[email] [drugs - Canadian Pharmacy botnet] [88.73.124.44] (providefive.hk / piotiongandesunkdes.com / chitionkdetunlionpsa.com / fionkunjerunhedase.com / gedsactunjerion.com) Fulfill all your pharmaceutical needs with Canadian Pharmacy.
TomezNet
IP 88.73.124.44 dslb-088-073-124-044.pools.arcor-ip.net
Spamvert:
providefive.hk => botnet
See below
© Copyright Canadian Pharmacy, 2003-2007. All Rights Reserved.
Much More Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
Plenty of Forged Certificates and logos as always.
Much More info below:
====================
Return-Path: <c...@0733.com>
Delivered-To: [MUNGED]
X-Spam-Flag: YES
Received: (qmail 5718 invoked from network); 11 Jun 2007 18:33:04
-0400
Received: from dslb-088-073-124-044.pools.arcor-ip.net (88.73.124.44)
by [MUNGED] with SMTP; 11 Jun 2007 18:33:04 -0400
Return-Path: <c...@0733.com>
Received: from 61.187.98.7 (HELO mail.0733.com)
by [MUNGED] with esmtp (RW)'ND487X' 1>6Z)
id <,=1BK-V=5:44-54
for [MUNGED]; Mon, 11 Jun 2007 22:33:02 -0060
From: "Josep Kodrin" <c...@0733.com>
To: <[MUNGED]>
Subject: *****SPAM***** Fulfill all your pharmaceutical needs with
Canadian Pharmacy.
Date: Mon, 11 Jun 2007 22:33:02 -0060
Message-ID: <01c7ac78$78add660$6c822ecf@cyf>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C7AC89.3C36A660"
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Thread-Index: Aca6QI(5NDU**H;>/6'5P<)E7AZOYJ==
X-Spam-Prev-Subject: Fulfill all your pharmaceutical needs with
Canadian Pharmacy.
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html;
charset=iso-8859-2">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
</head>
<body>
<body>
<p>
Ordering medications online is the best way to buy medications
discreet and to save on them.
</p>
<p>
According to the results of this survey Canadian <a href=http://
providefive.hk><b><font color=black>«CanadianPharmacy»</a></b></a>
drugstore has the best service, quality and prices on the Web.
</p>
<p>
All popular modern pharmaceutical products are available in <a
href=http://providefive.hk><b><font color=black>«CanadianPharmacy»</
a></b></a>.
</p>
<a href=http://providefive.hk><font size=+1 color=black><b>http://
providefive.hk</b></font></a>
<p>
<b> Nothing is more important than your health. </b>
</p>
<p>
Josep Kodrin
</p>
</body></html>
</body>
</html>
-- END OF SPAM --
WEB:
You may contact us at +1(210) 787-1711, please, keep your order I.D.
every time you make a call.
Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
See:
IP 88.73.124.44 dslb-088-073-124-044.pools.arcor-ip.net
http://www.moensted.dk/spam/?addr=88.73.124.44
http://www.spamhaus.org/query/bl?ip=88.73.124.44
http://www.spamhaus.org/pbl/query/PBL143067
Much More arcor-ip.net sightings:
http://groups.google.com/groups/search?q=arcor-ip.net+group%3A*abuse&start=0&scoring=d&
inetnum: 88.72.129.0 - 88.74.116.255
netname: ARCOR-DSL-NET15
descr: ARCOR AG
descr: Alfred-Herrhausen-Allee 1
descr: D-65760 Eschborn
country: DE
remarks: Peering contact: pee...@adm.arcor.net
remarks: Operational issues: n...@adm.arcor.net
remarks: Address assignment: ip-re...@arcor.net
route: 88.64.0.0/12
descr: ARCOR-IP
origin: AS3209
mnt-by: ARCOR-MNT
changed: ip-re...@arcor.net
Prefix: 88.64.0.0/12
Prefix Name: ARCOR IP
AS: 3209
AS Name: UNSPECIFIED Arcor IP Network Arcor AG & Co Alfred Herrhausen
Allee 1 D 65760 Eschborn Germany http://www arcor net http://www arcor
de
http://www.cidr-report.org/cgi-bin/as-report?as=3209
Spamvert URL:
http://providefive.hk/
Redirected to:
http://www.providefive.hk/
See:
providefive.hk => botnet
NS records at the parent servers are:
NS0.PIOTIONGANDESUNKDES.COM [78.84.145.75 (NO GLUE)] [LV]
NS0.GEDSACTUNJERION.COM [76.188.34.146 (NO GLUE)] [US]
NS0.FIONKUNJERUNHEDASE.COM [74.102.18.163 (NO GLUE)] [CA]
NS0.CHITIONKDETUNLIONPSA.COM [61.18.221.3 (NO GLUE)] [HK]
NS records at nameservers are:
ns0.chitionkdetunlionpsa.com [59.16.110.54] [TTL=300]
ns0.gedsactunjerion.com [69.136.80.156] [TTL=300]
ns0.fionkunjerunhedase.com [218.255.58.58] [TTL=300]
ns0.piotiongandesunkdes.com [80.171.84.176] [TTL=300]
www.providefive.hk has no MX records -> providefive.hk has no MX
records
SOA record [TTL=300] is:
Primary nameserver: ns0.chitionkdetunlionpsa.com
Hostmaster E-mail address:
Serial #: 0
4 MX records are (duplicate MX records):
ns0.chitionkdetunlionpsa.com. and ns0.gedsactunjerion.com. both
resolve to 0.0.0.0.
ns0.chitionkdetunlionpsa.com. and ns0.fionkunjerunhedase.com. both
resolve to 0.0.0.0.
ns0.chitionkdetunlionpsa.com. and ns0.piotiongandesunkdes.com. both
resolve to 0.0.0.0.
ns0.gedsactunjerion.com. and ns0.fionkunjerunhedase.com. both resolve
to 0.0.0.0.
ns0.gedsactunjerion.com. and ns0.piotiongandesunkdes.com. both resolve
to 0.0.0.0.
ns0.fionkunjerunhedase.com. and ns0.piotiongandesunkdes.com. both
resolve to 0.0.0.0.
www.providefive.hk A record is:
www.providefive.hk A 148.160.183.213 [TTL=300] [*U]
www.providefive.hk A 203.203.35.55 [TTL=300] [TW]
www.providefive.hk A 218.190.86.117 [TTL=300] [HK]
www.providefive.hk A 218.253.88.143 [TTL=300] [HK]
www.providefive.hk A 218.253.152.67 [TTL=300] [HK]
www.providefive.hk A 218.254.48.142 [TTL=300] [HK]
www.providefive.hk A 218.254.221.157 [TTL=300] [HK]
www.providefive.hk A 221.124.239.60 [TTL=300] [HK]
www.providefive.hk A 221.127.167.170 [TTL=300] [HK]
www.providefive.hk A 59.16.110.54 [TTL=300] [KR]
www.providefive.hk A 61.244.116.156 [TTL=300] [HK]
www.providefive.hk A 67.149.216.193 [TTL=300] [US]
www.providefive.hk A 69.136.80.156 [TTL=300] [US]
Let see whois:
Domain Name: PROVIDEFIVE.HK
Contract Version: HKDNR latest version
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): MR TOM SAMSSON
Holder Chinese Name:
Email: brian19...@usa.com
Domain Name Commencement Date: 07-06-2007
Country: US
Expiry Date: 07-06-2008
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1907882T
Technical Contact:
First name: TOM
Last name: SAMSSON
Company Name: TOM SAMSSON
Name Servers Information:
NS0.FIONKUNJERUNHEDASE.COM
NS0.GEDSACTUNJERION.COM
NS0.PIOTIONGANDESUNKDES.COM
NS0.CHITIONKDETUNLIONPSA.COM
More providefive.hk sightings:
http://groups.google.com/groups/search?q=providefive.hk+group%3A*abuse&qt_s=Search
SEE Also more NS sightings:
More CHITIONKDETUNLIONPSA.COM sightings:
http://groups.google.com/groups/search?q=CHITIONKDETUNLIONPSA.COM+group%3A*abuse&start=0&scoring=d&
More fionkunjerunhedase.com sightings:
http://groups.google.com/groups/search?q=fionkunjerunhedase.com+group%3A*abuse&start=0&scoring=d&
More gedsactunjerion.com sightings:
http://groups.google.com/groups/search?q=gedsactunjerion.com+group%3A*abuse&start=0&scoring=d&
More piotiongandesunkdes.com sightings:
http://groups.google.com/groups/search?q=piotiongandesunkdes.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/aaf4ebcc04755088
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/58967757e2b95545
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: