[email] [meds - PharmacyExpress.com] (overdohil.com) Re: tote soften
TomezNet
IP 218.61.145.125 cncln.online.ln.cn
(at ns.dcb.ln.cn / CNCGROUP-LN)
Spamvert:
www.overdohil.com IP 221.7.209.69
(SBL35655 / SBL35677) (at cncgroup-gx)
www.PharmacyExpress.com IP 203.97.56.43
www.expressgroup.co.nz IP 203.97.56.43
(at manux.co.nz / telstraclear.co.nz)
Canadian Pharm Spamhaus => PharmacyExpress.com
Pharmacy Express a.k.a PharmaExpress
Pyxis Holdings Limited and/or Express Group Limited
Technical Consultants and Experts Group Inc aka TCE Group
Forged false site "certificates"
Logos and support by Visa and MasterCard
Visa, CIPA (Licence #91959), BBB (Participant through 12/30/2005),
Verisign (Validity Period: 13-OCT-04 - 13-OCT-05)
PHARMACYEXPRESS.CO.NZ / CHEMISTSHOP.COM / expressgroup.co.nz
See Also the same spammer most recent:
relatisandi.com, pharmacyexpressgroup.com, anodefen.com, ebantene.com,
specioser.com, turinwads.com, chemistshop.com, freighteo.manyuman.com,
variousrevitalization.com, toplevelcombination.com,
mixesandtopvalue.com, rightfromtoddlingweb.com, offamilyniceweb.com,
elofanxiet.com, orredecte.com, morreser.com, inrealisti.com,
needonsan.com, estemegins.com, noculat.com, morsavem.com, chestain.com,
comoconta.com, ajersau.com, rustratix.com, harorelev.com, Etc .....
All above domains websites were marked as ©2005 PharmacyExpress.com
All Rights Reserved.
Search of CIPA website did NOT verify use of CIPA Seal
http://www.ciparx.ca/
Sorry, no results found based on any criteria or method regarding any
corporate name, domain name, etc ...
Received at an address harvested from domain registration.
More Pharmacy Express sightings:
http://groups.google.com/groups?q=%22Pharmacy+Express%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-Message-Status: n:0
X-SID-PRA: Duci Rojo <rojo...@antbear.de>
X-SID-Result: TempError
X-Message-Info: moY6YVwXQ44Yx/v3chq84bsuvSatm5FGVlGhILSUB9k=
Received: from tomts34-srv.bellnexxia.net ([209.226.175.108]) by
bay0-pamc1-f4.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
Sun, 25 Dec 2005 02:19:59 -0800
Received: from xxx.superb.net (HELO xxx.web-hosting.com)
([207.228.2....])
by toip4.bellnexxia.net with ESMTP; 25 Dec 2005 05:19:59 -0500
Received: from antbear.de (cncln.online.ln.cn [218.61.145.125] (may be
forged))
by xxx.web-hosting.com (8.11.6/8.11.1) with SMTP id jBPAJtp03168
for <xx..xx@xx..xx.com>; Sun, 25 Dec 2005 05:19:56 -0500 (EST)
Message-ID: <000001c6093c$b2baeb80$cf4da8c0@nearbeer>
Reply-To: "Duci Rojo" <rojo...@antbear.de>
From: "Duci Rojo" <rojo...@antbear.de>
To: "Caius Klopfer" <xx..xx@xx..xx.com>
Subject: Re: tote soften
Date: Sun, 25 Dec 2005 05:19:32 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C60912.C9E4E380"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Originating-IP: [0]
Return-Path: rojo...@antbear.de
X-OriginalArrivalTime: 25 Dec 2005 10:19:59.0771 (UTC)
FILETIME=[C2CF96B0:01C6093C]
This is a multi-part message in MIME format.
------=_NextPart_000_0001_01C60912.C9E4E380
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
=20
http://www.overdohil.com <http://www.overdohil.com>=20
=20
V
M
P
C
S
X
V
A
L
i agra
e ridia
r opecia
i alis
o ma
an ax
al ium
mbi en
e vitra
from $3'35 per one pilI
=20
=20
from $3'85 per one pilI
=20
=20
from $1'25 per one pilI
=20
=20
------=_NextPart_000_0001_01C60912.C9E4E380
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial></FONT> </DIV>
<DIV><FONT face=3DArial><A href=3D"http://www.overdohil.com"><FONT =
face=3DArial>http://www.overdohil.com</FONT></A></FONT></DIV>
<DIV><FONT face=3DArial></FONT> </DIV>
<DIV style=3D"FLOAT: left"><FONT face=3DArial>
<DIV><FONT face=3DArial><B>V</B></FONT></DIV>
<DIV><FONT face=3DArial>M</FONT></DIV>
<DIV><FONT face=3DArial>P</FONT></DIV>
<DIV><FONT face=3DArial><B>C</B></FONT></DIV>
<DIV><FONT face=3DArial>S</FONT></DIV>X<BR>
<DIV><FONT face=3DArial><STRONG>V</STRONG></FONT></DIV>
<DIV><FONT face=3DArial>A</FONT></DIV>
<DIV><FONT face=3DArial>L</FONT></DIV></FONT></DIV>
<DIV style=3D"FLOAT: left"><FONT face=3DArial><STRONG>i =
agra</STRONG><BR>e ridia<BR>
<DIV><FONT face=3DArial>r opecia</FONT></DIV><STRONG>i
alis</STRONG><BR>
<DIV><FONT face=3DArial>o ma</FONT></DIV>
<DIV><FONT face=3DArial>an ax</FONT></DIV>
<DIV><FONT face=3DArial><B>al ium</B></FONT></DIV>
<DIV><FONT face=3DArial>mbi en</FONT></DIV>e vitra<BR></FONT></DIV>
<DIV style=3D"FLOAT: left"><FONT face=3DArial>
<DIV><FONT face=3DArial><B>from $3'35 per one =
pilI</B></FONT></DIV> <BR>
<DIV><FONT face=3DArial> </FONT></DIV><STRONG>from $3'85 per one =
pilI</STRONG><BR> <BR>
<DIV><FONT face=3DArial> </FONT></DIV><B>from $1'25 per one =
pilI</B><BR> <BR>
<DIV><FONT face=3DArial> </FONT></DIV></FONT></DIV></BODY></HTML>
------=_NextPart_000_0001_01C60912.C9E4E380--
-- END OF SPAM --
More Technical Consultants and Experts Group sightings:
http://groups.google.com/groups?q=%22Technical+Consultants+and+Experts+Group%22+group%3A*abuse&start=0&scoring=d&
See:
IP 218.61.145.125 cncln.online.ln.cn
http://www.moensted.dk/spam/?addr=218.61.145.125
http://cbl.abuseat.org/lookup.cgi?ip=218.61.145.125
http://spamcop.net/w3m?action=checkblock&ip=218.61.145.125
http://www.spamhaus.org/query/bl?ip=218.61.145.125
inetnum: 218.60.0.0 - 218.61.255.255
netname: CNCGROUP-LN
route: 218.61.0.0/16
descr: PNAP-SEA SEA-PNAP-USEI-ROUTES
origin: AS4134
route: 218.61.0.0/16
descr: CNC Group LiaoNing Network
origin: AS4837
3 SBL listings for IPs under the responsibility of CNCGROUP-LN
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGROUP-LN
21 SBL/ROKSO listings for IPs under the responsibility of internap.com
http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com
See:
www.overdohil.com IP 221.7.209.69
ns0.ameseers.com A IN 138179 58.20.160.16
ns0.ameseers.com A IN 138179 218.201.43.140
ns0.ameseers.com A IN 138179 221.7.209.69
AND:
ns0.canalsactasa.com A IN 154192 58.20.160.16
ns0.canalsactasa.com A IN 154192 218.201.43.140
ns0.canalsactasa.com A IN 154192 221.7.209.69
www.overdohil.com has no MX records -> overdohil.com has no MX records
http://www.moensted.dk/spam/?addr=221.7.209.69
Spam source - http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=221.7.209.69
http://www.abuse.net/sbl.phtml?IP=221.7.209.69
More 221.7.209.69 sightings:
http://groups.google.com/groups?q=221.7.209.69+group%3A*abuse&start=0&scoring=d&
http://www.spamhaus.org/query/bl?ip=221.7.209.69
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL35655
221.7.209.69/32 is listed on the Spamhaus Block List (SBL)
15-Dec-2005 04:05 GMT | SR03
iseasieto.com ; etc.
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL35677
221.7.209.0/24 is listed on the Spamhaus Block List (SBL)
17-Dec-2005 19:13 GMT | SR21
China Netcom Group Dirty Block: CNC Guilin Internet network
3 SBL listings for IPs under the responsibility of cncgroup-gx
http://www.spamhaus.org/SBL/listings.lasso?isp=cncgroup-gx
Let see whois:
ICANN Registrar: YESNIC CO. LTD.
Domain Name : overdohil.com
Registrant:
Name : EDWARD HUDOCK
Email : harmibete[]yahoo.com
Address : 3506 W. SAYMORE LANE
Zipcode : 61615
Nation : US
Tel : 309 685 11 95
Fax :
Administrative Contact:
Name : EDWARD HUDOCK
Email : harm...@yahoo.com
Address : 3506 W. SAYMORE LANE
Zipcode : 61615
Nation : US
Tel : 309 685 11 95
Fax :
Technical Contact:
Name : EDWARD HUDOCK
Email : harm...@yahoo.com
Address : 3506 W. SAYMORE LANE
Zipcode : 61615
Nation : US
Tel : 309 685 11 95
Fax :
Name Servers:
ns0.ameseers.com
ns0.canalsactasa.com
Dates & Status:
Created Date 2005-12-22 13:08:10 EST
Updated Date 2005-12-22 13:08:10 EST
Valid Date 2006-12-22 13:08:10 EST
Status ACTIVE
More overdohil.com sightings:
http://groups.google.com/groups?q=overdohil.com+group%3A*abuse
See also multiple IP on NS server:
ns0.canalsactasa.com IP 201.49.143.64
ns0.canalsactasa.com IP 221.5.2.102
ns0.canalsactasa.com IP 221.7.209.69
ns0.canalsactasa.com IP 58.20.160.16
ns0.canalsactasa.com IP 218.201.43.140
Let see whois:
ICANN Registrar: YESNIC CO. LTD.
Domain Name : canalsactasa.com
Registrant:
Name : Bent Sullivan
Email : nesofax[]yahoo.com
Address : 3200 County Road
Zipcode : 33538
Nation : US
Tel : 3525692644
Fax :
Administrative Contact:
Name : Bent Sullivan
Email : nes...@yahoo.com
Address : 3200 County Road
Zipcode : 33538
Nation : US
Tel : 3525692644
Fax :
Technical Contact:
Name : Bent Sullivan
Email : nes...@yahoo.com
Address : 3200 County Road
Zipcode : 33538
Nation : US
Tel : 3525692644
Fax :
Name Servers:
Dates & Status:
Created Date 2005-12-15 15:25:05 EST
Updated Date 2005-12-15 15:25:05 EST
Valid Date 2006-12-15 15:25:05 EST
Status ACTIVE
More canalsactasa.com sightings:
http://groups.google.com/groups?q=canalsactasa.com+group%3A*abuse&start=0&scoring=d&
Let see whois:
ICANN Registrar: YESNIC CO. LTD.
Domain Name : ameseers.com
Registrant:
Name : Denny Payne
Email : faspondin[]yahoo.com
Address : 120 allentown road
Zipcode : 18964
Nation : US
Tel : 2157232980
Fax :
Administrative Contact:
Name : Denny Payne
Email : fasp...@yahoo.com
Address : 120 allentown road
Zipcode : 18964
Nation : US
Tel : 2157232980
Fax :
Technical Contact:
Name : Denny Payne
Email : fasp...@yahoo.com
Address : 120 allentown road
Zipcode : 18964
Nation : US
Tel : 2157232980
Fax :
Name Servers:
Dates & Status:
Created Date 2005-12-16 19:46:54 EST
Updated Date 2005-12-16 19:46:54 EST
Valid Date 2006-12-16 19:46:54 EST
Status ACTIVE
More ameseers.com sightings:
http://groups.google.com/groups?q=ameseers.com+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/2947cf5698b4e795
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: