[email] [drugs - Canadian Pharmacy botnet] [88.229.32.245] (chartheld.hk / chitionkdetunlionpsa.com / fionkunjerunhedase.com / gedsactunjerion.com / piotiongandesunkdes.com) Re:
TomezNet
IP 88.229.32.245 dsl88-229-8437.ttnet.net.tr
(at ns2.ttnet.net.tr / turktelekom.com.tr / telekom.gov.tr)
chartheld.hk IP 82.131.4.161 (ESTONIA)
(at starman.ee)
www.chartheld.hk IP 67.116.237.14 (US)
(at AT&T / pacbell.net)
Title => Canadian Pharmacy
Š Copyright Canadian Pharmacy, 2003-2007. All Rights Reserved.
Much More Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
Plenty of Forged Certificates and logos as always.
(VeriSign, Approved by ADA, CIDA, PharmaChecker, etc...)
Much More info below:
====================
Return-Path: <digested...@gryphon-media.com>
Delivered-To: [MUNGED]
Received: (qmail 32320 invoked from network); 8 Jun 2007 06:47:53
-0400
Received: from dsl88-229-8437.ttnet.net.tr (88.229.32.245)
by [MUNGED] with SMTP; 8 Jun 2007 06:47:53 -0400
Return-Path: <digested...@gryphon-media.com>
Received: from 64.18.6.13 (HELO gryphon-media.com.mail10.psmtp.com)
by [MUNGED] with esmtp ((3(50,I6V@H (('.)
id [MUNGED]
for [MUNGED]; Fri, 8 Jun 2007 10:47:49 -0120
From: "Trang Gingles" <digested...@gryphon-media.com>
To: <[MUNGED]>
Subject: Re:
Date: Fri, 8 Jun 2007 10:47:49 -0120
Message-ID: <01c7a9ba$74b3f370$6c822ecf@digesteddrunkenly>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C7A9D3.9A012B70"
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506
Thread-Index: Aca6Q,,PNFGLO0T)ID/)82/Z0,WVR*==
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
</head>
<body>
<BODY text=#000000 bgColor=#ffffff><font size="3"><p
align="center"><font color=#3366ff size="5"><strong>Don't let ED
affect your sex life!</strong></font></p>
<p align="center">Erectile dysfunction (ED) affects the lives of many
middle-aged men <br />
and their partners to one degree or another. ED, formerly called
impotence, <br />
refers to the inability to obtain an adequate erection for
satisfactory sexual activity.</p>
<p align="center"><font size="3"><a href="http://
chartheld.hk"><strong>See our site!</strong></a></p>
</BODY>
</body>
</html>
-- END OF SPAM --
WEB:
Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
You may contact us at +1(210) 787-1711, please, keep your order I.D.
every time you make a call.
See:
IP 88.229.32.245 dsl88-229-8437.ttnet.net.tr
http://www.moensted.dk/spam/?addr=88.229.32.245
http://www.spamhaus.org/query/bl?ip=88.229.32.245
http://www.spamhaus.org/pbl/query/PBL113991
http://www.uceprotect.net/rblcheck.php?ipr=88.229.32.245
http://www.apews.org/?page=test&C=82&E=202300&ip=88.229.32.245
Much More ttnet.net.tr sightings:
http://groups.google.com/groups/search?q=ttnet.net.tr+group%3A*abuse&start=0&scoring=d&
inetnum: 88.229.0.0 - 88.229.127.255
netname: TurkTelekom
descr: TT ADSL-alcatel dinamik_ulus
role: TT Administrative Contact Role
address: Turk Telekom
address: Bilisim Aglari Dairesi
address: Aydinlikevler
address: 06103 ANKARA
phone: +90 312 313 1950
fax-no: +90 312 313 1949
e-mail: ab...@ttnet.net.tr => ???
whois, postmaster and abuse[]ttnet.net.tr are listed in
rfc-ignorant.org database
postmaster and abuse[]telekom.gov.tr are listed in rfc-ignorant.org
database
route: 88.229.0.0/17
descr: TurkTelecom
origin: AS9121
mnt-by: AS9121-MNT
changed: i...@turktelekom.com.tr
AS Name: TTNet TTnet Autonomous System Turk Telekom A S Aydinlikevler
ANKARA 06103 TURKEY
http://www.cidr-report.org/cgi-bin/as-report?as=9121
22 SBL/ROKSO listings for IPs under the responsibility of ttnet.net.tr
http://www.spamhaus.org/sbl/listings.lasso?isp=ttnet.net.tr
Spamvert URL:
http://chartheld.hk/
Redirected to:
http://www.chartheld.hk/
See:
chartheld.hk IP 82.131.4.161 (ESTONIA)
NS0.PIOTIONGANDESUNKDES.COM [75.49.1.81 (NO GLUE)] [US]
NS0.GEDSACTUNJERION.COM [222.111.193.43 (NO GLUE)] [KR]
NS0.FIONKUNJERUNHEDASE.COM [NO GLUE; No A record]
NS0.CHITIONKDETUNLIONPSA.COM [NO GLUE; No A record]
ns adns1.berkeley.edu 128.32.136.3(US)
ns adns2.berkeley.edu 128.32.136.14(US)
ns b.dns.tw 210.201.138.58(TW)
ns ns-hk.ripe.net 193.0.12.100(NL)
ns ns1.hkirc.net.hk 203.119.2.18(HK)
ns ns2.cuhk.edu.hk 137.189.6.21(HK)
ns ns2.hkirc.net.hk 203.119.2.19(HK)
ns ns3.cuhk.edu.hk 202.45.188.19(HK)
ns sec3.apnic.net 202.12.28.140(AP)
ns tld1.ultradns.net 204.74.112.1(US)
ns tld2.ultradns.net 204.74.113.1(US)
ns tld3.ultradns.org 199.7.66.1(US)
ns tld4.ultradns.org 199.7.67.1(US)
ns tld5.ultradns.info 192.100.59.11(US)
ns tld6.ultradns.co.uk 198.133.199.11(US)
www.chartheld.hk A Records
a 148.160.183.213(SE) host183-213.bornet.net
a 203.203.35.55(TW) 203-203-35-55.cable.dynamic.giga.net.tw
a 218.252.202.7(HK) cm218-252-202-7.hkcable.com.hk
a 221.124.239.60(HK)
a 221.127.110.84(HK)
a 58.151.98.15(KR)
a 61.15.41.183(HK) cm61-15-41-183.hkcable.com.hk
a 67.116.237.14(US) adsl-67-116-237-14.dsl.pltn13.pacbell.net
a 68.124.60.251(US) adsl-68-124-60-251.dsl.irvnca.pacbell.net
a 69.136.80.156(US) c-69-136-80-156.hsd1.nj.comcast.net
a 70.132.148.192(US) ppp-70-132-148-192.dsl.hstntx.swbell.net
a 70.230.156.145(US) adsl-70-230-156-145.dsl.stlsmo.sbcglobal.net
a 71.232.92.247(US) c-71-232-92-247.hsd1.ma.comcast.net
a 77.182.59.178() essn-4db63bb2.pool.einsundeins.de
a 77.41.80.18()
a 80.66.242.129(EE) 80-66-242-129.kj.up.ee
a 81.226.63.252(SE) h252n2fls308o1033.telia.com
a 83.249.197.19(SE) c83-249-197-19.bredband.comhem.se
a 85.93.105.115(CZ)
a 89.245.65.190() i59f541be.versanet.de
www.chartheld.hk IP 67.116.237.14 (US)
ns ns0.chitionkdetunlionpsa.com 76.104.139.174(US)
ns ns0.fionkunjerunhedase.com 208.120.41.135(US)
ns ns0.gedsactunjerion.com 69.229.238.218(US)
ns ns0.piotiongandesunkdes.com 24.238.187.40(US)
www.chartheld.hk has no MX records -> chartheld.hk has no MX records
chartheld.hk IP 82.131.4.161 (ESTONIA)
(at starman.ee)
82.131.4.161 = ip161.cab4.lsn.starman.ee
inetnum: 82.131.4.0 - 82.131.7.255
netname: EE-STARMAN-CLIENTS
descr: Starman AS
descr: Cable network clients
descr: Static and dynamic addresses
country: EE
www.chartheld.hk IP 67.116.237.14 (US)
(at AT&T)
67.116.237.14 = adsl-67-116-237-14.dsl.pltn13.pacbell.net
AT&T Internet Services SBCIS-SIS80 (NET-67-112-0-0-1)
67.112.0.0 - 67.127.255.255
PPPoX Pool - rback1.pltnca 05182006-1157.50713 SBCIS-083006141945
(NET-67-116-236-0-1)
67.116.236.0 - 67.116.239.255
CustName: PPPoX Pool - rback1.pltnca 05182006-1157.50713
NetRange: 67.116.236.0 - 67.116.239.255
CIDR: 67.116.236.0/22
NetName: SBCIS-083006141945
NetHandle: NET-67-116-236-0-1
Parent: NET-67-112-0-0-1
Let see whois:
Domain Name: CHARTHELD.HK
Contract Version: HKDNR latest version
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): MR TOM SAMSSON
Holder Chinese Name:
Email: Jennifer...@aol.com
Domain Name Commencement Date: 05-06-2007
Country: US
Expiry Date: 05-06-2008
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1905638T
Technical Contact:
First name: TOM
Last name: SAMSSON
Company Name: TOM SAMSSON
Name Servers Information:
NS0.FIONKUNJERUNHEDASE.COM
NS0.GEDSACTUNJERION.COM
NS0.PIOTIONGANDESUNKDES.COM
NS0.CHITIONKDETUNLIONPSA.COM
See:
ns0.chitionkdetunlionpsa.com IP 76.104.139.174 (OLD IP 89.212.163.153)
NS0.CHITIONKDETUNLIONPSA.COM has no MX records ->
CHITIONKDETUNLIONPSA.COM has no MX records
http://www.moensted.dk/spam/?addr=89.212.163.153
76.104.139.174 = c-76-104-139-174.hsd1.wa.comcast.net
More CHITIONKDETUNLIONPSA.COM sightings:
http://groups.google.com/groups/search?q=CHITIONKDETUNLIONPSA.COM+group%3A*abuse&start=0&scoring=d&
See:
ns0.fionkunjerunhedase.com IP 208.120.41.135 (OLD IP 165.230.94.99)
NS0.FIONKUNJERUNHEDASE.COM has no MX records -> FIONKUNJERUNHEDASE.COM
has no MX records
http://www.moensted.dk/spam/?addr=208.120.41.135
208.120.41.135 = user-387gac7.cable.mindspring.com
More FIONKUNJERUNHEDASE.COM sightings:
http://groups.google.com/groups/search?q=FIONKUNJERUNHEDASE.COM+group%3A*abuse&start=0&scoring=d&
See:
ns0.gedsactunjerion.com IP 69.229.238.218 (OLD IP 70.52.60.13)
NS0.GEDSACTUNJERION.COM has no MX records -> GEDSACTUNJERION.COM has
no MX records
http://www.moensted.dk/spam/?addr=69.229.238.218
69.229.238.218 = adsl-69-229-238-218.dsl.scrm01.pacbell.net
More GEDSACTUNJERION.COM sightings:
http://groups.google.com/groups/search?q=GEDSACTUNJERION.COM+group%3A*abuse&start=0&scoring=d&
See:
ns0.piotiongandesunkdes.com IP 24.238.187.40 ( OLD IP 65.34.221.18)
NS0.PIOTIONGANDESUNKDES.COM has no MX records ->
PIOTIONGANDESUNKDES.COM has no MX records
http://www.moensted.dk/spam/?addr=24.238.187.40
24.238.187.40 = user-0cetep8.cable.mindspring.com
More PIOTIONGANDESUNKDES.COM sightings:
http://groups.google.com/groups/search?q=PIOTIONGANDESUNKDES.COM+group%3A*abuse&start=0&scoring=d&
Read More:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/d2391b74a703db73
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/aaf4ebcc04755088
Also:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/3490a573f7224292
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: