[email] [drugs - MyCanadianPharmacy] (inforavel.com) Medications that you need!
TomezNet
IP 68.184.59.102 68-184-59-102.dhcp.mtgm.al.charter.com
(at ns2.al.charter.com / charter.net)
Spamvert:
inforavel.com IP 218.26.252.182
(SBL45708 - ROK3095) (at cncgroup-sx)
Yambo Pharmacy image hosting:
http://194.145.201.202:8080/p/images/
IP 194.145.201.202 => ts4-202.twistspace.com
(SBL45225 - ROK3095) (at compukos.nl)
Yambo Financials drugs spam (Viagra / Cialis pills at Canadian
Pharmacy)
More Yambo MyCanadianPharmacy aka MyCanadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22MyCanadianPharmacy%22+group%3A*abuse&start=0&scoring=d&
Plenty of Forged certificates and logos.
More info below:
====================
X-SID-PRA: Carcinogen D. Guzzles <ti...@gmurzynska.com>
X-SID-Result: TempError
X-Message-Info: txF49lGdW43RQUvPzPU7nIql/++ssiyVtNOWYHo5+GA=
Received: from tomts48-srv.bellnexxia.net ([209.226.175.192]) by
bay0-pamc1-f10.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sun, 20 Aug 2006 09:11:14 -0700
Received: from [MUNGED]
by toip1.bellnexxia.net with ESMTP; 20 Aug 2006 12:11:10 -0400
Received: (qmail 3186 invoked by uid 110); 20 Aug 2006 12:11:09 -0400
Delivered-To: [MUNGED]
Received: (qmail 3131 invoked from network); 20 Aug 2006 12:11:07 -0400
Received: from 68-184-59-102.dhcp.mtgm.al.charter.com (HELO 141098712)
(68.184.59.102)
by [MUNGED] with SMTP; 20 Aug 2006 12:11:07 -0400
Received: from gmurzynska.com (144901456 [144901328])
by glenndierkes.com (Qmailv1) with ESMTP id 970C418F4C
for <[MUNGED]>; Sun, 20 Aug 2006 12:09:25 -0700
Date: Sun, 20 Aug 2006 12:09:25 -0700
From: "Carcinogen D. Guzzles" <ti...@gmurzynska.com>
X-Mailer: The Bat! (v2.00.9) Personal
X-Priority: 3
Message-ID: <4293577091.2...@gmurzynska.com>
To: [MUNGED]
Subject: Medications that you need!
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-milter (http://amavis.org/)
Return-Path: ti...@gmurzynska.com
X-OriginalArrivalTime: 20 Aug 2006 16:11:14.0382 (UTC)
FILETIME=[429286E0:01C6C473]
Don't want to expose your private life? There is no need to go to your
local drug store! All medications you can find in US Drug stores! We
have pills for any disease: ED, Weight loss, Antibiotics etc. Instant
shipping, perfect support!
And improve your sexual life! Only Confidential purchase. Verified by
VISA!
-- END OF SPAM --
Plenty of Forged certificates and logos.
* PharmacyChecker
CEO/President: Jack Poppins
My Canadian Pharmacy Corp.
1592 Wilson Avenue,
Toronto, ON M3L 1A6
* BBBOnLine Reliability
* Secure Site Seal / Pharmacy is a Soltrus Secure Site
* Verified by Visa
* CIPA Membership (The Canadian International Pharmacy Association)
See:
IP 68.184.59.102 68-184-59-102.dhcp.mtgm.al.charter.com
http://www.moensted.dk/spam/?addr=68.184.59.102
http://spamcop.net/w3m?action=checkblock&ip=68.184.59.102
Charter Communications CHARTER-NET-7BLK (NET-68-184-0-0-1)
68.184.0.0 - 68.191.255.255
Charter Communications BRMGHM-AL-68-184-48 (NET-68-184-48-0-1)
68.184.48.0 - 68.184.63.255
OrgName: Charter Communications
OrgID: CC04
NetRange: 68.184.48.0 - 68.184.63.255
CIDR: 68.184.48.0/20
NetName: BRMGHM-AL-68-184-48
NetHandle: NET-68-184-48-0-1
route: 68.184.48.0/20
descr: Broadwing Communications, LLC
1122 Capital of Texas Highway South
Austin, TX 78746
origin: AS20115
remarks: BRW Route
mnt-by: MAINT-AS6395
changed: dn...@broadwing.com
ASN: 20115
ASN Name: CHARTER-NET-HKY-NC
Country IP Range: 68.184.0.0 to 68.191.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=20115
22 SBL/ROKSO listings for IPs under the responsibility of charter.com
http://www.spamhaus.org/sbl/listings.lasso?isp=charter.com
See:
inforavel.com IP 218.26.252.182
ns1.inforavel.com A IN 591 218.26.252.182
ns2.inforavel.com A IN 591 218.26.252.182
ns3.inforavel.com A IN 591 230.17.57.36
ns1.dartnet.info [201.6.155.6 (NO GLUE)] [BR]
ns1.wizardup.info [212.52.166.78 (NO GLUE)] [HU]
ns2.lofhick.info [209.102.132.41 (NO GLUE)] [US]
ns2.molefancy.info [211.230.186.96 (NO GLUE)] [KR]
[inforavel.com has 1 MX record mail.inforavel.com.(10)]
http://www.moensted.dk/spam/?addr=218.26.252.182
http://www.spamhaus.org/query/bl?ip=218.26.252.182
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45708
218.26.252.182/32 is listed on the Spamhaus Block List (SBL/ROKSO)
20-Aug-2006 07:15 GMT | SR02
Yambo Financials
eagerface.com etc.
"U.S. Drugs" in the spam.
1 SBL/ROKSO listings for IPs under the responsibility of cncgroup-sx
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-sx
inetnum: 218.26.0.0 - 218.26.255.255
netname: CNCGROUP-SX
descr: China Network Communications Group Corporation
route: 218.26.0.0/16
descr: CNC Group
descr: CNC Group CHINA169 Shanxi Province Network
origin: AS4837
mnt-by: MAINT-AS4837
changed: I...@cnc-noc.net
ASN: 4837
ASN Name: CHINA169-Backbone (CNCGROUP China169 Backbone)
Country IP Range: 218.0.0.0 to 218.31.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4837
Let see whois:
Registrar: THE REGISTRY AT INFO AVENUE D/B/A IA REGISTRY
Registration Service Provided By: SPIRITDOMAINS/IAREGISTRY
Contact: +1.8779322339
Website: http://www.spiritdomains.com
Domain Name: INFORAVEL.COM
Registrant:
Gill Darie
Gill Darie (arieyuop[]yahoo.com)
1400 W Lincoln Hwy
Dekalb
Illinois,60115
US
Tel. +815.7480515
Creation Date: 29-Jul-2006
Expiration Date: 29-Jul-2007
Domain servers in listed order:
ns2.lofhick.info
ns1.dartnet.info
ns2.molefancy.info
ns1.wizardup.info
Administrative Contact:
Gill Darie
Gill Darie (arie...@yahoo.com)
1400 W Lincoln Hwy
Dekalb
Illinois,60115
US
Tel. +815.7480515
Technical Contact:
Gill Darie
Gill Darie (arie...@yahoo.com)
1400 W Lincoln Hwy
Dekalb
Illinois,60115
US
Tel. +815.7480515
Billing Contact:
Gill Darie
Gill Darie (arie...@yahoo.com)
1400 W Lincoln Hwy
Dekalb
Illinois,60115
US
Tel. +815.7480515
Status:ACTIVE
See Yambo Financials Image spam hosting:
IP 194.145.201.202 => ts4-202.twistspace.com
194.145.201.202 PTR record: ts4-202.twistspace.com
at ns2.twistspace.com
More 194.145.201.202 sightings:
http://groups.google.com/groups/search?q=194.145.201.202+group%3A*abuse
http://www.spamhaus.org/query/bl?ip=194.145.201.202
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45225
1 SBL/ROKSO listings for IPs under the responsibility of compukos.nl
http://www.spamhaus.org/sbl/listings.lasso?isp=compukos.nl
See:
ns1.dartnet.info IP 201.6.155.6 => SBL42469
201.6.155.6 PTR record: c9069b06.static.spo.virtua.com.br
at dns2.virtua.com.BR
More dartnet.info sightings:
http://groups.google.com/groups/search?q=dartnet.info+group%3A*abuse&start=0&scoring=d&
See:
ns1.wizardup.info IP 212.52.166.78 => SBL39594
212.52.166.78 PTR record: bongeszde.hu
at dns2.hu
More wizardup.info sightings:
http://groups.google.com/groups/search?q=wizardup.info+group%3A*abuse&start=0&scoring=d&
See:
ns2.lofhick.info IP 209.102.132.41 => SBL44181
209.102.132.41 PTR record: 209-102-132-41.adsl.gulftel.net
at dns1.madisonriver.net
More lofhick.info sightings:
http://groups.google.com/groups/search?q=lofhick.info+group%3A*abuse&start=0&scoring=d&
See:
ns2.molefancy.info IP 211.230.186.96
No PTR records exist for 211.230.186.96 at rev2.kornet.net
More molefancy.info sightings:
http://groups.google.com/groups/search?q=molefancy.info+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/11bd2601fdcf76f0
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/22b06036b87abbaa
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: