[email] [drugs - CanadianPharmacy] [76.1.18.28] (plainrest.hk / globalpharmsupport.com / downmix.hk / DOWNMIX.hk) re:Don't waste your time. Cheap pills are here.
TomezNet
IP 76.1.18.28 oh-76-1-18-28.dyn.embarqhsd.net
(at NS9.EMBARQSERVICES.NET)
Spamvert:
plainrest.hk IP 66.78.0.20
(at ns2.adcip.net / purefare.com / vdi.net / webhostplus.com)
globalpharmsupport.com IP 81.177.38.5
(at ns.rt-comm.ru / rtcomm.ru)
globalpharmsupport.com IP 121.36.114.51 => SBL53649
(at china-motion.com)
More CanadianPharmacy sightings:
http://groups.google.com/groups/search?q=CanadianPharmacy+group%3A*abuse&start=0&scoring=d&
Plenty of Forged certificates and logos.
More info below:
====================
X-SID-PRA: Angelina Mcrae <dwelec...@electrolab.com>
X-Message-Info: txF49lGdW41lXSTqe0B8lj/p/jMzofjxPjfDItlyuFwV1/
izkUgtloa4eyIpntQY
Received: from tomts41-srv.bellnexxia.net ([209.226.175.98]) by bay0-
pamc1-f7.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444); Thu,
19 Apr 2007 07:09:23 -0700
Received: from [MUNGED]
by toip16.srvr.bell.ca with ESMTP; 19 Apr 2007 10:09:19 -0400
Received: (qmail 7358 invoked by uid 110); 19 Apr 2007 10:09:19 -0400
Delivered-To: [MUNGED]
Received: (qmail 7354 invoked from network); 19 Apr 2007 10:09:19
-0400
Received: from oh-76-1-18-28.dyn.embarqhsd.net (76.1.18.28)
by [MUNGED] with SMTP; 19 Apr 2007 10:09:19 -0400
Return-Path: <dwelec...@electrolab.com>
Received: from [MUNGED] (HELO electrolab.com)
by [MUNGED] with esmtp (*0U.@X1EH6< T:P5)
id +-*+<@-7I0(,0-JN
for [MUNGED] ; Wed, 18 Apr 2007 15:09:04 +0300
From: "Angelina Mcrae" <dwelec...@electrolab.com>
To: [MUNGED]
Subject: re:Don't waste your time. Cheap pills are here.
Date: Wed, 18 Apr 2007 15:09:04 +0300
Message-ID: <01c781cb$80de6070$6c822ecf@dwelectrolabm>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C781A1.98085870"
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Thread-Index: Aca6Q+6--,20K>)?:/9R3,65C1(263==
X-OriginalArrivalTime: 19 Apr 2007 14:09:23.0956 (UTC)
FILETIME=[552F8B40:01C7828C]
This is a multi-part message in MIME format.
------=_NextPart_000_0006_01C781A1.98085870
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Dear customer.CanadianPharmacy is one of very few online stores that
sell generic medications only. Don't waste too much on what can cost
less.At CanadianPharmacy you will always be able to find the generic
drugs you need - and they will be a lot cheaper that those sold in the
USA. CanadianPharmacy is a licensed Canadian e-shop, which lets it
(and you too) turn the Canadian drug taxation system to its
advantage.http://plainrest.hk - the easiest and the cheapest way to
take care of your health.Best regards,Angelina Mcrae
------=_NextPart_000_0006_01C781A1.98085870
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:o=3D"urn:schemas-microsoft-com:office:office"
xmlns:w=3D"urn:sc=
hemas-microsoft-com:office:word" xmlns=3D"http://www.w3.org/TR/REC-
html40">
<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Dus-
ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered
medium)">
</head>
<body>
<html>
<body bgcolor=3D"#FFFFFF" link=3D"#333366">
<p><font face=3D"Verdana" size=3D"2" color=3D"#000000">Dear customer.</
font=
></p>
<p><font face=3D"Verdana" size=3D"2"><a href=3D"http://
plainrest.hk">Canadi=
anPharmacy</a> is one of very few online stores that sell generic
medicatio=
ns only. Don't waste too much on what can cost less.</font></p>
<p><font face=3D"Verdana" size=3D"2">At <a href=3D"http://
plainrest.hk">Can=
adianPharmacy</a> you will always be able to find the generic drugs
you nee=
d =96 and they will be a lot cheaper that those sold in the USA. <a
href=3D=
"http://plainrest.hk">CanadianPharmacy</a> is a licensed Canadian e-
shop, w=
hich lets it (and you too) turn the Canadian drug taxation system to
its ad=
vantage.</font></p>
<p><font face=3D"Verdana" size=3D"2"><a href=3D"http://
plainrest.hk">http:/=
/plainrest.hk</a> =96 the easiest and the cheapest way to take care of
your=
health.</font></p>
<p><font face=3D"Verdana" size=3D"2">Best regards,<br>Angelina Mcrae</
font>=
</p>
</body>
</html>
</body>
</html>
------=_NextPart_000_0006_01C781A1.98085870--
-- END OF SPAM --
Web:
This time:
CEO/President:
Kris Thorkelson
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
Customer Support (click here to mail us
sites...@globalpharmsupport.com
See:
IP 76.1.18.28 oh-76-1-18-28.dyn.embarqhsd.net
http://www.moensted.dk/spam/?addr=76.1.18.28
http://www.spamhaus.org/query/bl?ip=76.1.18.28
http://www.spamhaus.org/pbl/query/PBL036850
Spam source - http://wpbl.info/record?ip=76.1.18.28
OrgName: Embarq Corporation
OrgID: EMBAR
NetRange: 76.0.0.0 - 76.7.255.255
CIDR: 76.0.0.0/13
NetName: EMBARQ-GLOBAL
NetHandle: NET-76-0-0-0-1
Parent: NET-76-0-0-0-0
NetType: Direct Allocation
ASN: 11530
ASN Name: SPUN
Country (per IP registrar): US [United States]
Country IP Range: 76.0.0.0 to 76.7.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=11530
More embarqservices.net sightings:
http://groups.google.com/groups/search?q=embarqservices.net+group%3A*abuse&start=0&scoring=d&
See:
plainrest.hk IP 66.78.0.20
NS2.SPOTTRACK.hk [123.176.83.38] [TTL=28800] [CN]
NS1.SPOTTRACK.hk [202.99.172.162] [TTL=28800] [CN]
NS1.DOWNMIX.hk [202.99.172.162] [TTL=28800] [CN]
NS2.DOWNMIX.hk [123.176.83.38] [TTL=28800] [CN]
NS records a nameservers are:
ns2.plainrest.hk [no glue provided] [TTL=60]
ns1.plainrest.hk [no glue provided] [TTL=60]
SOA record [TTL=60] is:
Primary nameserver: ns1.plainrest.hk
Hostmaster E-mail address: ro...@plainrest.hk
Serial #: 2007046923
plainrest.hk has no MX records
http://www.moensted.dk/spam/?addr=66.78.0.20
66.78.0.20 PTR record: purefare.com
at ns2.adcip.net
OrgName: Virtual Development INC
OrgID: VDI (vdi.net)
NetRange: 66.78.0.0 - 66.78.63.255
CIDR: 66.78.0.0/18
NetName: NETBLK-VDI-3
NetHandle: NET-66-78-0-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
ASN: 18942
ASN Name: WEBHOSTPLUS-INC
Country (per IP registrar): US [United States]
Country IP Range: 66.78.0.0 to 66.78.63.255
http://www.cidr-report.org/cgi-bin/as-report?as=18942
postmaster and abuse[]webhostplus.com are listed in rfc-ignorant.org
database
postmaster and abuse[]vdi.net are listed in rfc-ignorant.org database
1 SBL listings for IPs under the responsibility of vdi.net
http://www.spamhaus.org/sbl/listings.lasso?isp=vdi.net
Let see whois:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): HUJ NUJAZSADSADSA
Holder Chinese Name:
Email: michaelp...@email.com
Domain Name Commencement Date: 17-04-2007
Country: US
Expiry Date: 17-04-2008
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1870260T
Technical Contact:
First name: MILE
Last name: ROGERS
Company Name: HUJ NUJAZSADSADSA
Name Servers Information:
NS1.DOWNMIX.HK
NS2.DOWNMIX.HK
NS1.SPOTTRACK.HK
NS2.SPOTTRACK.HK
More plainrest.hk sightings:
http://groups.google.com/groups/search?q=plainrest.hk+group%3A*abuse&qt_s=Search
See:
NS2.SPOTTRACK.hk IP 123.176.83.38
NS2.SPOTTRACK.hk has no MX records -> SPOTTRACK.hk has no MX records
http://www.moensted.dk/spam/?addr=123.176.83.38
http://www.spamhaus.org/query/bl?ip=123.176.83.38
123.176.83.38 is listed in the SBL, in the following records:
SBL53201, SBL53507, SBL53565, SBL53652
24 SBL/ROKSO listings for IPs under the responsibility of china-
netcom.com
http://www.spamhaus.org/sbl/listings.lasso?isp=china-netcom.com
Let see whois:
Domain Name: SPOTTRACK.HK
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): ELIZABETH ROZANSKIZX
Holder Chinese Name:
Email: john__f...@priest.com
Domain Name Commencement Date: 06-04-2007
Country: US
Expiry Date: 06-04-2008
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1862763T
Technical Contact:
First name: MILE
Last name: ROGERS
Company Name: ELIZABETH ROZANSKIZX
Name Servers Information:
NS1.SPOTTRACK.HK
NS2.SPOTTRACK.HK
See:
NS1.DOWNMIX.hk IP 202.99.172.162
NS1.DOWNMIX.hk has no MX records -> DOWNMIX.hk has no MX records
No PTR records exist for 202.99.172.162
at ns.hetsptt.net.cn / cncgroup-he
http://www.moensted.dk/spam/?addr=202.99.172.162
http://www.spamhaus.org/query/bl?ip=202.99.172.162
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL53650
202.99.172.162/32 is listed on the Spamhaus Block List (SBL/ROKSO)
19-Apr-2007 06:30 GMT | SR22
Yambo Financials.
Spammer DNS - ns2.findcall.hk
12 SBL/ROKSO listings for IPs under the responsibility of cncgroup-he
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-he
Let see whois:
Domain Name: DOWNMIX.HK
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): ELIZABETH ROZANSKIZX
Holder Chinese Name:
Email: john__f...@priest.com
Domain Name Commencement Date: 06-04-2007
Country: US
Expiry Date: 06-04-2008
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1862763T
Technical Contact:
First name: MILE
Last name: ROGERS
Company Name: ELIZABETH ROZANSKIZX
Name Servers Information:
NS1.DOWNMIX.HK
NS2.DOWNMIX.HK
More DOWNMIX.hk sightings:
http://groups.google.com/groups/search?q=DOWNMIX.hk+group%3A*abuse&qt_s=Search
See:
globalpharmsupport.com IP 81.177.38.5
globalpharmsupport.com to 121.36.114.51
ns1.globalpharmsupport.com [81.177.38.5] [TTL=172800] [RU]
ns2.globalpharmsupport.com [121.36.114.51] [TTL=172800] [CN]
NS records at your nameservers are:
ns1.counttop.hk [81.177.38.5] [TTL=60]
ns1.majorpast.hk [81.177.38.5] [TTL=60]
ns2.counttop.hk [123.176.83.38] [TTL=60]
ns2.majorpast.hk [123.176.83.38] [TTL=60]
SOA record [TTL=60] is:
Primary nameserver: ns.globalpharmsupport.com
Hostmaster E-mail address: ro...@globalpharmsupport.com
Serial #: 2007300438
1 MX record is:
10 mail.globalpharmsupport.com [TTL=60] IP=82.146.53.121 [TTL=60] [LU]
http://www.moensted.dk/spam/?addr=81.177.38.5
More 81.177.38.5 sightings:
http://groups.google.com/groups/search?q= 81.177.38.5+group
%3A*abuse&qt_s=Search
No PTR records exist for 81.177.38.5
at ns.rt-comm.ru / rtcomm.ru
inetnum: 81.177.38.0 - 81.177.39.255
netname: IN-TELECOM
descr: IN-Telecom Ltd. - modern service-provider
status: ASSIGNED PA
notify: in...@serverbox.ru
notify: i-sh...@list.ru
notify: l...@rtcomm.ru
mnt-by: AS8342-MNT
changed: r...@rtcomm.ru
notify: ab...@serverbox.ru => ???
postmaster and abuse[]serverbox.ru are listed in rfc-ignorant.org
database
person: Natalya I Lisnyak
address: IN-Telecom Limited
address: Dekabristov str., 10-72
address: 614022 Perm
address: Russia
phone: +7 3422 774365
fax-no: +7 3422 931076
e-mail: i-sh...@list.ru
abuse-mailbox: in...@in-telecom.ru => ???
postmaster and abuse[]in-telecom.ru are listed in rfc-ignorant.org
database
route: 81.176.0.0/15
descr: RTCOMM-RU
origin: AS8342
notify: n...@rtcomm.ru
mnt-by: AS8342-MNT
changed: r...@rt.ru
ASN: 8342
ASN Name: RTCOMM-AS (RTComm.RU Autonomous System)
Country (per IP registrar): RU [Russian Federation]
Country IP Range: 81.176.0.0 to 81.177.255.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=8342
2 SBL listings for IPs under the responsibility of rtcomm.ru
http://www.spamhaus.org/sbl/listings.lasso?isp=rtcomm.ru
abuse[]rt.ru is listed in rfc-ignorant.org database
See:
globalpharmsupport.com IP 121.36.114.51
[globalpharmsupport.com has 2 MX records mail0.globalpharmsupport.com
(10) mail.globalpharmsupport.com (20)]
Resolved mail.globalpharmsupport.com to 82.146.53.121
at ns9.ispsystem.net / mydomain.com
Resolved mail0.globalpharmsupport.com to 203.121.73.93 => SBL53651 at
time.net.my
http://www.moensted.dk/spam/?addr=121.36.114.51
http://www.spamhaus.org/query/bl?ip=121.36.114.51
http://www.spamhaus.org/pbl/query/PBL137176
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL53649
121.36.114.51/32 is listed on the Spamhaus Block List (SBL)
17-Apr-2007 21:00 GMT | SR02
bulletproof hosting - pharma spammer
9 SBL/ROKSO listings for IPs under the responsibility of china-
motion.com
http://www.spamhaus.org/sbl/listings.lasso?isp=china-motion.com
Let see whois:
Registrar: DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Domain Name: GLOBALPHARMSUPPORT.COM
Registrant:
United Pharm
United Pharm (Support[]UnitedPharmSupport.com)
11295 Dahlia Grove St
Rio de Janeiro
,32553
US
Tel. +23.31222743
Creation Date: 15-Jun-2006
Expiration Date: 15-Jun-2007
Domain servers in listed order:
ns2.globalpharmsupport.com [121.36.114.51]
ns1.globalpharmsupport.com [81.177.38.5]
Administrative Contact:
United Pharm
United Pharm (Sup...@UnitedPharmSupport.com)
11295 Dahlia Grove St
Rio de Janeiro
,32553
US
Tel. +23.31222743
Technical Contact:
United Pharm
United Pharm (Sup...@UnitedPharmSupport.com)
11295 Dahlia Grove St
Rio de Janeiro
,32553
US
Tel. +23.31222743
Billing Contact:
United Pharm
United Pharm (Sup...@UnitedPharmSupport.com)
11295 Dahlia Grove St
Rio de Janeiro
,32553
US
Tel. +23.31222743
Status:ACTIVE
See from registrant record:
UnitedPharmSupport.com IP N/A
Let see whois:
Registrar: DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Registration Service Provided By: TRI RUBLYA J.S.C.
Contact: +7.8123760140
Website: http://buy-cheap-domain.info
Domain Name: UNITEDPHARMSUPPORT.COM
Registrant:
United Pharm
United Pharm (Sup...@UnitedPharmSupport.com)
11295 Dahlia Grove St
Rio de Janeiro
,32553
US
Tel. +23.31222743
Creation Date: 16-Mar-2006
Expiration Date: 16-Mar-2007
Domain servers in listed order:
ns1.unitedpharmsupport.com
ns2.unitedpharmsupport.com
Administrative Contact:
United Pharm
United Pharm (Sup...@UnitedPharmSupport.com)
11295 Dahlia Grove St
Rio de Janeiro
,32553
US
Tel. +23.31222743
Technical Contact:
United Pharm
United Pharm (Sup...@UnitedPharmSupport.com)
11295 Dahlia Grove St
Rio de Janeiro
,32553
US
Tel. +23.31222743
Billing Contact:
United Pharm
United Pharm (Sup...@UnitedPharmSupport.com)
11295 Dahlia Grove St
Rio de Janeiro
,32553
US
Tel. +23.31222743
Status:RENEWAL HOLD
More UnitedPharmSupport.com sightings:
http://groups.google.com/groups/search?q=UnitedPharmSupport.com+group%3A*abuse&qt_s=Search
And More PUBLICDOMAINREGISTRY spam support sightings:
http://groups.google.com/groups/search?q=publicdomainregistry+group%3A*abuse&start=0&scoring=d&
whois, postmaster and abuse[]publicdomainregistry.com are listed in
rfc-ignorant.org database
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/61005d5c0747cc17
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: