Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] [drugs] [88.224.28.149] (nujs.hk - transitstars.com - ourboycot.com - grisaillesag.com - perceivablenut.com - 217.170.77.210) re:Special discounts.

15 views

Skip to first unread message

TomezNet

unread,

Feb 18, 2007, 1:02:23 AM2/18/07

Received From:
IP 88.224.28.149
(at ns1.ttnet.net.tr / turktelekom.com.tr / telekom.gov.tr)

Spamvert:
nujs.hk IP 218.21.90.7
(SBL47069 - ROK3095) (at chinanet-gx)

Yambo Image Hosting:
http://217.170.77.210:8080/usd/images/theme_mc_left.jpg

IP 217.170.77.210
(SBL50632) (at ns2.spaceweb.ru / eltel.net)

Web:
Copiright © 2003-2007 USDrugs. All Rights Reserved.

More info below:
====================

X-SID-PRA: Coleman Webb <dwj...@jshs.org>
X-Message-Info: txF49lGdW40+0x9TzNyvoLTZ74/hlhGj0LyuspSaPg0=
Received: from tomts26-srv.bellnexxia.net ([209.226.175.189]) by bay0-
pamc1-f13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sat, 17 Feb 2007 11:08:46 -0800
Received: from [MUNGED]
by toip24.srvr.bell.ca with ESMTP; 17 Feb 2007 14:08:40 -0500
Received: (qmail 29765 invoked by uid 110); 17 Feb 2007 14:08:39 -0500
Delivered-To: [MUNGED]
Received: (qmail 29762 invoked from network); 17 Feb 2007 14:08:38
-0500
Received: from unknown (HELO mx-1.loosefoot.com) (88.224.28.149)
by [MUNGED] with SMTP; 17 Feb 2007 14:08:38 -0500
Return-Path: <dwj...@jshs.org>
Received: from 209.113.187.194 (HELO mail.jshs.org)
by [MUNGED] with esmtp (E1H28K0V2-@ 70FL26)
id V*AP'?-50:L(=-G9
for [MUNGED]; Sat, 17 Feb 2007 19:08:40 -0120
From: "Coleman Webb" <dwj...@jshs.org>
To: [MUNGED]
Subject: re:Special discounts.
Date: Sat, 17 Feb 2007 19:08:40 -0120
Message-ID: <01c752c7$091d8e90$6c822ecf@dwjshsm>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C752D7.CCA65E90"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4963.1700
Thread-Index: Aca6Q,?(V-7J34E2ND/?DVQ812;-8*==
X-OriginalArrivalTime: 17 Feb 2007 19:08:46.0486 (UTC)
FILETIME=[0C7D5B60:01C752C7]

This is a multi-part message in MIME format.

------=_NextPart_000_0006_01C752D7.CCA65E90
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Dear,Stop wasting time cruising around the pharmacies of your city -
just visit http://nujs.hk and buy all the necessary medication quickly
and easily with the help of our unique search engine!Up to 20% off the
price for the most widely used generic drugs by reliable USA
manufacturers. Huge number of the most essential meds (Men's Health,
Antidepressants, Pain Relievers, General Health, Weight Loss, etc)
always in stock.No scamming and frauds - 100% generic drugs at lowest
prices here - at http://nujs.hk!Coleman Webb

------=_NextPart_000_0006_01C752D7.CCA65E90
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html;
charset=3Diso-8859-1">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered
medium)">
</head>
<body>
<html>
<body bgcolor=3D"#FFFFFF" link=3D"#04255A">
Dear,<=
/p>Stop wasting time cruising
around t=
he pharmacies of your city - just visit <a href=3D"http://
nujs.hk">http://n=
ujs.hk</a> and buy all the necessary medication quickly and easily
with the=
help of our unique search engine!Up to 20% off the price for the most widely used generic drugs
by re=
liable USA manufacturers. Huge number of the most essential meds
(Men's Hea=
lth, Antidepressants, Pain Relievers, General Health, Weight Loss,
etc) alw=
ays in stock.No
scamming an=
d frauds - 100% generic drugs at lowest prices here - at <a
href=3D"http://=
nujs.hk">http://nujs.hk</a>!Coleman Webb
</body></html>
</body>
</html>

------=_NextPart_000_0006_01C752D7.CCA65E90--

-- END OF SPAM --

See:
IP 88.224.28.149

http://www.moensted.dk/spam/?addr=88.224.28.149

inetnum: 88.224.0.0 - 88.224.255.255
netname: TurkTelekom
descr: Turk Telekom ADSL-alcatel
mnt-by: as9121-mnt
notify: i...@telekom.gov.tr
notify: i...@turktelekom.com.tr

route: 88.224.0.0/17
descr: TurkTelecom
origin: AS9121
mnt-by: AS9121-MNT
changed: i...@turktelekom.com.tr
ASN: 9121
ASN Name: TTNet (TTnet Autonomous System)
Country (per IP registrar): TR [Turkey]
Country IP Range: 88.224.0.0 to 88.255.255.255
Country fraud profile: High
City (per outside source): Ankara, Ankara
http://www.cidr-report.org/cgi-bin/as-report?as=9121

14 SBL/ROKSO listings for IPs under the responsibility of ttnet.net.tr
http://www.spamhaus.org/SBL/listings.lasso?isp=ttnet.net.tr

See:
nujs.hk IP 218.21.90.7
NS2.TRANSITSTARS.COM [64.94.117.200 (NO GLUE)] [US]
NS2.GRISAILLESAG.COM [199.243.242.9 (NO GLUE)] [CA]
NS1.PERCEIVABLENUT.COM [63.223.11.14 (NO GLUE)] [US]
NS1.OURBOYCOT.COM [63.223.11.14 (NO GLUE)] [US]

nujs.hk has no MX records

http://www.moensted.dk/spam/?addr=218.21.90.7
http://www.spamhaus.org/query/bl?ip=218.21.90.7
http://www.spamhaus.org/pbl/query/PBL108119

inetnum: 218.21.64.0 - 218.21.127.255
netname: CHINANET-GX
descr: CHINANET Guangxi province network
descr: China Telecom
mnt-lower: MAINT-CHINANET-GX
changed: hostm...@ns.chinanet.cn.net
e-mail: hostm...@gx163.net
changed: lq...@chinatelecom.com.cn 20051212
mnt-by: MAINT-CHINANET

route: 218.21.64.0/18
descr: China Telecom guangxi Province
origin: AS4134
mnt-by: MAINT-AS4134
changed: li...@ns.chinanet.cn.net
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
Country (per IP registrar): CN [China]
Country IP Range: 218.0.0.0 to 218.31.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4134

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL47069
218.21.90.7/32 is listed on the Spamhaus Block List (SBL/ROKSO)

23-Nov-2006 10:04 GMT | SR02

Yambo Financials.

hacked server hosting botnet spam gang

3 SBL listings for IPs under the responsibility of chinanet-gx
http://www.spamhaus.org/sbl/listings.lasso?isp=chinanet-gx

Let see whois:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): LOLOLS KOLSS
Holder Chinese Name:
Email: DaviK...@aol.com
Domain Name Commencement Date: 2007-02-09
Country: US
Expiry Date: 2008-02-10
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1813709T

Technical Contact:
First name: JOHN
Last name: SMITH
Company Name: LOLOLS KOLSS

Name Servers Information:
NS1.PERCEIVABLENUT.COM
NS2.TRANSITSTARS.COM
NS1.OURBOYCOT.COM
NS2.GRISAILLESAG.COM

More nujs.hk sightings:
http://groups.google.com/groups/search?q=nujs.hk+group%3A*abuse

NEW Yambo Pharmacy image hosting:
http://217.170.77.210:8080/p/images/cipa2.gif

IP 217.170.77.210

217.170.77.210 PTR record: db2.sorenssystem.com
at ns2.spaceweb.ru / eltel.net

http://www.spamhaus.org/query/bl?ip=217.170.77.210

More 217.170.77.210 sightings:
http://groups.google.com/groups/search?q=217.170.77.210+group%3A*abuse&start=0&scoring=d&

inetnum: 217.170.77.0 - 217.170.77.255
netname: Internet33com
descr: Web Hosting Services
country: US
admin-c: AF1468-RIPE
tech-c: AF1468-RIPE
status: ASSIGNED PA
notify: n...@eltel.net
mnt-by: ELTEL-RIPE-MNT
changed: regi...@eltel.net
person: Adan Fernandez
address: Panama
phone: +7 507 2693431
e-mail: ad...@internet33.com

route: 217.170.64.0/20
descr: ELTEL.net
origin: AS20597
mnt-by: ELTEL-RIPE-MNT
changed: regi...@eltel.net
ASN: 20597
ASN Name: ELTEL-AS (ELTEL.net Autonomous System)
Country (per IP registrar): RU [Russian Federation]
Country IP Range: 217.170.64.0 to 217.170.95.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=20597

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL50632
217.170.77.210/32 is listed on the Spamhaus Block List (SBL/ROKSO)

30-Jan-2007 19:03 GMT | SR20

Yambo botnet image proxying/hosting (compromised sytems)

4 SBL/ROKSO listings for IPs under the responsibility of eltel.net
http://www.spamhaus.org/sbl/listings.lasso?isp=eltel.net

See:
NS2.TRANSITSTARS.COM IP 64.94.117.200

More transitstars.com sightings:
http://groups.google.com/groups/search?q=TRANSITSTARS.COM+group%3A*abuse&start=0&scoring=d&

No PTR records exist for 64.94.117.200
at ns1.sef.pnap.net / ns2.pnap.net / internap.com

See:
NS2.GRISAILLESAG.COM IP 210.34.0.101 (OLD IP 199.243.242.9)

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48902
210.34.0.101/32 is listed on the Spamhaus Block List (SBL/ROKSO)

10-Dec-2006 15:44 GMT | SR20

Yambo Financials.
Yambo nameserver (compromised system)

4 SBL/ROKSO listings for IPs under the responsibility of net.edu.cn
http://www.spamhaus.org/sbl/listings.lasso?isp=net.edu.cn

More grisaillesag.com sightings:
http://groups.google.com/groups?q=GRISAILLESAG.COM+group%3A*abuse&start=0&scoring=d&

See:
NS1.PERCEIVABLENUT.COM IP 63.223.11.14

No PTR records exist for 63.223.11.14
at ns1.wvfiber.net / ns.cais.com

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49084
63.223.11.14/32 is listed on the Spamhaus Block List (SBL/ROKSO)

02-Feb-2007 00:49 GMT | SR21

Yambo Financials.
Spam DNS Server

14 SBL/ROKSO listings for IPs under the responsibility of
pccwglobal.com
http://www.spamhaus.org/sbl/listings.lasso?isp=pccwglobal.com

More perceivablenut.com sightings:
http://groups.google.com/groups/search?q=PERCEIVABLENUT.COM+group%3A*abuse&start=0&scoring=d&

See:
NS1.OURBOYCOT.COM IP 63.223.11.14

More ourboycot.com sightings:
http://groups.google.com/groups/search?q=OURBOYCOT.COM+group%3A*abuse&start=0&scoring=d&

Cheers, Tomez

--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.

For a copy of the guidelines to this group, see:

http://www.killfile.org/~tskirvin/nana/

0 new messages