[email] [drugs - MyCanadianPharmacy] [82.81.212.91] (ttery.hk) re:Don't forget to ask for discount!
TomezNet
IP 82.81.212.91 bzq-82-81-212-91.cablep.bezeqint.net
(at ns1.bezeqint.net)
drugs pusher Yambo Financials botnet
Spamvert:
www.ttery.hk IP 60.2.225.106
(SBL48240 - ROK3095) (at cncgroup-he / ns.hesjptt.net.cn)
NEW Yambo Pharmacy image hosting:
http://217.170.77.210:8080/p/images/cipa2.gif
More Yambo MyCanadianPharmacy aka MyCanadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22MyCanadianPharmacy%22+group%3A*abuse&start=0&scoring=d&
Plenty of Forged Certificates and logos.
More info below:
====================
X-SID-PRA: Larry Camp <dwmeetin...@meetingwizard.com>
X-Message-Info: txF49lGdW40e/wCgyE6oX8FCzL0piDkpiIkOL1SbbyU=
Received: from tomts41-srv.bellnexxia.net ([209.226.175.98]) by bay0-
pamc1-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Fri, 9 Feb 2007 01:25:58 -0800
Received: from [MUNGED]
by toip24.srvr.bell.ca with ESMTP; 09 Feb 2007 04:25:51 -0500
Received: (qmail 30268 invoked by uid 110); 9 Feb 2007 04:25:51 -0500
Delivered-To: [MUNGED]
Received: (qmail 30244 invoked from network); 9 Feb 2007 04:25:50
-0500
Received: from bzq-82-81-212-91.cablep.bezeqint.net (HELO comp1)
(82.81.212.91)
by [MUNGED] with SMTP; 9 Feb 2007 04:25:50 -0500
Return-Path: <dwmeetin...@meetingwizard.com>
Received: from 69.63.140.200 (HELO webmail.edgewebhosting.net)
by [MUNGED] with esmtp (-SK.Z6IR: S0,F6)
id D*Q7Z2-/<*SEP-C5
for [MUNGED]; Fri, 9 Feb 2007 09:42:00 -0120
From: "Larry Camp" <dwmeetin...@meetingwizard.com>
To: <[MUNGED]>
Subject: re:Don't forget to ask for discount!
Date: Fri, 9 Feb 2007 09:42:00 -0120
Message-ID: <01c74c2e$8be86ba0$6c822ecf@dwmeetingwizardm>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C74C3F.4F713BA0"
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
Thread-Index: Aca6QG+4,175*2O)75F*-2S<XZ3DE/==
X-OriginalArrivalTime: 09 Feb 2007 09:25:58.0370 (UTC)
FILETIME=[4E904C20:01C74C2C]
This is a multi-part message in MIME format.
------=_NextPart_000_0006_01C74C3F.4F713BA0
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit
Dear,I know that you purchase expensive American drugs and are looking
for possibility to save on them. I advise you to buy medications in
Canada.I understand your fears to be scammed or receive counterfeit
medications. Don't worry! Canadian medications are manufactured
according to the same strict medical standards followed in the United
States! MyCanadianPharmacy store offers only top quality
medications.Extremely low prices! Huge selection! Men's Health, Anti-
Depressants, Pain Relief, General health, Weight loss and other
medications are available!You will be satisfied with our service.
Speed of delivery will exceed all your expectations. To visit our site
and obtain more information about medications, prices, payment and
delivery conditions, click here. http://www.ttery.hkMany thanks for
choosing our store!Best regards,Larry Camp
------=_NextPart_000_0006_01C74C3F.4F713BA0
Content-Type: text/html;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<html xmlns:o=3D"urn:schemas-microsoft-com:office:office"
xmlns:w=3D"urn:sc=
hemas-microsoft-com:office:word" xmlns=3D"http://www.w3.org/TR/REC-
html40">
<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html;
charset=3DWindows-1252">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered
medium)">
</head>
<body>
<html>
<body bgcolor=3D"#FFFFFF" link=3D"#6F7AC8">
<p><font face=3D"Verdana" size=3D"2" color=3D"#000000"><b>Dear</b>,</
font><=
/p>
<p><font face=3D"Verdana" size=3D"2">I know that you purchase
expensive Ame=
rican drugs and are looking for possibility to save on them. I advise
you t=
o buy medications in Canada.<br>I understand your fears to be scammed
or re=
ceive counterfeit medications. Don't worry! <a href=3D"http://
www.ttery.hk"> Canadian medications</a> are manufactured according to
the same strict med=
ical standards followed in the United States! </font></p>
<p><font face=3D"Verdana" size=3D"2"><a href=3D"http://
www.ttery.hk">MyCana=
dianPharmacy store</a> offers only top quality
medications.<br>Extremely lo=
w prices! Huge selection! Men's Health, Anti-Depressants, Pain Relief,
Gene=
ral health, Weight loss and other medications are available!<br>You
will be=
satisfied with our service. Speed of delivery will exceed all your
expecta=
tions. </font></p>
<p><font face=3D"Verdana" size=3D"2"><a href=3D"http://
www.ttery.hk"><b>To =
visit our site and obtain more information about medications, prices,
payme=
nt and delivery conditions, click here.</b></a><br> <b>http://
www.ttery.hk<=
/b></font></p>
<p><font face=3D"Verdana" size=3D"2">Many thanks for choosing our
store!</f=
ont></p>
<p><font face=3D"Verdana" size=3D"2">Best regards,<br>Larry Camp</
font></p>
</body>
</html>
</body>
</html>
------=_NextPart_000_0006_01C74C3F.4F713BA0--
-- END OF SPAM --
See:
IP 82.81.212.91 bzq-82-81-212-91.cablep.bezeqint.net
http://www.moensted.dk/spam/?addr=82.81.212.91
inetnum: 82.81.192.0 - 82.81.255.255
netname: ADSL-CUSTOMER-CONNECTION
descr: SE-13
changed: hostm...@bezeqint.net
IP address: 82.81.212.91
Reverse DNS: bzq-82-81-212-91.cablep.bezeqint.net.
Reverse DNS authenticity: [Verified]
ASN: 8551
ASN Name: BEZEQ-INTERNATIONAL-AS (Bezeqint
Internet Backbone)
IP range connectivity: 0
Registrar (per ASN): RIPE
Country (per IP registrar): IL [Israel]
Country Currency: ILS [Israel New Shekels]
Country IP Range: 82.80.0.0 to 82.81.255.255
Country fraud profile: High
City (per outside source): Tel Aviv, Tel Aviv
http://www.cidr-report.org/cgi-bin/as-report?as= 8551
1 SBL listings for IPs under the responsibility of bezeqint.net
http://www.spamhaus.org/sbl/listings.lasso?isp=bezeqint.net
See:
www.ttery.hk IP 60.2.225.106
NS2.UNSELDOMDIG.COM [210.34.0.101 (NO GLUE)] [CN]
NS2.CHARTEREDBOL.COM [210.34.0.101 (NO GLUE)] [CN]
NS1.NOHOEVENTS.COM [83.15.82.74 (NO GLUE)] [PL]
NS1.AMYLACEOUSWER.COM [83.15.82.74 (NO GLUE)] [PL]
www.ttery.hk has no MX records -> [ttery.hk has 1 MX record
mail.ttery.hk (10)]
No PTR records exist for 60.2.225.106 at ns.hesjptt.net.cn
http://www.moensted.dk/spam/?addr=60.2.225.106
http://www.spamhaus.org/query/bl?ip=60.2.225.106
More 60.2.225.106 sightings:
http://groups.google.com/groups/search?q=60.2.225.106+group%3A*abuse&start=0&scoring=d&
http://www.cidr-report.org/cgi-bin/as-report?as=
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48240
60.2.225.106/32 is listed on the Spamhaus Block List (SBL/ROKSO)
06-Feb-2007 01:07 GMT | SR02
Yambo Financials.
rexito.com / sebaqv.conditioncat.com / etc
16 SBL listings for IPs under the responsibility of cncgroup-he
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-he
Let see whois.hkdnr.net.hk:
postmaster and abuse[]hkdnr.net.hk are listed in rfc-ignorant.org
database
WHOIS:
Domain Name: TTERY.HK
Contract Version: HKDNR latest version
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): MIKO KIKO
Holder Chinese Name:
Email: peter.wi...@writeme.com
Domain Name Commencement Date: 2007-02-03
Country: US
Expiry Date: 2008-02-03
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1803767T
Technical Contact:
First name: ALEX
Last name: NULIKOL
Company Name: MIKO KIKO
NS1.AMYLACEOUSWER.COM [193.230.183.161, 83.15.82.74]
NS2.UNSELDOMDIG.COM [210.34.0.101]
NS1.NOHOEVENTS.COM [83.15.82.74] => SBL50921
NS2.CHARTEREDBOL.COM [210.34.0.101] => SBL48902
More ttery.hk sightings:
http://groups.google.com/groups/search?q=ttery.hk+group%3A*abuse
Interesting:
Resolved 193.230.183.161 to This zone lists ONLY based on geographic
information to The zone does NOT contain known spammers, nor open
relays to Please see our webpage for more information
Please see our webpage for more information has no MX records ->
nerd.dk>our webpage for more information has no MX records
NEW Yambo Pharmacy image hosting:
http://217.170.77.210:8080/p/images/cipa2.gif
IP 217.170.77.210
217.170.77.210 PTR record: db2.sorenssystem.com
at ns2.spaceweb.ru / eltel.net
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL50632
217.170.77.210/32 is listed on the Spamhaus Block List (SBL/ROKSO)
30-Jan-2007 19:03 GMT | SR20
Yambo botnet image proxying/hosting (compromised sytems)
Are they really compromised?
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/b06cd6129c8d3b0c
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: