[email] [drugs - Pharmacy Express] [81.56.48.126] (rx555.com - hertunjinkdastion.com - vckionldesunjas.com) Re: hi
TomezNet
IP 81.56.48.126 bos94-2-81-56-48-126.fbx.proxad.net
(at ns2-rev.proxad.net / ns0.proxad.net)
Spamvert:
www.rx555.com IP 61.163.200.186 (OLD IP 61.31.214.78)
(NOW at ns.hazzptt.net.cn / CNCGROUP-HA)
OLD
(SBL48511 - ROK4932) (at tfn.net.tw / a78.xxking.com)
Web title: Pharmacy Express
© 2006 PharmacyExpress.com All Rights Reserved.
See also plenty forged site certificates and logos served from the same
domain this time.
More spammer sightings:
http://groups.google.com/groups/search?q=%22Pharmacy+Express%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.180; Mon, 27 Nov 2006
11:04:38 -0800
X-YahooFilteredBulk: 81.56.48.126
X-Originating-IP: [81.56.48.126]
Return-Path: <poor...@bbiinc.net>
Authentication-Results: mta111.mail.re4.yahoo.com from=bbiinc.net;
domainkeys=neutral (no sig)
Received: from 81.56.48.126 (HELO garygroup.com) (81.56.48.126) by
mta111.mail.re4.yahoo.com with SMTP; Mon, 27 Nov 2006 11:04:38 -0800
Message-ID: <01c71256$e26b78d0$6400a8c0@m5>
Date: Mon, 27 Nov 2006 20:04:37 +0100
X-MSMail-Priority: Normal
X-Priority: 3
To: [MUNGED]
Reply-to: "Aoibhi Weissman" <poor...@bbiinc.net>
From: "Aoibhi Weissman" <poor...@bbiinc.net>
Subject: Re: hi
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0003_01C71257.89540C70"
MIME-Version: 1.0
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Content-Length: 4778
Hi
*** REMOVED Attachment: insistenc88.gif (<0.01 MB) ****
Decoded base64 text:
Ambien
Soma
VIAGRA from $3.33 per pill
CIALIS from $3.75 per pill
Meridia
Xanax
Prozac
VALIUM from $1.21 per pill
SAVE OVER 50% with
WWW.RX555.COM
( don't click,
type www.rx555.com into your browser)
- END of decoded text -
-- END OF SPAM --
Filter evasion tactic. Animated gif asking to key web site in browser.
"Please don`t click. Type URL in your browser"
Google also the same tactics sighting for drugs domains like
kvakrx.com or fonfel.com
See:
IP 81.56.48.126 bos94-2-81-56-48-126.fbx.proxad.net
http://www.moensted.dk/spam/?addr=81.56.48.126
http://cbl.abuseat.org/lookup.cgi?ip=81.56.48.126
http://www.spamhaus.org/query/bl?ip=81.56.48.126
http://spamcop.net/w3m?action=checkblock&ip=81.56.48.126
inetnum: 81.56.48.0 - 81.56.49.255
netname: FR-PROXAD-ADSL
descr: Proxad / Free SAS
descr: Static pool (Freebox)
descr: bossuet-3 (th2)
descr: NCC#2003105443
country: FR
e-mail: hostm...@proxad.net
route: 81.56.0.0/15
descr: ProXad network / Free SA
descr: Paris, France
origin: AS12322
notify: ripe-...@proxad.net
mnt-by: PROXAD-MNT
changed: nhyv...@corp.free.fr
ASN: 12322
ASN Name: PROXAD (AS for Proxad ISP)
Country (per IP registrar): FR [France]
Country IP Range: 81.56.0.0 to 81.57.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=12322
More proxad.net sightings:
http://groups.google.com/groups/search?q=proxad.net+group%3A*abuse&start=0&scoring=d&
36 SBL/ROKSO listings for IPs under the responsibility of proxad.net
http://www.spamhaus.org/sbl/listings.lasso?isp=proxad.net
See:
www.rx555.com IP 61.163.200.186 (OLD IP 61.31.214.78)
ns0.hertunjinkdastion.com [121.36.124.62] [TTL=172800] [CN]
ns0.vckionldesunjas.com. [203.86.5.34] [TTL=172800] [CN] => see old IP
61.31.214.78
www.rx555.com has no MX records -> [rx555.com has no MX record
61.163.200.186 PTR record: hn.ly.kd.adsl.
at ns.hazzptt.net.cn
Reverse DNS authenticity: [Could be forged: hostname
hn.ly.kd.adsl. does not exist]
http://www.moensted.dk/spam/?addr=61.163.200.186
inetnum: 61.163.0.0 - 61.163.255.255
netname: CNCGROUP-HA
country: CN
descr: CNCGROUP Henan province network
changed: wa...@data.zz.ha.cn
mnt-by: MAINT-CNCGROUP-HA
route: 61.163.0.0/16
descr: CNC Group henan Network
origin: AS4837
mnt-by: MAINT-AS4837
changed: I...@cnc-noc.net
ASN: 4837
ASN Name: CHINA169-Backbone (CNCGROUP China169 Backbone)
Country (per IP registrar): CN [China]
Country IP Range: 61.128.0.0 to 61.191.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4837
1 SBL listings for IPs under the responsibility of CNCGROUP-HA
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGROUP-HA
More rx555.com sightings:
http://groups.google.com/groups/search?q=rx555.com+group%3A*abuse&start=0&scoring=d&
See:
ns0.hertunjinkdastion.com IP 121.36.124.62
ns0.hertunjinkdastion.com has no MX records -> hertunjinkdastion.com
has no MX records
http://www.moensted.dk/spam/?addr=121.36.124.62
http://www.spamhaus.org/query/bl?ip=121.36.124.62
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48531
121.36.124.62/32 is listed on the Spamhaus Block List (SBL/ROKSO)
25-Nov-2006 13:01 GMT | SR20
Leo Kuvayev / BadCow.
HealthSuite/PharmacyExpress etc
1 SBL/ROKSO listings for IPs under the responsibility of
china-motion.com
http://www.spamhaus.org/sbl/listings.lasso?isp=china-motion.com
More hertunjinkdastion.com sightings:
http://groups.google.com/groups/search?q=hertunjinkdastion.com+group%3A*abuse&start=0&scoring=d&
See also more Registrant mml...@163.com sightings:
http://groups.google.com/groups/search?q=%22mmlara%40163.com%22+group%3A*abuse&start=0&scoring=d&
See:
ns0.vckionldesunjas.com IP 203.86.5.34 (OLD IP 61.31.214.78)
ns0.vckionldesunjas.com has no MX records -> vckionldesunjas.com has no
MX records
http://www.moensted.dk/spam/?addr=203.86.5.34
http://www.spamhaus.org/query/bl?ip=203.86.5.34
No PTR records exist for 203.86.5.34 at ns4.cmmail.com
inetnum: 203.86.0.0 - 203.86.31.255
netname: CMNET
country: CN
descr: China Motion Network Communication
descr: 9F,Yu Hua Industrial & Trading Building,
descr: Bao Gang Rd.Luo Hu District, Shenzhen
admin-c: BY158-AP
tech-c: BY158-AP
status: ALLOCATED PORTABLE
changed: she...@cnnic.cn 20041129
mnt-by: MAINT-CNNIC-AP
person: Binghua Yang
nic-hdl: BY158-AP
e-mail: idcse...@china-motion.com
mnt-by: MAINT-CN-CMNET
changed: yang.b...@china-motion.com
route: 203.86.0.0/19
descr: Guangdong Runxun
origin: AS4134
remarks: this is registered by ruan zhidan
notify: r...@gddc.com.cn
mnt-by: MAINT-AS4813
changed: r...@gddc.com.cn
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
Country (per IP registrar): CN [China]
Country IP Range: 203.86.0.0 to 203.86.63.255
http://www.cidr-report.org/cgi-bin/as-report?as=4134
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48576
203.86.5.34/32 is listed on the Spamhaus Block List (SBL/ROKSO)
27-Nov-2006 10:38 GMT | SR04
Leo Kuvayev / BadCow.
jertionjerunhadesunfeuijasnde.com
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48577
203.86.5.0/24 is listed on the Spamhaus Block List (SBL/ROKSO)
27-Nov-2006 10:39 GMT | SR04
Leo Kuvayev / BadCow.
Dirty block
3 SBL listings for IPs under the responsibility of china-motion.com
http://www.spamhaus.org/sbl/listings.lasso?isp=china-motion.com
More vckionldesunjas.com sightings:
http://groups.google.com/groups/search?q=vckionldesunjas.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/d63f7433d627ff3e
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: