[email] [drugs - botnet] [212.242.218.44] (couldunit.hk / chitionkdetunlionpsa.com / piotiongandesunkdes.com / gedsactunjerion.com / fionkunjerunhedase.com) Re:
TomezNet
IP 212.242.218.44 port355.ds1-fh.adsl.cybercity.dk
Spamvert:
www.couldunit.hk
Resolved to 66.188.70.76 to 67.65.165.205 to 67.164.58.102 to
69.108.239.168 to 69.152.217.242 to 69.226.243.157 to 70.253.130.70 to
74.102.18.163 to 76.111.17.116 to 81.5.103.143
Title => Canadian Pharmacy
Much More Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
Return-Path: <cedepo...@modrijan.si>
Delivered-To: [MUNGED]
Received: (qmail 3852 invoked from network); 17 May 2007 14:25:13
-0400
Received: from port355.ds1-fh.adsl.cybercity.dk (212.242.218.44)
by [MUNGED] with SMTP; 17 May 2007 14:25:13 -0400
Return-Path: <cedepo...@modrijan.si>
Received: from 193.77.54.180 (HELO mail.modrijan.si)
by [MUNGED] with (8.53.0/8.00.6) ESMTP id vt8fydk92s3a32
for [MUNGED]; Thu, 17 May 2007 18:25:41 -0060
Received: from jzxyk.finjan.com ([179.149.37.215])
by 8elja.finjan.com (4.95.4.20061305/2.01.5) with ESMTP id
p1U20el9h484962
for [MUNGED]; Thu, 17 May 2007 18:25:41 -0060
From: "Marleny Mwashita" <cedepo...@modrijan.si>
To: <[MUNGED]
Subject: Re:
Date: Thu, 17 May 2007 18:25:41 -0060
Message-ID: <01c798b0$c6a8b640$6c822ecf@cedepolluted>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C798C1.8A318640"
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
Thread-Index: Aca6Q/Z9BT4O-1./Z<'+7A*=U2Q8:R==
X-Spam-Prev-Subject: Re:
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html;
charset=Windows-1252">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
</head>
<body>
<BODY text=#000000 bgColor=#ffffff>
<font size="3" face="Times New Roman"><p align="center"><font
color="#0000ff" size="6"><strong>VIAGRA</strong></font></p>
<p align="center">If you have a problem getting or keeping an
erection, your sex life can suffer. <br />You should know that
you're not alone. In fact, more than half of all men over 40 <br/>have
difficulties getting or maintaining an erection. This issue, also
called <br />erectile dysfunction, occurs with younger men as
well!</p>
<p align="center">You should know there is something you can do about
it. <br />Join the millions of men who have already <strong>improved
their sex lives with VIAGRA</strong>!</p>
<p align="center"><a href="http://couldunit.hk"><font
size="4"><strong>VISIT STORE ONLINE!</strong></font></a></p></font>
</BODY>
</body>
</html>
-- END OF SPAM --
WEB:
Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
See Much More Registrant E-mail mmlara[]163.com sightings:
http://groups.google.com/groups/search?q=%22mmlara%40163.com%22+group%3A*abuse&start=0&scoring=d&
See:
IP 212.242.218.44 port355.ds1-fh.adsl.cybercity.dk
http://www.moensted.dk/spam/?addr=212.242.218.44
http://www.spamhaus.org/query/bl?ip=212.242.218.44
http://www.spamhaus.org/pbl/query/PBL096497
http://spamcop.net/w3m?action=checkblock&ip=212.242.218.44
Spam source - http://wpbl.info/record?ip=212.242.218.44
Exploitable Server See: http://www.sorbs.net/lookup.shtml?212.242.218.44
See more 212.242.218.44 sightings:
http://groups.google.com/groups/search?q=212.242.218.44+group%3A*abuse&qt_s=Search
inetnum: 212.242.192.0 - 212.242.255.255
netname: CYBERCITY-DSL-USERS
descr: Cybercity A/S xDSL users
country: DK
route: 212.242.0.0/16
descr: CyberCity DK
origin: AS6785
mnt-by: AS6785-MNT
changed: p...@cybercity.dk
http://www.cidr-report.org/cgi-bin/as-report?as=6785
16 SBL/ROKSO listings for IPs under the responsibility of
goldenlines.net.il
http://www.spamhaus.org/sbl/listings.lasso?isp=goldenlines.net.il
1 SBL listings for IPs under the responsibility of 012.net.il
http://www.spamhaus.org/sbl/listings.lasso?isp=012.net.il
See:
www.couldunit.hk A record is:
www.couldunit.hk A 66.176.228.249 [TTL=300] [US]
www.couldunit.hk A 81.5.103.143 [TTL=300] [RU]
www.couldunit.hk A 69.152.217.242 [TTL=300] [US]
www.couldunit.hk A 66.188.70.76 [TTL=300] [US]
www.couldunit.hk A 76.111.17.116 [TTL=300] [US]
www.couldunit.hk A 70.253.130.70 [TTL=300] [US]
www.couldunit.hk A 208.120.86.29 [TTL=300] [US]
www.couldunit.hk A 69.154.161.82 [TTL=300] [US]
www.couldunit.hk A 74.102.18.163 [TTL=300] [CA]
www.couldunit.hk A 67.164.58.102 [TTL=300] [US]
NS0.PIOTIONGANDESUNKDES.COM [75.24.23.221 (NO GLUE)] [US]
NS0.CHITIONKDETUNLIONPSA.COM [65.24.170.10 (NO GLUE)] [US]
NS0.GEDSACTUNJERION.COM [64.85.255.75 (NO GLUE)] [US]
NS0.FIONKUNJERUNHEDASE.COM [208.120.86.29 (NO GLUE)] [US]
NS records at your nameservers are:
ns0.chitionkdetunlionpsa.com [65.24.170.10] [TTL=300]
ns0.piotiongandesunkdes.com [66.176.228.249] [TTL=300]
ns0.gedsactunjerion.com [64.85.255.75] [TTL=300]
ns0.fionkunjerunhedase.com [208.120.86.29] [TTL=300]
SOA record [TTL=300] is:
Primary nameserver: ns0.chitionkdetunlionpsa.com
Hostmaster E-mail address:
Serial #: 0
4 MX records are:
ns0.chitionkdetunlionpsa.com. and ns0.piotiongandesunkdes.com. both
resolve to 0.0.0.0.
ns0.chitionkdetunlionpsa.com. and ns0.gedsactunjerion.com. both
resolve to 0.0.0.0.
ns0.chitionkdetunlionpsa.com. and ns0.fionkunjerunhedase.com. both
resolve to 0.0.0.0.
ns0.piotiongandesunkdes.com. and ns0.gedsactunjerion.com. both resolve
to 0.0.0.0.
ns0.piotiongandesunkdes.com. and ns0.fionkunjerunhedase.com. both
resolve to 0.0.0.0.
ns0.gedsactunjerion.com. and ns0.fionkunjerunhedase.com. both resolve
to 0.0.0.0.
Resolve an BOTNET IP Addresses to a Host Name
66.176.228.249 = c-66-176-228-249.hsd1.fl.comcast.net
81.5.103.143 NO PTR at MIPT-telecom-VPN-1 (mipt.ru)
69.152.217.242 = adsl-69-152-217-242.dsl.fyvlar.swbell.net
66.188.70.76 = 66-188-70-76.dhcp.athn.ga.charter.com
76.111.17.116 = c-76-111-17-116.hsd1.md.comcast.net
70.253.130.70 = ppp-70-253-130-70.dsl.rcsntx.swbell.net
208.120.86.29 = user-387glgt.cable.mindspring.com
69.154.161.82 = adsl-69-154-161-82.dsl.hstntx.swbell.net
74.102.18.163 = cpe00115b15e45b-
cm001692410d72.cpe.net.cable.rogers.com
67.164.58.102 = c-67-164-58-102.hsd1.wa.comcast.net
Let see whois:
Domain Name: COULDUNIT.HK
Contract Version: HKDNR latest version
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): BGBDO LOLSDFFSDDDDDXSE
Holder Chinese Name:
Email: lewis....@gmail.com
Domain Name Commencement Date: 07-05-2007
Country: US
Expiry Date: 07-05-2008
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1882422T
Technical Contact:
First name: MILE
Last name: ROGERS
Company Name: BGBDO LOLSDFFSDDDDDXSE
Name Servers Information:
NS0.FIONKUNJERUNHEDASE.COM
NS0.GEDSACTUNJERION.COM
NS0.PIOTIONGANDESUNKDES.COM
NS0.CHITIONKDETUNLIONPSA.COM
See:
ns0.chitionkdetunlionpsa.com IP 65.24.170.10
ns0.chitionkdetunlionpsa.com has no MX records ->
chitionkdetunlionpsa.com has no MX records
65.24.170.10 = cpe-65-24-170-10.columbus.res.rr.com
http://www.moensted.dk/spam/?addr=65.24.170.10
http://www.spamhaus.org/query/bl?ip=65.24.170.10
http://www.spamhaus.org/pbl/query/PBL137768
Let see whois:
Domain Name:chitionkdetunlionpsa.com
Registrant:
Dima li
jungonglu1219hao
200093
Administrative Contact:
Dima li
Dima li
jungonglu1219hao
shang hai Shanghai 200093
China
tel: 86 021 76886639
fax: 86 021 76886639
mmlara[]163.com
Technical Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Billing Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Registration Date: 2006-09-29
Update Date: 2007-05-09
Expiration Date: 2007-09-29
Primary DNS: ns0.caseruikiontungandesun.com 60.191.254.73
Secondary DNS: ns0.daseruiyionkdefunhan.com 222.88.90.106
More chitionkdetunlionpsa.com sightings:
http://groups.google.com/groups/search?q=chitionkdetunlionpsa.com+group%3A*abuse&qt_s=Search
See:
ns0.piotiongandesunkdes.com IP 66.176.228.249
ns0.piotiongandesunkdes.com has no MX records ->
piotiongandesunkdes.com has no MX records
66.176.228.249 = c-66-176-228-249.hsd1.fl.comcast.net
http://www.moensted.dk/spam/?addr=66.176.228.249
http://www.spamhaus.org/query/bl?ip=66.176.228.249
http://www.spamhaus.org/pbl/query/PBL114746
Let see whois:
Domain Name:piotiongandesunkdes.com
Registrant:
Dima li
jungonglu1219hao
200093
Administrative Contact:
Dima li
Dima li
jungonglu1219hao
shang hai Shanghai 200093
China
tel: 86 021 76886639
fax: 86 021 76886639
mmlara[]163.com
Technical Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Billing Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Registration Date: 2006-09-22
Update Date: 2007-05-09
Expiration Date: 2007-09-22
Primary DNS: ns0.caseruikiontungandesun.com 60.191.254.73
Secondary DNS: ns0.daseruiyionkdefunhan.com 222.88.90.106
More piotiongandesunkdes.com sightings:
http://groups.google.com/groups/search?q=piotiongandesunkdes.com+group%3A*abuse&start=0&scoring=d&
See:
ns0.gedsactunjerion.com IP 64.85.255.75
ns0.gedsactunjerion.com has no MX records -> gedsactunjerion.com has
no MX records
64.85.255.75 = astound-64-85-255-75.ca.astound.net
http://www.moensted.dk/spam/?addr=64.85.255.75
Let see whois:
Domain Name:gedsactunjerion.com
Registrant:
Dima li
jungonglu1219hao
200093
Administrative Contact:
Dima li
Dima li
jungonglu1219hao
shang hai Shanghai 200093
China
tel: 86 021 76886639
fax: 86 021 76886639
mmlara[]163.com
Technical Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Billing Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Registration Date: 2006-09-14
Update Date: 2007-05-09
Expiration Date: 2007-09-14
Primary DNS: ns0.caseruikiontungandesun.com 60.191.254.73
Secondary DNS: ns0.daseruiyionkdefunhan.com 222.88.90.106
More gedsactunjerion.com sightings:
http://groups.google.com/groups/search?q=gedsactunjerion.com+group%3A*abuse&start=0&scoring=d&
See:
ns0.fionkunjerunhedase.com IP 208.120.86.29
ns0.fionkunjerunhedase.com has no MX records -> fionkunjerunhedase.com
has no MX records
208.120.86.29 = user-387glgt.cable.mindspring.com
http://www.moensted.dk/spam/?addr=208.120.86.29
Let see whois:
Domain Name:fionkunjerunhedase.com
Registrant:
Dima li
jungonglu1219hao
200093
Administrative Contact:
Dima li
Dima li
jungonglu1219hao
shang hai Shanghai 200093
China
tel: 86 021 76886639
fax: 86 021 76886639
mmlara[]163.com
Technical Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Billing Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Registration Date: 2006-09-29
Update Date: 2007-05-09
Expiration Date: 2007-09-29
Primary DNS: ns0.caseruikiontungandesun.com 60.191.254.73
Secondary DNS: ns0.daseruiyionkdefunhan.com 222.88.90.106
More fionkunjerunhedase.com sightings:
http://groups.google.com/groups/search?q=fionkunjerunhedase.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/7541b88414d363b1
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/0709c18e7f3847f2
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: