[email] [drugs - Pharmacy Express] [81.193.61.187] (rx555.com - hertunjinkdastion.com - vckionldesunjas.com) Re: hi
TomezNet
IP 81.193.61.187 bl4-61-187.dsl.telepac.pt
(at ns.telepac.pt)
Spamvert:
www.rx555.com IP 61.31.214.78
(SBL48511 - ROK4932) (at tfn.net.tw / a78.xxking.com)
Web title: Pharmacy Express
© 2006 PharmacyExpress.com All Rights Reserved.
See also plenty forged site certificates and logos served from the same
domain this time.
More spammer sightings:
http://groups.google.com/groups/search?q=%22Pharmacy+Express%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.170; Sun, 26 Nov 2006
10:38:46 -0800
X-YahooFilteredBulk: 81.193.61.187
X-Originating-IP: [81.193.61.187]
Return-Path: <monte...@zahlreich.de>
Authentication-Results: mta551.mail.mud.yahoo.com from=zahlreich.de;
domainkeys=neutral (no sig)
Received: from 81.193.61.187 (HELO randscot.com) (81.193.61.187) by
mta551.mail.mud.yahoo.com with SMTP; Sun, 26 Nov 2006 10:38:46 -0800
Message-ID: <01c7118a$18ef3f40$bb3dc151@joaninha>
Date: Sun, 26 Nov 2006 18:38:42 +0000
X-Priority: 3
X-MSMail-Priority: Normal
Reply-to: "Blas Rybicki" <monte...@zahlreich.de>
From: "Blas Rybicki" <monte...@zahlreich.de>
To: [MUNGED]
Subject: Re: hi
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0003_01C71188.A1F71EE0"
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Content-Length: 4728
Hi
*** REMOVED Attachment: affai9.gif (<0.01 MB) ****
Decoded base64 text:
VALIUM from $1.21 per pill
Meridia
Viagra from $3.33 per pill
Ambien
Soma
Prozac
Xanax
Cialis from $3.75 per pill
SAVE OVER 50% with
WWW.RX555.COM
( don't click,
type www.rx555.com into your browser
- END of decoded text -
-- END OF SPAM --
Filter evasion tactic. Animated gif asking to key web site in browser.
"Please don`t click. Type URL in your browser"
Google also the same tactics sighting for drugs domains like
kvakrx.com or fonfel.com
See:
IP 81.193.61.187 bl4-61-187.dsl.telepac.pt
http://www.moensted.dk/spam/?addr=81.193.61.187
http://cbl.abuseat.org/lookup.cgi?ip=81.193.61.187
http://www.spamhaus.org/query/bl?ip=81.193.61.187
inetnum: 81.193.0.0 - 81.193.127.255
netname: TELEPAC-DSL
descr: Telepac - Comunicacoes Interactivas, SA
descr: DSL Service Networks
route: 81.193.0.0/16
descr: Telepac - Comunicacoes Interactivas, SA
origin: AS3243
mnt-by: TELEPAC-MNT
changed: al.re...@mail.telepac.pt
ASN: 3243
ASN Name: TELEPAC (PT.Com - Comunicacoes Interactivas, S.A.)
Country (per IP registrar): PT [Portugal]
Country IP Range: 81.193.0.0 to 81.193.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=3243
More telepac.pt sightings:
http://groups.google.com/groups/search?q=telepac.pt+group%3A*abuse&start=0&scoring=d&
See:
www.rx555.com IP 61.31.214.78
ns0.hertunjinkdastion.com [121.36.124.62] [TTL=172800] [CN]
ns0.vckionldesunjas.com [61.31.214.78] [TTL=172800] [TW]
www.rx555.com has no MX records -> [rx555.com has 1 MX record
mail.rx555.com (10)]
http://www.moensted.dk/spam/?addr=61.31.214.78
http://www.spamhaus.org/query/bl?ip=61.31.214.78
61.31.214.78 PTR record: a78.xxking.com
at dns1.tfn.net.tw
inetnum: 61.31.0.0 - 61.31.255.255
netname: TFN-NET
descr: Taiwan Fixed Network CO.,LTD.
descr: 7FI., No. 498, Ruei-Guang Rd., Nei-Hu
descr: Taipei Taiwan 114.
country: TW
admin-c: TT164-AP
tech-c: SH376-AP
mnt-by: MAINT-TW-TWNIC
changed: hostm...@twnic.net.tw
person: Ting Tseng
nic-hdl: TT164-AP
e-mail: ting_...@twfn.com.tw
e-mail: steve...@howin.com.tw
changed: ting_...@twfn.com.tw
route: 61.31.0.0/16
descr: Taiwna Fixed Network
origin: AS9924
notify: eri...@profond.com.tw
mnt-by: MAINT-AS9924
route: 61.31.0.0/16
descr: Proxy Announcement
origin: AS17444
remarks: Addresses from AS9924
remarks: Transit via AS17444
notify: radb_...@newworldtel.com
mnt-by: MAINT-AS17444
route: 61.31.0.0/16
origin: AS9924
descr: Taiwan Fixed Network
notify: eri...@twfn.com.tw
mnt-by: MAINT-AS9924
changed: ting_...@howin.com.tw
ASN: 9924
ASN Name: TFN-TW (Taiwan Fixed Network, Telco and Network Service
Provider.)
Country (per IP registrar): TW [Taiwan]
Country IP Range: 61.30.0.0 to 61.31.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=9924
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48511
61.31.214.78/32 is listed on the Spamhaus Block List (SBL/ROKSO)
24-Nov-2006 21:06 GMT | SR22
Leo Kuvayev / BadCow.
Spam webhosting - rinkionypindfunhadesm.com
6 SBL/ROKSO listings for IPs under the responsibility of tfn.net.tw
http://www.spamhaus.org/sbl/listings.lasso?isp=tfn.net.tw
More rx555.com sightings:
http://groups.google.com/groups/search?q=rx555.com+group%3A*abuse&start=0&scoring=d&
See:
ns0.hertunjinkdastion.com IP 121.36.124.62
ns0.hertunjinkdastion.com has no MX records -> hertunjinkdastion.com
has no MX records
http://www.moensted.dk/spam/?addr=121.36.124.62
http://www.spamhaus.org/query/bl?ip=121.36.124.62
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48531
121.36.124.62/32 is listed on the Spamhaus Block List (SBL/ROKSO)
25-Nov-2006 13:01 GMT | SR20
Leo Kuvayev / BadCow.
HealthSuite/PharmacyExpress etc
1 SBL/ROKSO listings for IPs under the responsibility of
china-motion.com
http://www.spamhaus.org/sbl/listings.lasso?isp=china-motion.com
More hertunjinkdastion.com sightings:
http://groups.google.com/groups/search?q=hertunjinkdastion.com+group%3A*abuse&start=0&scoring=d&
See also more Registrant mml...@163.com sightings:
http://groups.google.com/groups/search?q=%22mmlara%40163.com%22+group%3A*abuse&start=0&scoring=d&
See:
ns0.vckionldesunjas.com IP 61.31.214.78
ns0.vckionldesunjas.com has no MX records -> vckionldesunjas.com has no
MX records
http://www.moensted.dk/spam/?addr=61.31.214.78
http://www.spamhaus.org/query/bl?ip=61.31.214.78
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48511
More vckionldesunjas.com sightings:
http://groups.google.com/groups/search?q=vckionldesunjas.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/d0d59a6270c5547c
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: