[email] [drugs - Yambo] [221.185.38.2] (quitefull.com - jotokio.info - rupponce.com - tyroidont.com - upgoandstay.com) Good health is above wealth
TomezNet
IP 221.185.38.2 p3002-ipad04otsu.shiga.ocn.ne.jp
(at ns-kn001.ocn.ad.jp)
Spamvert:
quitefull.com IP 217.218.235.6
(SBL49572 - ROK3095 Yambo Financials) (at dci.co.ir)
More info below:
====================
X-SID-PRA: Opines F. Kindness <mary...@griffin-realtors.com>
X-Message-Info: txF49lGdW43doCoqs4Lnga29X0QfTCQWsmxbwoomakA=
Received: from tomts41-srv.bellnexxia.net ([209.226.175.98]) by
bay0-pamc1-f2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Wed, 3 Jan 2007 06:12:34 -0800
Received: from [MUNGED]
by toip18.srvr.bell.ca with ESMTP; 03 Jan 2007 09:12:29 -0500
Received: (qmail 17625 invoked by uid 110); 3 Jan 2007 09:01:37 -0500
Delivered-To: [MUNGED]
Received: (qmail 17612 invoked from network); 3 Jan 2007 09:01:36 -0500
Received: from p3002-ipad04otsu.shiga.ocn.ne.jp (HELO 144681040)
(221.185.38.2)
by [MUNGED] with SMTP; 3 Jan 2007 09:01:36 -0500
Received: from griffin-realtors.com (145130944 [143523296])
by p3002-ipad04otsu.shiga.ocn.ne.jp (Qmailv1) with ESMTP id
AAFEB643B9
for <[MUNGED]>; Wed, 03 Jan 2007 14:03:46 -0500
Date: Wed, 03 Jan 2007 14:03:46 -0500
From: "Opines F. Kindness" <mary...@griffin-realtors.com>
X-Mailer: The Bat! (v2.00.7) Personal
X-Priority: 3
Message-ID: <1246187484.2...@griffin-realtors.com>
To: Crew <[MUNGED]>
Subject: Good health is above wealth
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: Norton
Return-Path: mary...@griffin-realtors.com
X-OriginalArrivalTime: 03 Jan 2007 14:12:34.0474 (UTC)
FILETIME=[36F4C8A0:01C72F41]
The most powerful medicines for you!
Allegra - $1.32 - an antihistamine that comes in a variety of strengths
and formulations to provide relief from a wide range of seasonal
allergy symptoms.
Augmetin - $4.8 - FDA-approved antibiotic for both acute bacterial
sinusitis (ABS) and community-acquired pneumonia (CAP).
Wellbutrin SR - $3 - antidepressant used to treat depression.
Horny Goat Weed - $35.99 - Epimedium is a genus of twenty-one related
plant species. It boosts libido (sex drive), increases energy levels
and enhances recovery from exercise.
Valtrex - $4.95 - reduce the risk of spreading genital herpes
and more!
our site http://quitefull.com/
[MUNGED]
-- END OF SPAM --
Decimal results for 144681040
IP 8.159.168.80 at ns2.level3.net is decimal 144681040.
See:
IP 221.185.38.2 p3002-ipad04otsu.shiga.ocn.ne.jp
http://www.moensted.dk/spam/?addr=221.185.38.2
http://njabl.org/cgi-bin/lookup.cgi?query=221.185.38.2
http://cbl.abuseat.org/lookup.cgi?ip=221.185.38.2
http://www.spamhaus.org/query/bl?ip=221.185.38.2
inetnum: 221.184.0.0 - 221.191.255.255
netname: OCN-JPNIC-JP
descr: NTT Communications Corporation
role: Japan Network Information Center
changed: ip-a...@nic.ad.jp
inetnum: 221.185.0.0 - 221.185.255.255
netname: OCN
descr: Open Computer Network
ASN: 4713
ASN Name: APNIC-AS-BLOCK
Country (per IP registrar): JP [Japan]
Country IP Range: 221.184.0.0 to 221.191.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4713
8 SBL/ROKSO listings for IPs under the responsibility of ocn.ne.jp
http://www.spamhaus.org/sbl/listings.lasso?isp=ocn.ne.jp
See:
quitefull.com IP 217.218.235.6
ns1.jotokio.info [63.223.11.14 (NO GLUE)] [US]
ns1.rupponce.com [63.223.11.14] [TTL=172800] [US]
ns2.tyroidont.com [83.143.12.252] [TTL=172800] [IL]
ns2.upgoandstay.com [83.143.12.252] [TTL=172800] [IL]
quitefull.com has no MX records
http://www.moensted.dk/spam/?addr=217.218.235.6
http://dsbl.org/listing?217.218.235.6
http://www.spamhaus.org/query/bl?ip=217.218.235.6
Exploitable Server See: http://www.sorbs.net/lookup.shtml?217.218.235.6
More 217.218.235.6 sightings:
http://groups.google.com/groups/search?q=217.218.235.6+group%3A*abuse&start=0&scoring=d&
inetnum: 217.218.235.0 - 217.218.235.31
netname: GRS
descr: GHOSTARESH RAYANEH SHOKA CO
person: HAMED KABOODVAND
address: SHOOKA,NORTH KHAYAM STREET,QAZVIN,IRAN
phone: +98 281 332 26 61
e-mail: in...@shooka.net
route: 217.218.192.0/18
descr: TCI-IRAN via EMIX
origin: AS12880
notify: n...@emix.net.ae
mnt-by: MAINT-AS8966
changed: yaq...@emix.net.ae 20060404
source: RADB
route: 217.218.224.0/19
descr: DCI-Route
origin: As12880
mnt-by: AS12880-MNT
changed: moha...@dci.ir 20060203
source: RIPE
route: 217.218.192.0/18
descr: TCI-IRAN via EMIX
origin: AS12880
mnt-by: ETISALAT-MAINT-MCI
changed: n...@emix.net.ae
ASN: 12880
ASN Name: DCI-AS (DCI Autonomous System)
Country (per IP registrar): IR [Iran]
Country IP Range: 217.218.0.0 to 217.219.255.255
Country fraud profile: High
City (per outside source): Karaj, Tehran
http://www.cidr-report.org/cgi-bin/as-report?as=12880
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49572
217.218.235.0/27 is listed on the Spamhaus Block List (SBL/ROKSO)
02-Jan-2007 07:46 GMT | SR02
Yambo Financials.
shomfat.com etc. @ 217.218.235.6
Linux device (broadband router, wireless, firewall) hacked via weak SSH
password.
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3095
15 SBL/ROKSO listings for IPs under the responsibility of dci.co.ir
http://www.spamhaus.org/sbl/listings.lasso?isp=dci.co.ir
postmaster and abuse[]dci.co.ir are listed in rfc-ignorant.org database
Let see whois:
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Domain: quitefull.com
Registrant
Jordan Neft
Jordan Neft
ordaty6un[]yahoo.com
553 Elmwood Ave
Evanston, IL 60202 US
+1.8478691246
Administrative
Jordan Neft
Jordan Neft
orda...@yahoo.com
553 Elmwood Ave
Evanston, IL 60202 US
+1.8478691246
Billing
Jordan Neft
Jordan Neft
orda...@yahoo.com
553 Elmwood Ave
Evanston, IL 60202 US
+1.8478691246
Technical
Jordan Neft
Jordan Neft
orda...@yahoo.com
553 Elmwood Ave
Evanston, IL 60202 US
+1.8478691246
Record created on December 03, 2006
Record last updated on December 05, 2006
Record expires on December 03, 2007
Domain Name Servers:
NS1.JOTOKIO.INFO
NS2.TYROIDONT.COM
NS1.RUPPONCE.COM
NS2.UPGOANDSTAY.COM
More quitefull.com sightings:
http://groups.google.com/groups?q=quitefull.com+group%3A*abuse&start=0&scoring=d&
See:
ns1.jotokio.info IP 63.223.11.14
ns1.jotokio.info has no MX records -> [jotokio.info has 1 MX record
mail.jotokio.info (10)]
http://www.moensted.dk/spam/?addr=63.223.11.14
http://www.spamhaus.org/query/bl?ip=63.223.11.14
More 63.223.11.14 sightings:
http://groups.google.com/groups/search?q=63.223.11.14+group%3A*abuse&start=0&scoring=d&
No PTR records exist for 63.223.11.14
at ns2.wvfiber.net / ns.cais.com / pccwglobal.com
IP 63.223.11.14 => See ns1.tyroidont.com, ns1.rupponce.com
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49084
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49717
63.223.11.14/32 is listed on the Spamhaus Block List (SBL/ROKSO)
03-Jan-2007 17:08 GMT | SR21
Yambo Financials
Spammer-Controlled DNS server
8 SBL/ROKSO listings for IPs under the responsibility of pccwglobal.com
http://www.spamhaus.org/sbl/listings.lasso?isp=pccwglobal.com
More jotokio.info sightings:
http://groups.google.com/groups/search?q=jotokio.info+group%3A*abuse&start=0&scoring=d&
See:
ns1.rupponce.com IP 63.223.11.14
More rupponce.com sightings:
http://groups.google.com/groups/search?q=rupponce.com+group%3A*abuse&start=0&scoring=d&
See:
ns2.tyroidont.com IP 83.143.12.252
ns2.tyroidont.com has no MX records -> [tyroidont.com has 1 MX record
mail.tyroidont.com (10)]
http://www.moensted.dk/spam/?addr=83.143.12.252
83.143.12.252 PTR record: 12-252.vgcphc.net
at sns.vgcphc.net
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL47528
83.143.12.252/32 is listed on the Spamhaus Block List (SBL/ROKSO)
14-Dec-2006 13:52 GMT | SR20
Yambo Financials.
Yambo nameservers/webhosts
69.44.192.184 on level3/FAIRPOINT
COMMUNICATIONS/neonova.net/chouteautel.com
83.143.12.252 on VGC Communication Ltd., Nigeria, vgccl.net,vgcphc.net
1 SBL/ROKSO listings for IPs under the responsibility of vgccl.net
http://www.spamhaus.org/sbl/listings.lasso?isp=vgccl.net
More tyroidont.com sightings:
http://groups.google.com/groups/search?q=tyroidont.com+group%3A*abuse&start=0&scoring=d&
More tyroidont.com sightings:
http://groups.google.com/groups/search?q=tyroidont.com+group%3A*abuse&start=0&scoring=d&
abuse[]vgccl.net is listed in rfc-ignorant.org database
See:
ns2.upgoandstay.com IP 83.143.12.252
ns2.upgoandstay.com has no MX records -> [upgoandstay.com has 1 MX
record mail.upgoandstay.com (10)]
More upgoandstay.com sightings:
http://groups.google.com/groups/search?q=upgoandstay.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/f0940a98662253ef
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: