[email] [drugs - Canadian Pharmacy botnet] [80.232.250.171] (burnshout.hk / piotiongandesunkdes.com / chitionkdetunlionpsa.com / fionkunjerunhedase.com / gedsactunjerion.com) Global sale before new project opening!
TomezNet
IP 80.232.250.171
(at lattelekom.lv)
halcax.burnshout.hk => botnet
halcax.burnshout.hk Resolved to 59.148.163.77 to 68.122.224.54 to
69.205.236.179 to 69.253.143.21 to 76.24.246.224 to 122.34.1.62 to
124.53.243.54 to 140.116.226.138 to 211.9.160.216 to 222.100.80.107
© Copyright Canadian Pharmacy, 2003-2007. All Rights Reserved.
Much More Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
Plenty of Forged Certificates and logos as always.
Much More info below:
====================
Return-Path: <bv...@blueraytech.com.cn>
Delivered-To: [MUNGED]
Received: (qmail 13519 invoked from network); 7 Jun 2007 10:16:48
-0400
Received: from unknown (HELO ?80.232.250.171?) (80.232.250.171)
by [MUNGED] with SMTP; 7 Jun 2007 10:16:48 -0400
Return-Path: <bv...@blueraytech.com.cn>
Received: from 202.108.33.44 (HELO mx.sina.net)
by [MUNGED] with esmtp (G13G0CW70DF 8T6B)
id HVVHCF-CHIB8T-R3
for [MUNGED]; Thu, 7 Jun 2007 14:16:51 -0200
From: "Suzette Hull" <bv...@blueraytech.com.cn>
To: <[MUNGED]>
Subject: Global sale before new project opening!
Date: Thu, 7 Jun 2007 14:16:51 -0200
Message-Id: <01c7a90e$7df5de50$abfae850@bvps>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C7A927.A3431650"
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
Thread-Index: Aca6Q0A608S2HQF25CYVC13HYJ85MS==
Dear valued member.
Extra discounts for our meds! Global sale before new project opening!
Our web page: http://halcax.burnshout.hk/?623397162225
Thank you and best regards
Suzette Hull
Email: bv...@blueraytech.com.cn
-- END OF SPAM --
WEB:
You may contact us at +1(210) 787-1711, please, keep your order I.D.
every time you make a call.
Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
See:
IP 80.232.250.171
http://www.moensted.dk/spam/?addr=80.232.250.171
http://cbl.abuseat.org/lookup.cgi?ip=80.232.250.171
http://www.spamhaus.org/query/bl?ip=80.232.250.171
http://www.spamhaus.org/pbl/query/PBL039376
http://dsbl.org/listing?80.232.250.171
http://spamcop.net/w3m?action=checkblock&ip=80.232.250.171
inetnum: 80.232.240.0 - 80.232.255.255
netname: LTC-HOME
descr: Address pool for LTC-HOME customers
country: LV, LATVIA
person: Edgars Tone
address: SIA "Lattelekom"
route: 80.232.128.0/17
descr: LATTELEKOM
origin: AS12578
mnt-by: AS6747-MNT
changed: armands.valdmanis[]verdi.lv
Prefix: 80.232.128.0/17
Prefix Name: LATTELEKOM
AS: 12578
AS Name: APOLLO AS LATTELEKOM APOLLO Latvia
http://www.cidr-report.org/cgi-bin/as-report?as=12578
Spamvert URL:
http://halcax.burnshout.hk/?623397162225
See:
halcax.burnshout.hk => botnet
halcax.burnshout.hk Resolved to 59.148.163.77 to 68.122.224.54 to
69.205.236.179 to 69.253.143.21 to 76.24.246.224 to 122.34.1.62 to
124.53.243.54 to 140.116.226.138 to 211.9.160.216 to 222.100.80.107
halcax.burnshout.hk has no MX records -> burnshout.hk has no MX
records
ns ns0.chitionkdetunlionpsa.com 76.104.139.174(US)
ns ns0.fionkunjerunhedase.com 208.120.41.135(US)
ns ns0.gedsactunjerion.com 69.229.238.218(US)
ns ns0.piotiongandesunkdes.com 24.238.187.40(US)
NS records at the parent servers are:
NS0.PIOTIONGANDESUNKDES.COM [65.34.221.18 (NO GLUE)] [US]
NS0.GEDSACTUNJERION.COM [70.52.60.13 (NO GLUE)] [CA]
NS0.FIONKUNJERUNHEDASE.COM [165.230.94.99 (NO GLUE)] [US]
NS0.CHITIONKDETUNLIONPSA.COM [89.212.163.153 (NO GLUE)] [SI]
SOA record [TTL=300] is:
Primary nameserver: ns0.piotiongandesunkdes.com
Hostmaster E-mail address:
Serial #: 0
4 MX records are:
ns0.piotiongandesunkdes.com. and ns0.gedsactunjerion.com. both resolve
to 0.0.0.0.
ns0.piotiongandesunkdes.com. and ns0.chitionkdetunlionpsa.com. both
resolve to 0.0.0.0.
ns0.piotiongandesunkdes.com. and ns0.fionkunjerunhedase.com. both
resolve to 0.0.0.0.
ns0.gedsactunjerion.com. and ns0.chitionkdetunlionpsa.com. both
resolve to 0.0.0.0.
ns0.gedsactunjerion.com. and ns0.fionkunjerunhedase.com. both resolve
to 0.0.0.0.
ns0.chitionkdetunlionpsa.com. and ns0.fionkunjerunhedase.com. both
resolve to 0.0.0.0.
www.burnshout.hk A record is:
www.burnshout.hk A 222.111.193.43 [TTL=300] [KR]
www.burnshout.hk A 59.10.64.36 [TTL=300] [KR]
www.burnshout.hk A 165.230.94.99 [TTL=300] [US]
www.burnshout.hk A 67.177.206.113 [TTL=300] [US]
www.burnshout.hk A 70.230.178.21 [TTL=300] [US]
www.burnshout.hk A 142.217.199.123 [TTL=300] [CA]
www.burnshout.hk A 140.115.35.130 [TTL=300] [TW]
www.burnshout.hk A 222.100.80.107 [TTL=300] [KR]
www.burnshout.hk A 220.121.183.150 [TTL=300] [KR]
www.burnshout.hk A 222.111.193.19 [TTL=300] [KR]
Let see whois:
Domain Name: BURNSHOUT.HK
Contract Version: HKDNR latest version
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): MR TOM SAMSSON
Holder Chinese Name:
Email: johnews_u...@nycmail.com
Domain Name Commencement Date: 05-06-2007
Country: US
Expiry Date: 05-06-2008
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1905444T
Technical Contact:
First name: TOM
Last name: SAMSSON
Company Name: TOM SAMSSON
Name Servers Information:
NS0.FIONKUNJERUNHEDASE.COM
NS0.GEDSACTUNJERION.COM
NS0.PIOTIONGANDESUNKDES.COM
NS0.CHITIONKDETUNLIONPSA.COM
More burnshout.hk sightings:
http://groups.google.com/groups/search?q=burnshout.hk+group%3A*abuse&qt_s=Search
See:
NS0.PIOTIONGANDESUNKDES.COM IP 65.34.221.18
NS0.PIOTIONGANDESUNKDES.COM has no MX records ->
PIOTIONGANDESUNKDES.COM has no MX records
http://www.moensted.dk/spam/?addr=65.34.221.18
More PIOTIONGANDESUNKDES.COM sightings:
http://groups.google.com/groups/search?q=PIOTIONGANDESUNKDES.COM+group%3A*abuse&start=0&scoring=d&
See:
NS0.GEDSACTUNJERION.COM IP 70.52.60.13
NS0.GEDSACTUNJERION.COM has no MX records -> GEDSACTUNJERION.COM has
no MX records
http://www.moensted.dk/spam/?addr=70.52.60.13
More GEDSACTUNJERION.COM sightings:
http://groups.google.com/groups/search?q=GEDSACTUNJERION.COM+group%3A*abuse&start=0&scoring=d&
See:
NS0.FIONKUNJERUNHEDASE.COM IP 165.230.94.99
NS0.FIONKUNJERUNHEDASE.COM has no MX records -> FIONKUNJERUNHEDASE.COM
has no MX records
http://www.moensted.dk/spam/?addr=165.230.94.99
More FIONKUNJERUNHEDASE.COM sightings:
http://groups.google.com/groups/search?q=FIONKUNJERUNHEDASE.COM+group%3A*abuse&start=0&scoring=d&
See:
NS0.CHITIONKDETUNLIONPSA.COM IP 89.212.163.153
NS0.CHITIONKDETUNLIONPSA.COM has no MX records ->
CHITIONKDETUNLIONPSA.COM has no MX records
http://www.moensted.dk/spam/?addr=89.212.163.153
More CHITIONKDETUNLIONPSA.COM sightings:
http://groups.google.com/groups/search?q=CHITIONKDETUNLIONPSA.COM+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/3490a573f7224292
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/f2175dcdedce9bf2
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: