[email] [ComfortRX drugs botnet] (unkeferr.com - tilleypom.com) SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*, CIPRO, MERIDI*, CELEBRE*, VALIU* hard
TomezNet
IP 200.161.99.26 200-161-99-26.dsl.telesp.net.br
(at dnsqipbr2.telesp.net.BR / B.DNS.BR)
Spamvert drugs botnet:
nfra.unkeferr.com
Resolved nfra.unkeferr.com to 12.203.17.115 to 82.39.250.122 to
82.233.132.30 to 82.254.194.187
Spamvert drugs botnet:
unkeferr.com
tilleypom.com
Looks like ComfortRX is VIP Pharmacy aka PharmacyExpress.com
More Comfort RX sightings:
http://groups.google.com/groups/search?q=ComfortRX+group%3A*abuse
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 206.190.49.52; Thu, 06 Apr 2006
09:45:36 -0700
X-YahooFilteredBulk: 200.161.99.26
X-Originating-IP: [200.161.99.26]
Return-Path: <awapj...@ieway.com>
Authentication-Results: mta223.mail.re2.yahoo.com from=ieway.com;
domainkeys=fail (bad syntax)
Received: from 200.161.99.26 (HELO 200-161-99-26.dsl.telesp.net.br)
(200.161.99.26) by mta223.mail.re2.yahoo.com with SMTP; Thu, 06 Apr
2006 09:45:36 -0700
Received: from [192.168.1.0] ([200.161.99.26]) by ameritech.net
(Sendmail 8.7.5) with ESMTP (SSL) id IYT29835 for <xx..xx@xx..xx.com>;
Thu, 06 Apr 2006 11:45:24 -0600
Message-ID: <605h707u...@ameritech.net>
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=beautiful.evening; d=ameritech.net;
b=slUOB2phejO31COVxFwxMS4RjCLbKTSAPHkriRJzVaQk5R52g0DfUfxiKcCXt72sI0PjogUZDSYtRXyN;
Date: Thu, 06 Apr 2006 11:45:24 -0600
From: "Paris Sunday" <awapj...@ieway.com>
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xx..xx@xx..xx.com
Subject: SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*,
CIPRO, MERIDI*, CELEBRE*, VALIU* hard
Content-Type: multipart/related;
boundary="------------08337080==.MRA"
Content-Length: 916
---------------------------------
next different very,Quality Meds Selling At Cheeap
We dont keep ur record (not even your name)
You just pay & we ship, No Question form to fill
We ship to all countries
Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro, Meridi*,
Celebre*, Valiu*, Zoloft & Many More Meds appearance
reference C11ck Here for Huge Saving anybody
purpose next immediate somewhere pride or, thus find fly carefully?
sugar wife use.
force commit friends young similar she,
money leader social human least. sugar added evening wrong a edge.
development different hard explain hard miserable,
how he suddenly, fly few supposedto hard.
servants is miserable. again why bad.
tying rich am very reply,
<html><head>
<meta http-equiv="Content-Type" content="text; charset=iso-8859-1">
</head>
<body>
<font color=FFA4D1 size=1>next different very,</font>
<table border=10 cellspacing=0 cellpadding=3 width=520
bordercolor=CDFF59>
<tr><td bgcolor=ffffff bordercolor=000000><center>
<font size=2 face=arial color=CC0000>
<font size=4 color=000000><b>Quality Meds Selling At Cheeap<br><font
color=EA0000>We dont keep ur record (not even your
name)</font><br><font color=AEAE00>You just pay & we ship, No Question
form to fill</font><br><font color=FF5EAE>We ship to all
countries</b></center></font></font><br><font color=000000
size=2>Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro,
Meridi*, Celebre*, Valiu*, Zoloft & Many More Meds
appearance<br><center>
<a href=http://nfra.unk%65%66%65%72r%2eco%6d target=_blank><font size=4
color=5E5EFF><u>reference <b>C11ck Here for Huge Saving</b>
anybody</font></u></a></font></center><br></td></tr></table><font
color=FFA4D1 size=1>purpose next immediate somewhere pride or, thus
find fly carefully? sugar wife use.<br>
force commit friends young similar she,<br>
money leader social human least. sugar added evening wrong a edge.
development different hard explain hard miserable,<br>
how he suddenly, fly few supposedto hard.<br>
servants is miserable. again why bad.<br>
tying rich am very reply,<br></font>
</body></html>
-- END OF SPAM --
See forged site certificates and logos by ComfortRX Ltd / Canadian RX
Corp:
* VeriSign Secure VeriSign Secure Server ID authenticated by Soltrus
Country = US
State = FL
Locality PharmacyChecker = Canada / Toronto
Organization = Technical Consultants and Experts Group Inc
Organizational Unit = TCE Group
Logos and support by Visa
BBBOnLine Reliability
Cipa Certification/Membership
The CIPA seal's link also claims to be MyCanadianPharmacy:
Organization: MyCanadianPharmacy
Licence #: 91959
More tilleypom.com sightings:
http://groups.google.com/groups/search?q=tilleypom.com+group%3A*abuse
See:
IP 200.161.99.26 200-161-99-26.dsl.telesp.net.br
http://www.moensted.dk/spam/?addr=200.161.99.26
inetnum: 200.161/16
aut-num: AS27699
abuse-c: ABL226
owner: TELECOMUNICACOES DE SAO PAULO S.A. - TELESP
ownerid: 002.558.157/0001-62
responsible: Luiz A. P. Lopes
ASN: 27699
ASN Name: LACNIC-27648
http://www.cidr-report.org/cgi-bin/as-report?as=27699
22 SBL/ROKSO listings for IPs under the responsibility of telesp.net.br
http://www.spamhaus.org/sbl/listings.lasso?isp=telesp.net.br
See botnet:
nfra.unkeferr.com A IN 180 12.203.17.115
nfra.unkeferr.com A IN 180 82.233.132.30
nfra.unkeferr.com A IN 180 82.39.250.122
nfra.unkeferr.com A IN 180 82.254.194.187
nfra.unkeferr.com A IN 180 82.39.250.122
ns1.tilleypom.com [68.61.193.173]
ns2.tilleypom.com [82.254.194.187]
ns3.tilleypom.com [67.183.122.34]
ns4.tilleypom.com [82.242.19.172]
ns5.tilleypom.com [61.103.125.106]
nfra.unkeferr.com has no MX records -> unkeferr.com has no MX records
Let see whois:
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Domain Name.......... unkeferr.com
Creation Date........ 2006-04-03
Registration Date.... 2006-04-03
Expiry Date.......... 2007-04-03
Organisation Name.... Rachel Unkefer
Organisation Address. 3105 Edgewater Drive
Organisation Address.
Organisation Address. Charlottesville
Organisation Address. 22911
Organisation Address. VA
Organisation Address. UNITED STATES
Admin Name........... Rachel Unkefer
Admin Address........ 3105 Edgewater Drive
Admin Address........
Admin Address........ Charlottesville
Admin Address........ 22911
Admin Address........ VA
Admin Address........ UNITED STATES
Admin Email.......... unkefer[]hotmail.com
Admin Phone.......... +1.4349750788
Admin Fax............
Tech Name............ Rachel Unkefer
Tech Address......... 3105 Edgewater Drive
Tech Address.........
Tech Address......... Charlottesville
Tech Address......... 22911
Tech Address......... VA
Tech Address......... UNITED STATES
Tech Email........... unk...@hotmail.com
Tech Phone........... +1.4349750788
Tech Fax.............
Name Server.......... ns1.tilleypom.com
Name Server.......... ns2.tilleypom.com
Name Server.......... ns3.tilleypom.com
Name Server.......... ns4.tilleypom.com
Name Server.......... ns5.tilleypom.com
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/5d5d3093256b8fd6
AND:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/75ff2c095e1e11d4
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: