.whizsugar.info [193.120.10.116]
ocwda.webbercalp.com has no MX records -> [webbercalp.com has 1 MX
record mail.webbercalp.com.(10)]
http://www.moensted.dk/spam/?addr=58.57.107.34
http://www.spamhaus.org/query/bl?ip=58.57.107.34
More 58.57.107.34 sightings:
http://groups.google.com/groups/search?q=58.57.107.34+group%3A*abuse&start=0&scoring=d&
inetnum: 58.56.0.0 - 58.59.127.255
netname: CHINANET-SD
descr: CHINANET SHANDONG PROVINCE NETWORK
descr: Shandong Telecom Corporation
descr: No.999,Shunhua road,Jinan,Shandong
country: CN
route: 58.56.0.0/15
descr: China Telecom ShanDong province
origin: AS4134
mnt-by: MAINT-AS4134
changed: tia...@cndata.com
Country IP Range: 58.32.0.0 to 58.63.255.255
ASN Name: CHINATELECOM-SD-AS-AP (ASN for Shandong Provincial Net of CT)
http://www.cidr-report.org/cgi-bin/as-report?as=17633
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL43324
58.57.107.34/32 is listed on the Spamhaus Block List (SBL/ROKSO)
13-Jun-2006 17:10 GMT | SR23
Yambo Financials
everbestrep.info etc
Main Info:
http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Yambo%20Financials
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3095
3 SBL/ROKSO listings for IPs under the responsibility of chinanet-sd
http://www.spamhaus.org/sbl/listings.lasso?isp=chinanet-sd
Let see whois:
Registrar: TUCOWS INC.
Registrant:
Lucas
1030 Le Conte Ave
San Francisco, CA 94124
US
Domain name: WEBBERCALP.COM
Administrative Contact:
Lucas, Bennie ebby2wed[]yahoo.com
1030 Le Conte Ave
San Francisco, CA 94124
US
+1.4154678722 Fax: +1.4154678722
Technical Contact:
Hostmaster, Globat hostm...@globat.com
1128 Ventura Blvd. #443B
Los Angeles, CA 91604
US
+1.3234175167 Fax: +1.3234174995
Registration Service Provider:
Globat.com, hostm...@globat.com
323-874-9000
323-874-1290 (fax)
http://www.globat.com
This company may be contacted for domain login/passwords,
DNS/Nameserver changes, and general domain support questions.
Registrar of Record: TUCOWS, INC.
Record last updated on 20-Jun-2006.
Record expires on 16-Jun-2007.
Record created on 16-Jun-2006.
Domain servers in listed order:
NS1.BABYMORE.INFO [72.164.185.16]
NS2.WHIZSUGAR.INFO [193.120.10.116]
Domain status: ACTIVE
More webbercalp.com sightings:
http://groups.google.com/groups/search?q=webbercalp.com+group%3A*abuse
See:
ns1.babymore.info IP 72.164.185.16
72.164.185.16 PTR record: host16.dnvrcc2.hyatthsiaq.com
at DCA-ANS-01.INET.QWEST.NET
ns1.babymore.info has no MX records -> [babymore.info has 1 MX record
mail.babymore.info (10)]
http://www.moensted.dk/spam/?addr=72.164.185.16
http://www.spamhaus.org/query/bl?ip=72.164.185.16
Qwest Communications Corporation QWEST-INET-37 (NET-72-164-0-0-1)
72.164.0.0 - 72.166.255.255
HYATT REGENCY DENVER Q1220-72-164-185-0 (NET-72-164-185-0-1)
72.164.185.0 - 72.164.185.255
OrgName: HYATT REGENCY DENVER
OrgID: HRD-8
NetRange: 72.164.185.0 - 72.164.185.255
CIDR: 72.164.185.0/24
NetName: Q1220-72-164-185-0
ASN Name: ASN-QWEST
http://www.cidr-report.org/cgi-bin/as-report?as=209
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL43703
72.164.185.16/32 is listed on the Spamhaus Block List (SBL/ROKSO)
22-Jun-2006 19:11 GMT | SR20
Yambo Financials
Yambo pharmacy web hosts and nameservers.
24 SBL/ROKSO listings for IPs under the responsibility of qwest.net
http://www.spamhaus.org/sbl/listings.lasso?isp=qwest.net
Let see whois.afilias.info:
Domain ID:D13075004-LRMS
Domain Name:BABYMORE.INFO
Created On:14-Apr-2006 17:45:18 UTC
Last Updated On:19-Jun-2006 19:41:44 UTC
Expiration Date:14-Apr-2007 17:45:18 UTC
Sponsoring Registrar:Tucows Inc. (R139-LRMS)
Status:OK
Registrant ID:tu9FSWEutaj99xlo
Registrant Name:Veneta Devetakova
Registrant Organization: Veneta Devetakova
Registrant Street1:5801 22 St
Registrant Street2:
Registrant Street3:
Registrant City:Lubbock
Registrant State/Province:TX
Registrant Postal Code:79407
Registrant Country:US
Registrant Phone:+1.8067914243
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: devkova01[]yahoo.com
Admin ID:tu9FSWEutaj99xlo
Admin Name:Veneta Devetakova
Admin Organization:Veneta Devetakova
Admin Street1:5801 22 St
Admin Street2:
Admin Street3:
Admin City:Lubbock
Admin State/Province:TX
Admin Postal Code:79407
Admin Country:US
Admin Phone:+1.8067914243
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email: devk...@yahoo.com
Billing ID:tu9FSWEutaj99xlo
Billing Name:Veneta Devetakova
Billing Organization:Veneta Devetakova
Billing Street1:5801 22 St
Billing Street2:
Billing Street3:
Billing City:Lubbock
Billing State/Province:TX
Billing Postal Code:79407
Billing Country:US
Billing Phone:+1.8067914243
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email: devk...@yahoo.com
Tech ID:tuThmB97KTid5E0K
Tech Name:Domains Manager
Tech Organization:Netfirms, Inc.
Tech Street1:5160 Yonge St
Tech Street2:1800
Tech Street3:
Tech City:Toronto
Tech State/Province:ON
Tech Postal Code:M2N6L9
Tech Country:CA
Tech Phone:+1.4166612100
Tech Phone Ext.:
Tech FAX:+1.4166610700
Tech FAX Ext.:
Tech Email: sup...@netfirms.com
Name Server:NS1.BABYMORE.INFO
Name Server:NS2.BABYMORE.INFO
More babymore.info sightings:
http://groups.google.com/groups/search?q=babymore.info+group%3A*abuse&start=0&scoring=d&
See:
ns2.whizsugar.info IP 193.120.10.116
ns2.whizsugar.info has no MX records -> [whizsugar.info has 1 MX record
mail.whizsugar.info (10)]
http://www.moensted.dk/spam/?addr=193.120.10.116
http://www.spamhaus.org/query/bl?ip=193.120.10.116
No PTR records exist for 193.120.10.116
at sec02.ns.esat.net
inetnum: 193.120.10.96 - 193.120.10.128
netname: INSUP-ESATNET-20040615
descr: Esat Net Customer block
country: IE
route: 193.120.0.0/16
descr: IEUNET-AGG-ROUTE-1
descr: Principal address block of EUnet Ireland
origin: AS2110
remarks: Aggregated route covering multiple EUnet Ireland networks
ASN Name: IEUNET (Esat Net backbone AS Number)
http://www.cidr-report.org/cgi-bin/as-report?as=2110
1 SBL/ROKSO listings for IPs under the responsibility of esat.net
http://www.spamhaus.org/sbl/listings.lasso?isp=esat.net
Let see whois.afilias.info:
Domain ID:D13568652-LRMS
Domain Name: WHIZSUGAR.INFO
Created On:27-May-2006 21:26:32 UTC
Last Updated On:19-Jun-2006 19:44:23 UTC
Expiration Date:27-May-2007 21:26:32 UTC
Sponsoring Registrar: eNom, Inc. (R126-LRMS)
Status:TRANSFER PROHIBITED
Registrant ID:B4C250C276DDEF9D
Registrant Name:Alena Petrova
Registrant Organization:Petrova Alena
Registrant Street1:Schnirchova 15
Registrant Street2:
Registrant Street3:
Registrant City:Praha
Registrant State/Province:PR
Registrant Postal Code:17000
Registrant Country:CZ
Registrant Phone:+420.283870025
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: etrongd[]yahoo.com
Admin ID:B4C250C276DDEF9D
Admin Name:Alena Petrova
Admin Organization:Petrova Alena
Admin Street1:Schnirchova 15
Admin Street2:
Admin Street3:
Admin City:Praha
Admin State/Province:PR
Admin Postal Code:17000
Admin Country:CZ
Admin Phone:+420.283870025
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email: etr...@yahoo.com
Billing ID:B4C250C276DDEF9D
Billing Name:Alena Petrova
Billing Organization:Petrova Alena
Billing Street1:Schnirchova 15
Billing Street2:
Billing Street3:
Billing City:Praha
Billing State/Province:PR
Billing Postal Code:17000
Billing Country:CZ
Billing Phone:+420.283870025
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email: etr...@yahoo.com
Tech ID:B4C250C276DDEF9D
Tech Name:Alena Petrova
Tech Organization:Petrova Alena
Tech Street1:Schnirchova 15
Tech Street2:
Tech Street3:
Tech City:Praha
Tech State/Province:PR
Tech Postal Code:17000
Tech Country:CZ
Tech Phone:+420.283870025
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email: etr...@yahoo.com
Name Server:NS2.WHIZSUGAR.INFO
Name Server:NS1.WHIZSUGAR.INFO
More whizsugar.info sightings:
http://groups.google.com/groups/search?q=whizsugar.info+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/eb02e56fe62dcd24
AND:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/f533218081cf9d6b
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: