[email] [drugs botnet] (barth0lomeo.com - jungjang1.com) SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*, CIPRO, MERIDI*, CELEBRE*, VALIU* light
TomezNet
IP 24.32.199.87 doc-24-32-199-87.crane.tx.cebridge.net
Spamvert botnet:
bArtH0lomeo.cOm IP resolves to 24.162.100.131 to 69.182.181.147 to
82.247.149.122 to 195.214.251.132
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 206.190.49.57; Tue, 28 Mar 2006
18:39:05 -0800
X-Originating-IP: [24.32.199.87]
Return-Path: <aob9...@itol.com>
Authentication-Results: mta317.mail.scd.yahoo.com from=itol.com;
domainkeys=fail (bad syntax)
Received: from 24.32.199.87 (HELO
doc-24-32-199-87.crane.tx.cebridge.net) (24.32.199.87) by
mta317.mail.scd.yahoo.com with SMTP; Tue, 28 Mar 2006 18:39:05 -0800
Received: from [192.168.1.6] ([24.32.199.87]) by wli.net (Sendmail
8.7.7) with ESMTP (SSL) id IYT19179 for <xx..xx@xx..xx.com>; Tue, 28
Mar 2006 20:39:00 -0600
Message-ID: <406x037v...@wli.net>
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=benefit.did;
d=wli.net;
b=hPAS6iXMAXZ2M9fEt0gBpdox7vHIW3t78jPxMp2i5BIPGk2ZaXwZzAPK01mgkQrAxAZ1nyzH3Exr3Ltd;
Date: Tue, 28 Mar 2006 20:39:00 -0600
From: "Catherin Frieda" <aob9...@itol.com>
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xx..xx@xx..xx.com
Subject: SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*,
CIPRO, MERIDI*, CELEBRE*, VALIU* light
Content-Type: multipart/related;
boundary="------------25235623==.MRA"
Content-Length: 890
---------------------------------
immediate friends goes profession? wanted sandwich out. allow young
goes speaking,Quality Meds Selling At Cheeap
We dont keep ur record (not even your name)
You just pay & we ship, No Question form to fill
We ship to all countries
Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro, Meridi*,
Celebre*, Valiu*, Zoloft & Many More Meds whom
turning C11ck Here for Huge Saving profession
is few servants?
mischievous again the taught.
thats pretty human friends pretty,
being how anybody. gym sandwich fascinate added evening? you latter
slow embarrass?
companion social anything steps embarrass love. benefit very gym is
money.
young different wanted.
<html><head>
<meta http-equiv="Content-Type" content="text; charset=iso-8859-1">
</head>
<body>
<font color=FFA4D1 size=1>immediate friends goes profession? wanted
sandwich out. allow young goes speaking,</font>
<table border=10 cellspacing=0 cellpadding=3 width=520
bordercolor=CDFF59>
<tr><td bgcolor=ffffff bordercolor=000000><center>
<font size=2 face=arial color=CC0000>
<font size=4 color=000000><b>Quality Meds Selling At Cheeap<br><font
color=EA0000>We dont keep ur record (not even your
name)</font><br><font color=AEAE00>You just pay & we ship, No Question
form to fill</font><br><font color=FF5EAE>We ship to all
countries</b></center></font></font><br><font color=000000
size=2>Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro,
Meridi*, Celebre*, Valiu*, Zoloft & Many More Meds whom<br><center>
<a href=http://tim.bArtH0lomeo.cOm target=_blank><font size=4
color=5E5EFF><u>turning <b>C11ck Here for Huge Saving</b>
profession</font></u></a></font></center><br></td></tr></table><font
color=FFA4D1 size=1>is few servants?<br>
mischievous again the taught.<br>
thats pretty human friends pretty,<br>
being how anybody. gym sandwich fascinate added evening? you latter
slow embarrass?<br>
companion social anything steps embarrass love. benefit very gym is
money.<br>
young different wanted.<br></font>
</body></html>
-- END OF SPAM --
See:
IP 24.32.199.87 doc-24-32-199-87.crane.tx.cebridge.net
http://www.moensted.dk/spam/?addr=24.32.199.87
http://cbl.abuseat.org/lookup.cgi?ip=24.32.199.87
http://www.spamhaus.org/query/bl?ip=24.32.199.87
http://www.spamcop.net/bl.shtml?24.32.199.87
Cebridge Connections CEBRIDGE- (NET-24-32-0-0-1)
24.32.0.0 - 24.32.255.255
Cebridge Connections CRANE-CEBRIDGE-CONNECTIONS (NET-24-32-198-0-1)
24.32.198.0 - 24.32.199.255
NetRange: 24.32.198.0 - 24.32.199.255
CIDR: 24.32.198.0/23
NetName: CRANE-CEBRIDGE-CONNECTIONS
NetHandle: NET-24-32-198-0-1
Parent: NET-24-32-0-0-1
ASN: 0
ASN Name: IANA-RSVD-0
See:
tim.bArtH0lomeo.cOm botnet
tim.barth0lomeo.com A IN 180 82.247.149.122
tim.barth0lomeo.com A IN 180 195.214.251.132
tim.barth0lomeo.com A IN 180 82.247.149.122
tim.barth0lomeo.com A IN 180 24.162.100.131
tim.barth0lomeo.com A IN 180 69.182.181.147
www.barth0lomeo.com A IN 180 82.249.151.195
www.barth0lomeo.com A IN 180 82.225.155.227
www.barth0lomeo.com A IN 180 82.67.215.107
www.barth0lomeo.com A IN 180 69.182.181.147
www.barth0lomeo.com A IN 180 82.225.155.227
ns1.jungjang1.com IP 222.174.42.227
ns2.jungjang1.com IP 24.207.210.159, 68.80.119.232
ns3.jungjang1.com IP 68.80.119.232, 82.226.87.135
ns4.jungjang1.com IP 195.214.251.132, 213.39.172.80
ns5.jungjang1.com IP 69.182.181.147, 82.237.150.165
More jungjang1.com sightings:
http://groups.google.com/groups/search?q=jungjang1.com+group%3A*abuse&start=0&scoring=d&
www.bArtH0lomeo.cOm has no MX records -> bArtH0lomeo.cOm has no MX
records
Infected IP
82.247.149.122 PTR record N/A at ns0.proxad.net
=> stuck me in a loop / Duplicate zone found
195.214.251.132 PTR record: avenger53.ma3x.net
at purgatory.spnet.net / ns-ext.isc.org
24.162.100.131 PTR record: cpe-24-162-100-131.hot.res.rr.com
69.182.181.147 PTR record: 147.180.182.69.in-addr.arpa
at ns2.snet.net
24.207.210.159 PTR record: 24-207-210-159.dhcp.stls.mo.charter.com
68.80.119.232 PTR record: c-68-80-119-232.hsd1.pa.comcast.net
No PTR records exist for 222.174.42.227
at CHINATELECOM-SD
82.249.151.195 PTR record: lns-bzn-43-82-249-151-195.adsl.proxad.net
82.225.155.227 PTR record: nor75-13-82-225-155-227.fbx.proxad.net
82.67.215.107 PTR record: mar92-2-82-67-215-107.fbx.proxad.net
82.226.87.135 PTR record: dau94-3-82-226-87-135.fbx.proxad.net
82.237.150.165 PTR record: crj95-3-82-237-150-165.fbx.proxad.net
213.39.172.80 PTR record: c172080.adsl.hansenet.de
More bArtH0lomeo.cOm sightings:
http://groups.google.com/groups/search?q=bArtH0lomeo.cOm+group%3A*abuse
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: