Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] [drugs - Hoodia] [58.8.94.137] (goabntszheep.com - driedoutdns.com) You make me sick

0 views

Skip to first unread message

TomezNet

unread,

Mar 11, 2007, 5:00:08 PM3/11/07

Received From:
IP 58.8.94.137 ppp-58.8.94.137.revip2.asianet.co.th
(at clarinet.asianet.co.th / trueinternet.co.th)

Spamvert:
www.goabntszheep.com IP 58.83.5.100
(SBL51895 - SBL51900) (at APNIC / CNCGroup-HN / chinanetlink.com /
hylink-cn)

More paul gregoire spam and sightings:
http://groups.google.com/groups/search?q=%22paul+gregoire%22+group%3A*abuse&start=0&scoring=d&

More info below:
====================

X-SID-PRA: Andria <Tandy...@rosys.com>
X-Message-Info: txF49lGdW40+s8RSFHi6/yVJ7Grcug7ABeMLSwol2RM=
Received: from tomts48-srv.bellnexxia.net ([209.226.175.192]) by bay0-
pamc1-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sun, 11 Mar 2007 08:32:41 -0700
Received: from [MUNGED]
by toip16.srvr.bell.ca with ESMTP; 11 Mar 2007 11:32:39 -0400
Received: (qmail 28654 invoked by uid 110); 11 Mar 2007 11:32:39 -0400
Delivered-To: [MUNGED]
Received: (qmail 28637 invoked from network); 11 Mar 2007 11:32:34
-0400
Received: from ppp-58.8.94.137.revip2.asianet.co.th (HELO 45BAC6F8)
(58.8.94.137)
by [MUNGED] with SMTP; 11 Mar 2007 11:32:34 -0400
Received: from source ([139.76.198.25]) by
exprod7mx73.ekindustries.com ([58.8.94.137]) with SMTP;
Sun, 11 Mar 2007 11:32:42 -0500
Received: from single.okhc.akay (d91-73-6.mwxufbr.rosys.com
[206.47.75.112])
by fep2.rosys.com (Postfix) with ESMTP id 2C0D288
for <[MUNGED]>; Sun, 11 Mar 2007 11:32:42 -0500 (EST)
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
Subject: You make me sick
Date: Sun, 11 Mar 2007 11:32:42 -0500
Message-ID: <JUSC60BD0D94394AABC...@single.okhc.akay>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: You make me sick
Thread-Index: AccilSZz1adJ6USiTT+YWtdv9M7bgs==
From: "Andria" <Tandy...@rosys.com>
To: <[MUNGED]>
X-ST-MF-Message-Resent: 3/2/2007 21:10
X-pstn-levels: (S:90.30701/99.90000 R:95.9108 P:95.9108 M:97.0282
C:98.6951 )
X-pstn-settings: 3 (1.0000:1.0000) s gt3 gt2 gt1 r p m c
X-pstn-addresses: from <Tandy...@rosys.com> [96/6]
X-Antivirus: AVG for E-mail 7.5.446 [268.18.5/707]
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="=======AVGMAIL-95E9D14A527B======="
Return-Path: BethelRL...@miracleworks.com
X-OriginalArrivalTime: 11 Mar 2007 15:32:41.0435 (UTC)
FILETIME=[81CE12B0:01C763F2]

--=======AVGMAIL-95E9D14A527B=======
Content-Type: multipart/related; type="multipart/alternative";
boundary="----_=_NextPart_001_01C84HFJ.952EE488"

------_=_NextPart_001_01C84HFJ.952EE488
Content-Type: multipart/alternative; boundary="----
_=_NextPart_002_01C84HFJ.952EE488"

------_=_NextPart_002_01C84HFJ.952EE488
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

Take a look at what Marcy did in just 6 months.
Now take a look at yourself in the mirror.
Do yourself and everyone around you a favor this summer.
STOP WEARING BATHING SUITES! OR LOSE SOME WEIGHT!
IF you need some help, then take some HoodiaGordonii.
http://[MUNGED].goabntszheep.com

Security Message #:
[MUNGED]mwflerasmn[MUNGED]8puwetxduiawnnlsziikc[MUNGED]quodrhjfslsprmizismupzasiaawzyrdtwmmrlernbfaxhshnawsvylsdukm[MUNGED]jghfktbhkccftkilmoqlnnhqrelllfkgsolsjleazewhysopks[MUNGED]kbboibawntrpqejvputuehlzwjdhbfmcerhbteedylofwcshcavdhtixolzxlczivqxfrfntzhgovilazbbquhkilqwxdglxwdks

------_=_NextPart_002_01C84HFJ.952EE488
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

</head>
<body lang=3DEN-US link=3Dblue vlink=3Dpurple>
<div class=3DSection1>

Take a look at what Karen did in just 6
months.

Now take a look at yourself in the mirror.</
sp=
an>

Do yourself and everyone around you a favor
this
summer.

STOP
WEARING
BATHING SUITES! OR LOSE SOME WEIGHT!

</
sp=
an>

</sp=
an>

IF you need some help, then take some
HoodiaGo
rdonii.
Security Message #:
6110mwflerasmn2181336068puwetxduiawnnlsziikc0561349975quodrhjfslsprmizismupzasiaawzyrdtwmmrlernbfaxhshnawsvylsdukm5211176578jghfktbhkccftkilmoqlnnhqrelllfkgsolsjleazewhysopks12735799575046141046kbboibawntrpqejvputuehlzwjdhbfmcerhbteedylofwcshcavdhtixolzxlczivqxfrfntzhgovilazbbquhkilqwxdglxwdks

<sp=
an style=3D'font-size:14.0pt;font-family:"Arial
Black";color:blue'>http://www.goabntszheep.com
</div>

------_=_NextPart_002_01C84HFJ.952EE488--
------_=_NextPart_001_01C84HFJ.952EE488
Content-ID: <image0...@01C76340.EECF5390>
Content-Description: image001.jpg
Content-Location: image001.jpg
Content-Type: image/jpeg; name=image001.jpg
Content-Transfer-Encoding: base64

------_=_NextPart_001_01C84HFJ.952EE488--
--=======AVGMAIL-95E9D14A527B=======
Content-Type: text/plain; x-avg=cert; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Message"

Take a look at what Tina did in just 6 months.

Now take a look at yourself in the mirror.
Do yourself and everyone around you a favor this summer.

STOP WEARING BATHING SUITES! OR LOSE SOME WEIGHT!
IF you need some help, then take some HoodiaGordonii.

http://[MUNGED].goabntszheep.com

--=======AVGMAIL-95E9D14A527B=======--

*** REMOVED Attachment: image001.jpg (<0.02 MB) ****

-- END OF SPAM --

See:
IP 58.8.94.137 ppp-58.8.94.137.revip2.asianet.co.th

http://www.moensted.dk/spam/?addr=58.8.94.137
http://www.spamhaus.org/query/bl?ip=58.8.94.137
http://www.spamhaus.org/pbl/query/PBL114402
http://cbl.abuseat.org/lookup.cgi?ip=58.8.94.137
http://www.apews.org/?page=test&C=3&E=57638&ip=58.8.94.137

inetnum: 58.8.0.0 - 58.8.255.255
netname: TRUENET
country: TH
descr: ADSL HuaweiBB Truehisp Infrastructure True internet Co.,
Ltd.
admin-c: TIA6-AP
trouble: ab...@trueinternet.co.th => ???

abuse[]trueinternet.co.th is listed in rfc-ignorant.org database
postmaster and abuse[]asianet.co.th are listed in rfc-ignorant.org
database

route: 58.8.64.0/18
descr: ASIAINFO-TH New IP
origin: AS7470
mnt-by: MAINT-AS7470
changed: regi...@asianet.co.th
ASN: 7470
ASN Name: ASIAINFO-AS-AP (ASIA INFONET Co.,Ltd.)
Country (per IP registrar): TH [Thailand]
Country IP Range: 58.8.0.0 to 58.11.255.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=7470

2 SBL listings for IPs under the responsibility of trueinternet.co.th
http://www.spamhaus.org/sbl/listings.lasso?isp=trueinternet.co.th

14 SBL/ROKSO listings for IPs under the responsibility of
asianet.co.th
http://www.spamhaus.org/sbl/listings.lasso?isp=asianet.co.th

See:
[MUNGED].goabntszheep.com IP 58.83.5.100

Resolved [MUNGED].goabntszheep.com to goabntszheep.com to 58.83.5.100

www.goabntszheep.com IP 58.83.5.100
ns1.driedoutdns.com [210.82.89.183] [TTL=172800] [CN]
ns2.driedoutdns.com [58.251.49.65] [TTL=172800] [CN]

NS records at nameservers are:
ns1.goabntszheep.com [58.83.5.100] [TTL=172800]
ns2.goabntszheep.com [58.83.5.100] [TTL=172800]

SOA record [TTL=86400] is:
Primary nameserver: ns1.goabntszheep.com
Hostmaster E-mail address: webm...@goabntszheep.com
Serial #: 1173633318

goabntszheep.com has no MX records

http://www.moensted.dk/spam/?addr=58.83.5.100
http://www.spamhaus.org/query/bl?ip=58.83.5.100

inetnum: 58.83.4.0 - 58.83.7.255
netname: hylink-cn
descr: henyang hylink technology co., LTD
country: CN

person: lusheng wang
nic-hdl: LW935-AP
e-mail: w...@chinanetlink.com
address: hengyang hylink technology co., LTD
phone: +86-734-8211008
fax-no: +86-734-8211008
country: cn
changed: bluesky...@163.com

ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
Country (per IP registrar): CN [China]
Country IP Range: 58.82.0.0 to 58.83.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4134

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL51895
58.83.4.0/22 is listed on the Spamhaus Block List (SBL)

03-Mar-2007 06:28 GMT | SR02

hylink-cn - spammer operated allocation
New name, same old problems in this CNCGroup-HN downstream.

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL51900
58.83.0.0/16 is listed on the Spamhaus Block List (SBL)

03-Mar-2007 06:37 GMT | SR02

tianjian

23 SBL/ROKSO listings for IPs under the responsibility of APNIC
http://www.spamhaus.org/sbl/listings.lasso?isp=APNIC

12 SBL listings for IPs under the responsibility of CNCGroup-HN
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGroup-HN

9 SBL/ROKSO listings for IPs under the responsibility of hylink-cn
http://www.spamhaus.org/sbl/listings.lasso?isp=hylink-cn

Let see whois:
Registrar: THE NAME IT CORPORATION DBA NAMESERVICES.NET

Domain Name: goabntszheep.com

Registrant Contact
Name: paul gregoire
Address: 175 Montreal Road
304
vanier, on K1L 6E4
CA
Email Address: gregoirep[]coldmail.ca
Phone Number: (613)255-2162

Administrative Contact
Name: paul gregoire
Address: 175 Montreal Road
304
vanier, on K1L 6E4
CA
Email Address: greg...@coldmail.ca
Phone Number: (613)255-2162

Technical Contact
Name: paul gregoire
Address: 175 Montreal Road
304
vanier, on K1L 6E4
CA
Email Address: greg...@coldmail.ca
Phone Number: (613)255-2162

Record Created on........ 2007-02-22 20:15:43.250
Expire on................ 2008-02-22 20:26:02.000

Domain servers in listed order:
ns1.driedoutdns.com
ns2.driedoutdns.com

More goabntszheep.com sightings:
http://groups.google.com/groups/search?q=goabntszheep.com+group%3A*abuse

See also more paul gregoire email gregoirep[]coldmail.ca sightings:
http://groups.google.com/groups/search?q=%22gre...@coldmail.ca%22+group%3A*abuse

See:
ns1.driedoutdns.com IP 210.82.89.183

ns1.driedoutdns.com has no MX records -> driedoutdns.com has no MX
records

http://www.moensted.dk/spam/?addr=210.82.89.183
http://www.spamhaus.org/query/bl?ip=210.82.89.183

No PTR records exist for 210.82.89.183
at dns-zhonggc.bj.cncnet.net / bj-dns.cncnet.net

inetnum: 210.82.89.128 - 210.82.89.255
netname: beijing-qingshui-yamen-corp
status: ASSIGNED NON-PORTABLE
changed: da...@china-netcom.com

route: 210.82.0.0/15
descr: CNC Group CncNet
changed: ab...@cnc-noc.net => ???

whois, bogusmx, postmaster and abuse[]cnc-noc.net are listed in rfc-
ignorant.org database

person: qiong lu
nic-hdl: QL69-AP
e-mail: tan...@china-netcom.com
address: CNCGROUP Beijing province network
address: China Network Communications Group Corporation
changed: wuh...@china-netcom.com

route: 210.82.0.0/17
descr: CHINA NETCOM
origin: AS9929
mnt-by: MAINT-AS9929
changed: xu...@china-netcom.com
changed: liu...@china-netcom.com
ASN: 17620
ASN Name: CNCGROUP-BJ (CNCGROUP IP network of Beijing region MAN
network)
Country (per IP registrar): CN [China]
Country IP Range: 210.82.0.0 to 210.83.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=17620

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL51774
210.82.89.183/32 is listed on the Spamhaus Block List (SBL/ROKSO)

28-Feb-2007 08:26 GMT | SR02

Alex Blood / Alexander Mosh / AlekseyB / Alex Polyakov.

spam hosting (botnet spammers)

http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK6138

28 SBL/ROKSO listings for IPs under the responsibility of china-
netcom.com
http://www.spamhaus.org/sbl/listings.lasso?isp=china-netcom.com

Let see whois:
Registrar: ACE OF DOMAINS, INC

Domain Name: DRIEDOUTDNS.COM

Registrant [1649]:
Gregory William gregw[]coldmail.ca
1808 Bowen road
109
Nanaimo
British Columbia
V9S 5W4
CA

Administrative Contact [1649]:
Gregory William gr...@coldmail.ca
1808 Bowen road
109
Nanaimo
British Columbia
V9S 5W4
CA
Phone: +1.6047678695

Billing Contact [1649]:
Gregory William gr...@coldmail.ca
1808 Bowen road
109
Nanaimo
British Columbia
V9S 5W4
CA
Phone: +1.6047678695

Technical Contact [1649]:
Gregory William gr...@coldmail.ca
1808 Bowen road
109
Nanaimo
British Columbia
V9S 5W4
CA
Phone: +1.6047678695

Domain servers in listed order:
NS1.DNSGOLDONE.COM
NS2.DNSGOLDONE.COM

Record created on: 2007-02-17 21:57:14.0
Database last updated on: 2007-02-27 12:47:29.24
Domain Expires on: 2008-02-17 21:57:14.0

More driedoutdns.com sightings:
http://groups.google.com/groups/search?q=driedoutdns.com+group%3A*abuse&start=0&scoring=d&

See also more paul gregoire email gregw[]coldmail.ca sightings:
http://groups.google.com/groups?q=%22g...@coldmail.ca%22+group%3A*abuse

Cheers, Tomez

--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.

For a copy of the guidelines to this group, see:

http://www.killfile.org/~tskirvin/nana/

0 new messages