[email] [drugs botnet] (barosaaa.com - tilleypom.com) SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*, CIPRO, MERIDI*, CELEBRE*, VALIU* fly
TomezNet
IP 85.206.146.176
(at telecom.lt)
Spamvert drugs botnet:
barosaaa.com
tilleypom.com
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 206.190.49.63; Sat, 01 Apr 2006
06:50:18 -0800
X-YahooFilteredBulk: 85.206.146.176
X-Originating-IP: [85.206.146.176]
Return-Path: <egwni...@acsalaska.net>
Authentication-Results: mta206.mail.mud.yahoo.com
from=acsalaska.net; domainkeys=fail (bad syntax)
Received: from 85.206.146.176 (HELO 4.79.181.14) (85.206.146.176) by
mta206.mail.mud.yahoo.com with SMTP; Sat, 01 Apr 2006 06:50:18 -0800
Received: from [192.168.1.8] ([85.206.146.176]) by millcomm.com
(Sendmail 8.7.7) with ESMTP (SSL) id IYT90926 for <xx..xx@xx..xx.com>;
Sat, 01 Apr 2006 08:50:15 -0600
Message-ID: <912z432q...@millcomm.com>
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=thus.pretty;
d=millcomm.com;
b=RrMk64oZjt1rr5ImdgSvKdVrBGHYt48Zw5rt3S5KjShzJ5vZzL9kNwHQQUGMnFjCaq2SuukDSICR8SNS;
Date: Sat, 01 Apr 2006 08:50:15 -0600
From: "Sharilyn Jeanice" <egwni...@acsalaska.net>
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xx..xx@xx..xx.com
Subject: SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*,
CIPRO, MERIDI*, CELEBRE*, VALIU* fly
Content-Type: multipart/related;
boundary="------------11168272==.MRA"
Content-Length: 898
---------------------------------
did did hard embarrass?Quality Meds Selling At Cheeap
We dont keep ur record (not even your name)
You just pay & we ship, No Question form to fill
We ship to all countries
Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro, Meridi*,
Celebre*, Valiu*, Zoloft & Many More Meds thus
leader C11ck Here for Huge Saving again
night wrong money how light,
anything arms steps. how across is. or pretty fascinate.
not again parents profession least principle. young side anything
shining nothing slow? black make parents turning find.
very leader somewhere respect light carefully.
explain studied light. studied steps carefully? evening respect already
shining again.
anybody yours respect pride yours.
<html><head>
<meta http-equiv="Content-Type" content="text; charset=iso-8859-1">
</head>
<body>
<font color=FFA4D1 size=1>did did hard embarrass?</font>
<table border=10 cellspacing=0 cellpadding=3 width=520
bordercolor=CDFF59>
<tr><td bgcolor=ffffff bordercolor=000000><center>
<font size=2 face=arial color=CC0000>
<font size=4 color=000000><b>Quality Meds Selling At Cheeap<br><font
color=EA0000>We dont keep ur record (not even your
name)</font><br><font color=AEAE00>You just pay & we ship, No Question
form to fill</font><br><font color=FF5EAE>We ship to all
countries</b></center></font></font><br><font color=000000
size=2>Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro,
Meridi*, Celebre*, Valiu*, Zoloft & Many More Meds thus<br><center>
<a href=http://ktc.bARosAaa.coM target=_blank><font size=4
color=5E5EFF><u>leader <b>C11ck Here for Huge Saving</b>
again</font></u></a></font></center><br></td></tr></table><font
color=FFA4D1 size=1>night wrong money how light,<br>
anything arms steps. how across is. or pretty fascinate.<br>
not again parents profession least principle. young side anything
shining nothing slow? black make parents turning find.<br>
very leader somewhere respect light carefully.<br>
explain studied light. studied steps carefully? evening respect already
shining again.<br>
anybody yours respect pride yours.<br></font>
</body></html>
-- END OF SPAM --
See:
IP 85.206.146.176
http://www.moensted.dk/spam/?addr=85.206.146.176
http://cbl.abuseat.org/lookup.cgi?ip=85.206.146.176
http://www.spamhaus.org/query/bl?ip=85.206.146.176
inetnum: 85.206.145.0 - 85.206.146.255
netname: LIETUVOS-TELEKOMAS
descr: PROVIDER
descr: Joint Stock Company Lietuvos Telekomas
descr: local, long distance and international
telecommunications
descr: services carrier
descr: LOCAL REGISTRY
country: LT
route: 85.206.144.0/21
descr: LT-TELEKOMAS
origin: AS8764
http://www.cidr-report.org/cgi-bin/as-report?as=8764
See:
ktc.barosaaa.com A IN 180 66.41.41.21
ktc.barosaaa.com A IN 180 12.206.21.44
ktc.barosaaa.com A IN 180 24.33.26.71
ktc.barosaaa.com A IN 180 82.240.146.36
ktc.barosaaa.com A IN 180 68.34.40.115
ns4.tilleypom.com [82.247.37.91]
Let see whois (barosaaa.com):
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Domain Name.......... barosaaa.com
Creation Date........ 2006-03-20
Registration Date.... 2006-03-20
Expiry Date.......... 2007-03-20
Organisation Name.... armando barosa
Organisation Address. 7012 moss rose court
Organisation Address.
Organisation Address. fort worth
Organisation Address. 76137
Organisation Address. TX
Organisation Address. UNITED STATES
Admin Name........... armando barosa
Admin Address........ 7012 moss rose court
Admin Address........
Admin Address........ fort worth
Admin Address........ 76137
Admin Address........ TX
Admin Address........ UNITED STATES
Admin Email.......... barosaaa[]hotmail.com
Admin Phone.......... +1.8174271106
Admin Fax............
Tech Name............ armando barosa
Tech Address......... 7012 moss rose court
Tech Address.........
Tech Address......... fort worth
Tech Address......... 76137
Tech Address......... TX
Tech Address......... UNITED STATES
Tech Email........... baro...@hotmail.com
Tech Phone........... +1.8174271106
Tech Fax.............
Name Server.......... ns1.tilleypom.com [68.34.40.115]
Name Server.......... ns2.tilleypom.com [68.61.193.173]
Name Server.......... ns3.tilleypom.com [82.240.146.36]
Name Server.......... ns4.tilleypom.com [82.247.37.91]
Name Server.......... ns5.tilleypom.com [12.206.21.44]
More barosaaa.com sightings:
http://groups.google.com/groups/search?q=barosaaa.com+group%3A*abuse
Let see whois (tilleypom.com):
Registrar: TUCOWS INC.
Registrant:
Michael Tilley
2324 Freedom Drive
Hood River, Oregon 97031
AD
Domain name: TILLEYPOM.COM
Administrative Contact:
Tilley, Michael tilley_pom[]yahoo.com
2324 Freedom Drive
Hood River, Oregon 97031
AD
+5413868365
Technical Contact:
Tilley, Michael tille...@yahoo.com
2324 Freedom Drive
Hood River, Oregon 97031
AD
+5413868365
Registration Service Provider:
DiscountDomainRegistry.com
http://DiscountDomainRegistry.com
Register your domain for only $14.99 at
http://DiscountDomainRegistry.com !
Customers may contact us for domain login/passwords, DNS/Nameserver
changes, and general domain support questions at
http://discountdomainregistry.com/crm/ .
Registrar of Record: TUCOWS, INC.
Record last updated on 01-Apr-2006.
Record expires on 31-Mar-2007.
Record created on 31-Mar-2006.
Domain servers in listed order:
NS1.TILLEYPOM.COM 68.34.40.115
NS2.TILLEYPOM.COM 68.61.193.173
NS3.TILLEYPOM.COM 82.240.146.36
NS4.TILLEYPOM.COM 82.247.37.91
NS5.TILLEYPOM.COM 12.206.21.44
Domain status: ACTIVE
More tilleypom.com sightings:
http://groups.google.com/group/news.admin.net-abuse.email/msg/f01f3e10bb97efe9
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/4522ba2032b5ab20
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: