Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] [drugs - Canadian Pharmacy botnet] [62.105.19.138] (woodbefore.com / axrpss.com / lutrwpghd.com / sjrbofa.com / vqwgds.com) RE: Discount. Coupon #xvtgr

0 views

Skip to first unread message

TomezNet

unread,

Apr 8, 2008, 1:00:22 PM4/8/08

Received From:
IP 62.105.19.138
(at MPLS / OJSC Uralsviazinform MFIST / usi.ru)

Spamvert:
myv.woodbefore.com => botnet
myv.woodbefore.com Resolved to 221.127.143.95 to 24.38.202.179 to
61.15.245.139 to 61.58.184.213 to 68.50.244.32 to 69.14.247.212 to
69.86.213.81 to 69.245.174.253 to 70.127.55.82 to 70.230.156.188 to
71.170.85.91 to 74.128.136.74 to 90.183.115.170 to 118.167.172.215 to
124.51.106.155 to 125.215.119.234 to 193.150.211.127 to 210.106.5.55
to 211.193.118.198 to 219.240.79.58

Title: European Pharmacy (aka Canadian Pharmacy)

WEB:
© Copyright Canadian Pharmacy, 2003-2008. All Rights Reserved.

Much More Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&

Plenty of Forged Certificates and logos as always.

SEE sender identity and headers forgery by spammer spoofing our
domain.

Much More info below:
==================X-SID-PRA: [MUNGED]
X-Message-Info:
6sSXyD95QpVEviSqnSF8cgeshl3rxdDwzB9JGgr2dKd8EqI4UfZpaFx5zt4zNt4RB6uljLHEJ5cuk/
4vhX4DkQ=Received: from tomts12-srv.bellnexxia.net ([209.226.175.56]) by bay0-
pamc1-f4.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Thu, 27 Mar 2008 23:22:32 -0700
Received: from toip19.srvr.bell.ca ([67.69.240.21])
by toip49.srvr.bell.ca with ESMTP; 28 Mar 2008 02:22:24 -0400
Received: from [MUNGED]
by toip19.srvr.bell.ca with ESMTP; 28 Mar 2008 02:22:23 -0400
Received: (qmail 13716 invoked by uid 110); 28 Mar 2008 02:22:23 -0400
Delivered-To: [MUNGED]
Received: (qmail 13690 invoked from network); 28 Mar 2008 02:22:22
-0400
Received: from unknown (HELO klient) (62.105.19.138)
by [MUNGED] with SMTP; 28 Mar 2008 02:22:22 -0400
X-Originating-IP: [10.06.232.3]
X-Originating-Email: [[MUNGED]]
X-Sender: [MUNGED]
Message-Id: <20080328162228.14425.qmail@klient>
To: <[MUNGED]>
Subject: RE: Discount. Coupon #xvtgr
From: <[MUNGED]>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Date: Fri, 28 Mar 2008 02:22:31 -0400
Return-Path: stuar...@netsuite.com.au
X-OriginalArrivalTime: 28 Mar 2008 06:22:32.0565 (UTC)
FILETIME=[1B327A50:01C8909C]

Announcement about anti-ED drugs.
Dear [MUNGED], Visit our new online chemist's and save upto 85% on all
popular Ed treatments.
http://www.google.com/pagead/iclk?sa=l&ai=mitso&num 3808&adurl=http://myv.woodbefore.com

-- END OF SPAM --

OLD Listing:
SBL61248 - ROK4932 / SBL61418, SBL61896, SBL62483

http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4932

WEB:
Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
You may contact us at +1(210) 888-9089, please, keep your order I.D.
every time you make a call
© Copyright Canadian Pharmacy, 2003-2008. All Rights Reserved.

Contact:
Also you may send us an e-mail.
You will get an answer ASAP. Customer Support (click here to mail us
sup...@canadianmedicationsupport.com)

More spammer sightings:
http://groups.google.com/groups/search?q=%22September+70%25%22+group%3A*abuse&start=0&scoring=d&

More canadianmedicationsupport.com sightings:
http://groups.google.com/groups/search?q=canadianmedicationsupport.com+group%3A*abuse*&qt_s=Search

See:
IP 62.105.19.138

http://moensted.dk/spam/?addr=62.105.19.138
Listed in PSBL, see http://psbl.surriel.com/listing?ip=62.105.19.138

abuse[]usi.ru is listed in rfc-ignorant.org database

inetnum: 62.105.19.0 - 62.105.19.255
netname: MPLS
descr: OJSC Uralsvyazinform, Khanty-Mansyisk subsidiary
descr: Kominterna Street 3, Hanty-Mansiysk, Russia
remarks: INFRA-AW
country: RU
role: Uralsvyazinform KHFES Administration Staff
address: 11, Moskovskaya str.
address: Yekaterinburg, 620014
address: Russian Federation
e-mail: ip...@hanty.usi.ru
person: Dudin Eugeniy
address: JSC "Khantymansiyskokrtelecom"
address: 3 Komintern Street, khantymansiysk, Tyumen region,
628011, Russia
phone: +7 34671 91250
fax-no: +7 34671 30404
e-mail: du...@hanty.usi.ru
person: Sergei Kokorin
address: OJSC Uralsviazinform MFIST
address: Russia
e-mail: kokor...@mfist.usi.ru
person: Dudin Eugeniy
e-mail: du...@hanty.usi.ru
person: Alexander Smelik
e-mail: smel...@mfist.usi.ru

route: 62.105.0.0/19
descr: KHMOD Autonomous System
origin: AS28719
route: 62.105.19.0/24
descr: KHMOD Autonomous System
origin: AS28719
mnt-by: KHMOD-MNT
changed: i...@hanty.usi.ru

SEE:
myv.woodbefore.com => botnet
myv.woodbefore.com Resolved to 221.127.143.95 to 24.38.202.179 to
61.15.245.139 to 61.58.184.213 to 68.50.244.32 to 69.14.247.212 to
69.86.213.81 to 69.245.174.253 to 70.127.55.82 to 70.230.156.188 to
71.170.85.91 to 74.128.136.74 to 90.183.115.170 to 118.167.172.215 to
124.51.106.155 to 125.215.119.234 to 193.150.211.127 to 210.106.5.55
to 211.193.118.198 to 219.240.79.58

DNS with NEW IP's:
ns0.axrpss.com = 24.38.202.179
ns0.lutrwpghd.com = 78.129.0.123
ns0.sjrbofa.com = 220.74.128.26
ns0.vqwgds.com = 88.134.185.93

myv.woodbefore.com has no MX records -> woodbefore.com has no MX
records

See IP rDNS on botnet:
221.127.143.95 no PTR at Hutchison / hgc.com.hk
24.38.202.179 = static-host-24-38-202-179.patmedia.net
61.15.245.139 = cm61-15-245-139.hkcable.com.hk
61.58.184.213 = 61-58-184-213.nty.dynamic.lsc.net.tw
68.50.244.32 = c-68-50-244-32.hsd1.dc.comcast.net
69.14.247.212 = d14-69-212-247.try.wideopenwest.com
69.86.213.81 = user-12ldlah.cable.mindspring.com
69.245.174.253 = c-69-245-174-253.hsd1.in.comcast.net
70.127.55.82 = 82-55.127-70.tampabay.res.rr.com
70.230.156.188 = adsl-70-230-156-188.dsl.stlsmo.sbcglobal.net
71.170.85.91 = static-71-170-85-91.dllstx.fios.verizon.net
74.128.136.74 = 74-128-136-74.dhcp.insightbb.com
90.183.115.170 = 170.115.broadband16.iol.cz
118.167.172.215 = 118-167-172-215.dynamic.hinet.net
124.51.106.155 no PTR at Xpeed / powercomm.com / Korea
125.215.119.234 = opt-125-215-119-234.client.pikara.ne.jp
193.150.211.127 = c193-150-211-127.bredband.comhem.se
210.106.5.55 no PTR at DREAMPLUS / nowcom.co.kr / Korea
211.193.118.198 no PTR at KORNET / kt.co.kr / Korea
219.240.79.58 no PTR at HANARO / HANANET / Korea

AND:
24.38.202.179 = static-host-24-38-202-179.patmedia.net
78.129.0.123 = host-78-129-0-123.brutele.be
220.74.128.26 no PTR at KORNET / kt.co.kr / Korea
88.134.185.93 = 88-134-185-93-dynip.superkabel.de

Let see whois.paycenter.com.cn:
Domain Name: woodbefore.com

Registrant:
Haiwei Sun
NO.13,Zhongshan street,Guiyang City GuiZhou Province
550001

Administrative Contact:
SunHaiwei
Haiwei Sun
NO.13,Zhongshan street,Guiyang City GuiZhou Province
Guiyang Guizhou 550001
CN
tel: 851 4355128
fax: 851 4355128
pengxi...@163.com

Technical Contact:
SunHaiwei
Haiwei Sun
NO.13,Zhongshan street,Guiyang City GuiZhou Province
Guiyang Guizhou 550001
CN
tel: 4355128
fax: 4355128
pengxi...@163.com

Billing Contact:
SunHaiwei
Haiwei Sun
NO.13,Zhongshan street,Guiyang City GuiZhou Province
Guiyang Guizhou 550001
CN
tel: 4355128
fax: 4355128
pengxi...@163.com

Registration Date: 2008-03-26
Update Date: 2008-03-26
Expiration Date: 2009-03-26

Primary DNS: ns0.sjrbofa.com 220.74.128.26
Secondary DNS: ns0.axrpss.com 24.38.202.179

More woodbefore.com sightings:
http://groups.google.com/groups/search?q=woodbefore.com+group%3A*abuse*&qt_s=Search

domains using this as nameserver
6phr.com
applyforsmiles.com
assortmentandspecie.com
aztxobzipyijon.com
buycheapmeds5.com
buycheapmeds6.com
buycheapmeds7.com
buypillsonline5.com
buypillsonline6.com
buypillsonline7.com
check-this-out-a.com
cometourwells.com
discount-a.com
discount-l.com
discount-m.com
discount-n.com
discount-r.com
disscount-a.com
disscount-b.com
disscount-c.com
disscount-d.com
disscount-e.com
dodrx.com
ebadesunajisadefun.com
energyfromwate.com
enjoymorerelaxs.com
express6.net
express8.net
express9.net
fawunjunterfuyun.com
formorerelaxs.com
gudrx.com
guihgzybira.com
huteryadesunde.com
juiceandfruit.com
kanhershdepions.com
keyassortmen.com
kodrx.com
look-at-this-site.com
medic3.net
medic4.net
medic5.com
medic6.com
meds5.com
meds6.com
meds7.com
medsonline5.com
medsonline6.com
medsonline7.com
medsonline8.com
mixturejo.com
mudrx.com
no-miss-your-chance-a.com
no-miss-your-chance-b.com
no-miss-your-chance-c.com
no-miss-your-chance.net
offastdeals.com
perfectionandassortmen.com
perfectmixtur.com
pharm4.com
pharm6.com
pharm9.com
pharmacy6.net
pharmacy8.net
pharmacy9.net
pharmonline5.com
pharmonline6.com
pharmonline7.com
pharmonline8.com
pills4.net
pills5.net
pills6.net
pudrx.com
rx-information.net
rxclubdiscount.com
rxmedic.net
rxshop2.com
rxshop3.com
rxshop5.com
seeurrelaxs.com
soft-cialis-online.com
soft-vigra-online.com
upaladins10.com
upgradeeasily8.com
urbigworld7.com
urdailysmiles.com
urdelight6.com
ureasyselecteds.com
urfreshair5.com
urgoodtastes4.com
urhughsuppliy3.com
urlifeideas2.com
urmoresmiles1.com
urrelaxseens.com
vahuitnderun.com
viagra-delivery.net
wateryoursou.com
werinkiondefunhadesun.com
wonderfulassortmen.com
xodrx.com
xrzu.com
yourrelaxings.com
(only showing 100 results)

More axrpss.com sightings:
http://groups.google.com/groups/search?q=axrpss.com+group%3A*abuse*&qt_s=Search

More lutrwpghd.com sightings:
http://groups.google.com/groups/search?q=lutrwpghd.com+group%3A*abuse*&qt_s=Search

More sjrbofa.com sightings:
http://groups.google.com/groups/search?q=sjrbofa.com+group%3A*abuse*&qt_s=Search

More vqwgds.com sightings:
http://groups.google.com/groups/search?q=vqwgds.com+group%3A*abuse*&qt_s=Search

And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/de16aa972aa64ea2

Cheers, Tomez

--
All postings to news.admin.net-abuse.sightings are unconfirmed and unverified
unless stated otherwise by the moderators. All opinions expressed above are
considered the opinions of the original poster, not the moderators or their
respective employers. For a copy of the guidelines to this group, see:
http://www.killfile.org/~tskirvin/nana/

0 new messages