[email] [drugs botnet - Discount Pharmacy] (needogetridofit.org - tdwdcg.org) finally
TomezNet
IP 201.1.10.228 201-1-10-228.dsl.telesp.net.br
(at dnsqipbr2.telesp.net.BR)
Spamvert:
rwmo.needogetridofit.org IP 24.173.115.50
(at ns1.biz.rr.com)
ns2.needogetridofit.org IP 61.107.16.80
(webcash.co.kr / dreamline.co.kr / epnetworks.co.kr)
ns1.needogetridofit.org IP 83.228.42.37 and 24.173.115.50
(at pns.btc-net.bg)
www.tdwdcg.org IP 211.95.79.126
(SBL43771) (at dns.sh.cnuninet.net / cnuninet.com / UNICOM)
Plenty of forged site certificates and logos served from tdwdcg.org
domain.
Received at a spamtrap.
More info below:
====================
X-SID-PRA: Josephine <br...@blackinq.every1.net>
X-SID-Result: Neutral
X-Message-Info: txF49lGdW42b5r4wwkwwxr8MSs/ZzwGro+uNCD0b2qk=
Received: from tomts17-srv.bellnexxia.net ([209.226.175.71]) by
bay0-pamc1-f12.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Fri, 30 Jun 2006 05:17:13 -0700
Received: from xx..xx..xx.net ([207.58.1....])
by toip2.bellnexxia.net with ESMTP; 30 Jun 2006 08:16:39 -0400
Received: (qmail 17361 invoked by uid 110); 30 Jun 2006 12:16:38 -0000
Delivered-To: xx..xx@xx..xx.com
Received: (qmail 17243 invoked from network); 30 Jun 2006 12:16:38
-0000
Received: from 201-1-10-228.dsl.telesp.net.br (HELO
blackinq.every1.net) (201.1.10.228)
by xx..xx..xx.net with SMTP; 30 Jun 2006 12:16:37 -0000
Message-ID: <FE159BBF...@blackinq.every1.net>
Date: Fri, 30 Jun 2006 21:05:25 +0800
From: "Josephine" <br...@blackinq.every1.net>
User-Agent: Internet Mail Service (5.5.2650.21)
X-Accept-Language: en-us
MIME-Version: 1.0
To: xx..xx@xx..xx.com
Subject: finally
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
Return-Path: br...@blackinq.every1.net
X-OriginalArrivalTime: 30 Jun 2006 12:17:14.0434 (UTC)
FILETIME=[1F0B3A20:01C69C3F]
According to the latest news stories, they said that the majority of
Americans are really moved in keeping their riches and not spending it
on there sickness That is why they found yesterday this place
http://rds.yahoo.com/EXP=/**http://rwmo.needogetridofit.org/yq/.
They chanced upon it after going around the web. The things of the net.
on of my and the is line was narrative a sending cooperative is the
small and the in hook small plot thing end which or over end the story
manufacturer into I
Josephine
-- END OF SPAM --
Forged site certificates and logos:
* Best international Pharma site
Best international Pharma:
Discount Pharmacy
Fontana, CA 92337
Cheshire 12/2
* Verisign Secure Site
Discount Pharmacy is a Soltrus Secure Site
Name: Discount Pharmacy www.tdwdcg.org
Status: Valid
Validity Period: 13-SEP-05 - 13-SEP-06
Server ID Information:
Country = US
State = UT
Locality = Layton
Organization = Technical Consultants Inc
Organizational Unit = TCE Group
Organizational Unit = Terms of use at Verisign (c) 04
Organizational Unit = Authenticated by Verisign
Organizational Unit = VeriSign Trust Network
Common Name = Discount Pharmacy
* BBBOnLine Reliability
Participation Confirmed For Discount Pharmacy
Participant through 12/30/2006
See:
IP 201.1.10.228 201-1-10-228.dsl.telesp.net.br
http://www.moensted.dk/spam/?addr=201.1.10.228
http://cbl.abuseat.org/lookup.cgi?ip=201.1.10.228
http://www.spamhaus.org/query/bl?ip=201.1.10.228
http://dsbl.org/listing?201.1.10.228
inetnum: 201.1/16
aut-num: AS27699
abuse-c: ABL226
owner: TELECOMUNICACOES DE SAO PAULO S.A. - TELESP
ownerid: 002.558.157/0001-62
responsible: Luiz A. P. Lopes
ASN Name: LACNIC-27648
Country IP Range: 201.0.0.0 to 201.63.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=27699
22 SBL/ROKSO listings for IPs under the responsibility of telesp.net.br
http://www.spamhaus.org/sbl/listings.lasso?isp=telesp.net.br
See:
rwmo.needogetridofit.org IP 24.173.115.50
ns2.needogetridofit.org [61.107.16.80]
ns1.needogetridofit.org [83.228.42.37]
rwmo.needogetridofit.org has no MX records -> needogetridofit.org has
no MX records
http://www.moensted.dk/spam/?addr=24.173.115.50
24.173.115.50 PTR record: rrcs-24-173-115-50.se.biz.rr.com
OrgName: Road Runner HoldCo LLC
OrgID: RCSW
NetRange: 24.173.0.0 - 24.173.255.255
CIDR: 24.173.0.0/16
NetName: RR-COMM-SOUTHEAST
NetHandle: NET-24-173-0-0-1
route: 24.173.112.0/20
descr: RR-Route
origin: AS10994
ASN Name: TAMPA2-TWC-5
http://www.cidr-report.org/cgi-bin/as-report?as=10994
Let see whois.publicinterestregistry.net:
Domain ID:D125266734-LROR
Domain Name:NEEDOGETRIDOFIT.ORG
Created On:30-Jun-2006 11:52:12 UTC
Last Updated On:30-Jun-2006 11:53:14 UTC
Expiration Date:30-Jun-2007 11:52:12 UTC
Sponsoring Registrar:Beijing Innovative Linkage Technology Ltd.
(R1292-LROR)
Status:TRANSFER PROHIBITED
Registrant ID:CTXS476A3SADLAX
Registrant Name:Chuyi ZHU
Registrant Organization:Chuyi ZHU
Registrant Street1:379 West Yingze Boulevard
Registrant Street2:
Registrant Street3:
Registrant City:Taiyuan
Registrant State/Province:SX
Registrant Postal Code:030024
Registrant Country:CN
Registrant Phone:+86.3516010332
Registrant Phone Ext.:
Registrant FAX:+86.3516010332
Registrant FAX Ext.:
Registrant Email: vince_stebbins[]hotmail.com
Admin ID:CTWFY6FRAF65OOW
Admin Name:Chuyi ZHU
Admin Organization:Chuyi ZHU
Admin Street1:379 West Yingze Boulevard
Admin Street2:
Admin Street3:
Admin City:Taiyuan
Admin State/Province:SX
Admin Postal Code:030024
Admin Country:CN
Admin Phone:+86.3516010332
Admin Phone Ext.:
Admin FAX:+86.3516010332
Admin FAX Ext.:
Admin Email: vince_s...@hotmail.com
Tech ID:CT8KZAESP7J5E2X
Tech Name:he wenjie
Tech Organization:shenzhen zhongbaohong industrial comany
Tech Street1:706,huanandianli building,shennanzhong rd
Tech Street2:
Tech Street3:
Tech City:shenzhen
Tech State/Province:SZ
Tech Postal Code:518031
Tech Country:CN
Tech Phone:+86.75561280100
Tech Phone Ext.:
Tech FAX:+86.75561280100
Tech FAX Ext.:
Tech Email: admins...@126.com
Name Server: NS1.NEEDOGETRIDOFIT.ORG
Name Server: NS2.NEEDOGETRIDOFIT.ORG
See More "vince_stebbins[]hotmail.com" sightings:
http://groups.google.com/groups/search?q=%22vince_stebbins%40hotmail.com%22+group%3A*abuse&start=0&scoring=d&
See:
ns2.needogetridofit.org IP 61.107.16.80
ns2.needogetridofit.org has no MX records -> needogetridofit.org has no
MX records
http://www.moensted.dk/spam/?addr=61.107.16.80
http://korea.services.net/blocked.phtml?addr=61.107.16.80
IPv4 Address : 61.107.16.0-61.107.16.127
Network Name : DREAMX-LLINE-WEBCASH
Connect ISP Name : DREAMX
Organization ID : ORG265228
Org Name : WEBCASH
Name : Laehyuk Park
route: 61.107.0.0/17
descr: EnterpriseNetworks
origin: AS9457
notify: net...@epnetworks.co.kr
mnt-by: MAINT-GNG
changed: net...@gngidc.net
ASN Name: DREAMX-AS (DREAMLINE CO.) (cjdream.com)
Country IP Range: 61.96.0.0 to 61.111.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=9457
www.webcash.co.kr IP 222.122.82.16
21 SBL/ROKSO listings for IPs under the responsibility of
dreamline.co.kr
http://www.spamhaus.org/sbl/listings.lasso?isp=dreamline.co.kr
See:
ns1.needogetridofit.org IP 83.228.42.37 and 24.173.115.50
http://www.moensted.dk/spam/?addr=83.228.42.37
83.228.42.37 PTR record: 37-42-228-83.btc-net.bg
More 83.228.42.37 sightings:
http://groups.google.com/groups/search?q=83.228.42.37+group%3A*abuse
inetnum: 83.228.42.0 - 83.228.43.255
netname: ADSL-POOL-STARAZAGORA-4243
descr: ADSL POOL STARA ZAGORA
address: BTC-NET Ltd.
country: BG [Bulgaria]
route: 83.228.40.0/22
descr: Bulgarian Telecommunications Company Plc.
origin: AS8866
mnt-by: BT95-ADM
Country fraud profile: High
Country IP Range: 83.228.0.0 to 83.228.127.255
ASN Name: BTC-AS (Bulgarian Telecommunication Company Plc.)
http://www.cidr-report.org/cgi-bin/as-report?as=8866
See:
www.tdwdcg.org IP 211.95.79.126
ns1.dns.com.cn A IN 3600 218.244.47.5
ns2.dns.com.cn A IN 3600 218.244.47.6
wwww.tdwdcg.org has no MX records -> tdwdcg.org has no MX records
http://www.moensted.dk/spam/?addr=211.95.79.126
http://www.spamhaus.org/query/bl?ip=211.95.79.126
inetnum: 211.90.0.0 - 211.97.255.255
netname: UNICOM
descr: China United Telecommunications Corporation
descr: No.133,Taiyun Building,Xidan North Street
descr: Xicheng District,Beijing,China
country: CN
route: 211.95.0.0/17
descr: China United Telecom
origin: AS9800
mnt-by: MAINT-AS9800
changed: jin...@bj.cnuninet.net
ASN Name: UNICOM (CHINA UNICOM)
Country IP Range: 211.80.0.0 to 211.95.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=9800
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL43771
211.95.79.126/32 is listed on the Spamhaus Block List (SBL)
25-Jun-2006 16:37 GMT | SR22
Spammer webhosting - fiejak.org
4 SBL listings for IPs under the responsibility of cnuninet.com
http://www.spamhaus.org/sbl/listings.lasso?isp=cnuninet.com
Let see whois.publicinterestregistry.net:
Domain ID:D116828563-LROR
Domain Name: TDWDCG.ORG
Created On:17-Feb-2006 22:26:06 UTC
Last Updated On:27-Jun-2006 08:54:54 UTC
Expiration Date:17-Feb-2007 22:26:06 UTC
Sponsoring Registrar:Beijing Innovative Linkage Technology Ltd.
(R1292-LROR)
Status:OK
Registrant ID:CTGH70SF17UYQGE
Registrant Name:Lixing JIANG
Registrant Organization:Lixing JIANG
Registrant Street1:272 Mingyang Road
Registrant Street2:
Registrant Street3:
Registrant City:Tsingtao
Registrant State/Province:SH
Registrant Postal Code:266565
Registrant Country:CN
Registrant Phone:+86.5326086148
Registrant Phone Ext.:
Registrant FAX:+86.5326086148
Registrant FAX Ext.:
Registrant Email: antwan_leclair[]hotmail.com
Admin ID:CTMOU6SOUQ6ZEJR
Admin Name:Lixing JIANG
Admin Organization:Lixing JIANG
Admin Street1:272 Mingyang Road
Admin Street2:
Admin Street3:
Admin City:Tsingtao
Admin State/Province:SH
Admin Postal Code:266565
Admin Country:CN
Admin Phone:+86.5326086148
Admin Phone Ext.:
Admin FAX:+86.5326086148
Admin FAX Ext.:
Admin Email: antwan_...@hotmail.com
Tech ID:CTRU4S6MQJIHQXH
Tech Name:he wenjie
Tech Organization:shenzhen zhongbaohong industrial comany
Tech Street1:706,huanandianli building,shennanzhong rd
Tech Street2:
Tech Street3:
Tech City:shenzhen
Tech State/Province:SZ
Tech Postal Code:518031
Tech Country:CN
Tech Phone:+86.75561280100
Tech Phone Ext.:
Tech FAX:+86.75561280100
Tech FAX Ext.:
Tech Email: sup...@speed123.com
Name Server: NS1.DNS.COM.CN
Name Server: NS2.DNS.COM.CN
More tdwdcg.org sightings:
http://groups.google.com/groups/search?q=tdwdcg.org+group%3A*abuse
Read more Discount Pharmacy botnet => mroeseetomroonly.org:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/8fbe818ad81d3a7d
AND:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/55e524e969fe5993
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: