[email] [drugs - American Pharmacy] (gasdaw.com - 212.50.9.253 - dartnet.info - wizardup.info l- ofhick.info - molefancy.info) Re:
TomezNet
IP 124.90.228.217
(at CNCGROUP-ZJ)
Spamvert:
gasdaw.com IP 60.248.85.221
(SBL44232) (at hinet.net)
NEW Yambo Pharmacy image hosting:
http://212.50.9.253:8080/usd/images/
IP 212.50.9.253
(at ns.bbf.bg / spnet.net)
Web:
American Pharmacy
Copiright © 2003-2006 USDrugs.
See American Pharmacy aka USDrugs aka Canadian Pharmacy more sightings:
http://groups.google.com/groups/search?q=%22American+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
Plenty of Forged certificates and logos.
More info below:
====================
X-SID-PRA: Impair J. Coordinate <cre...@gonenler.com>
X-SID-Result: TempError
X-Message-Info: txF49lGdW40tG/XvOznsSJPDoYd0zD4ri4I7BjTIS0A=
Received: from tomts38-srv.bellnexxia.net ([209.226.175.95]) by
bay0-pamc1-f7.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Thu, 24 Aug 2006 20:15:36 -0700
Received: from [MUNGED]
by toip2.bellnexxia.net with ESMTP; 24 Aug 2006 23:15:29 -0400
Received: (qmail 1861 invoked by uid 110); 24 Aug 2006 23:15:29 -0400
Delivered-To: [MUNGED]
Received: (qmail 1853 invoked from network); 24 Aug 2006 23:15:27 -0400
Received: from unknown (HELO -1209383056) (@124.90.228.217)
by [MUNGED] with SMTP; 24 Aug 2006 23:15:27 -0400
Received: from gonenler.com (-1209422376 [-1209380728])
by gmgcorporation.com (Qmailv1) with ESMTP id BEFF38AEB6
for <[MUNGED]>; Thu, 24 Aug 2006 23:13:35 -0700
Date: Thu, 24 Aug 2006 23:13:35 -0700
From: "Impair J. Coordinate" <cre...@gonenler.com>
X-Mailer: The Bat! (v2.00.9) Personal
X-Priority: 3
Message-ID: <3249742280.2...@gonenler.com>
To: [MUNGED]
Subject: Re:
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-milter at gmgcorporation.com
Return-Path: cre...@gonenler.com
X-OriginalArrivalTime: 25 Aug 2006 03:15:36.0707 (UTC)
FILETIME=[BC059D30:01C6C7F4]
welc ome to the best pharmacy http://gasdaw.com/
-- END OF SPAM --
See also more USDrugs sightings:
http://groups.google.com/groups/search?q=USDrugs+group%3A*abuse&start=0&scoring=d&
See:
IP 124.90.228.217
http://www.moensted.dk/spam/?addr=124.90.228.217
inetnum: 124.90.0.0 - 124.91.255.255
netname: CNCGROUP-ZJ
descr: CNC Group Zhejiang province network
descr: China Network Communications Group Corporation
route: 124.90.0.0/15
descr: CNC Group CHINA169 Zhejiang Province Network
country: CN
origin: AS4837
mnt-by: MAINT-CNCGROUP-RR
ASN: 4837
ASN Name: CHINA169-Backbone (CNCGROUP China169 Backbone)
Country IP Range: 124.88.0.0 to 124.95.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4837
1 SBL listings for IPs under the responsibility of CNCGROUP-ZJ
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGROUP-ZJ
See:
gasdaw.com IP 60.248.85.221
ns1.dartnet.info [201.6.155.6 (NO GLUE)] [BR]
ns1.wizardup.info [NO GLUE; No A record] => old ip 146.48.82.40
ns2.lofhick.info [194.29.49.1 (NO GLUE)] [GR]
ns2.molefancy.info [200.51.90.94 (NO GLUE)] [AR]
gasdaw.com has no MX records
60.248.85.221 PTR record: 60-248-85-221.HINET-IP.hinet.net
at vns1.hinet.net
More 60.248.85.221 sightings:
http://groups.google.com/groups/search?q=60.248.85.221+group%3A*abuse&start=0&scoring=d&
http://www.spamhaus.org/query/bl?ip=60.248.85.221
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL44232
60.248.85.221/32 is listed on the Spamhaus Block List (SBL/ROKSO)
08-Jul-2006 18:11 GMT | SR20
Yambo Financials
Yambo nameservers, web sites.
53 SBL/ROKSO listings for IPs under the responsibility of hinet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=hinet.net
Let se whois.domaincontender.com:
Registrar: DOMAIN CONTENDER, LLC
Registrant:
Shirely Kuder
12358 Marionwood Ct
HERNDON, VA 20171
US
703-648-9034
Domain Name: GASDAW.COM
Administrative Contact:
Kuder, Shirely ertli9ujp[]yahoo.com
12358 Marionwood Ct
HERNDON, VA 20171
US
703-648-9034
Technical Contact:
Kuder, Shirely ertl...@yahoo.com
12358 Marionwood Ct
HERNDON, VA 20171
US
703-648-9034
Record last updated 07-21-2006 04:58:32 AM
Record expires on 07-08-2007
Record created on 07-08-2006
Domain servers in listed order:
NS1.WIZARDUP.INFO 146.48.82.40
NS2.MOLEFANCY.INFO 194.226.178.26
NS1.DARTNET.INFO 194.29.49.1
NS2.LOFHICK.INFO 212.52.166.78
NEW See image hosting:
IP 212.50.9.253
NO PTR record at ns.bbf.bg
http://www.moensted.dk/spam/?addr=212.50.9.253
inetnum: 212.50.9.192 - 212.50.9.255
netname: ZEAT
descr: BBF-ZEAT GmbH
country: BG [Bulgaria]
admin-c: GD667-RIPE
tech-c: GD667-RIPE
rev-srv: ns.spnet.net
rev-srv: purgatory.spnet.net
route: 212.50.9.0/24
descr: SPNET specific announce
origin: AS8717
notify: regi...@spnet.net
mnt-by: SPNET-MNT
changed: sav...@spnet.net
source: RIPE
route: 212.50.0.0/19
descr: Frontier GlobalCenter Customer Subnet 212.50.0.0/19
origin: AS11042
mnt-by: PRIMENET-MAINT-MCI
changed: w...@globalcenter.net
ASN: 8717
ASN Name: SPECTRUMNET (Spectrum NET)
Country IP Range: 212.50.0.0 to 212.50.31.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=8717
1 SBL listings for IPs under the responsibility of spnet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=spnet.net
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/d543c6670be16741
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: