[email] [meds - PharmacyExpress.com] (elofanxiet.com) confirmation shoeshine
TomezNet
IP 84.5.180.194
(at cegetel.fr / cegetel.net)
Spamvert:
www.elofanxiet.com IP 61.31.214.81
(SBL34806 / SBL35716) (at tfn.net.tw)
Received at an address harvested from
Canadian Pharm Spamhaus => PharmacyExpress.com
Pharmacy Express a.k.a PharmaExpress
Technical Consultants and Experts Group Inc aka TCE Group
See More Pharmacy Express sightings:
http://groups.google.com/groups?q=%22Pharmacy+Express%22+group%3A*abuse
See Also the same spammer most recent:
relatisandi.com, anodefen.com, ebantene.com, specioser.com,
turinwads.com, pharmacyexpressgroup.com, chemistshop.com,
freighteo.manyuman.com, variousrevitalization.com,
toplevelcombination.com, mixesandtopvalue.com,
rightfromtoddlingweb.com, offamilyniceweb.com, Etc .....
More info below:
====================
X-Message-Info: moY6YVwXQ46pWxkcLZbbuhaKIRYK+4QkyWQe7VmmWXk=
Received: from tomts11-srv.bellnexxia.net ([209.226.175.55]) by
bay0-pamc1-f5.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
Sun, 11 Dec 2005 10:15:06 -0800
Received: from xxx.superb.net (HELO xxx.web-hosting.com)
(207.228.2....)
by toip4.bellnexxia.net with ESMTP; 11 Dec 2005 13:15:05 -0500
Received: from theasi.net ([84.5.180.194])
by aries.web-hosting.com (8.11.6/8.11.1) with SMTP id jBBIANU04126
for <xx..xx@xx..xx.com>; Sun, 11 Dec 2005 13:10:23 -0500 (EST)
Message-ID: <000001c5fe7e$24aba410$4899a8c0@misrule>
Reply-To: "Simonette Muse" <musosi...@theasi.net>
From: "Simonette Muse" <musosi...@theasi.net>
To: "Ingeborg Tye" <xx..xx@xx..xx.com>
Subject: Re: confirmation shoeshine
Date: Sun, 11 Dec 2005 13:10:18 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C5FE54.3BD59C10"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Originating-IP: [0]
Return-Path: musosi...@theasi.net
X-OriginalArrivalTime: 11 Dec 2005 18:15:06.0722 (UTC)
FILETIME=[D07E9C20:01C5FE7E]
This is a multi-part message in MIME format.
------=_NextPart_000_0001_01C5FE54.3BD59C10
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0002_01C5FE54.3BD59C10"
------=_NextPart_001_0002_01C5FE54.3BD59C10
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
=20
http://www.elofanxiet.com
=20
=20
the cart. Big Rex, youre one bad dog, buddy, said the driver in a
half-loud, very Southern voice. Whatd you drag out of there, you dumb
bastard? The brass-plated asshole would shave your coat for messing up
his eestate! ... Rex? Rex, you come here, you fuckin hound! The man
grabbed the limb and pulled it off the road under the pine tree into
the
shadows. Rex, you hear me! You humpin knotholes, you horny stud? Stay
completely still and put your arms out in front of you, said Jason
Bourne, walking into view. Holy shit! Who are you? Someone who doesnt
give a damn whether you live or die, replied the intruder calmly. You
got a gun! I can see it!
------=_NextPart_001_0002_01C5FE54.3BD59C10
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV> </DIV>
<DIV><A =
href=3D"http://www.elofanxiet.com">http://www.elofanxiet.com</A></DIV>
<DIV> </DIV>
<DIV><IMG src=3D"cid:000101c5fe7e$249d5fb8$4899a8c0@misrule"></DIV>
<DIV></DIV>
<DIV> </DIV>
<DIV>the cart.
Big Rex, youre one bad dog, buddy, said the driver in a half-loud,
very Southern voice. Whatd you drag out of there, you dumb bastard?
The brass-plated asshole would shave your coat for messing up his
eestate! ... Rex? Rex, you come here, you fuckin hound! The man
grabbed the limb and pulled it off the road under the pine tree into
the
shadows. Rex, you hear me! You humpin knotholes, you horny stud?
Stay completely still and put your arms out in front of you, said
Jason Bourne, walking into view.
Holy shit! Who are you?
Someone who doesnt give a damn whether you live or die, replied
the intruder calmly.
You got a gun! I can see it!</DIV></BODY></HTML>
------=_NextPart_001_0002_01C5FE54.3BD59C10--
------=_NextPart_000_0001_01C5FE54.3BD59C10
Content-Type: image/gif
Content-Transfer-Encoding: base64
Content-ID: <000101c5fe7e$249d5fb8$4899a8c0@misrule>
*** REMOVED Attachment: image5.gif (< 0.01 MB - 2k) ***
------=_NextPart_000_0001_01C5FE54.3BD59C10--
From: "Simonette Muse" <musosi...@theasi.net>
Reply-To: "Simonette Muse" <musosi...@theasi.net>
Date: Sun, 11 Dec 2005 13:10:18 -0500
To: "Ingeborg Tye" <xx..xx@xx..xx.com>
Subject: Re: confirmation shoeshine
the cart. Big Rex, youre one bad dog, buddy, said the driver in a
half-loud, very Southern voice. Whatd you drag out of there, you dumb
bastard? The brass-plated asshole would shave your coat for messing up
his eestate! ... Rex? Rex, you come here, you fuckin hound! The man
grabbed the limb and pulled it off the road under the pine tree into
the shadows. Rex, you hear me! You humpin knotholes, you horny stud?
Stay completely still and put your arms out in front of you, said Jason
Bourne, walking into view. Holy shit! Who are you? Someone who doesnt
give a damn whether you live or die, replied the intruder calmly. You
got a gun! I can see it!
-- END OF SPAM --
More Technical Consultants and Experts Group sightings:
http://groups.google.com/groups?q=%22Technical+Consultants+and+Experts+Group%22+group%3A*abuse
More PharmacyExpress.com sightings:
http://groups.google.com/groups?q=PharmacyExpress.com+group%3A*abuse
See:
IP 84.5.180.194
http://www.moensted.dk/spam/?addr=84.5.180.194
inetnum: 84.4.0.0 - 84.7.216.255
netname: CEGETEL-INTERNET-RESIDENTIEL
descr: INTERNET RESIDENTIEL CEGETEL France
route: 84.5.0.0/16
descr: CEGETEL CIDR Block
descr: CEGETEL France
origin: AS8228
1 SBL listings for IPs under the responsibility of cegetel.fr
http://www.spamhaus.org/SBL/listings.lasso?isp=cegetel.fr
See:
www.elofanxiet.com IP 61.31.214.81
ns0.orredecte.com [201.49.143.64]
ns0.morreser.com [58.20.160.16]
www.elofanxiet.com has no MX records -> elofanxiet.com has no MX
records
http://www.moensted.dk/spam/?addr=61.31.214.81
More 61.31.214.81 sightings:
http://groups.google.com/groups?q=61.31.214.81+group%3A*abuse
inetnum: 61.31.0.0 - 61.31.255.255
netname: TFN-NET
descr: Taiwan Fixed Network CO.,LTD.
route: 61.31.0.0/16
descr: Proxy Announcement
origin: AS17444
remarks: Addresses from AS9924
remarks: Transit via AS17444
notify: radb_...@newworldtel.com
mnt-by: MAINT-AS17444
changed: radb_...@newworldtel.com
route: 61.31.0.0/16
descr: Taiwna Fixed Network
origin: AS9924
notify: eri...@profond.com.tw
mnt-by: MAINT-AS9924
changed: ting_...@howin.com.tw
27 SBL/ROKSO listings for IPs under the responsibility of
newworldtel.com
http://www.spamhaus.org/sbl/listings.lasso?isp=newworldtel.com
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL34806
61.31.214.0/24 is listed on the Spamhaus Block List (SBL)
24-Nov-2005 20:10 GMT | SR15
midvalue.com etc Canadian Pharm Spamhaus - dirty block
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL35716
61.31.214.81/32 is listed on the Spamhaus Block List (SBL)
10-Dec-2005 20:18 GMT | SR04
33 SBL/ROKSO listings for IPs under the responsibility of tfn.net.tw
http://www.spamhaus.org/sbl/listings.lasso?isp=tfn.net.tw
Let see whois:
Domain Name : elofanxiet.com
ICANN Registrar: YESNIC CO. LTD.
Registrant:
Name : doug windress
Email : patt...@yahoo.com
Address : 2402 NE Summit Ridge Drive
Zipcode : 98686
Nation : US
Tel : 3605467404
Fax :
Administrative Contact:
Name : doug windress
Email : patt...@yahoo.com
Address : 2402 NE Summit Ridge Drive
Zipcode : 98686
Nation : US
Tel : 3605467404
Fax :
Technical Contact:
Name : doug windress
Email : patt...@yahoo.com
Address : 2402 NE Summit Ridge Drive
Zipcode : 98686
Nation : US
Tel : 3605467404
Fax :
Name Servers:
ns0.morreser.com
ns0.orredecte.com
Dates & Status:
Created Date 2005-12-09 15:02:22 EST
Updated Date 2005-12-09 15:02:22 EST
Valid Date 2006-12-09 15:02:22 EST
Status ACTIVE
See also forged false site "certificates":
Verified by VISA
Better Business Bureau (BBB)
The Canadian International Pharmacy Association (CIPA)
Note:
All text and images located on the same website only!
See Also whois:
Domain Name : ORREDECTE.COM
ICANN Registrar: NAMEBAY
Created On : 2005-12-07
Expiration Date : 2006-12-07
Status : ACTIVE
Registrant Name : Stephen Earnhart
Registrant Street1 : 13228 lee rd
Registrant City : Trenton
Registrant State/Province : IL
Registrant Postal Code : 62293
Registrant Country : US
Admin Handle : SE93812
Admin Name : Stephen Earnhart
Admin Street1 : 13228 lee rd
Admin City : Trenton
Admin State/Province : IL
Admin Postal Code : 62293
Admin Country : US
Admin Phone : +1.6186545032
Admin Email : ball...@yahoo.com
Tech Handle : SE93812
Tech Name : Stephen Earnhart
Tech Street1 : 13228 lee rd
Tech City : Trenton
Tech State/Province : IL
Tech Postal Code : 62293
Tech Country : US
Tech Phone : +1.6186545032
Tech Email : ball...@yahoo.com
Billing Handle : SE93812
Billing Name : Stephen Earnhart
Billing Street1 : 13228 lee rd
Billing City : Trenton
Billing State/Province : IL
Billing Postal Code : 62293
Billing Country : US
Billing Phone : +1.6186545032
Billing Email : ball...@yahoo.com
Name Server : DNS1.NAMEBAY.COM
Name Server : DNS2.NAMEBAY.COM
Registrar Name : NAMEBAY
Registrar WebSite : http://www.namebay.com
See Also whois:
Domain Name : morreser.com
ICANN Registrar: YESNIC CO. LTD.
Registrant:
Name : Stephen Earnhart
Email : certa...@yahoo.com
Address : 13228 lee rd,
Zipcode : 62293
Nation : US
Tel : 6186545032
Fax :
Administrative Contact:
Name : Stephen Earnhart
Email : certa...@yahoo.com
Address : 13228 lee rd,
Zipcode : 62293
Nation : US
Tel : 6186545032
Fax :
Technical Contact:
Name : Stephen Earnhart
Email : certa...@yahoo.com
Address : 13228 lee rd,
Zipcode : 62293
Nation : US
Tel : 6186545032
Fax :
Name Servers:
Dates & Status:
Created Date 2005-12-07 14:44:28 EST
Updated Date 2005-12-07 14:44:28 EST
Valid Date 2006-12-07 14:44:28 EST
Status ACTIVE
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/81dafaf59e0dcc02
AND:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/3ec0b2a1d699d00e
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: