[email] [drugs - Enlarge Patch Rx] [24.81.233.4] (fonfel.com - gansans.com - rikkirs.com) Separate yourself from other men
TomezNet
IP 24.81.233.4 S0106001346ac5d9f.vs.shawcable.net
(at pd1ns2.st.vc.shawcable.net / ns8.so.cg.shawcable.net / sjrb.ca /
shaw.ca)
at Spam ignorant Shaw Communications
posible open proxies - see:
http://moensted.dk/spam/no-more-funn?addr=71.31.129.4
Spamver:
www.fonfel.com hosted now on a botnet
Resolved www.fonfel.com to 61.58.180.49 to 124.91.68.76 to
124.163.42.244 to 124.248.21.222 to 222.59.158.184
Web Title:
Penis Enlarge Patch Rx
by Advanced Laboratories Inc.
More Penis Enlarge Patch Rx sightings:
http://groups.google.com/groups/search?q=%22Penis+Enlarge+Patch+Rx%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.175; Fri, 24 Nov 2006
12:19:24 -0800
X-YahooFilteredBulk: 24.81.233.4
X-Originating-IP: [24.81.233.4]
Return-Path: <galerie-de...@hbweite.com>
Authentication-Results: mta541.mail.mud.yahoo.com from=hbweite.com;
domainkeys=neutral (no sig)
Received: from 24.81.233.4 (HELO localhost) (24.81.233.4) by
mta541.mail.mud.yahoo.com with SMTP; Fri, 24 Nov 2006 12:19:23 -0800
Message-ID: <000001c71005$63e23b00$0100007f@localhost>
From: "Rafael Peterson" <galerie-de...@hbweite.com>
To: [MUNGED]
Subject: Separate yourself from other men
Date: Fri, 24 Nov 2006 12:18:48 -0800
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0001_01C71005.63E23B00"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2745.2800
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2745.2800
Content-Length: 17693
<div id=yiv370205204><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0
Transitional//EN">
<html><head>
<xmetahttp-equiv=Content-Type>
<xmeta>
<style>
#message #yiv370205204 textarea {display:none;visibility:hidden;}
#message #yiv370205204 .p {display:none;visibility:hidden;}
</style>
</head>
<xbody><div align=center>
<table id="oau" border="0">
<tr id="smwt" align=center><td><img
src="http://attach.mud.mail.yahoo.com/us.f905.mail.yahoo.com/ym/us/ShowLetter?box=%40B%40Bulk&MsgId=2385_0_3344_1252_17693_0_17916_24205_768592523_oSOYkYn4Ur6Rg9euJfSMZ2XWQsPy9M8u7l9rEmxgG0OZjDONCv6aTsK2R9LgNE9_tmEVtz02N5QZNHML4Luazor9Dd8PP32rFdqyaApEAsxqbRs1WYQ.Kdj3bLRQYGYGH1EZgcNJuZdAr0RPXbaov4uenEZOQTiqw6zDMd7LTwaI&bodyPart=2&YY=50002&y5beta=yes&y5beta=yes&order=down&sort=date&pos=0&view=a&head=f&Idx=4"
border=0></td></tr>
<tr id="perb" align=center><td><img
src="http://attach.mud.mail.yahoo.com/us.f905.mail.yahoo.com/ym/us/ShowLetter?box=%40B%40Bulk&MsgId=2385_0_3344_1252_17693_0_17916_24205_768592523_oSOYkYn4Ur6Rg9euJfSMZ2XWQsPy9M8u7l9rEmxgG0OZjDONCv6aTsK2R9LgNE9_tmEVtz02N5QZNHML4Luazor9Dd8PP32rFdqyaApEAsxqbRs1WYQ.Kdj3bLRQYGYGH1EZgcNJuZdAr0RPXbaov4uenEZOQTiqw6zDMd7LTwaI&bodyPart=3&YY=50002&y5beta=yes&y5beta=yes&order=down&sort=date&pos=0&view=a&head=f&Idx=4"
border=0></td></tr>
</table></div>
<textarea class=p>Please view as original HTML.</textarea>
<table class=p id="aer" border="0">
<tr><td>qisv</td><td>skdy</td><td>nmhu</td></tr>
<tr><td>sill</td><td>topless</td><td>catalyst</td></tr>
<tr><td>rxm</td><td>ihra</td><td>kdh</td></tr>
<tr><td>eagerness</td><td>qualms</td><td>putrefied</td></tr>
<tr><td>ybf</td><td>lpen</td><td>cll</td></tr>
<tr><td>mused</td><td>great</td><td>thunderbolt</td></tr>
<tr><td>gcp</td><td>ctp</td><td>iql</td></tr>
<tr><td>spartan</td><td>explaining</td><td>paradise</td></tr>
<tr><td>kjm</td><td>nnxm</td><td>teh</td></tr>
<tr><td>moonstruck</td><td>sort</td><td>wrapping</td></tr>
</table>
<xbody>
</html>
</div>
-- END OF SPAM --
Filter evasion tactic. Animated gif asking to key web site in browser.
"Please don`t click. Enter manually following address"
Identical spam as for:
kvakrx.com IP 60.200.246.243 (OLD IP 58.83.0.6)
ns1.moisharx.com. [60.200.246.243] [TTL=172800] [CN]
ns2.moisharx.com. [60.200.246.243] [TTL=172800] [CN]
(SBL48022 - ROK4932) (at jxtvnet.com)
OLD
www.fonfel.com IP 121.31.56.34 -> cncgroup-gx, SBL48362
www.fonfel.com IP 221.4.243.131 => cncgroup-gd, SBL48363
ns1.polons.com. [211.161.3.55] [TTL=172800] [CN]
ns1.srepol.com. [121.31.56.34] [TTL=172800] [CN]
1 MX record was:
10 relay.fonfel.com [TTL=60] IP=121.31.56.34
See:
IP 24.81.233.4 S0106001346ac5d9f.vs.shawcable.net
http://www.moensted.dk/spam/?addr=24.81.233.4
http://cbl.abuseat.org/lookup.cgi?ip=24.81.233.4
http://www.spamhaus.org/query/bl?ip=24.81.233.4
http://spamcop.net/w3m?action=checkblock&ip=24.81.233.4
Exploitable Server See: http://www.sorbs.net/lookup.shtml?24.81.233.4
http://groups.google.com/groups/search?q=shawcable.net+group%3A*abuse&start=0&scoring=d&
route: 24.81.224.0/19
descr: NETBLK-FIBERLINK-CABLE-3BLK
Shaw Cablesystems GP
origin: AS6327
notify: ipa...@sjrb.ca
mnt-by: MAINT-AS6327
changed: ipa...@sjrb.ca
ASN: 6327
ASN Name: SHAW
Country (per IP registrar): CA [Canada]
Country IP Range: 24.80.0.0 to 24.87.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=6327
1 SBL/ROKSO listings for IPs under the responsibility of SHAWCABLE.NET
http://www.spamhaus.org/sbl/listings.lasso?isp=SHAWCABLE.NET
More shawcable.net sightings:
http://groups.google.com/groups/search?q=shawcable.net+group%3A*abuse&start=0&scoring=d&
See:
www.fonfel.com now hosted on a botnet
Resolved www.fonfel.com to 61.58.180.49 to 124.91.68.76 to
124.163.42.244 to 124.248.21.222 to 222.59.158.184
ns1.rikkirs.com [69.212.241.197] [TTL=172800] [US]
ns2.rikkirs.com [125.212.196.78] [TTL=172800] [VN]
ns4.gansans.com [206.145.24.29] [TTL=172800] [US]
ns5.gansans.com [61.58.190.41] [TTL=172800] [TW]
www.fonfel.com has no MX records -> fonfel.com has no MX records
61.58.180.49 PTR record: 61-58-180-49.nty.dynamic.lsc.net.tw
at dns2.lsc.net.tw / rns3.twnic.net
No PTR records exist for 124.91.68.76 at CNCGROUP-ZJ
No PTR records exist for 124.163.42.244 at CNCGROUP-SX
No PTR records exist for 124.248.21.222 at HRXT (Beijing HongRuiXunTong
science & technology - Development Co. ltd)
No PTR records exist for 222.59.158.184 at CRTC / crc.net.cn (CHINA
RAILWAY TELECOMMUNICATIONS CENTER)
More fonfel.com sightings:
http://groups.google.com/groups/search?q=fonfel.com+group%3A*abuse&qt_s=Search
SEE:
ns1.rikkirs.com IP 69.212.241.197
Also Resolved ns1.rikkirs.com to 59.144.43.68
69.212.241.197 PTR record: adsl-69-212-241-197.dsl.ipltin.ameritech.net
at ns2.ameritech.net
59.144.43.68 PTR record: BTNL-KK-DSL068.43.144.59.airtelbroadband.in at
aaadel.mantraonline.com
SEE:
ns2.rikkirs.com IP 125.212.196.78
Also Resolved ns2.rikkirs.com to 82.156.203.144
ns2.rikkirs.com has no MX records -> rikkirs.com has no MX records
No PTR records exist for 125.212.196.78 at ETC-VNNIC-VN / enet.vn
(Electric Telecommunication Company)
82.156.203.144 PTR record: c529ccb90.cable.wanadoo.nl at ns.euronet.nl
Let see whois:
Registrar: TUCOWS INC. ( => who else for botnet !!??)
Registrant:
Private
2904 Dublin Drive
South San Francisco, CA 94080
US
Domain name: RIKKIRS.COM
Administrative Contact:
madriaga, arnella toptroi[]email.com
2904 Dublin Drive
South San Francisco, CA 94080
US
+1.6509522048
Technical Contact:
madriaga, arnella top...@email.com
2904 Dublin Drive
South San Francisco, CA 94080
US
+1.6509522048
Registration Service Provider:
NS.com., sup...@ns.com
704.884.9000
http://www.ns.com
This company may be contacted for domain login/passwords and general
domain support questions.
Registrar of Record: TUCOWS, INC.
Record last updated on 25-Sep-2006.
Record expires on 22-Sep-2007.
Record created on 22-Sep-2006.
Domain servers in listed order:
NS5.RIKKIRS.COM 219.136.2.234
NS4.RIKKIRS.COM 82.230.126.135
NS3.RIKKIRS.COM 62.195.219.65
NS1.RIKKIRS.COM 84.100.182.190
NS2.RIKKIRS.COM 82.156.203.144
Domain status: ok
SEE:
ns4.gansans.com IP 206.145.24.29
Also Resolved ns4.gansans.com to 82.230.126.135
ns4.gansans.com has no MX records -> gansans.com has no MX records
206.145.24.29 PTR record: ip29.windsl2.bevcomm.net at ns2.onvoy.net
82.230.126.135 PTR record: 4aa54-3-82-230-126-135.fbx.proxad.net at
ns3-rev.proxad.net
SEE:
ns5.gansans.com IP 61.58.190.41
61.58.190.41 PTR record: 61-58-190-41.nty.dynamic.lsc.net.tw at
dns2.lsc.net.tw / rns2.twnic.net
Let see whois:
Registrar: TUCOWS INC. ( => who else for botnet !!??)
Registrant:
bennett
17 aqua view dr.
la selva, ca 95076
US
Domain name: GANSANS.COM
Administrative Contact:
bennett, price sou...@usa.com
17 aqua view dr.
la selva, ca 95076
US
+1.831-724-5515
Technical Contact:
Administration, Domain reg....@whatevercomputes.com
P.O. Box 642
Regina, SK S4P 3A3
CA
+1.3065694174 Fax: +1.3065259159
Registration Service Provider:
Whatever Computes Ltd., regi...@whatevercomputes.com
306-569-4174
http://www.whatevercomputes.com
This company may be contacted for domain login/passwords,
DNS/Nameserver changes,
and general domain support questions.
Registrar of Record: TUCOWS, INC.
Record last updated on 21-Sep-2006.
Record expires on 20-Sep-2007.
Record created on 20-Sep-2006.
Domain servers in listed order:
NS3.GANSANS.COM 62.195.219.65
NS2.GANSANS.COM 82.156.203.144
NS4.GANSANS.COM 82.230.126.135
NS5.GANSANS.COM 61.58.190.41
NS1.GANSANS.COM 84.100.182.190
Domain status: ok
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/72d5a1fc357a5e8e
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: