[email] [counterfeit] (trotterdm.com - jestorn.com - muhlberierdns.com - quintanadnsbenji.com) Gold n diamonds
TomezNet
IP 72.77.104.236 pool-72-77-104-236.pitbpa.east.verizon.net
(at NS2.BELLATLANTIC.NET)
Spamvert:
trotterdm.com IP 210.51.190.119
(at dns1.cnc-idc.com / china-netcom.com)
ns1.muhlberierdns.com IP 195.144.21.94
(at rx-host.net / rx-name.net)
ns2.quintanadnsbenji.com IP 140.113.203.146
(at edu.tw / ns3.nctu.edu.tw)
See frames URL:
http://150.jestorn.com/us/
150.jestorn.com IP 210.172.177.175
(at ns.namedserver.net / dns.interq.or.jp)
Web:
Copyright © 2003 Exquisite Replicas. All rights reserved.
More Exquisite Replicas sightings:
http://groups.google.com/groups/search?q=%22Exquisite+Replicas%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: corny willey <marku...@nkaz.rusal.ru>
X-SID-Result: TempError
X-Message-Info: txF49lGdW42yG3f8mpRi50SKM8WGUmDkaKK/ih43DMQ=
Received: from tomts2-srv.bellnexxia.net ([209.226.175.114]) by
bay0-pamc1-f13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Mon, 14 Aug 2006 09:35:21 -0700
Received: from xx..xx..xx.net ([207.58.1....])
by toip4.bellnexxia.net with ESMTP; 14 Aug 2006 12:35:17 -0400
Received: (qmail 2012 invoked by uid 110); 14 Aug 2006 12:35:15 -0400
Delivered-To: xx..xx@xx..xx.com
Received: (qmail 2002 invoked from network); 14 Aug 2006 12:35:14 -0400
Received: from pool-72-77-104-236.pitbpa.east.verizon.net (HELO
novatek) (72.77.104.236)
by xx..xx..xx.net with SMTP; 14 Aug 2006 12:35:14 -0400
Message-Id: <00a301c6bfb8$1a229700$1012c0a8@laird>
From: "corny willey" <marku...@nkaz.rusal.ru>
To: xx..xx@xx..xx.com
Subject: Gold n diamonds
Date: Mon, 14 Aug 2006 15:41:26 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_009B_01C6BFB8.1A229700"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Return-Path: marku...@nkaz.rusal.ru
X-OriginalArrivalTime: 14 Aug 2006 16:35:21.0576 (UTC)
FILETIME=[A2B04E80:01C6BFBF]
This is a multi-part message in MIME format.
------=_NextPart_000_009B_01C6BFB8.1A229700
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
TODAYS SPECIAL
Jewelry * Handbags * Pens * Watches * Neckties * Clutches * Wallets
Natural leather, silk, white gold and real jewels!
http://trotterdm.com/gold/
split wing infra praesidia
cow oak canoe yacht
drill cloth hog turn
red-flaggery flea hopper
baby-sitting ring-necked
cinch bill rood tower
------=_NextPart_000_009B_01C6BFB8.1A229700
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html;
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2900.2180" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY>
<DIV><STRONG>TODAYS SPECIAL</STRONG></DIV>
<DIV><STRONG>Jewelry * Handbags * Pens * Watches * Neckties * Clutches
* Wallets</STRONG></DIV>
<DIV>Natural leather, silk, white gold and real jewels!</DIV>
<DIV><A
href=3D"http://trotterdm.com/gold/">http://trotterdm.com/gold/</A></DIV>
<BR><BR>
<DIV><FONT face=3DArial size=3D2>split wing infra praesidia<BR>
cow oak canoe yacht<BR>
drill cloth hog turn<BR>
red-flaggery flea hopper<BR>
baby-sitting ring-necked<BR>
cinch bill rood tower</FONT></DIV></BODY></HTML>
------=_NextPart_000_009B_01C6BFB8.1A229700--
-- END OF SPAM --
See:
IP 72.77.104.236 pool-72-77-104-236.pitbpa.east.verizon.net
http://www.moensted.dk/spam/?addr=72.77.104.236
http://cbl.abuseat.org/lookup.cgi?ip=72.77.104.236
http://www.spamhaus.org/query/bl?ip=72.77.104.236
OrgName: Verizon Internet Services Inc.
OrgID: VRIS
NetRange: 72.64.0.0 - 72.95.255.255
CIDR: 72.64.0.0/11
NetName: VIS-72-64
NetHandle: NET-72-64-0-0-1
ASN: 19262
ASN Name: VZGNI-TRANSIT
http://www.cidr-report.org/cgi-bin/as-report?as=19262
12 SBL/ROKSO listings for IPs under the responsibility of verizon.net
http://www.spamhaus.org/sbl/listings.lasso?isp=verizon.net
178 SBL/ROKSO listings for IPs under the responsibility of
verizonbusiness.com
http://www.spamhaus.org/sbl/listings.lasso?isp=verizonbusiness.com
See:
trotterdm.com IP 210.51.190.119
ns1.trotterdm.com [210.51.190.119] [TTL=300]
ns2.trotterdm.com [210.51.190.119] [TTL=300]
ns1.muhlberierdns.com [195.144.21.94] [TTL=172800] [UA]
ns2.quintanadnsbenji.com [140.113.203.146] [TTL=172800] [TW]
trotterdm.com has no MX records
http://www.moensted.dk/spam/?addr=210.51.190.119
http://www.spamhaus.org/query/bl?ip=210.51.190.119
http://cbl.abuseat.org/lookup.cgi?ip=210.51.190.119
More 210.51.190.119 sightings:
http://groups.google.com/groups/search?q=210.51.190.119+group%3A*abuse
inetnum: 210.51.190.0 - 210.51.191.255
netname: ZHONGSUO
country: CN
descr: ZHONGSUO
route: 210.51.0.0/16
descr: CNC Group CncNet
route: 210.51.0.0/16
descr: CNC Route Object
origin: AS9929
member-of: rs-Secondary
mnt-by: CHINANETCOM-MNT
changed: liu...@china-netcom.com
http://www.cidr-report.org/cgi-bin/as-report?as=9929
9 SBL/ROKSO listings for IPs under the responsibility of
china-netcom.com
http://www.spamhaus.org/sbl/listings.lasso?isp=china-netcom.com
Let see whois.itsyourdomain.com:
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Domain: trotterdm.com
Registrant
victor baret
Victor Baret
vitastora[]yahoo.com
126 oak street
Plantersville, AL 36758 US
+1.3345960916
Administrative
victor baret
Victor Baret
vita...@yahoo.com
126 oak street
Plantersville, AL 36758 US
+1.3345960916
Billing
victor baret
Victor Baret
vita...@yahoo.com
126 oak street
Plantersville, AL 36758 US
+1.3345960916
Technical
victor baret
Victor Baret
vita...@yahoo.com
126 oak street
Plantersville, AL 36758 US
+1.3345960916
Record created on August 11, 2006
Record last updated on August 11, 2006
Record expires on August 11, 2007
Domain Name Servers:
NS1.MUHLBERIERDNS.COM
NS2.QUINTANADNSBENJI.COM
See:
ns1.muhlberierdns.com IP 195.144.21.94
http://www.moensted.dk/spam/?addr=195.144.21.94
No PTR records exist for 195.144.21.94 at ns3.rx-name.net
inetnum: 195.144.21.0 - 195.144.21.255
netname: RX-NET
descr: RX-HOST UKRAINE DATACENTER
descr: 54001, PBOX 297, Mykolayiv - 001
descr: Mykolayiv, Ukraine
country: UA [Ukraine]
route: 195.144.21.0/24
descr: RX-HOST NOC
origin: AS38957
notify: al...@rx-host.net
ASN: 38957
ASN Name: RX-HOST-AS (RX-HOST UKRAINE HOSTING, Mykolayiv)
Country IP Range: 195.144.21.0 to 195.144.21.255
http://www.cidr-report.org/cgi-bin/as-report?as=38957
More muhlberierdns.com sightings:
http://groups.google.com/groups/search?q=muhlberierdns.com+group%3A*abuse
See:
ns2.quintanadnsbenji.com IP 140.113.203.146
ns2.quintanadnsbenji.com has no MX records -> quintanadnsbenji.com has
no MX records
http://www.moensted.dk/spam/?addr=140.113.203.146
More 140.113.203.146 sightings:
http://groups.google.com/groups/search?q=140.113.203.146+group%3A*abuse
inetnum: 140.113.0.0 - 140.113.255.255
netname: TANET
descr: Taiwan Academic Network
descr: Ministry of Education computer Center
descr: 12F, No 106, Sec. 2, Heping E. Rd., Taipei
country: TW
inetnum: 140.113.0.0 - 140.113.255.255
netname: T-NCTU.EDU.TW-NET
descr: National Chiao Tung University
descr: HSINCHU Taiwan
country: TW
route: 140.113.0.0/16
descr: NCTU (proxy-registered route object)
origin: AS9916
notify: ylc...@gate.sinica.edu.tw
ASN: 9916
ASN Name: NCTU-TW (National Chiao Tung University,)
Country IP Range: 140.112.0.0 to 140.127.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=9916
37 SBL/ROKSO listings for IPs under the responsibility of edu.tw
http://www.spamhaus.org/sbl/listings.lasso?isp=edu.tw
More quintanadnsbenji.com sightings:
http://groups.google.com/groups/search?q=quintanadnsbenji.com+group%3A*abuse
See:
150.jestorn.com IP 210.172.177.175
ns1.jestorn.com A IN 300 210.172.177.175
ns2.jestorn.com A IN 300 210.172.177.175
ns1.jestorn.com [202.144.228.170] [TTL=172800] [HK]
ns2.jestorn.com [202.147.26.2] [TTL=172800] [JP]
150.jestorn.com has no MX records -> [jestorn.com has 1 MX record
mx.jestorn.com (10)]
http://www.moensted.dk/spam/?addr=210.172.177.175
210.172.177.175 PTR record: fra-net.jp
at ns.namedserver.net / dns.interq.or.jp
inetnum: 210.160.0.0 - 210.175.255.255
netname: JPNIC-NET-JP
descr: Japan Network Information Center
country: JP
inetnum: 210.172.128.0 - 210.172.191.255
netname: INTERQ
descr: Global Media Online inc.
route: 210.172.128.0/18
descr: Global Media Online Inc
Cerulean Tower, 11F
Sakuragaokacho-26-1
Shibuya-ku, Tokyo
150-8512, Japan
origin: AS7506
mnt-by: MAINT-AS7506
changed: sh...@interq.or.jp
ASN: 7506
ASN Name: APNIC-AS-2-BLOCK
Country IP Range: 210.160.0.0 to 210.175.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=7506
4 SBL listings for IPs under the responsibility of interq.or.jp
http://www.spamhaus.org/sbl/listings.lasso?isp=interq.or.jp
Let see whois:
Registrar: REGISTERFLY.COM, INC.
Registrant:
Jerriling
Kessilong ave 28
Labordond, CA 87236
US
Domain name: JESTORN.COM
Administrative Contact:
Derseng, Raul bhvujhv[]bvjrbv.com
Kessilong ave 28
Labordond, CA 87236
US
+1.8972343382 Fax: +1.8972343382
Technical Contact:
Derseng, Raul bhv...@bvjrbv.com
Kessilong ave 28
Labordond, CA 87236
US
+1.8972343382 Fax: +1.8972343382
Registrar of Record: REGISTERFLY.COM, INC.
Record last updated on 03-Jun-2006.
Record expires on 03-Jun-2007.
Record created on 03-Jun-2006.
Domain servers in listed order:
NS2.JESTORN.COM 202.147.26.2
NS1.JESTORN.COM 202.144.228.170
Domain status: ACTIVE
More jestorn.com sightings:
http://groups.google.com/groups/search?q=jestorn.com+group%3A*abuse
See:
ns1.jestorn.com IP 202.144.228.170
202.144.228.170 PTR record: bat.aicompro.com
at smok.aicompro.com / AICOM.COM
ns2.jestorn.com IP 202.147.26.2
ASN: 7928
ASN Name: AICOM-AS
Country (per IP registrar): HK [Hong Kong]
http://www.cidr-report.org/cgi-bin/as-report?as=7928
202.147.26.2 PTR record: ip-202-147-26-2.asianetcom.net
at ns1.asianetcom.net
inetnum: 202.147.26.0 - 202.147.26.7
netname: HEALTH-WAY-MNL-NETBLK02
descr: Health Way Medical Clinics. #2 / Digitel
descr: Asia Netcom MNL HUB
country: PH
ASN: 10026
ASN Name: ANC (Asia Netcom Corporation)
Country (per IP registrar): JP [Japan]
http://www.cidr-report.org/cgi-bin/as-report?as=10026
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/bcdfc3c038a00592
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/5e43a18eecacd913
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: