[email] [drugs - Legal RX] (sonsale.com - 213.254.61.238 - dartnet.info - wizardup.info - lofhick.info - molefancy.info) International Legal RX
TomezNet
IP 124.101.230.247 p6247-ipbf1102marunouchi.tokyo.ocn.ne.jp
(at ns-kg002.ocn.ad.jp / ocn.ne.jp)
Spamvert:
sonsale.com IP 220.130.39.67
(SBL45154 - SBL45717 / ROK3095) (at hinet.net)
NEW Yambo Pharmacy image hosting:
http://213.254.61.238:8080/legalrx/images/
IP 213.254.61.238
(at planet-ic.de)
More Legal RX Medications sightings:
http://groups.google.com/groups?q=%22Legal+RX+Medications%22+group%3A*abuse&start=0&scoring=d&
Copyright 1994-2006 © International Legal RX medications All right
reserved.
More info below:
====================
X-SID-PRA: Psychokinesis L. Merrick <Ssid...@gouker.net>
X-SID-Result: TempError
X-Message-Info: txF49lGdW42yG3f8mpRi55sqPNdxQvGVXp5pgh0XSYk=
Received: from tomts12-srv.bellnexxia.net ([209.226.175.56]) by
bay0-pamc1-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Tue, 22 Aug 2006 12:47:24 -0700
Received: from [MUNGED]
by toip2.bellnexxia.net with ESMTP; 22 Aug 2006 15:47:20 -0400
Received: (qmail 20238 invoked by uid 110); 22 Aug 2006 15:47:19 -0400
Delivered-To: [MUNGED]
Received: (qmail 20199 invoked from network); 22 Aug 2006 15:47:19
-0400
Received: from p6247-ipbf1102marunouchi.tokyo.ocn.ne.jp (HELO
143511496) (124.101.230.247)
by [MUNGED] with SMTP; 22 Aug 2006 15:47:19 -0400
Received: from gouker.net (144264504 [145248248])
by p6247-ipbf1102marunouchi.tokyo.ocn.ne.jp (Qmailv1) with ESMTP id
EAEBFB88F8
for <[MUNGED]>; Tue, 22 Aug 2006 15:45:32 -0700
Date: Tue, 22 Aug 2006 15:45:32 -0700
From: "Psychokinesis L. Merrick" <Ssid...@gouker.net>
X-Mailer: The Bat! (v2.00.6) Personal
X-Priority: 3
Message-ID: <2152010057.2...@gouker.net>
To: [MUNGED]
Subject: International Legal RX
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----------D39F57F69D4EF77"
X-AntiVirus: OK! AntiVir MailGate Version 2.0.1; AVE: 6.15.0.0; VDF:
6.15.0.6
Return-Path: Ssid...@gouker.net
X-OriginalArrivalTime: 22 Aug 2006 19:47:25.0290 (UTC)
FILETIME=[CAA984A0:01C6C623]
This is a multi-part message in MIME format.
------------D39F57F69D4EF77
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Welcome to International RX!
- Best quality drugs
- Special Internet prices
- Fast and discreet worldwide shipping
- Friendly customer support
Men's Health
Anti-Depressants
Pain Relief
General health
Weight loss
Anti-biotics
Anti-herpes
Women's health
Anti-diabetic
Blood Pressure/Cholesterol
Anti-Allergic/Asthma
Anti-Acidity
View Full Products List
http://
------------D39F57F69D4EF77
Content-Type: text/html
Content-Transfer-Encoding: 7bit
<html>
<body>
<font color="#333333"><strong>Welcome to International RX!</strong><br>
- Best quality drugs <br>
- Special Internet prices <br>
- Fast and discreet worldwide shipping <br>
- Friendly customer support
<p>Men's Health <br>
Anti-Depressants <br>
Pain Relief <br>
General health <br>
Weight loss <br>
Anti-biotics <br>
Anti-herpes <br>
Women's health <br>
Anti-diabetic <br>
Blood Pressure/Cholesterol <br>
Anti-Allergic/Asthma <br>
Anti-Acidity </p>
</font>
<p><font color="#333333"><a href="http://sonsale.com/">View Full
Products List</a></font></p>
</body>
</html>
------------D39F57F69D4EF77--
-- END OF SPAM --
See forged site certificates and logos:
* BBBOnLine Reliability Participation Confirmed
BBBOnLine Reliability
Participation Confirmed For Pharmacy
Participant through 12/30/2007
* Best international Pharma site
USA
Fontana, CA 92337
Cheshire 12/2
* Verisign Secure Site
Intenational Legal RX Medications is a Soltrus Secure Site
Name: Intenational Legal RX Medications
Status: Valid
Validity Period: 13-SEP-05 - 13-SEP-06
Server ID Information:
Country = US
State = UT
Locality = Layton
Organization = Technical Consultants and Experts Group Inc
Organizational Unit = TCE Group
Organizational Unit = Terms of use at Verisign (c) 04
Organizational Unit = Authenticated by Verisign
Organizational Unit = Member, VeriSign Trust Network
Common Name = Intenational Legal RX Medications
See:
IP 124.101.230.247 p6247-ipbf1102marunouchi.tokyo.ocn.ne.jp
http://www.moensted.dk/spam/?addr=124.101.230.247
http://www.spamhaus.org/query/bl?ip=124.101.230.247
inetnum: 124.96.0.0 - 124.103.255.255
netname: OCN
descr: NTT Communications Corporation
descr: 1-6 Uchisaiwai-cho 1-chome Chiyoda-ku, Tokyo 100-8019
Japan
country: JP [Japan]
route: 124.96.0.0/13
descr: OCN (AS4713) CIDR BLOCK 79
NTT Communications Corporation
1-1-6 Uchisaiwai-cho, Chiyoda-ku
Tokyo 100-8019 JAPAN
admin-c: Ichiro MIZUKOSHI
tech-c: Tomoya YOSHIDA
origin: AS4713
mnt-by: MAINT-AS4713
changed: ad...@ocn.ad.jp
ASN: 4713
ASN Name: APNIC-AS-BLOCK
Country IP Range: 124.96.0.0 to 124.103.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4713
15 SBL/ROKSO listings for IPs under the responsibility of ocn.ne.jp
http://www.spamhaus.org/sbl/listings.lasso?isp=ocn.ne.jp
See:
sonsale.com IP 220.130.39.67
ns1.dartnet.info [201.6.155.6 (NO GLUE)] [BR]
ns1.wizardup.info [212.52.166.78 (NO GLUE)] [HU]
ns2.lofhick.info [209.102.132.41 (NO GLUE)] [US]
ns2.molefancy.info [201.231.50.189 (NO GLUE)] [AR]
NS records at nameservers are:
ns1.sonsale.com [220.130.39.67] [TTL=600]
ns2.sonsale.com [220.130.39.67] [TTL=600]
ns3.sonsale.com [109.51.200.45] [TTL=600]
[sonsale.com has 1 MX record mail.sonsale.com (10)]
http://www.moensted.dk/spam/?addr=220.130.39.67
http://www.spamhaus.org/query/bl?ip=220.130.39.67
More 220.130.39.67 sightings:
http://groups.google.com/groups/search?q=220.130.39.67+group%3A*abuse&start=0&scoring=d&
220.130.39.67 PTR record: 220-130-39-67.HINET-IP.hinet.net
vns1.hinet.net
inetnum: 220.129.0.0 - 220.143.255.255
netname: HINET-NET
country: TW [Taiwan]
descr: CHTD, Chunghwa Telecom Co.,Ltd.
descr: Data-Bldg.6F, No.21, Sec.21, Hsin-Yi Rd.
descr: Taipei Taiwan 100
admin-c: HN27-AP
tech-c: HN28-AP
status: ALLOCATED PORTABLE
changed: hostm...@twnic.net
e-mail: network...@hinet.net
inetnum: 220.130.39.0 - 220.130.39.255
netname: HINET-NET
descr: Chunghwa Telecom Data Communication Business Group
changed: fkc...@ms1.hinet.net
route: 220.128.0.0/12
descr: (HiNet) Chunghwa Telecom Co., Ltd.
origin: AS3462
member-of: RS-COMM_NSFNET
mnt-by: MAINT-AS3462
changed: cyk...@ms1.hinet.net
ASN: 3462
ASN Name: HINET (Data Communication Business Group)
Country IP Range: 220.128.0.0 to 220.143.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=3462
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45154
220.130.39.0/24 is listed on the Spamhaus Block List (SBL/ROKSO)
10-Aug-2006 07:18 GMT | SR23
Yambo Financials
Spam webhosting / compromised host @ 220.130.39.67
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45717
220.130.39.67/32 is listed on the Spamhaus Block List (SBL/ROKSO)
20-Aug-2006 09:31 GMT | SR02
Yambo Financials
http://urbdgq.wellfault.net/legalrx/?
53 SBL/ROKSO listings for IPs under the responsibility of hinet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=hinet.net
Let see whois.iaregistry.com:
Registrar: THE REGISTRY AT INFO AVENUE D/B/A IA REGISTRY
Registration Service Provided By: SPIRITDOMAINS/IAREGISTRY
Contact: +1.8779322339
Website: http://www.spiritdomains.com
Domain Name: SONSALE.COM
Registrant:
Abramovszki Alexandru
Abramovszki Alexandru (exavszaq[]yahoo.com)
5959 Bonhomme Rd
Houston
Texas,77036
US
Tel. +713.7826540
Creation Date: 18-Jul-2006
Expiration Date: 18-Jul-2007
Domain servers in listed order:
ns2.molefancy.info
ns2.lofhick.info
ns1.wizardup.info
ns1.dartnet.info
Administrative Contact:
Abramovszki Alexandru
Abramovszki Alexandru (exav...@yahoo.com)
5959 Bonhomme Rd
Houston
Texas,77036
US
Tel. +713.7826540
Technical Contact:
Abramovszki Alexandru
Abramovszki Alexandru (exav...@yahoo.com)
5959 Bonhomme Rd
Houston
Texas,77036
US
Tel. +713.7826540
Billing Contact:
Abramovszki Alexandru
Abramovszki Alexandru (exav...@yahoo.com)
5959 Bonhomme Rd
Houston
Texas,77036
US
Tel. +713.7826540
Status:ACTIVE
See:
NEW Yambo Pharmacy image hosting:
http://213.254.61.238:8080/legalrx/images/
IP 213.254.61.238
http://www.moensted.dk/spam/?addr=213.254.61.238
inetnum: 213.254.32.0 - 213.254.63.255
org: ORG-PG4-RIPE
netname: DE-PLANET-20011109
descr: PLANET IC GmbH
country: DE [Germany]
route: 213.254.32.0/19
descr: DE-PLANET-IC-213-254-32-0-19
origin: AS8351
notify: guar...@p4.net
mnt-by: PLANET-MNT
changed: bu...@planet-ic.de
ASN: 8351
ASN Name: PLANET-DE (AS for PLANET IC GmbH)
Country IP Range: 213.254.32.0 to 213.254.63.255
http://www.cidr-report.org/cgi-bin/as-report?as=8351
1 SBL/ROKSO listings for IPs under the responsibility of planet-ic.de
http://www.spamhaus.org/sbl/listings.lasso?isp=planet-ic.de
See:
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL42807
Yambo nameservers/webhosts. (213.254.47.6/32)
More 213.254.61.238 sightings:
http://groups.google.com/groups/search?q=213.254.61.238+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/d543c6670be16741
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/5c941131698166b6
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: