Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] [drugs - Canadian Pharmacy botnet] [192.245.181.93] (pills33.com / biknasufadupo.com / markuzapilod.com / rubakopesanm.com / rumbaponukas.com) overwhelmingly girl

0 views

Skip to first unread message

TomezNet

unread,

Sep 17, 2007, 4:31:13 AM9/17/07

Received From:
IP 207.255.70.251 207-255-70-251-dhcp.aoo.pa.atlanticbb.net
(at atlanticbb.com)

Spamvert botnet:
pills33.com => botnet
pills33.com Resolved to 58.89.244.199 to 61.10.122.23 to 61.225.3.114
to 82.131.5.157 to 84.160.232.96 to 122.24.131.190 to 122.26.238.46 to
123.192.24.176 to 123.217.190.155 to 202.132.105.246 to
202.162.138.180 to 210.96.194.180 to 210.96.207.157 to 218.190.213.161
to 221.125.110.250

Title: Canadian Pharmacy

WEB:
© Copyright Canadian Pharmacy, 2003-2007. All Rights Reserved.

Much More Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&

Plenty of Forged Certificates and logos as always.

Much More info below:
====================

X-SID-PRA: marek <marek[]milo.com.pl>
X-Message-Info:
6sSXyD95QpVE6MqiwsTt7aSendyVFlwEB2wKuL77myZ3SEuPHfbqYf3sZ0v9DSsJb1lpFGm57k8q3XVE5aFO9Q==
Received: from tomts17-srv.bellnexxia.net ([209.226.175.71]) by bay0-
pamc1-f2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sun, 16 Sep 2007 14:43:01 -0700
Received: from [MUNGED]
by toip18.srvr.bell.ca with ESMTP; 16 Sep 2007 17:42:51 -0400
Received: (qmail 14018 invoked by uid 110); 16 Sep 2007 16:01:52 -0400
Delivered-To: [MUNGED]
Received: (qmail 14014 invoked from network); 16 Sep 2007 16:01:52
-0400
Received: from 207-255-70-251-dhcp.aoo.pa.atlanticbb.net
(207.255.70.251)
by [MUNGED] with SMTP; 16 Sep 2007 16:01:52 -0400
Received: from IYGB ([192.245.181.93])
by 207-255-70-251-dhcp.aoo.pa.atlanticbb.net (8.13.4/8.13.4) with
SMTP id s496160514050o6Ep011755
for <[MUNGED]>; Sun, 16 Sep 2007 16:08:50 -0500 (CDT)
(envelope-from marek[]milo.com.pl)
Message-ID: <010101c7f89d$662ce280$fb46ffcf@IYGB>
From: "marek" <marek[]milo.com.pl>
To: <[MUNGED]>
Subject: overwhelmingly girl
Date: Mon, 17 Sep 2007 01:04:02 +0400
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_00FE_01C7F87B.DEA29010";
type="multipart/alternative"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138
Return-Path: ma...@milo.com.pl
X-OriginalArrivalTime: 16 Sep 2007 21:43:02.0047 (UTC)
FILETIME=[8E6522F0:01C7F8AA]

This is a multi-part message in MIME format.

------=_NextPart_000_00FE_01C7F87B.DEA29010
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_00FF_01C7F87B.DEA29010"

------=_NextPart_001_00FF_01C7F87B.DEA29010
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

kqoj ipvy fikoh bhoqol aoqomkd
------=_NextPart_001_00FF_01C7F87B.DEA29010
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-
ascii">
<META content=3D"MSHTML 6.00.6000.16525" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV>
almost Alaskan
<IMG src=3D"cid:010101c7f89d$662ce280$fb46ffcf@IYGB">uxorious <BR>
</DIV></BODY></HTML>

------=_NextPart_001_00FF_01C7F87B.DEA29010--

------=_NextPart_000_00FE_01C7F87B.DEA29010
Content-Type: image/jpeg;
name="vacuum cleaner.jpg"
Content-Transfer-Encoding: base64
Content-ID: <010101c7f89d$662ce280$fb46ffcf@IYGB>

------=_NextPart_000_00FE_01C7F87B.DEA29010--

-- END OF SPAM --

NOTE:
Remove Attachment base64 image: cleaner.jpg

WEB:
Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
You may contact us at +1(210) 787-1711, please, keep your order I.D.
every time you make a call.
© Copyright Canadian Pharmacy, 2003-2007. All Rights Reserved.

See:
IP 207.255.70.251 207-255-70-251-dhcp.aoo.pa.atlanticbb.net

http://moensted.dk/spam/?addr=207.255.70.251
http://dsbl.org/listing?207.255.70.251
Spam source - http://wpbl.info/record?ip=207.255.70.251

Atlantic Broadband Finance, LLC ATLANTICBB-JOHNSTOWN
(NET-207-255-0-0-1)
207.255.0.0 - 207.255.255.255
Atlantic Broadband Finance, LLC JST-PA-207-255-64
(NET-207-255-64-0-1)
207.255.64.0 - 207.255.95.255

OrgName: Atlantic Broadband Finance, LLC
OrgID: ATLAN-19
NetRange: 207.255.64.0 - 207.255.95.255
CIDR: 207.255.64.0/19
NetName: JST-PA-207-255-64
NetHandle: NET-207-255-64-0-1
Parent: NET-207-255-0-0-1
NetType: Reallocated
Comment: Please send all Abuse complaints to ab...@atlanticbb.com
=> ???

postmaster and abuse[]atlanticbb.com are listed in rfc-ignorant.org
database

route: 207.255.64.0/19
descr: 207-255-64-0-JST-PA
tech-c: JEM1-LEVEL3
origin: AS11776
mnt-by: ABF-MNT
changed: jmcmasters[]atlanticbb.com
AS Name: ATLANTICBB-JOHNSTOWN - Atlantic Broadband Finance, LLC
http://www.cidr-report.org/cgi-bin/as-report?as=11776

1 SBL listings for IPs under the responsibility of atlanticbb.net
http://www.spamhaus.org/sbl/listings.lasso?isp=atlanticbb.net

Image Spamvert URL:
http://pillas33.com/

See:
pillas33.com => botnet
pills33.com Resolved to 58.89.244.199 to 61.10.122.23 to 61.225.3.114
to 82.131.5.157 to 84.160.232.96 to 122.24.131.190 to 122.26.238.46 to
123.192.24.176 to 123.217.190.155 to 202.132.105.246 to
202.162.138.180 to 210.96.194.180 to 210.96.207.157 to 218.190.213.161
to 221.125.110.250

ns0.biknasufadupo.com [84.94.198.237] [TTL=172800] [IL]
ns0.markuzapilod.com [82.240.154.185] [TTL=172800] [FR]
ns0.rubakopesanm.com [76.247.75.31] [TTL=172800] [US]
ns0.rumbaponukas.com [202.162.138.180] [TTL=172800] [JP]

SOA record [TTL=300] is:
Primary nameserver: ns0.markuzapilod.com
Hostmaster E-mail address: n...@rubakopesanm.com
Serial #: 615266456

www.pills33.com A record are:

www.pills33.com A 58.89.244.199 [TTL=300] [JP]
www.pills33.com A 61.10.122.23 [TTL=300] [HK]
www.pills33.com A 61.225.3.114 [TTL=300] [TW]
www.pills33.com A 84.160.232.96 [TTL=300] [DE]
www.pills33.com A 122.24.131.190 [TTL=300] [JP]
www.pills33.com A 122.26.238.46 [TTL=300] [JP]
www.pills33.com A 123.217.190.155 [TTL=300] [JP]
www.pills33.com A 125.134.39.178 [TTL=300] [KR]
www.pills33.com A 202.132.105.246 [TTL=300] [TW]
www.pills33.com A 202.162.138.180 [TTL=300] [JP]
www.pills33.com A 210.96.194.180 [TTL=300] [KR]
www.pills33.com A 210.96.207.157 [TTL=300] [KR]
www.pills33.com A 218.190.213.161 [TTL=300] [HK]

Let see whois.dns.com.cn:
Domain Name.......... pills33.com
Creation Date........ 2007-07-25 07:45:13
Registration Date.... 2007-07-25 07:45:13
Expiry Date.......... 2008-07-25 07:45:13
Organisation Name.... cao dong
Organisation Address. NO.312 qingyun road guiyan
Organisation Address.
Organisation Address. Guangzhou
Organisation Address. 321000
Organisation Address. GD
Organisation Address. CN

Admin Name........... cao dong
Admin Address........ NO.312 qingyun road guiyan
Admin Address........
Admin Address........ Guangzhou
Admin Address........ 321000
Admin Address........ GD
Admin Address........ CN
Admin Email.......... addd...@loftyrx.org
Admin Phone.......... +86.2032100023
Admin Fax............ +86.2032100023

Tech Name............ cao dong
Tech Address......... NO.312 qingyun road guiyan
Tech Address.........
Tech Address......... Guangzhou
Tech Address......... 321000
Tech Address......... GD
Tech Address......... CN
Tech Email........... addd...@loftyrx.org
Tech Phone........... +86.2032100023
Tech Fax............. +86.2032100023

Bill Name............ cao dong
Bill Address......... NO.312 qingyun road guiyan
Bill Address.........
Bill Address......... Guangzhou
Bill Address......... 321000
Bill Address......... GD
Bill Address......... CN
Bill Email........... addd...@loftyrx.org
Bill Phone........... +86.2032100023
Bill Fax............. +86.2032100023
Name Server.......... ns0.rubakopesanm.com
Name Server.......... ns0.markuzapilod.com
Name Server.......... ns0.biknasufadupo.com
Name Server.......... ns0.rumbaponukas.com

More pills33.com sightings:
http://groups.google.com/groups/search?q=pills33.com+group%3A*abuse&qt_s=Search

See:
ns0.biknasufadupo.com IP 84.94.198.237

84.94.198.237 = 84.94.198.237.cable.012.net.il

Let see whois.paycenter.com.cn:
Domain Name: biknasufadupo.com

Registrant:
Wang Ming
Shang Hai
610021

Administrative Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
df...@hotmail.com

Technical Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
df...@hotmail.com

Billing Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
df...@hotmail.com

Registration Date: 2007-06-04
Update Date: 2007-06-04
Expiration Date: 2008-06-04

Primary DNS: ns0.biknasufadupo.com 84.94.198.237
Secondary DNS: ns1.biknasufadupo.com 76.247.75.31

More biknasufadupo.com sightings:
http://groups.google.com/groups/search?q=biknasufadupo.com+group%3A*abuse&start=0&scoring=d&

See:
ns0.markuzapilod.com IP 82.240.154.185

82.240.154.185 = lau06-3-82-240-154-185.fbx.proxad.net

Let see whois.paycenter.com.cn:
Domain Name: markuzapilod.com

Registrant:
Wang Ming
Shang Hai
610021

Administrative Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
dfere[]hotmail.com

Technical Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
df...@hotmail.com

Billing Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
df...@hotmail.com

Registration Date: 2007-06-04
Update Date: 2007-06-04
Expiration Date: 2008-06-04

Primary DNS: ns0.markuzapilod.com
Secondary DNS: ns1.markuzapilod.com

More markuzapilod.com sightings:
http://groups.google.com/groups/search?q=markuzapilod.com+group%3A*abuse&start=0&scoring=d&

See:
ns0.rubakopesanm.com IP 76.247.75.31

76.247.75.31 = adsl-76-247-75-31.dsl.wotnoh.sbcglobal.net

Let see whois.paycenter.com.cn:
Domain Name: rubakopesanm.com

Registrant:
Wang Ming
Shang Hai
610021

Administrative Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
dfere[]hotmail.com

Technical Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
df...@hotmail.com

Billing Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
df...@hotmail.com

Registration Date: 2007-06-04
Update Date: 2007-06-04
Expiration Date: 2008-06-04

Primary DNS: ns0.rubakopesanm.com
Secondary DNS: ns1.rubakopesanm.com

More rubakopesanm.com sightings:
http://groups.google.com/groups/search?q=rubakopesanm.com+group%3A*abuse&start=0&scoring=d&

See:
ns0.rumbaponukas.com IP 202.162.138.180

202.162.138.180 = 138.180.hinocatv.ne.jp

Let see whois.paycenter.com.cn:
Domain Name: rumbaponukas.com

Registrant:
Wang Ming
Shang Hai
610021

Administrative Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
dfere[]hotmail.com

Technical Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
df...@hotmail.com

Billing Contact:
Wang Ming
Wang Ming
Shang Hai
Shang Hai Shanghai 610021
China
tel: 86 021 59986552
fax: 86 021 59986552
df...@hotmail.com

Registration Date: 2007-06-04
Update Date: 2007-06-04
Expiration Date: 2008-06-04

Primary DNS: ns0.rumbaponukas.com
Secondary DNS: ns1.rumbaponukas.com

More rumbaponukas.com sightings:
http://groups.google.com/groups/search?q=rumbaponukas.com+group%3A*abuse&start=0&scoring=d&

SEE Also:
58.89.244.199 = 58-89-244-199.nasicnet.com
61.10.122.23 = cm61-10-122-23.hkcable.com.hk
61.225.3.114 = 61-225-3-114.dynamic.hinet.net
84.160.232.96 = p54A0E860.dip.t-dialin.net
122.24.131.190 = p4190-ipbf1106hodogaya.kanagawa.ocn.ne.jp
122.26.238.46 = p3046-ipbf3001marunouchi.tokyo.ocn.ne.jp
123.217.190.155 = p4155-ipad308funabasi.chiba.ocn.ne.jp
125.134.39.178 => at kornet.net / Korea
202.132.105.246 => at ttn.com.tw / iasiaworks.com / Taiwan
202.162.138.180 = 138.180.hinocatv.ne.jp
210.96.194.180 => at bora.net / Korea
210.96.207.157 => at bora.net / Korea
218.190.213.161 => at hutchcity.com / hgc.com.hk

SEE also from Registrant data:
whois.publicinterestregistry.net for loftyrx.org:
Domain ID:D140032992-LROR
Domain Name:LOFTYRX.ORG
Created On:19-Feb-2007 15:36:56 UTC
Last Updated On:21-Apr-2007 03:48:28 UTC
Expiration Date:19-Feb-2008 15:36:56 UTC
Sponsoring Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-
LROR)
Status:CLIENT TRANSFER PROHIBITED
Registrant ID:CTQ4QOBQA45GRP4
Registrant Name:zhou ming
Registrant Organization:zhou ming
Registrant Street1:jiang xi nan change
Registrant Street2:
Registrant Street3:
Registrant City:nan chang
Registrant State/Province:JX
Registrant Postal Code:321000
Registrant Country:CN
Registrant Phone:+86.7913210002
Registrant Phone Ext.:
Registrant FAX:+86.7913222322
Registrant FAX Ext.:
Registrant Email: adddmicn[]loftyrx.org
Admin ID:CT0F0SA8KRFVZDS
Admin Name:zhou ming
Admin Organization:zhou ming
Admin Street1:jiang xi nan change
Admin Street2:
Admin Street3:
Admin City:nan chang
Admin State/Province:JX
Admin Postal Code:321000
Admin Country:CN
Admin Phone:+86.7913210002
Admin Phone Ext.:
Admin FAX:+86.7913222322
Admin FAX Ext.:
Admin Email: addd...@loftyrx.org
Tech ID:CT49WCKWA3OCR7X
Tech Name:zhou ming
Tech Organization:zhou ming
Tech Street1:jiang xi nan change
Tech Street2:
Tech Street3:
Tech City:nan chang
Tech State/Province:JX
Tech Postal Code:321000
Tech Country:CN
Tech Phone:+86.7913210002
Tech Phone Ext.:
Tech FAX:+86.7913222322
Tech FAX Ext.:
Tech Email: addd...@loftyrx.org
Name Server: NS1.MEDDSP.ORG
Name Server: NS2.MEDDSP.ORG

More loftyrx.org sightings:
http://groups.google.com/groups/search?q=loftyrx.org+group%3A*abuse&start=0&scoring=d&

SEE also from Registrant data:
whois.publicinterestregistry.net:
Domain ID:D138355955-LROR
Domain Name:MEDDSP.ORG
Created On:27-Jan-2007 09:55:01 UTC
Last Updated On:29-Mar-2007 03:50:00 UTC
Expiration Date:27-Jan-2008 09:55:01 UTC
Sponsoring Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-
LROR)
Status:OK
Registrant ID:CT9QTTHW1SZ4D5F
Registrant Name:feng ming fei
Registrant Organization:feng ming fei
Registrant Street1:fu jian xia meng
Registrant Street2:
Registrant Street3:
Registrant City:xia meng
Registrant State/Province:FJ
Registrant Postal Code:321000
Registrant Country:CN
Registrant Phone:+86.5923210023
Registrant Phone Ext.:
Registrant FAX:+86.5923210023
Registrant FAX Ext.:
Registrant Email: admin[]universalmatches.com
Admin ID:CT44J4SV89BPKAW
Admin Name:feng ming fei
Admin Organization:feng ming fei
Admin Street1:fu jian xia meng
Admin Street2:
Admin Street3:
Admin City:xia meng
Admin State/Province:FJ
Admin Postal Code:321000
Admin Country:CN
Admin Phone:+86.5923210023
Admin Phone Ext.:
Admin FAX:+86.5923210023
Admin FAX Ext.:
Admin Email: ad...@universalmatches.com
Tech ID:CTP1IIQORZZ0G21
Tech Name:feng ming fei
Tech Organization:feng ming fei
Tech Street1:fu jian xia meng
Tech Street2:
Tech Street3:
Tech City:xia meng
Tech State/Province:FJ
Tech Postal Code:321000
Tech Country:CN
Tech Phone:+86.5923210023
Tech Phone Ext.:
Tech FAX:+86.5923210023
Tech FAX Ext.:
Tech Email: ad...@universalmatches.com
Name Server:NS1.MEDDSP.ORG
Name Server:NS2.MEDDSP.ORG

More MEDDSP.ORG sightings:
http://groups.google.com/groups/search?q=MEDDSP.ORG+group%3A*abuse&qt_s=Search

And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/a0e349c86d831623

And:
http://groups.google.com/group/news.admin.net-abuse.sightings/browse_thread/thread/6f1f9261420f4505/d5e68e2f01bec936#d5e68e2f01bec936

And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/ae0a8cc1a8b9e918

Cheers, Tomez

--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.

For a copy of the guidelines to this group, see:

http://www.killfile.org/~tskirvin/nana/

0 new messages