[email] [drugs - Canadian Pharmacy botnet] [64.135.139.61] (mediapix.ru / eightposition.hk / piotiongandesunkdes.com / chitionkdetunlionpsa.com / gedsactunjerion.com / fionkunjerunhedase.com) Lovers package at discount price!
TomezNet
IP 64.135.139.61 61-139-135-64.gray-ng.dsl.pinetreenetworks.com
Spamvwert Image hosting:
http://mediapix.ru/pics/bb39d8ee325070d5d818d6d9c0e7084d.gif
mediapix.ru IP 84.252.148.70
(at informcenter.ru / mchost.ru)
utm.eightposition.hk => botnet
Resolves to:
88.66.50.67, 88.161.117.62, 85.29.232.25, 84.58.14.207,
83.135.84.95, 80.93.180.194, 75.17.18.24, 70.250.71.193, 217.211.55.49
Title => Canadian Pharmacy
© Copyright Canadian Pharmacy, 2003-2007. All Rights Reserved.
Much More Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
Headers Forgery by spammer.
Plenty of Forged Certificates and logos as always.
Much More info below:
====================
Return-Path: <in...@anita-bijoux.de>
Delivered-To: [MUNGED]
Received: (qmail 19527 invoked from network); 1 Jun 2007 23:03:27
-0400
Received: from 61-139-135-64.gray-ng.dsl.pinetreenetworks.com (HELO
dem4500) (64.135.139.61)
by [MUNGED] with SMTP; 1 Jun 2007 23:03:27 -0400
X-Originating-IP: [89.879.66.477]
X-Originating-Email: [[MUNGED]]
X-Sender: [MUNGED]
Return-Path: [MUNGED]
Received: (qmail 147223 by uid 480); Fri, 1 Jun 2007 11:03:31 -0500
Message-Id: <20070601060331.147225.qmail@dem4500>
To: <[MUNGED]>
Subject: Lovers package at discount price!
From: Ad...@viagra.com <[MUNGED]>
MIME-Version: 1.0
Importance: High
Content-Type: text/html
<style>'&cg <br Finance court Wal <br mortgages />
<br title <br hunter /> pos Young Edinburgh 488 Login Annual
qc_may8_07 '&rp Reme
mber NYT_UPDATE_BOTTOM #sitesearch_text quicklinks finances
'&title mail />
<br jnf_text &Atilde <br Reshape text_link Line /> De
middleeast&pos Need &title Sponsored 6 />
photo_galleries See Text <br star confidence gap Treo <br flying
remember_me /> driving />
line Banking ahead <br special' <br Arsenal /> ago tradition
enter moktada_al_sadr Newsroom />
<br A?A?A¬1bn interviewed banner&amp Leaders <br 1&amp July />
Alive California />
sc2 at <br QC Guides Maria <br melting Heritage /> DOWNLOAD
qc_26_april_07 Links Searches cellPadding />
footer1 Primary <br doors text_ad 1&objId <br /> doc #top />
in_bottom Useful <br promo_header1 <br /> />
homegrown cabinet <br 24_6_text <br /> text_only Environment&div_
c3 relapse Reaction text_image 2007' MULTI />
CMS do membercenter <br Israel's sheraton_text_2007 <br />
regpss_toolbar According qc_may29_07 />
_top hundreds <br food <br /> edition Wednesday jobbox_arrow average
heroes' remaining Put />
trail qc_april17_07 ships <br qc_may22_07 />
POST <br Tickets />
'text <br moving Set david_s_cloud so <br /> sitesearch_text 07
children HEAD article_text />
<br Jewish graphical_text_blocks possible <br thorough Advisers 3px />
left angry TEXT Clyde Information />
insurgents aviation <br Kingdom Eldan_text <br Share qc_may15_07
doctype /> new_1_tr website DIV obvious />
<br liked <br avoid for head /> archsearch_head text conceive
416 founder song_text_2007 />
tr b5b609671115256c&ei <br searches aasearch_head Pointless <br
seeing _42990039_nicky_bigbro trouble /> solid text Film CORP
ORATE Dor_Alon_txt_May_2007 />
'&si #archsearch_head date_select <br compatible job expanded <br
potd_30_05_07_171745b easyJet NYT_TEXT /> text' 19 course />
earlier <br Reference Les <br toolbar_ukfs /> debate fff idcNov_text
22px businessmen subway thanks text '%2F' 10pt Blair' Area />
<br Donations s_account <br TR 2007 /> />
/original/emailfriend/collection/militarily/bookmarking/APY/
david_s_cloud/particularly/Sheik/recent/html&title/05_29_2007_6_T
B_on_Planes/'menu6'/roll_mdpolitics/Podcast/apps/someone/reputation/
ie7/general/head/PRO/restaurants/'&ot/'2007/shopping&
amp/'&s/text_ad/article/'&pev1/
/justice/185/1&oref/jcs/'&si/1398475&source/cellpadding/
alienate/insider/robin_toner/responded/s_dc/&&/interr
ogation/006/tr/************/AT&amp/prison/
/Hunt/05_03_2007_2_nat__a03__tuberculosis/back/Blues/Good/testing/
clear/EU_Select/05_30_2007_6_Tuberculosis_Infection/icon_text_l
g/NEW/renditions/likes/SIZE/1167996&source/TH&size/combination/
ts/Servlet/Take/MINIMUM/2&source/elections/#BFBFBF/Ten
/Pro/
/date_select/login_password_bg/blog/Services/count/title/books/
Also/'&pe/TM/very/colleges/'&amp/capital/dollar/3&&
;/'sub_nav_one'/its/NYT_INLINE_IMAGE_POSITION1/added/TILE_RIGHT_TOP/
premium/***/back_edge/run/update/TEXT/
</style><a href="http://utm.eightposition.hk" ><img src="http://
mediapix.ru/pics/bb39d8ee325070d5d818d6d9c0e7084d.gif">
<style>
/Breaking/hd_lifestyle/Motion's/Interactive/relatedrail_left/
australia&sid/'&title/max/Arizona/focuses/%3A%2F%2Fninemsn%2
Erealestate%2Ecom%2Eau%2Fcgi%2Dbin%2Frsearch%3Fa%3Dbhp%26t%3Dres%26cu
%3DMSN&_t/code/head/%3A%2F%2Fninemsn%2Eseek%2Ecom%2Eau%2
Findex%2Easpx&_t/Jim/but1/stuff/1/ALP's/Please/Killing'/De/Charter/
#primary/fcx/05_30_2007_6_Tuberculosis_Infection_World/
/aligned/Lebanese/se&amp/%3A%2F%2Fninemsn%2Ecarpoint%2Ecom%2Eau
%2F&_t/head_financialpost/Slevin/Gardens/hd_nav_bullet/com
ments_login_block/tools_top/660px/hcat/MELIA/
copyright/'&p/'&rp/A©2007/important/&_m/addition/hard/At/
Restaurants/
/Food/strained/BY/V13a***/questions/knightridder_hp_420x200&event/
HEAD/book/ #hd_ms_options/SIZE&n
bsp/Bombings/believe/Questions/Block/'linkName'&/feature/
comment_anchor_81414/inequality/
/Non/DE/7329&DI/Searches/bgColor/when/agenda/21/&_p/'parent'/
date_str/treat/text_image/ text/1'/reporter/politicians/HTML
/detailed/talkback/foxsports/cellPadding/html/headlines&head/
Organization/'&k/Neighborhoods/embattled/icon_text_sm/sittin
g/#336699/
/Class/family /metro/meetings/
hd_moresites/'text/deployment/intends/Aol/ONE/uninsured/
a#hd_signinLink/k
ristin/ads/templateimages/additionals_send_printer/Nigerian/embed/
100px/Cove/1&_l/said/erasure/please/20'/Papers/padding/year
/topstrip/'&bh/
/Marshall/Months/myAccount/A?A»A?/NYT_TEXT/Item/fatally/scitech/
hd_mid_tile/Then/'&oi/sent/My/'mn_Article'/turned/homepage/costs
/74px/text/MIAMI/roll_sellhome/jspa/170px/ ***/after/
05_29_2007_6_Tuberculosis_Infection/
/30m/shaken/Text/at/when/really/themed/Diplomats/GMC/expert/
Speed_Start_Time/login_loginid_bg/clips/#C4C4C4/text/ACLU/NE/protecti
on/travel/sr'/spark/Athens/helicopter/vision/related_media_bar/arts/
move/search_text/activities/'menu5'/
/Funk/HEADER/ Add/photo/1&vieweroffset/
Stock/breach/FOCUS/Government/comment_anchor_81333/comment_a
nchor_81776/s_oc/timesselect/souvenirs/NYT_UPDATE_BOTTOM/
gave/'&pidt/majority/%3A%2F%2Fad%2Edoubleclick%2Enet%2Fclk
%3B2681964
1%3B12601542%3Bb%3F/roll_redskins/spend/bid/ #hd_1/
Message/headerimage/col/grow/Hats/consequences/mh_text/
/2007/screened/
si/ Time/
commentaries/'True'/Massachusetts/66px/cellp
adding/Rep/ARE/breakthroughs/'12pt'/Billiton/NYSE/2007'/2007&nbsp/
cars/1&lc/
/Mart/wants/former/fields/nwsource/*************/TB/University/DEB/
Press/16/Americas/Putin's/410/Benjamin/popup/Manulife/roll_pos
tmag/Mail/30/Rises/cellSpacing/aponline/
/leaning/05_04_2007_2_world__a04__tuberculosis/AREA/Costly/etrade/
login&destination/mail/tr/'&pev2/05_29_2007_6_Tuberculo
sis_Infection_Glance/MNG/top_news/devices/ex/nyt_org_all/gorman/year's/
calling/cityguide/washington_nationals/
/delicious&title/search_go/live/87px/mags/Etrade/badly/136px/
SPACER/SAN/button_layout_login_comments/bg_video_77x77/ci_602237
7/story_tr/icon_text_med/been/text'/'block/employers/
05_30_2007_6_Disease_at_the_Border/1986532&source/'&cg/
Republican/ro
ll_newsadvice/SO/left/Rates/Oppenheimer/unlikely/jamieson/md_off/
/AOL/Among/138/05_29_2007_10_Tuberculosis_Infection/Gov/credit/Spector/
hd/legislative/solving/exports/361/05_30_2007_2_a30_TB_qua
rantine/cannot/ETag/Microsoft/2007////////
</style>
-- END OF SPAM --
Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
You may contact us at +1(210) 787-1711, please, keep your order I.D.
every time you make a call.
Pharma Checker:
Contact Information
Hours of Operation: Customer Service: Mon-Sun, 24 Hour/day. Pharmacy:
M-Fri, 7:30a-11:30p CST, Sat-Sun 8a-6p
CEO/President: Kris Thorkelson
24 Terracon Place
Winnipeg, MB, R2J 4G7
Canada
Affiliated Physical Pharmacy(ies)
eightposition.hk
Licensed by: Manitoba Pharmaceutical Association - License #32195,
Canada
SEE contact page:
Form and Also you may send us an e-mail.
You will get an answer ASAP. Customer Support (click here to mail us
sites...@globalpharmsupport.com)
globalpharmsupport.com IP N/A
AND connection to UnitedPharmSupport.com
More globalpharmsupport.com sightings:
http://groups.google.com/groups/search?q=globalpharmsupport.com+group%3A*abuse&qt_s=Search
See:
IP 64.135.139.61 61-139-135-64.gray-ng.dsl.pinetreenetworks.com
http://www.moensted.dk/spam/?addr=64.135.139.61
http://spamcop.net/w3m?action=checkblock&ip=64.135.139.61
OrgName: COMMUNICATIONS DESIGN ACQUISITION CORPORATION
OrgID: CDAC-3
Address: c/o Pine Tree Networks
Address: c/o Pine Tree Networks
Address: 56 Campus Drive
City: New Gloucester
StateProv: ME
PostalCode: 04260
Country: US
NetRange: 64.135.128.0 - 64.135.143.255
CIDR: 64.135.128.0/20
NetName: CDAC-CRCCO
NetHandle: NET-64-135-128-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.PINETREENETWORKS.COM
NameServer: NS2.PINETREENETWORKS.COM
Prefix: 64.135.128.0/20
Prefix Name: error
AS: 13518
AS Name: GR8 GR8, INC.
http://www.cidr-report.org/cgi-bin/as-report?as=13518
Spamvwert Image hosting:
http://mediapix.ru/pics/bb39d8ee325070d5d818d6d9c0e7084d.gif
See:
mediapix.ru IP 84.252.148.70
ns1.mchost.ru [84.252.148.19] [TTL=345600] [RU]
ns2.mchost.ru [84.252.149.19] [TTL=345600] [RU]
SOA record [TTL=600] is:
Primary nameserver: ns1.mchost.ru
Hostmaster E-mail address: in...@mchost.ru
Serial #: 1180618836
1 MX record is:
10 mail.mediapix.ru [TTL=600] IP=84.252.148.4 [TTL=600] [RU]
84.252.148.4 = mx.mchost.ru
http://www.moensted.dk/spam/?addr=84.252.148.70
inetnum: 84.252.148.0 - 84.252.149.255
netname: MCHOST
descr: MC Host.ru
country: RU
role: InformCenter NOC
address: Closed Stock Company "Information Center"
route: 84.252.128.0/18
descr: InformCenter route block
origin: AS25532
notify: n...@informcenter.ru
mnt-by: MASTERHOST-MNT
changed: ca...@informcenter.ru
IP: 84.252.148.70
Reverse: sport.mchost.ru
Aliases: hotmail.kz
Prefix: 84.252.128.0/18
Prefix Name: InformCenter route block
AS: 25532
AS Name: MASTERHOST AS masterhost autonomous system Moscow, Russia
http://www.cidr-report.org/cgi-bin/as-report?as=25532
More mchost.ru sightings:
http://groups.google.com/groups/search?q=mchost.ru+group%3A*abuse&qt_s=Search
Let see whois:
domain: MEDIAPIX.RU
type: CORPORATE
nserver: ns1.mchost.ru
nserver: ns2.mchost.ru
state: REGISTERED, DELEGATED
person: Alexandr V Strokov
phone: +7 47391 47186
fax-no: +7 47391 47186
e-mail: volf...@hotbox.ru
e-mail: volf...@bk.ru
registrar: REGTIME-REG-RIPN
created: 2007.02.14
paid-till: 2008.02.14
source: TC-RIPN
Last updated on 2007.06.02 11:52:05 MSK/MSD
Spamvert URL:
http://utm.eightposition.hk
utm.eightposition.hk Resolves to:
217.211.55.49(SE) 217-211-55-49-no47.tbcn.telia.com
70.250.71.193(US) ppp-70-250-71-193.dsl.rcsntx.swbell.net
75.17.18.24(US) adsl-75-17-18-24.dsl.irvnca.sbcglobal.net
80.93.180.194(RU) n180-static-194.rssp-net.spb.ru
83.135.84.95(DE) i5387545f.versanet.de
84.58.14.207(DE) dslb-084-058-014-207.pools.arcor-ip.net
84.61.175.188(DE) dslb-084-061-175-188.pools.arcor-ip.net
85.29.232.25(EE) 25-232-j.ipv4.vnet.ee
88.161.117.62(FR) mol92-7-88-161-117-62.fbx.proxad.net
88.66.50.67(DE) dslb-088-066-050-067.pools.arcor-ip.net
eightposition.hk Resolves to:
ns0.chitionkdetunlionpsa.com 76.104.139.174(US)
ns0.fionkunjerunhedase.com 208.120.41.135(US)
ns0.gedsactunjerion.com 69.229.238.218(US)
ns0.piotiongandesunkdes.com 24.238.187.40(US)
5 hosts sharing ip
lastlift.hk
repeatphrase.hk
serma.hk
thousandhundred.hk
utm.eightposition.hkutm.eightposition.hk
NS records at the parent servers are:
NS0.GEDSACTUNJERION.COM [89.178.228.245 (NO GLUE)] [RU]
NS0.FIONKUNJERUNHEDASE.COM [89.179.220.204 (NO GLUE)] [RU]
NS0.PIOTIONGANDESUNKDES.COM [143.248.231.204 (NO GLUE)] [KR]
NS0.CHITIONKDETUNLIONPSA.COM [213.219.227.79 (NO GLUE)] [RU]
NS records at nameservers are:
ns0.piotiongandesunkdes.com [69.156.107.156] [TTL=300]
ns0.chitionkdetunlionpsa.com [88.66.50.67] [TTL=300]
ns0.gedsactunjerion.com [89.178.78.207] [TTL=300]
ns0.fionkunjerunhedase.com [89.178.84.235] [TTL=300]
utm.eightposition.hk has no MX records -> eightposition.hk has no MX
records
4 MX records are:
ns0.piotiongandesunkdes.com and ns0.chitionkdetunlionpsa.com both
resolve to 0.0.0.0.
ns0.piotiongandesunkdes.com and ns0.gedsactunjerion.com both resolve
to 0.0.0.0.
ns0.piotiongandesunkdes.com and ns0.fionkunjerunhedase.com both
resolve to 0.0.0.0.
ns0.chitionkdetunlionpsa.com and ns0.gedsactunjerion.com both resolve
to 0.0.0.0.
ns0.chitionkdetunlionpsa.com and ns0.fionkunjerunhedase.com both
resolve to 0.0.0.0.
ns0.gedsactunjerion.com. and ns0.fionkunjerunhedase.com both resolve
to 0.0.0.0.
www.eightposition.hk A record is:
www.eightposition.hk A 89.102.191.23 [TTL=300] [CZ]
www.eightposition.hk A 217.211.55.49 [TTL=300] [SE]
www.eightposition.hk A 24.152.128.81 [TTL=300] [US]
www.eightposition.hk A 88.66.50.67 [TTL=300] [DE]
www.eightposition.hk A 81.236.184.9 [TTL=300] [SE]
www.eightposition.hk A 89.212.144.247 [TTL=300] [SI]
www.eightposition.hk A 89.179.66.24 [TTL=300] [RU]
www.eightposition.hk A 71.130.204.142 [TTL=300] [US]
www.eightposition.hk A 85.29.232.25 [TTL=300] [EE]
www.eightposition.hk A 88.161.117.62 [TTL=300] [FR]
Let see whois:
Domain Name: EIGHTPOSITION.HK
Contract Version: HKDNR latest version
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): MR SAM PATTERSON
Holder Chinese Name:
Email: maries...@safe-mail.net
Domain Name Commencement Date: 29-05-2007
Country: US
Expiry Date: 29-05-2008
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1898648T
Technical Contact:
First name: SAM
Last name: PATTERSON
Company Name: SAM PATTERSON
Name Servers Information:
NS0.FIONKUNJERUNHEDASE.COM
NS0.GEDSACTUNJERION.COM
NS0.PIOTIONGANDESUNKDES.COM
NS0.CHITIONKDETUNLIONPSA.COM
See also thread:
http://groups.google.com/group/news.admin.net-abuse.email/browse_thread/thread/495f5468b21f15dc/3026ddc916d676a3#3026ddc916d676a3
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/af63d236addb98b7
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: