[email] [drugs - Legal RX] [87.3.240.85] (southd.hk - 213.240.234.132 - faqseller.hk - hebeticbob.com - uiltonthe.net - renedrop.com - ferrywend.com) Education OnSite Training
TomezNet
IP 87.3.240.85 host215-240-dynamic.55-82-r.retail.telecomitalia.it
(at dnsts.interbusiness.it)
Spamvert:
southd.hk IP 83.229.85.132
faqseller.hk IP 83.229.85.132
(at sky-vision.net)
See Yambo Pharmacy image hosting:
http://213.240.234.132:8080/legalrx/images/award_bestpharma.gif
IP 213.240.234.132
(SBL49388) (at interbgc.com)
Web:
Copyright 1994-2007 © International Legal RX medications All rights
reserved.
More Legal RX Medications sightings:
http://groups.google.com/groups/search?q=%22Legal+RX%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: Montana <fl...@fentonfan.com>
X-SID-Result: Neutral
X-Message-Info: txF49lGdW407InPDMj1lPcMONr99I0fgS2GtqTqI6d4=
Received: from tomts11-srv.bellnexxia.net ([209.226.175.55]) by
bay0-pamc1-f5.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sun, 14 Jan 2007 08:01:32 -0800
Received: from [MUNGED]
by toip22.srvr.bell.ca with ESMTP; 14 Jan 2007 11:01:24 -0500
Received: (qmail 22179 invoked by uid 110); 14 Jan 2007 11:01:24 -0500
Delivered-To: [MUNGED]
Received: (qmail 22159 invoked from network); 14 Jan 2007 11:01:23
-0500
Received: from host85-240-dynamic.3-87-r.retail.telecomitalia.it (HELO
host215-240-dynamic.55-82-r.retail.telecomitalia.it) (87.3.240.85)
by [MUNGED] with SMTP; 14 Jan 2007 11:01:23 -0500
Received: from LXF (unknown [162.150.95.123])
by fentonfan.com with ESMTP id CBF73A1C4328
for <[MUNGED]>; Sun, 14 Jan 2007 17:01:28 +0100 (GMT)
Message-ID: <000801c737f5$3253b3d0$d7f03752@STUDIO>
From: "Montana" <fl...@fentonfan.com>
To: [MUNGED]
Subject: Education OnSite Training
Date: Sun, 14 Jan 2007 17:00:58 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_0004_01C737FD.90824AE0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Return-Path: fl...@fentonfan.com
X-OriginalArrivalTime: 14 Jan 2007 16:01:32.0519 (UTC)
FILETIME=[427A8770:01C737F5]
------=_NextPart_000_0004_01C737FD.90824AE0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0005_01C737FD.90824AE0"
------=_NextPart_001_0005_01C737FD.90824AE0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Have helped more than clients become licensed in.
Written conducted by highly qualified, with.
Toll, free fax tn center. Voice az, dunlap phoenix va marshall st. =
Portions are written conducted, by highly qualified, with!
Colorado delaware florida georgia.
Commercial electrical, mechanical contractor exams also prepare =
candidates for. Students, design services sample testing cont education
=
onsite training.
Questions math concepts used, on. Llc filing renewal about. Are
written, =
conducted, by highly qualified. Exams also prepare, candidates for =
business. Online careers customer service southern hwy mineral wells
wv!
Titles industry, limited, shipping within, us orders over. State
alabama =
alaska arizona arkansas california, colorado delaware? Policy
specialize =
info other, click here?
------=_NextPart_001_0005_01C737FD.90824AE0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.2180" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2><A HREF=3Dhttp://southd.hk/><IMG =
alt=3D"" hspace=3D0=20
src=3D"cid:000301c737f5$2ebde2e0$d7f03752@STUDIO" align=3Dbaseline=20
border=3D0></A></FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Have helped more than clients become =
licensed in.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Written conducted by highly qualified,
=
with.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Toll, free fax tn center. Voice az, =
dunlap phoenix=20
va marshall st. Portions are written conducted, by highly qualified, =
with!</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Colorado delaware florida =
georgia.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Commercial electrical, mechanical =
contractor exams=20
also prepare candidates for. Students, design services sample testing =
cont=20
education onsite training.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Questions math concepts used, on. Llc
=
filing=20
renewal about. Are written, conducted, by highly qualified. Exams also
=
prepare,=20
candidates for business. Online careers customer service southern hwy =
mineral=20
wells wv!</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Titles industry, limited, shipping =
within, us=20
orders over. State alabama alaska arizona arkansas california,
colorado=20
delaware? Policy specialize info other, click =
here?</FONT></DIV></BODY></HTML>
------=_NextPart_001_0005_01C737FD.90824AE0--
------=_NextPart_000_0004_01C737FD.90824AE0
Content-Type: image/gif;
name="you our.gif"
Content-Transfer-Encoding: base64
Content-ID: <000301c737f5$2ebde2e0$d7f03752@STUDIO>
------=_NextPart_000_0004_01C737FD.90824AE0--
*** REMOVED Attachment: you our.gif (< 0.01 MB) ****
-- END OF SPAM --
See forged site certificates and logos.
See:
IP 87.3.240.85 host215-240-dynamic.55-82-r.retail.telecomitalia.it
http://www.moensted.dk/spam/?addr=87.3.240.85
http://www.spamhaus.org/query/bl?ip=87.3.240.85
http://www.spamhaus.org/pbl/query/PBL043484
inetnum: 87.0.0.0 - 87.15.255.255
netname: TELECOM-ADSL-7
descr: Telecom Italia S.p.A. TIN EASY LITE
mnt-routes: tiws-mnt
changed: thomas...@telecomitalia.it
postmaster and abuse[]interbusiness.it are listed in rfc-ignorant.org
database
route: 87.3.0.0/16
descr: INTERBUSINESS
origin: AS3269
notify: net...@cgi.interbusiness.it
mnt-by: TIWS-MNT
mnt-routes: INTERB-MNT
changed: net...@telecomitalia.it
ASN: 3269
ASN Name: ASN-IBSNAZ (TELECOM ITALIA)
IP range connectivity: 4
Registrar (per ASN): RIPE
Country (per IP registrar): IT [Italy]
Country Currency: EUR [euros]
Country IP Range: 87.0.0.0 to 87.31.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=3269
19 SBL/ROKSO listings for IPs under the responsibility of
interbusiness.it
http://www.spamhaus.org/sbl/listings.lasso?isp=interbusiness.it
URL:
http://www.southd.hk/legalrx/?&pid=2321
See:
southd.hk IP 83.229.85.132
NS2.FERRYWEND.COM [63.223.11.14 (NO GLUE)] [US]
NS2.HEBETICBOB.COM [63.223.11.14 (NO GLUE)] [US]
NS1.RENEDROP.COM [203.129.232.82 (NO GLUE)] [IN]
NS1.UILTONTHE.NET [203.129.232.82 (NO GLUE)] [IN]
[southd.hk has 1 MX record mail.southd.hk (10)]
mail.southd.hk A IN 600 239.191.59.59
NS records at nameservers are:
ns3.southd.hk [239.191.59.59] [TTL=600]
ns1.southd.hk [83.229.85.132] [TTL=600]
ns2.southd.hk [83.229.85.132] [TTL=600]
SOA record [TTL=600] is:
Primary nameserver: southd.hk
Hostmaster E-mail address: ad...@southd.hk
Serial #: 2005000000
http://www.moensted.dk/spam/?addr=83.229.85.132
inetnum: 83.229.84.0 - 83.229.85.255
org: ORG-BA131-RIPE
netname: BBH-Accra
route: 83.229.84.0/23
descr: SkyVision
origin: AS8513
mnt-by: SV-MNT
mnt-lower: RIPE-NCC-RPSL-MNT
source: RIPE
changed: n...@sky-vision.net
ASN: 8513
ASN Name: SKYVISION (SkyVision Network Services)
Country (per IP registrar): GB [United Kingdom]
Country IP Range: 83.229.0.0 to 83.229.127.255
http://www.cidr-report.org/cgi-bin/as-report?as=8513
23 SBL/ROKSO listings for IPs under the responsibility of
sky-vision.net
http://www.spamhaus.org/sbl/listings.lasso?isp=sky-vision.net
Let see whois:
Domain Name: SOUTHD.HK
Contract Version: HKDNR latest version
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): DUSTIN GILBERT
Holder Chinese Name:
Email: dsd...@yahoo.com
Domain Name Commencement Date: 2006-12-30
Country: US
Expiry Date: 2007-12-31
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1775789T
Technical Contact:
First name: DUSTIN
Last name: GILBERT
Company Name: DUSTIN GILBERT
Name Servers Information:
NS1.RENEDROP.COM
NS2.FERRYWEND.COM
NS1.UILTONTHE.NET
NS2.HEBETICBOB.COM
More southd.hk sightings:
http://groups.google.com/groups/search?q=southd.hk+group%3A*abuse
See:
NS2.FERRYWEND.COM IP 63.223.11.14
NS2.FERRYWEND.COM has no MX records -> [FERRYWEND.COM has 1 MX record
mail.FERRYWEND.COM (10)]
http://www.moensted.dk/spam/?addr=63.223.11.14
http://www.spamhaus.org/query/bl?ip=63.223.11.14
More 63.223.11.14 sightings:
http://groups.google.com/groups/search?q=63.223.11.14+group%3A*abuse&start=0&scoring=d&
No PTR records exist for 63.223.11.14 at NS.CAIS.COM / pccwglobal.com
check with hostm...@wvfiber.net
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49084
63.223.11.14/32 is listed on the Spamhaus Block List (SBL/ROKSO)
09-Jan-2007 00:26 GMT | SR21
Yambo Financials.
Spam DNS Server
10 SBL/ROKSO listings for IPs under the responsibility of
pccwglobal.com
http://www.spamhaus.org/sbl/listings.lasso?isp=pccwglobal.com
Let see whois.paycenter.com.cn
Registrar: XIN NET TECHNOLOGY CORPORATION
Domain Name: ferrywend.com
Registrant:
liu fei
nanchang
321000
Administrative Contact:
liu fei
liu fei
nanchang
jiang xi Jiangxi 321000
China
tel: 86 0791 32299123
fax: 86 0791 32299123
admin[]ferrywend.com
Technical Contact:
liu fei
liu fei
nanchang
jiang xi Jiangxi 321000
China
tel: 86 0791 32299123
fax: 86 0791 32299123
ad...@ferrywend.com
Billing Contact:
liu fei
liu fei
nanchang
jiang xi Jiangxi 321000
China
tel: 86 0791 32299123
fax: 86 0791 32299123
ad...@ferrywend.com
Registration Date: 2006-11-20
Update Date: 2006-12-26
Expiration Date: 2007-11-20
Primary DNS: ns1.ferrywend.com 203.129.232.82
Secondary DNS: ns2.ferrywend.com 63.223.11.14
More ferrywend.com sightings:
http://groups.google.com/groups/search?q=ferrywend.com+group%3A*abuse&start=0&scoring=d&
See:
NS2.HEBETICBOB.COM IP 63.223.11.14
ns2.hebeticbob.com has no MX records -> [hebeticbob.com has 1 MX record
mail.hebeticbob.com (10)]
http://www.moensted.dk/spam/?addr=63.223.11.14
Let see whois:
Registrar: DSTR ACQUISITION VII, LLC
Registrant:
Pilzek Vichesku (HEBETICBOB-COM-DOM)
Cal. Giulesti, No. 1-6
Bucuresti, Sector 6 73403
Romania
+040.0214021043
+040.0214021043
pilzek_vichesku[]yahoo.com
Domain Name: HEBETICBOB.COM
Status: PROTECTED
Administrative Contact:
Pilzek Vichesku pilzek_...@yahoo.com
Cal. Giulesti, No. 1-6
Bucuresti, Sector 6 73403
Romania
+040.0214021043
Fax- +040.0214021043
Technical Contact, Zone Contact:
Pilzek Vichesku pilzek_...@yahoo.com
Cal. Giulesti, No. 1-6
Bucuresti, Sector 6 73403
Romania
+040.0214021043
Fax- +040.0214021043
Record last updated on 26-Dec-2006.
Record expires on 25-Dec-2007.
Record created on 25-Dec-2006.
Domain servers in listed order:
Name Server: ns1.hebeticbob.com
Name Server: ns2.hebeticbob.com
More hebeticbob.com sightings:
http://groups.google.com/groups/search?q=hebeticbob.com+group%3A*abuse&start=0&scoring=d&
See:
NS1.RENEDROP.COM IP 203.129.232.82
ns1.renedrop.com has no MX records -> [renedrop.com has 1 MX record
mail.renedrop.com (10)]
http://www.moensted.dk/spam/?addr=203.129.232.82
http://www.spamhaus.org/query/bl?ip=203.129.232.82
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49984
203.129.232.82/32 is listed on the Spamhaus Block List (SBL/ROKSO)
11-Jan-2007 23:39 GMT | SR20
Yambo Financials.
Yambo botnet nameservers/webhosts (compromised systems)
2 SBL/ROKSO listings for IPs under the responsibility of stpi.in
http://www.spamhaus.org/sbl/listings.lasso?isp=stpi.in
postmaster and abuse[]stpi.in are listed in rfc-ignorant.org database
Let see whois:
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Domain Name.......... renedrop.com
Creation Date........ 2006-12-03 17:11:19
Registration Date.... 2006-12-03 17:11:19
Expiry Date.......... 2007-12-03 17:11:19
Organisation Name.... liu ming
Organisation Address. guang zhou
Organisation Address.
Organisation Address. guang zhou
Organisation Address. 321000
Organisation Address. GD
Organisation Address. CN
Admin Name........... liu ming
Admin Address........ guang zhou
Admin Address........
Admin Address........ guang zhou
Admin Address........ 321000
Admin Address........ GD
Admin Address........ CN
Admin Email.......... admin[]peckdore.com
Admin Phone.......... +86.203210002
Admin Fax............ +86.203210001
Tech Name............ liu ming
Tech Address......... guang zhou
Tech Address.........
Tech Address......... guang zhou
Tech Address......... 321000
Tech Address......... GD
Tech Address......... CN
Tech Email........... ad...@peckdore.com
Tech Phone........... +86.203210002
Tech Fax............. +86.203210001
Bill Name............ liu ming
Bill Address......... guang zhou
Bill Address.........
Bill Address......... guang zhou
Bill Address......... 321000
Bill Address......... GD
Bill Address......... CN
Bill Email........... ad...@peckdore.com
Bill Phone........... +86.203210002
Bill Fax............. +86.203210001
Name Server.......... ns2.renedrop.com
Name Server.......... ns1.renedrop.com
More renedrop.com sightings:
http://groups.google.com/groups/search?q=renedrop.com+group%3A*abuse&start=0&scoring=d&
See:
NS1.UILTONTHE.NET IP 203.129.232.82
NS1.UILTONTHE.NET has no MX records -> [UILTONTHE.NET has 1 MX record
mail.UILTONTHE.NET (10)]
http://www.moensted.dk/spam/?addr=203.129.232.82
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49984
Registrar: MONIKER ONLINE SERVICES, INC.
Domain Name: UILTONTHE.NET
Registrant [537543]:
Roy Prejean
6404 78 Pl NE
Marysville
WA
98270
US
Administrative Contact [537543]:
Roy Prejean pxm6go[]yahoo.com
6404 78 Pl NE
Marysville
WA
98270
US
Phone: +1.3606597092
Billing Contact [537543]:
Roy Prejean pxm...@yahoo.com
6404 78 Pl NE
Marysville
WA
98270
US
Phone: +1.3606597092
Technical Contact [537543]:
Roy Prejean pxm...@yahoo.com
6404 78 Pl NE
Marysville
WA
98270
US
Phone: +1.3606597092
Domain servers in listed order:
NS1.UILTONTHE.NET 63.223.11.14
NS2.UILTONTHE.NET 83.143.12.252
Record created on: 2006-12-09 15:52:16.0
Database last updated on: 2006-12-27 05:27:02.457
Domain Expires on: 2007-12-09 15:52:17.0
More uiltonthe.net sightings:
http://groups.google.com/groups/search?q=uiltonthe.net+group%3A*abuse&start=0&scoring=d&
See:
peckdore.com IP 211.139.47.250
[peckdore.com has 1 MX record mail.peckdore.com (10)]
http://www.moensted.dk/spam/?addr=211.139.47.250
[2] chinamobile/dts619, see http://spews.org/html/S1644.html
http://tqmcube.com/cgi-bin/rbltqm?ip=211.139.47.250
See also whois peckdore.com from Registrant record:
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Domain Name.......... PECKDORE.COM
Creation Date........ 2006-12-03 17:11:10
Registration Date.... 2006-12-03 17:11:10
Expiry Date.......... 2007-12-03 17:11:10
Organisation Name.... liu ming
Organisation Address. guang zhou
Organisation Address.
Organisation Address. guang zhou
Organisation Address. 321000
Organisation Address. GD
Organisation Address. CN
Admin Name........... liu ming
Admin Address........ guang zhou
Admin Address........
Admin Address........ guang zhou
Admin Address........ 321000
Admin Address........ GD
Admin Address........ CN
Admin Email.......... admin[]peckdore.com
Admin Phone.......... +86.203210002
Admin Fax............ +86.203210001
Tech Name............ liu ming
Tech Address......... guang zhou
Tech Address.........
Tech Address......... guang zhou
Tech Address......... 321000
Tech Address......... GD
Tech Address......... CN
Tech Email........... ad...@peckdore.com
Tech Phone........... +86.203210002
Tech Fax............. +86.203210001
Bill Name............ liu ming
Bill Address......... guang zhou
Bill Address.........
Bill Address......... guang zhou
Bill Address......... 321000
Bill Address......... GD
Bill Address......... CN
Bill Email........... ad...@peckdore.com
Bill Phone........... +86.203210002
Bill Fax............. +86.203210001
Name Server.......... ns2.peckdore.com
Name Server.......... ns1.peckdore.com
More peckdore.com sightings:
http://groups.google.com/groups/search?q=peckdore.com+group%3A*abuse&start=0&scoring=d&
SEE Yambo Pharmacy image hosting:
IP 213.240.234.132
More 213.240.234.132 sightings:
http://groups.google.com/groups/search?q=213.240.234.132+group%3A*abuse&start=0&scoring=d&
http://www.moensted.dk/spam/?addr=213.240.234.132
http://www.spamhaus.org/query/bl?ip=213.240.234.132
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49388
213.240.234.132/32 is listed on the Spamhaus Block List (SBL/ROKSO)
23-Dec-2006 01:04 GMT | SR20
Yambo Financials.
213.240.234.132: Yambo botnet - image host/proxy (port 8080)
4 SBL/ROKSO listings for IPs under the responsibility of interbgc.com
http://www.spamhaus.org/sbl/listings.lasso?isp=interbgc.com
SEE forced bookmark by javascript from web source code:
faqseller.hk => Pharmacy - best source for cheap meds!!!
faqseller.hk IP 83.229.85.132
[faqseller.hk has 1 MX record mail.faqseller.hk (10)]
http://www.moensted.dk/spam/?addr=83.229.85.132
Let see whois:
Domain Name: FAQSELLER.HK
Contract Version: HKDNR latest version
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): ANTONIO NACRUR
Holder Chinese Name:
Email: sik...@safe-mail.net
Domain Name Commencement Date: 2006-12-21
Country: US
Expiry Date: 2007-12-22
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1772050T
Technical Contact:
First name: ANTONIO
Last name: NACRUR
Company Name: ANTONIO NACRUR
Name Servers Information:
NS1.XETOPNET.COM
NS2.LOERJAMM.COM
NS1.THEBLACKRAINS.NET
NS2.ASDERDUB.COM
More faqseller.hk sightings:
http://groups.google.com/groups/search?q=faqseller.hk+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/9b749e352a1dd9b6
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/f0940a98662253ef
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: