[email] [meds - PharmacyExpress.com] (renoneors.com) SAVE 82% VALIU*, ATIVA*, LEVITR*, MERIDI* & ALL POPULAR MEDICATIONS, NO QUESTION ASKED bought
TomezNet
IP 61.52.62.54
(at CNCGROUP-HA)
Spamvert URL:
http://ca.geocities.com/ivette27680tedie71193/
Redirected to:
http://210.192.120.43/pharmacy/
(at CHINANETCENTER)
Forged false site "certificates" pop-up window at fewfew.renoneors.com
Logos and support by Visa, CIPA (Licence #91959), BBB (Participant
through 12/30/2005),
Verisign Secure Site (Validity Period: 13-OCT-04 - 13-OCT-05)
PharmacyChecker - CEO/President: Jack Poppins
My Canadian Pharmacy Corp.
1592 Wilson Avenue,
Toronto, ON M3L 1A6
fewfew.renoneors.com IP 59.188.12.74
(at FECOM-HK / newworldtel.com)
More Pharmacy Express sightings:
http://groups.google.com/groups?q=%22Pharmacy+Express%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 206.190.49.51; Sun, 22 Jan 2006
23:21:17 -0800
X-Originating-IP: [61.52.62.54]
Return-Path: <sqqgl...@voicenet.com>
Authentication-Results: mta101.mail.dcn.yahoo.com from=voicenet.com;
domainkeys=neutral (no sig)
Received: from 61.52.62.54 (HELO 216.155.197.59) (61.52.62.54) by
mta101.mail.dcn.yahoo.com with SMTP; Sun, 22 Jan 2006 23:21:16 -0800
To: xx..xx@xx..xx.com
From: "Desirae Deneen" <sqqgl...@voicenet.com>
Reply-to: "Desirae Deneen" <sqqgl...@voicenet.com>
Date: Mon, 23 Jan 2006 01:21:13 -0600
Subject: SAVE 82% VALIU*, ATIVA*, LEVITR*, MERIDI* & ALL POPULAR
MEDICATIONS, NO QUESTION ASKED bought
Message-ID: <1ztzhsq...@voicenet.com>
MIME-Version: 1.0
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.5702.6264
Content-Type: multipart/related; boundary="--IBXWWWVQJV-BILZXT"
Content-Length: 943
force night evening. my find gym rich, here companion a embarrass
latter sandwich.
already we window?
purpose edge pretty music anything. commit money he not corner?
speaking end anything speaking embarrass sandwich, prison off the?
respect did drew across allow sandwich? reference black different.
<html><head>
<meta http-equiv="Content-Type" content="text; charset=iso-8859-1">
</head>
<body>
<font color=FFFFFF size=1>added thus how. reply not next whom few? a
social side disappoint. thats wife light back again.</font>
<center><table border=5 cellspacing=1 cellpadding=10 width=550
bordercolor=E6FD42>
<tr><td bgcolor=ffffff align=center bordercolor=2020FF>
<font size=1 face=arial color=000000>
<font size=5 color=FF5353><b>Hot Selling Meds At Low<br><font
color=E10000 size=3>U Just Pay & We Ship, Dont Keep Ur Record<br><font
color=B70000>All Countries Shipping</font></b></font></font><br><font
color=000000 size=2>Ciali*, Xana*, Viagr*, Ambie*, Valiu*, Ativa*,
Zoloft, Clonazepa*, Rivotri*, Levitr*, Cipro, Meridi*, Celebre*,
Amoxicili & Many More Meds reading anything</font><br><br>
<center>
<a href=http://ca.geocities.com/ivette27680tedie71193/
target=_blank><font size=5 color=0000E8 size=arial><b><u>whom 0RDER
YOUR MEDS HERE</font></u></b></a><br><font size=1>Sir/Madam, The site
might slow on loading, Please Allow 10-15 sec for site fully
loaded</font><br><br></center></td></tr></table><font color=FFFFFF
size=1>corner different music force.</font>
</body></html>
-- END OF SPAM --
See:
IP 61.52.62.54
http://www.moensted.dk/spam/?addr=61.52.62.54
http://cbl.abuseat.org/lookup.cgi?ip=61.52.62.54
http://www.spamhaus.org/query/bl?ip=61.52.62.54
http://dsbl.org/listing?61.52.62.54
inetnum: 61.52.0.0 - 61.53.255.255
netname: CNCGROUP-HA
country: CN
ASN: 4837
ASN Name: CHINA169-Backbone (CNCGROUP China169 Backbone)
11 SBL/ROKSO listings for IPs under the responsibility of CNCGROUP-HA
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGROUP-HA
See URL:
http://ca.geocities.com/ivette27680tedie71193/
See:
IP 210.192.120.43
http://www.moensted.dk/spam/?addr=210.192.120.43
http://www.spambag.org/cgi-bin/spambag?mailfrom=chinanetcenter
[2] chinanetcenter, see http://spews.org/html/S1939.html
inetnum: 210.192.96.0 - 210.192.127.255
netname: CHINANETCENTER
descr: ChinaNetCenter Ltd.
descr: Internet Service Provider
descr: China
ASN: 4808
ASN Name: CHINA169-BJ (CNCGROUP IP network！China169 Beijing
Province Network)
http://www.cidr-report.org/cgi-bin/as-report?as=4808
7 SBL/ROKSO listings for IPs under the responsibility of
chinanetcenter.com
http://www.spamhaus.org/sbl/listings.lasso?isp=chinanetcenter.com
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/b8c7978827628fd7
See:
fewfew.renoneors.com IP 59.188.12.74
ns0.moumetto.com A IN 165830 221.11.133.48
ns0.greecaste.com A IN 165830 58.20.176.46
fewfew.renoneors.com has no MX records -> renoneors.com has no MX
records
http://www.moensted.dk/spam/?addr=59.188.12.74
http://www.abuse.net/sbl.phtml?IP=59.188.12.74
More 59.188.12.74 spam sightings:
http://groups.google.com/groups?q=59.188.12.74+group%3A*abuse
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL37430
59.188.12.0/24 is listed on the Spamhaus Block List (SBL)
06-Feb-2006 22:29 GMT | SR20
healthsuite/pharmacy express website/nameserver
IP address 59.188.12.74 on newworldtel.com/"F.E.Company"
30 SBL/ROKSO listings for IPs under the responsibility of
newworldtel.com
http://www.spamhaus.org/sbl/listings.lasso?isp=newworldtel.com
inetnum: 59.188.12.64 - 59.188.12.127
netname: FECOM-HK
country: HK
descr: F.E.Company
descr: Servers and Internet
descr: Access Facilities
descr: Hong Kong
mnt-by: MAINT-HK-NEWWORLDTEL
ASN: 17444
ASN Name: NWT-AS-AP (AS number for New World Telephone Ltd.)
http://www.cidr-report.org/cgi-bin/as-report?as=17444
Let see whois:
Registrar: ONLINE SAS
Domain Name : renoneors.com (RENONE2-BMN-DOM)
Registrar : BookMyName
Whois Server : whois.bookmyname.com
Referral URL : https://www.bookmyname.com
Registrant / Admin Contact :
PERSON
Michael DOMANN (DOMANN2-BMN-PE)
10824 Watercress Rd
44149 Strongsville
UNITED STATES OH
phone : 4408210573
fax :
e-mail : iguriver[]yahoo.com
Billing Contact :
PERSON
Michael DOMANN (DOMANN2-BMN-PE)
10824 Watercress Rd
44149 Strongsville
UNITED STATES OH
phone : 4408210573
fax :
e-mail : igur...@yahoo.com
Technical Contact :
PERSON
Michael DOMANN (DOMANN2-BMN-PE)
10824 Watercress Rd
44149 Strongsville
UNITED STATES OH
phone : 4408210573
fax :
e-mail : igur...@yahoo.com
Domain servers :
ns0.greecaste.com (NGC70-BMN-HST)
ns0.moumetto.com (NMC116-BMN-HST)
Created on 02/01/2006 20:54:10
Updated on 02/07/2006 17:43:15
Expires on 02/01/2007 15:54:10
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/a2701899714bd4fa
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: