[email] [drugs - ED Pills] [201.223.112.67] (ltkdesigns.com / official-medicals.com / eNom.com / name-services.com) Cialis and Viagra Directly from Original Manufacturer
TomezNet
IP 201.223.112.67 67-112-223-201.adsl.terra.cl
Spamvert:
www.ltkdesigns.com IP 64.74.96.243
www.ltkdesigns.com IP 216.52.184.240
www.ltkdesigns.com IP 63.251.92.195
ltkdesigns.com IP 69.25.142.3
(All at name-services.com / eNom.com / internap.com)
mail.ltkdesigns.com IP 72.36.143.223
(at layeredtech.com) => Open Relay
Redirected to:
http://www.official-medicals.com/
AND Redirected Again at eNom to:
https://www.official-medicals.com/
www.official-medicals.com IP 124.42.8.150
(SBL54680) (at sinnet.com.cn)
official-medicals.com it is a replacement for genuine-pharmacy.com
Title:
Ed Pills - Donāt let ED affect your sex life. Take control.
Much More Ed Pills sightings:
http://groups.google.com/groups/search?q=%22Ed+Pills%22+group%3A*abuse&start=0&scoring=d&
Much More info below:
====================
Return-Path: <sa...@ltkdesigns.com>
Delivered-To: [MUNGED]
Received: (qmail 32149 invoked from network); 30 May 2007 01:21:22
-0400
Received: from 67-112-223-201.adsl.terra.cl (HELO nombre-2lhjzdra)
(201.223.112.67)
by [MUNGED] with SMTP; 30 May 2007 01:21:22 -0400
Message-ID: <50f101c7a279$12467181$4370dfc9@nombre-2lhjzdra>
From: "Sales Department" <sa...@ltkdesigns.com>
To: "Chakraborty Satyakam" <[MUNGED]>
Subject: Cialis and Viagra Directly from Original Manufacturer
Date: Wed, 30 May 2007 05:16:00 +0000
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="Windows-1252";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1437
Now you can order Original Viagra directly from Pfizer
Here: http://www.ltkdesigns.com/
All prices are tax/vat free and same-day free worldwide shipping also
included.
--
pmuouuujursjujunuttruntsqkuuuhui
-- END OF SPAM --
The same as was for pulseambulanceservice.com, direttaspettacoli.com,
AKzOnObelInc.com, MarcusSjogren.com, Uisxksdcinaltd.com,
riverrockdirectbill.com, brewcitycruisers.com, eraoftechnology.com,
redavisandsoninc.com, theshiremusic.com and plenty more on the same
IP(s) with full support of eNom (hosting, DNS, domain registration).
abuse[]name-services.com is listed in rfc-ignorant.org database
eNom sucks by default
See also more eNom long connection to ED Pills with redirection,
hosting and domain registration services:
http://groups.google.com/groups/search?q=216.40.47.17+eNom+group%3A*abuse&qt_s=Search
Web ED Pills:
Website is in secure mode https
with link:
https://smarticon.geotrust.com/smarticonprofile?Referer=https://www.official-medicals.com
The following site has been issued a QuickSSLā¢ certificate to enable
server security
Domain: https://www.official-medicals.com
Status: Active
Serial Number: 614e1
Validity Period: 27-May-2007 to 27-May-2008
abuse[]geotrust.com is listed in rfc-ignorant.org database however
their mail server did not rejected email notifying them about the same
spammer (genuine-pharmacy.com - #5f2a0) site is selling counterfeit
prescription drugs, highly illegal.
abuse[]geotrust.com is listed in rfc-ignorant.org database
And:
SSL Server Certificate
Connection Encrepted (AES-256) PKCS #1 MD5 With RSA Encryption
Organizational Unit (OU) GT9972937
Version 3
Serial Number 06:14:E1
Issuer:
CN = Equifax Secure Global eBusiness CA-1
O = Equifax Secure Global
C = US
Issued On 5/27/2007
CRL Distribution Points
Not Critical
URI: http://crl.geotrust.com/crls/globalca1.crl
CN = www.official-medicals.com
OU = Domain Control Validated - QuickSSL(R)
OU = See www.geotrust.com/resources/cps (c)07
OU = GT99272937
O = www.official-medicals.com
C = FR
See:
IP 201.223.112.67 67-112-223-201.adsl.terra.cl
http://www.moensted.dk/spam/?addr=201.223.112.67
http://www.spamhaus.org/query/bl?ip=201.223.112.67
http://www.spamhaus.org/pbl/query/PBL066212
http://spamcop.net/w3m?action=checkblock&ip=201.223.112.67
inetnum: 201.223.0/17
status: allocated
owner: Terra Networks Chile S.A.
ownerid: CL-TNCS-LACNIC
nic-hdl: TEC
person: Technical Contact
e-mail: tech...@CORP.TERRA.CL
postmaster and abuse[]terra.cl are listed in rfc-ignorant.org database
Prefix: 201.223.0.0/17
Prefix Name: Proxy registered route object
AS: 7418
AS Name: CL-TNCS-LACNIC Terra Networks Chile S.A.
http://www.cidr-report.org/cgi-bin/as-report?as=7418
Much More terra.cl sightings:
http://groups.google.com/groups/search?q=terra.cl+group%3A*abuse&start=0&scoring=d&
Spamver URL:
http://www.ltkdesigns.com/
HTTP/1.1 302 Object moved
Connection: close
Date: Thu, 31 May 2007 07:17:37 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Location: http://www.official-medicals.com
Cache-Control: private
Content-Type: text/html
Content-Length: 153
<head><title>Object moved</title></head><body><h1>Object Moved</
h1>This object may be found <a HREF="http://www.official-
medicals.com">here</a>.</body>
Redirected to:
http://www.official-medicals.com/
AND Redirected again at eNom to:
https://www.official-medicals.com/
HTTP/1.1 302 Found
Date: Thu, 31 May 2007 01:40:24 GMT
Server: Apache
Location: https://www.official-medicals.com/
Content-Length: 218
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://www.official-
medicals.com/">here</a>.</p>
</body></html>
See:
www.ltkdesigns.com IP 64.74.96.243
www.ltkdesigns.com IP 216.52.184.240
www.ltkdesigns.com IP 63.251.92.195
ltkdesigns.com IP 69.25.142.3
dns1.name-services.com [69.25.142.1] [TTL=172800] [US]
dns2.name-services.com [216.52.184.230] [TTL=172800] [US]
dns3.name-services.com [63.251.92.193] [TTL=172800] [US]
dns4.name-services.com [64.74.96.242] [TTL=172800] [US]
dns5.name-services.com [70.42.37.1] [TTL=172800] [US]
SOA record [TTL=1800] is:
Primary nameserver: dns1.name-services.com
Hostmaster E-mail address: in...@name-services.com
Serial #: 2002050701
1 MX record are:
10 mail.ltkdesigns.com [TTL=1800] IP=72.36.143.223 [TTL=1800] [US]
Spammer MX record moved from IP 64.92.172.210 to IP 72.36.143.223 =>
still at layeredtech.com
72.36.143.223 = 223.143.36.72.static.reverse.layeredtech.com
WARNING:
mail.ltkdesigns.com appears to be an open relay: 250 ok
See also More 64.92.172.210 sightings:
http://groups.google.com/groups/search?q=64.92.172.210+group%3A*abuse&qt_s=Search
OrgName: Layered Technologies, Inc.
OrgID: LAYER-3
NetRange: 72.36.128.0 - 72.36.255.255
CIDR: 72.36.128.0/17
NetName: LAYERED-TECH-
NetHandle: NET-72-36-128-0-1
Parent: NET-72-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.LAYEREDTECH.COM
NameServer: NS2.LAYEREDTECH.COM
Comment: Please send all abuse complaints to
Comment: ab...@layeredtech.com => ???
postmaster and abuse[]layeredtech.com are listed in rfc-ignorant.org
database
Prefix: 72.36.128.0/18
Prefix Name: error
AS: 3561
AS Name: SAVVIS SAVVIS Communications
http://www.cidr-report.org/cgi-bin/as-report?as=3561
Much More layeredtech.com sightings:
http://groups.google.com/groups/search?q=layeredtech.com+group%3A*abuse&start=0&scoring=d&
See:
ltkdesigns.com IP 216.52.184.240
http://www.moensted.dk/spam/?addr=216.52.184.240
http://www.apews.org/?page=test&C=82&E=162808&ip=216.52.184.240
Blocked - see http://www.spambag.org/cgi-bin/spambag?mailfrom=enom
Escalated Listing (Spam or Spam Support) See: http://www.sorbs.net/lookup.shtml?216.52.184.240
Much More 216.52.184.240 sightings:
http://groups.google.com/groups/search?q=216.52.184.240+group%3A*abuse&start=0&scoring=d&
Internap Network Services PNAP-8-98 (NET-216-52-0-0-1)
216.52.0.0 - 216.52.255.255
eNom PNAP-DAL-ENOM-RM-01 (NET-216-52-184-224-1)
216.52.184.224 - 216.52.184.255
OrgName: Internap Network Services
OrgID: PNAP
NetRange: 216.52.0.0 - 216.52.255.255
CIDR: 216.52.0.0/16
NetName: PNAP-8-98
NetHandle: NET-216-52-0-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.PNAP.NET
NameServer: NS2.PNAP.NET
CustName: eNom
NetRange: 216.52.184.224 - 216.52.184.255
CIDR: 216.52.184.224/27
NetName: PNAP-DAL-ENOM-RM-01
NetHandle: NET-216-52-184-224-1
Parent: NET-216-52-0-0-1
NetType: Reassigned
route: 216.52.176.0/20
descr: PNAP-DAL
origin: AS12179
mnt-by: INAP-MAINT-RADB
changed: pe...@internap.com
Prefix: 216.52.176.0/20
Prefix Name: PNAP DAL PNAP DAL
AS: 12179
AS Name: INTERNAP-2BLK Internap Network Services
http://www.cidr-report.org/cgi-bin/as-report?as=12179
20 SBL/ROKSO listings for IPs under the responsibility of internap.com
http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com
5 SBL/ROKSO listings for IPs under the responsibility of eNom.com
http://www.spamhaus.org/sbl/listings.lasso?isp=eNom.com
See:
www.ltkdesigns.com IP 63.251.92.195
www.ltkdesigns.com has no MX records -> [ltkdesigns.com has 1 MX
record mail.ltkdesigns.com (10)]
http://www.sorbs.net/lookup.shtml?63.251.92.195
Much More 63.251.92.195 sightings:
http://groups.google.com/groups/search?q=63.251.92.195+group%3A*abuse&start=0&scoring=d&
Internap Network Services NETBLK-PNAP-11-99 (NET-63-251-0-0-1)
63.251.0.0 - 63.251.255.255
eNom INAP-WDC002-ENOM-1942 (NET-63-251-92-192-1)
63.251.92.192 - 63.251.92.255
CustName: eNom
Address: 2002 156th Ave NE
NetRange: 63.251.92.192 - 63.251.92.255
CIDR: 63.251.92.192/26
NetName: INAP-WDC002-ENOM-1942
NetHandle: NET-63-251-92-192-1
Parent: NET-63-251-0-0-1
NetType: Reassigned
route: 63.251.80.0/20
descr: PNAP-WDC
descr: InterNAP
origin: AS10913
mnt-by: INAP-MAINT-MCI
changed: jo...@internap.com
Prefix: 63.251.80.0/20
Prefix Name: PNAP WDC InterNAP PNAP WDC InterNAP
AS: 10913
AS Name: INTERNAP-BLK Internap Network Services
http://www.cidr-report.org/cgi-bin/as-report?as=10913
See:
ltkdesigns.com IP 69.25.142.3
http://www.moensted.dk/spam/?addr=69.25.142.3
Escalated Listing (Spam or Spam Support) See: http://www.sorbs.net/lookup.shtml?69.25.142.3
Internap Network Services PNAP-12-2002 (NET-69-25-0-0-1)
69.25.0.0 - 69.25.255.255
eNom INAP-SEF-ENOM-1761 (NET-69-25-142-0-1)
69.25.142.0 - 69.25.142.63
Much More 69.25.142.3 sightings:
http://groups.google.com/groups?q=69.25.142.3+group%3A*abuse&start=0&scoring=d&
See:
ltkdesigns.com IP 64.74.96.243
http://www.moensted.dk/spam/?addr=64.74.96.243
Escalated Listing (Spam or Spam Support) See: http://www.sorbs.net/lookup.shtml?64.74.96.243
Internap Network Services PNAP-SEA-BLOCK4 (NET-64-74-0-0-1)
64.74.0.0 - 64.74.255.255
eNom PNAP-CHG-ENOM-RM-01 (NET-64-74-96-224-1)
64.74.96.224 - 64.74.96.255
Much More 64.74.96.243 sightings:
http://groups.google.com/groups/search?q=64.74.96.243+group%3A*abuse&start=0&scoring=d&
Let see whois:
Registration Service Provided By: eNom, Inc.
Contact: in...@eNom.com
Domain name: ltkdesigns.com
Administrative Contact:
friede prl
reinhold friede (reinhold.friede[]gmail.com)
+49.0455196180
Fax: -
grunewaldstrase 14
hamburg, HAMBURG 84125
DE
Technical Contact:
friede prl
reinhold friede (reinhol...@gmail.com)
+49.0455196180
Fax: -
grunewaldstrase 14
hamburg, HAMBURG 84125
DE
Registrant Contact:
friede prl
reinhold friede (reinhol...@gmail.com)
+49.0455196180
Fax: -
grunewaldstrase 14
hamburg, HAMBURG 84125
DE
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
Creation date: 29 May 2007 02:43:27
Expiration date: 29 May 2008 02:43:27
Redirected to:
https://www.official-medicals.com/
See:
www.official-medicals.com IP 124.42.8.150
dns1.name-services.com [69.25.142.1] [TTL=172800] [US]
dns2.name-services.com [216.52.184.230] [TTL=172800] [US]
dns3.name-services.com [63.251.92.193] [TTL=172800] [US]
dns4.name-services.com [64.74.96.242] [TTL=172800] [US]
dns5.name-services.com [70.42.37.1] [TTL=172800] [US]
SOA record [TTL=1800] is:
Primary nameserver: dns1.name-services.com
Hostmaster E-mail address: in...@name-services.com
Serial #: 2002050701
1 MX record are:
10 mail.official-medicals.com [TTL=1800] IP=64.92.172.210 [TTL=1800]
[US]
mail.official-medicals.com claims to be invalid hostname 'server':
220 server ESMTP Postfix
64.92.172.210 = 210.172.92.64.static.reverse.layeredtech.com
WARNING:
mail.official-medicals.com appears to be an open relay: 250 ok
http://www.moensted.dk/spam/?addr=124.42.8.150
Escalated Listing (Spam or Spam Support) See: http://www.sorbs.net/lookup.shtml?124.42.8.150
http://www.spamhaus.org/query/bl?ip=124.42.8.150
inetnum: 124.42.0.0 - 124.42.127.255
netname: SINNET
descr: Beijing Guanghuan Xinwang Digital Technology co.Ltd
person: Chen hao
nic-hdl: CH471-AP
e-mail: lic...@sinnet.com.cn
person: Wang Huijun
nic-hdl: WH271-AP
e-mail: che...@sinnet.com.cn
abuse[]sinnet.com.cn is listed in rfc-ignorant.org database
Prefix: 124.42.0.0/19
Prefix Name: error
AS: 23844
AS Name: BJ GUANGHUAN AP Beijing Guanghuan Xinwang Digital Technology
Co , LTD
http://www.cidr-report.org/cgi-bin/as-report?as=23844
route: 124.42.0.0/17
descr: China United Telecom
origin: AS9800
mnt-by: MAINT-AS9800
changed: y...@chinaunicom.com.cn
http://www.cidr-report.org/cgi-bin/as-report?as=4134
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL55063
124.42.8.150/32 is listed on the Spamhaus Block List (SBL)
29-May-2007 09:04 GMT | SR22
Spam webhosting - official-medicals.com
Spam redirection target: visitors that visit the URL mentioned in spam
get redirected to www.official-medicals.com, which is on 124.42.8.150.
This site is selling counterfeit prescription drugs, highly illegal!
1 SBL listings for IPs under the responsibility of sinnet.com.cn
http://www.spamhaus.org/sbl/listings.lasso?isp=sinnet.com.cn
Let see whois:
Registration Service Provided By: eNom, Inc.
Contact: in...@eNom.com
Domain name: official-medicals.com
Administrative Contact:
escher
michael escher (info[]remara.com)
+49.8654806103
Fax: -
meierstrase 3
hamburg, HAMBURG 21233
DE
Technical Contact:
escher
michael escher (in...@remara.com)
+49.8654806103
Fax: -
meierstrase 3
hamburg, HAMBURG 21233
DE
Registrant Contact:
escher
michael escher (in...@remara.com)
+49.8654806103
Fax: -
meierstrase 3
hamburg, HAMBURG 21233
DE
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
Creation date: 24 May 2007 14:56:28
Expiration date: 24 May 2008 14:56:28
More official-medicals.com sightings:
http://groups.google.com/groups/search?q=official-medicals.com+group%3A*abuse&qt_s=Search
SEE from registrant email record whois remara.com:
remara.com does not have a website
Let see whois output for: remara.com
Domain Name Owner:
escher
meierstrase 3
hamburg, hamburg 21233
DE
Administrative Contact:
escher, michael
escher
meierstrase 3
hamburg, hamburg 21233, DE
Phone: +498654806103
Email: frank.george[]limousinbeef.com
Technical Contact:
escher, michael
escher
meierstrase 3
hamburg, hamburg 21233, DE
Phone: +498654806103
Email: frank....@limousinbeef.com
Billing Contact:
escher, michael
escher
meierstrase 3
hamburg, hamburg 21233, DE
Phone: +498654806103
Email: frank....@limousinbeef.com
Record Information:
Domain Record Created: May 24, 2007
Domain Record Updated: May 23, 2007
Domain Record Expires: May 24, 2008
DNS Information:
Name Server: ns1.omnis.com
Name Server: ns2.omnis.com
remara.com IP 216.239.138.122
ns1.omnis.com [216.239.128.2] [TTL=172800] [US]
ns2.omnis.com [216.239.128.3] [TTL=172800] [US]
SOA record [TTL=3600] is:
Primary nameserver: ns1.omnis.com
Hostmaster E-mail address: dns-admin.omnis.com
Serial #: 2007052317
1 MX record is:
10 postoffice.omnis.com [TTL=3600] IP=216.239.128.25 [TTL=3600] [US]
http://www.moensted.dk/spam/?addr=216.239.138.122
216.239.138.122 = 216-239-138.122.cluster.omnis.com
OrgName: Omnis Network, LLC
OrgID: OMSN
NetRange: 216.239.128.0 - 216.239.143.255
CIDR: 216.239.128.0/20
NetName: OMNIS-NET-1
NetHandle: NET-216-239-128-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Allocation
Aliases on ip:
www.advancedsafety.com
[whois.radb.net]
route: 216.239.128.0/20
descr: RR-RC-Omnis Network-Los Angeles
origin: AS20001
notify: ipad...@rr.com
mnt-by: MAINT-RR
changed: ipad...@rr.com 20061011
source: RADB
route: 216.239.128.0/20
descr: AS19237 proxy-registered route by Cogent
origin: AS19237
remarks: Proxy-registered route object
remarks: for Cogent customer
notify: net...@cogentco.com
mnt-by: MAINT-AS174
http://www.cidr-report.org/cgi-bin/as-report?as=19237
See also more genuine-pharmacy.com sightings:
http://groups.google.com/groups/search?q=genuine-pharmacy.com+group%3A*abuse&qt_s=Search
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/143ee8e2bcb3b75e
See also thread:
http://groups.google.com/group/news.admin.net-abuse.email/browse_thread/thread/e2d44e663c4f6c33/3e4917b26de1b918#3e4917b26de1b918
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: