[email] [drugs - Pharmacy Express] [84.120.37.254] (rx555.com - hertunjinkdastion.com - vckionldesunjas.com) Re: overabundanc deservedl
TomezNet
IP 84.120.37.254 84-120-37-254.onocable.ono.com
(at dns02.ono.com)
Spamvert:
www.rx555.com IP 210.51.37.50
(OLD IP 61.163.200.186, 61.31.214.78)
(SBL48664) (NOW at china-netcom.com)
Web title: Pharmacy Express
© 2006 PharmacyExpress.com All Rights Reserved.
See also plenty forged site certificates and logos served from the same
domain this time.
More spammer sightings:
http://groups.google.com/groups/search?q=%22Pharmacy+Express%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.172; Sat, 02 Dec 2006
08:43:41 -0800
X-YahooFilteredBulk: 84.120.37.254
X-Originating-IP: [84.120.37.254]
Return-Path: <jai...@nassmagnet.de>
Authentication-Results: mta418.mail.re4.yahoo.com from=nassmagnet.de;
domainkeys=neutral (no sig)
Received: from 84.120.37.254 (HELO jarday.com) (84.120.37.254) by
mta418.mail.re4.yahoo.com with SMTP; Sat, 02 Dec 2006 08:43:40 -0800
Message-ID: <01c71631$042d8890$fe257854@nombre5735998c>
Date: Sat, 2 Dec 2006 17:43:38 +0100
X-MSMail-Priority: Normal
X-Priority: 3
Reply-to: "Rajnish Pages" <jai...@nassmagnet.de>
From: "Rajnish Pages" <jai...@nassmagnet.de>
To: [MUNGED]
Subject: Re: overabundanc deservedl
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_000C_01C71639.4D654D60"
Content-Location: http://seek2.zootseek.com/d4/body2.html
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Content-Length: 5714
<html><head>
<meta http-equiv=Content-Type>
<meta>
<style></style>
</head>
<body bgColor=#ffffff>
<div><img
src="http://attach.mud.mail.yahoo.com/us.f905.mail.yahoo.com/ym/us/ShowLetter?box=%40B%40Bulk&MsgId=685_0_16206_1341_5714_0_18128_8936_1258250288_oSOYkYn4Ur6Rg9WuJfSMZ.S0.uvayXRfGrM2uUrhW6pLq26qkR1Nv.zyf1n00oPhmU5Cl0zPDJeNdX9oxIy7JMAK6ToBVGvNkgbWi1Me8nhJd9H1dy9o2lKsmY.hooxJtfCBOMNiyo.w.u16S8lSdpW_iY1FqkuitxWaj.XspYQ-&bodyPart=2&YY=11100&y5beta=yes&y5beta=yes&order=down&sort=date&pos=0&view=a&head=f&Idx=0">
<div> No talking now! Breathe silently-do not stir, one of our
guides
his woolly mount skidded to a stop. He frowned down on me from behind
I remember pulling the trigger-then suddenly you are holding the
She smiled and kissed his forehead below the bandage. Of course she
without human intervention. The same thing happened to the inner door
on my ankle, pulled me towards him. Reached up . . .
Of course. I have the requisite authority to provide augmentive
deadline runs out.
be listening in and can send the marines if any of us gets into
male singer to follow all of Madonettes movements. Wrote her image
</div>
</body></html>
*** REMOVED Attachment: insistenc88.gif (<0.01 MB) ****
Decoded base64 text:
Ambien
Soma
VIAGRA from $3.33 per pill
CIALIS from $3.75 per pill
Meridia
Xanax
Prozac
VALIUM from $1.21 per pill
SAVE OVER 50% with
WWW.RX555.COM
( don't click,
type www.rx555.com into your browser)
- END of decoded text -
-- END OF SPAM --
Filter evasion tactic. Animated gif asking to key web site in browser.
"Please don`t click. Type URL in your browser"
Google also the same tactics sighting for drugs domains like
kvakrx.com or fonfel.com
See:
IP 84.120.37.254 84-120-37-254.onocable.ono.com
http://www.moensted.dk/spam/?addr=84.120.37.254
http://cbl.abuseat.org/lookup.cgi?ip=84.120.37.254
http://www.spamhaus.org/query/bl?ip=84.120.37.254
http://spamcop.net/w3m?action=checkblock&ip=81.56.48.126
inetnum: 84.120.0.0 - 84.123.255.255
netname: ONO-SCOPES-PCs
descr: Cableuropa - ONO
descr: ONO net in whole Spain
remarks: mail spam reports: ab...@ono.com => ?????
remarks: security incidents: secu...@ono.com
notify: ripe...@ono.es
nic-hdl: OIM1-RIPE
changed: jose....@ono.es
postmaster and abuse[]ono.com are listed in rfc-ignorant.org database
route: 84.120.0.0/13
descr: Cableuropa - Ono
descr: Ono network in whole Spain
origin: AS6739
mnt-by: ONO-MNT
changed: ripe...@ono.es
ASN: 6739
ASN Name: ONO-AS (Cableuropa - ONO)
Country (per IP registrar): ES [Spain]
Country IP Range: 84.120.0.0 to 84.127.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=6739
More proxad.net sightings:
http://groups.google.com/groups/search?q=proxad.net+group%3A*abuse&start=0&scoring=d&
31 SBL/ROKSO listings for IPs under the responsibility of ono.com
http://www.spamhaus.org/sbl/listings.lasso?isp=ono.com
See:
www.rx555.com IP 210.51.37.50
(OLD IP 61.163.200.186, 61.31.214.78)
ns0.hertunjinkdastion.com [121.36.124.62] [TTL=172800] [CN]
ns0.vckionldesunjas.com. [210.51.37.50] [TTL=172800] [CN] => see old IP
61.31.214.78, 203.86.5.34
www.rx555.com has no MX records -> rx555.com has no MX records
NS records at your nameservers are:
ns0.hertunjinkdastion.com [121.36.124.62] [TTL=3600]
ns0.vckionldesunjas.com
SOA record [TTL=3600] is:
Primary nameserver: ns0.vckionldesunjas.com
Hostmaster E-mail address: ns0.hertunjinkdastion.com
IP 210.51.37.50 No PTR records, stuck in a loop
at pns.cnc-idc.net / sns.cnc-idc.com
http://www.moensted.dk/spam/?addr=210.51.37.50
http://www.spamhaus.org/query/bl?ip=210.51.37.50
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48664
210.51.37.50/32 is listed on the Spamhaus Block List (SBL/ROKSO)
01-Dec-2006 23:09 GMT | SR22
Leo Kuvayev / BadCow.
Spam webhosting - aruijinkdefunhadesun.com
16 SBL/ROKSO listings for IPs under the responsibility of
china-netcom.com
http://www.spamhaus.org/sbl/listings.lasso?isp=china-netcom.com
inetnum: 210.51.20.0 - 210.51.63.255
netname: CNC-SH-IDC
country: CN
descr: Shanghai Caohejing IDC of China Netcom
admin-c: CH140-AP
tech-c: YQ87-AP
status: ALLOCATED NON-PORTABLE
changed: cnci...@china-netcom.com
postmaster and abuse[]china-netcom.com are listed in rfc-ignorant.org
database
ASN: 9929
ASN Name: CNCNET-CN (China Netcom Corp.)
Country (per IP registrar): CN [China]
Country IP Range: 210.51.0.0 to 210.51.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=9929
1 SBL listings for IPs under the responsibility of CNCGROUP-HA
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGROUP-HA
Much More rx555.com sightings:
http://groups.google.com/groups/search?q=rx555.com+group%3A*abuse&start=0&scoring=d&
More hertunjinkdastion.com sightings:
http://groups.google.com/groups/search?q=hertunjinkdastion.com+group%3A*abuse&start=0&scoring=d&
See also more vckionldesunjas.com sightings:
http://groups.google.com/groups/search?q=vckionldesunjas.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/d326bd6dd034ea03
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: