[email] [meds - PharmacyExpress.com] (ajersau.com) Re: Trojan asseverate
TomezNet
IP 218.9.191.162
(at CNCGROUP-HL)
Spamvert:
www.ajersau.com IP 221.7.209.69
(SBL35655 / SBL35677) (at cncgroup-gx)
www.PharmacyExpress.com IP 203.97.56.43
www.expressgroup.co.nz IP 203.97.56.43
(at manux.co.nz / telstraclear.co.nz)
Canadian Pharm Spamhaus => PharmacyExpress.com
Pharmacy Express a.k.a PharmaExpress
Pyxis Holdings Limited and/or Express Group Limited
Technical Consultants and Experts Group Inc aka TCE Group
Forged false site "certificates"
Logos and support by Visa and MasterCard
Visa, CIPA (Licence #91959), BBB (Participant through 12/30/2005),
Verisign (Validity Period: 13-OCT-04 - 13-OCT-05)
PHARMACYEXPRESS.CO.NZ / CHEMISTSHOP.COM / expressgroup.co.nz
See Also the same spammer most recent:
relatisandi.com, anodefen.com, ebantene.com, specioser.com,
turinwads.com, pharmacyexpressgroup.com, chemistshop.com,
freighteo.manyuman.com, variousrevitalization.com,
toplevelcombination.com, mixesandtopvalue.com,
rightfromtoddlingweb.com, offamilyniceweb.com, elofanxiet.com,
orredecte.com, morreser.com, inrealisti.com, needonsan.com,
estemegins.com, noculat.com, morsavem.com, chestain.com, comoconta.com,
Etc .....
All above domains websites were marked as ©2005 PharmacyExpress.com
All Rights Reserved.
Search of CIPA website did NOT verify use of CIPA Seal
http://www.ciparx.ca/
Sorry, no results found based on any criteria or method regarding any
corporate name, domain name, etc ...
Received at an address harvested from our autoresponder.
More Pharmacy Express sightings:
http://groups.google.com/groups?q=%22Pharmacy+Express%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: Melchior Matt <mattem...@hallertau.net>
X-SID-Result: TempError
X-Message-Info: moY6YVwXQ46MLOHbSVNmvxsY8nkemPVEjkz4btzEbKE=
Received: from tomts38-srv.bellnexxia.net ([209.226.175.95]) by
bay0-pamc1-f10.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
Thu, 22 Dec 2005 03:38:31 -0800
Received: from xxx.superb.net (HELO xxx.web-hosting.com)
([207.228.2....])
by toip3.bellnexxia.net with ESMTP; 22 Dec 2005 06:49:40 -0500
Received: from hallertau.net ([222.212.206.165])
by xxx.web-hosting.com (8.11.6/8.11.1) with SMTP id jBMBcOh24284
for <xx..xx@xx..xx.com>; Thu, 22 Dec 2005 06:38:25 -0500 (EST)
Message-ID: <000001c606ec$2ed8b380$1511a8c0@transceiver>
Reply-To: "Melchior Matt" <mattem...@hallertau.net>
From: "Melchior Matt" <mattem...@hallertau.net>
To: "Boleslawa Chai" <xx..xx@xx..xx.com>
Subject: Re: Trojan asseverate
Date: Thu, 22 Dec 2005 06:38:09 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C606C2.4602AB80"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Originating-IP: [0]
Return-Path: mattem...@hallertau.net
X-OriginalArrivalTime: 22 Dec 2005 11:38:31.0185 (UTC)
FILETIME=[3BCB1010:01C606EC]
This is a multi-part message in MIME format.
------=_NextPart_000_0001_01C606C2.4602AB80
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Am
Xan
Lev
VIA
So
Pro
VA
Mer
CIA
bien
ax
itra
GRA
ma
pecia=20
LIUM
idia
LIS
$120.00 (30)
$123.45 (30)
$165.95 (30)
$134.95 (30 pi
$123.45 (90)
$139.95 (90)
$161.45 (90 pi
$99.95 (30)
$169.95 (30 pi
lls)
lls)
lls)
=20
http://www.ajersau.com
------=_NextPart_000_0001_01C606C2.4602AB80
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV style=3D"FLOAT: left"><FONT face=3DArial =
size=3D3>Am<BR>Xan<BR>Lev<BR><STRONG>VIA</STRONG><BR>So<BR>Pro<BR><STRONG=
>VA</STRONG><BR>Mer<BR><STRONG>CIA</STRONG></FONT></DIV>
<DIV style=3D"FLOAT: left"><FONT face=3DArial =
size=3D3>bien<BR>ax<BR>itra<BR><STRONG>GRA</STRONG><BR>ma<BR>pecia <=
BR><STRONG>LIUM</STRONG><BR>idia<BR><STRONG>LIS</STRONG></FONT></DIV>
<DIV style=3D"FLOAT: left"><FONT face=3DArial size=3D3>$120.00 =
(30)<BR>$123.45 (30)<BR>$165.95 (30)<BR><STRONG>$134.95 (30 =
pi</STRONG><BR>$123.45 (90)<BR>$139.95 (90)<BR><STRONG>$161.45 (90 =
pi</STRONG><BR>$99.95 (30)<BR><STRONG>$169.95 (30 =
pi</STRONG></FONT></DIV>
<DIV style=3D"FLOAT: left"><FONT face=3DArial size=3D3> <BR> <BR> =
<BR><STRONG>lls)</STRONG><BR> <BR> <BR><STRONG>lls)</STRONG><BR> =
<BR><STRONG>lls)</STRONG></FONT></DIV><DIV style=3D"CLEAR: =
both"> </DIV>
<DIV><A =
href=3D"http://www.ajersau.com">http://www.ajersau.com</A></DIV></BODY></=
HTML>
------=_NextPart_000_0001_01C606C2.4602AB80--
-- END OF SPAM --
See:
IP 222.212.206.165
http://www.moensted.dk/spam/?addr=218.9.191.162
http://cbl.abuseat.org/lookup.cgi?ip=218.9.191.162
http://www.spamhaus.org/query/bl?ip=218.9.191.162
inetnum: 218.7.0.0 - 218.10.255.255
netname: CNCGROUP-HL
route: 218.9.0.0/16
descr: China Telecom heilongjiang Province
origin: AS4134
mnt-by: MAINT-AS4134
changed: li...@ns.chinanet.cn.net
1 SBL listings for IPs under the responsibility of CNCGROUP-HL
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGROUP-HL
See:
www.ajersau.com IP 221.7.209.69
ns0.ameseers.com A IN 157701 58.20.160.16
ns0.ameseers.com A IN 157701 221.7.209.69
ns0.canalsactasa.com A IN 170271 221.5.2.102
ns0.canalsactasa.com A IN 170271 201.49.143.64
www.ajersau.com has no MX records -> ajersau.com has no MX records
http://www.moensted.dk/spam/?addr=221.7.209.69
Spam source - http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=221.7.209.69
http://www.abuse.net/sbl.phtml?IP=221.7.209.69
More 221.7.209.69 sightings:
http://groups.google.com/groups?q=221.7.209.69+group%3A*abuse&start=0&scoring=d&
http://www.spamhaus.org/query/bl?ip=221.7.209.69
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL35655
221.7.209.69/32 is listed on the Spamhaus Block List (SBL)
15-Dec-2005 04:05 GMT | SR03
iseasieto.com ; etc.
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL35677
221.7.209.0/24 is listed on the Spamhaus Block List (SBL)
17-Dec-2005 19:13 GMT | SR21
China Netcom Group Dirty Block: CNC Guilin Internet network
3 SBL listings for IPs under the responsibility of cncgroup-gx
http://www.spamhaus.org/SBL/listings.lasso?isp=cncgroup-gx
Let see whois:
ICANN Registrar: NAMEBAY
Domain Name : AJERSAU.COM
Created On : 2005-12-19
Expiration Date : 2006-12-19
Status : ACTIVE
Registrant Name : Lynn Jasperse
Registrant Street1 : 823 INNES ST NE
Registrant City : GRAND RAPIDS
Registrant State/Province : MI
Registrant Postal Code : 49503-3517
Registrant Country : US
Admin Handle : LJ18556
Admin Name : Lynn Jasperse
Admin Street1 : 823 INNES ST NE
Admin City : GRAND RAPIDS
Admin State/Province : MI
Admin Postal Code : 49503-3517
Admin Country : US
Admin Phone : +1.6164517090
Admin Email : eliberatel[]yahoo.com
Tech Handle : LJ18556
Tech Name : Lynn Jasperse
Tech Street1 : 823 INNES ST NE
Tech City : GRAND RAPIDS
Tech State/Province : MI
Tech Postal Code : 49503-3517
Tech Country : US
Tech Phone : +1.6164517090
Tech Email : eliberatel[]yahoo.com
Billing Handle : LJ18556
Billing Name : Lynn Jasperse
Billing Street1 : 823 INNES ST NE
Billing City : GRAND RAPIDS
Billing State/Province : MI
Billing Postal Code : 49503-3517
Billing Country : US
Billing Phone : +1.6164517090
Billing Email : elibe...@yahoo.com
Name Server : NS0.AMESEERS.COM
Name Server : NS0.CANALSACTASA.COM
Registrar Name : NAMEBAY
Registrar WebSite : http://www.namebay.com
See:
www.PharmacyExpress.com IP 203.97.56.43
www.expressgroup.co.nz IP 203.97.56.43
dns1.manux.net.nz A IN 172800 203.97.56.42
dns2.manux.net.nz A IN 172800 210.55.16.30
mx1.manux.net.nz A IN 172800 203.97.56.42
mx2.manux.net.nz A IN 172800 210.55.16.30
Resolved www.PharmacyExpress.com to expressgroup.co.nz to 203.97.56.43
[www.PharmacyExpress.com has 2 MX records mx1.manux.net.nz (10)
mx2.manux.net.nz (20)]
http://www.moensted.dk/spam/?addr=203.97.56.43
203.97.56.43 PTR record: iguana.manux.co.nz
at dns2.clear.net.nz
inetnum: 203.97.0.0 - 203.97.127.255
netname: TELSTRACLEAR-NZ (telstraclear.co.nz)
descr: TelstraClear Ltd
country: NZ
More 203.97.56.43 sightings:
http://groups.google.com/groups?q=203.97.56.43+group%3A*abuse
Let see whois:
New Zealand Domain Name Registry Limited
domain_name: expressgroup.co.nz
query_status: 200 Active
domain_dateregistered: 2000-05-17T00:00:00+12:00
domain_datebilleduntil: 2006-05-17T18:57:41+12:00
domain_datelastmodified: 2005-06-27T19:49:26+12:00
domain_delegaterequested: yes
%
registrar_name: Domainz Limited
registrar_address1: Private Bag 1810
registrar_city: Wellington
registrar_country: NZ (NEW ZEALAND)
registrar_phone: +64 4 473 4567
registrar_fax: +64 4 473 4569
registrar_email: 4ser...@domainz.net.nz
%
registrant_contact_name: Pyxis Holdings Limited
registrant_contact_address1: PO Box 28036
registrant_contact_address2: Beckenham
registrant_contact_city: CHRISTCHURCH
registrant_contact_country: NZ (NEW ZEALAND)
registrant_contact_phone: +64 3 2090023
registrant_contact_fax: +64 3 209 0024
registrant_contact_email: jonathan[]expressgroup.co.nz
%
admin_contact_name: Jonathan Tomlinson
admin_contact_address1: PO Box 28036
admin_contact_address2: Beckenham
admin_contact_city: CHRISTCHURCH
admin_contact_country: NZ (NEW ZEALAND)
admin_contact_phone: +64 3 2090023
admin_contact_fax: +64 3 209 0024
admin_contact_email: jona...@expressgroup.co.nz
%
technical_contact_name: Manux Domain Administrator
technical_contact_address1: L1, 39 Leslie Hills Drive, PO Box 3074
technical_contact_address2: Christchurch
technical_contact_city: Christchurch
technical_contact_country: NZ (NEW ZEALAND)
technical_contact_phone: +64 33 432031
technical_contact_email: domai...@manux.co.nz
%
ns_name_01: tuatara.manux.co.nz [203.97.56.42]
ns_name_02: iguana.manux.co.nz [203.97.56.43]
More expressgroup.co.nz sightings:
http://groups.google.com/groups?q=expressgroup.co.nz+group%3A*abuse
Let see whois:
ICANN Registrar: Network Solutions Private Registration
Pyxis Holdings Limited and/or Express Group Limited
Registrant:
pyxis holdings limited
ATTN: PHARMACYEXPRESS.COM
c/o Network Solutions
P.O. Box 447
Herndon, VA. 20172-0447
Domain Name: PHARMACYEXPRESS.COM
Administrative Contact:
pyxis holdings limited
vc854...@networksolutionsprivateregistration.com
ATTN: PHARMACYEXPRESS.COM
c/o Network Solutions
P.O. Box 447
Herndon, VA 20172-0447
570-708-8780
Record expires on 18-May-2006.
Record created on 19-May-1998.
Database last updated on 22-Dec-2005 11:00:59 EST.
Domain servers in listed order:
TUATARA.MANUX.CO.NZ 203.97.56.42
IGUANA.MANUX.CO.NZ 203.97.56.43
Much More PharmacyExpress.com sightings:
http://groups.google.com/groups?q=PharmacyExpress.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/2c376e212694ac91
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: