[email] [drugs - American Pharmacy] (harrowbroth.com - whizsugar.info - babymore.info) Few steps to become healthy!
TomezNet
IP 59.33.240.83
(at CHINANET-GD - gddc.com.cn / ns.guangzhou.gd.cn)
Spamvert:
harrowbroth.com IP 59.120.127.152
(SBL43573 - ROK3095) (at hinet.net)
ns2.whizsugar.info IP 209.102.132.41
(SBL44181 - ROK3095) (at madisonriver.net)
ns1.babymore.info IP 213.150.164.154
(SBL45161 - ROK3095) (at ati.tn)
Yambo Financials drugs spam (Viagra / Cialis pills at Canadian
Pharmacy)
This time as an American Pharmacy aka USDrugs aka Canadian Pharmacy,
see more sightings:
http://groups.google.com/groups/search?q=%22American+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
>From web:
Copiright © 2003-2006 USDrugs. All Rights Reserved.
USDRUGS LTD is licensed by Minnesota Board of Pharmacy
licence.jpg => 404 not found at:
http://80.86.83.166:8080/usd/usd/images/licence.jpg
New IP 80.86.83.166 fresno156.webperoni.de
(at ns02.webperoni.de)
See old listing Yambo Pharmacy image hosting:
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL40023
Address:
Main Office (headquaters)
6362 Lakeshore Road, NY
ICS International Certified Stocks
Kamdhenu Complex, Opp. Bombay, India
Also forged certificates and logos:
FDA Approved Drugs
VERISIGN SECURE SITE
VERIFIED BY VISA
Worldwide Delivery by United States Postal Service
More info below:
====================
X-SID-PRA: Steamboats R. Newsprint <waan...@globalgimmicks.com>
X-SID-Result: TempError
X-Message-Info: txF49lGdW42AAbs0U3LqtDXMYDq/SAatzlnbpmrzSKU=
Received: from tomts49-srv.bellnexxia.net ([209.226.175.193]) by
bay0-pamc1-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Tue, 8 Aug 2006 07:35:58 -0700
Received: from xx..xx..xx.net ([207.58.1....])
by toip7.bellnexxia.net with ESMTP; 08 Aug 2006 10:34:39 -0400
Received: (qmail 22130 invoked by uid 110); 8 Aug 2006 10:34:38 -0400
Delivered-To: xx..xx@xx..xx.com
Received: (qmail 22110 invoked from network); 8 Aug 2006 10:34:35 -0400
Received: from unknown (HELO 174988960) (59.33.240.83)
by xx..xx..xx.net with SMTP; 8 Aug 2006 10:34:35 -0400
Received: from globalgimmicks.com (175413040 [175413552])
by grand.gaugeforsuccess.net (Qmailv1) with ESMTP id 00897DE31D
for <xx..xx@xx..xx.com>; Tue, 08 Aug 2006 09:35:09 -0700
Date: Tue, 08 Aug 2006 09:35:09 -0700
From: "Steamboats R. Newsprint" <waan...@globalgimmicks.com>
X-Mailer: The Bat! (v2.00.1) Personal
X-Priority: 3
Message-ID: <3348145679.2...@globalgimmicks.com>
To: xx..xx@xx..xx.com
Subject: Few steps to become healthy!
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by AMaViS perl-11 mion
Return-Path: waan...@globalgimmicks.com
X-OriginalArrivalTime: 08 Aug 2006 14:35:59.0121 (UTC)
FILETIME=[F70DE810:01C6BAF7]
Just buy Viagra or Cialis pills at Canadian Pharmacy store and you'll
solve all your sexual problems! Perfect sex all night and day long!
Penis Enlargement Pills will help you with you small size.
any pill you need! Absolutely Confidential and Secure purchase
-- END OF SPAM --
See also more USDrugs sightings:
http://groups.google.com/groups/search?q=USDrugs+group%3A*abuse&start=0&scoring=d&
See also more Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
More ICS International Certified Stocks sightings:
http://groups.google.com/groups/search?q=%22ICS+International+Certified+Stocks%22+group%3A*abuse
See:
IP 59.33.240.83
http://www.moensted.dk/spam/?addr=59.33.240.83
inetnum: 59.32.0.0 - 59.42.255.255
netname: CHINANET-GD
route: 59.32.0.0/13
descr: China Telecom Guangdong province
origin: AS4134
mnt-by: MAINT-AS4134
changed: wan...@cndata.com
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
Country IP Range: 59.32.0.0 to 59.63.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4134
3 SBL listings for IPs under the responsibility of cncgroup-gd
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-gd
See:
harrowbroth.com IP 59.120.127.152
ns1.harrowbroth.com A IN 600 59.120.127.152
ns2.harrowbroth.com A IN 600 59.120.127.152
ns3.harrowbroth.com A IN 600 109.51.200.45 / 251.229.97.66
ns2.whizsugar.info [209.102.132.41]
ns1.babymore.info [213.150.164.154]
[harrowbroth.com has 1 MX record mail.harrowbroth.com (10)]
http://www.moensted.dk/spam/?addr=59.120.127.152
http://www.spamhaus.org/query/bl?ip=59.120.127.152
59.120.127.152 PTR record: 59-120-127-152.HINET-IP.hinet.net
at vns2.hinet.net
route: 59.120.0.0/14
descr: (HiNet) Chunghwa Telecom Co., Ltd.
origin: AS3462
member-of: RS-COMM_NSFNET
mnt-by: MAINT-AS3462
changed: cyk...@ms1.hinet.net
ASN: 3462
ASN Name: HINET (Data Communication Business Group)
Country IP Range: 59.112.0.0 to 59.127.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=3462
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL43573
59.120.127.152/32 is listed on the Spamhaus Block List (SBL/ROKSO)
18-Jun-2006 22:55 GMT | SR23
Yambo Financials
flyroyaljet.com etc
Main Info:
http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Yambo%20Financials
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3095
56 SBL/ROKSO listings for IPs under the responsibility of hinet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=hinet.net
Let see whois:
Registrar: 4DOMAINS.COM
Domain Name........... HARROWBROTH.COM
Security Status....... LOCKED
Registered............ Jun-16-2006
Expires............... Jun-16-2007
For passwords, transfer inquires, and general info:
Accredited Service Provider:
DomainsAtCost.com
Email............... 115952124...@nowhoisspam.com
Web................. http://www.domainsatcost.com
==================================================
= Registrant Details ================== CID: 26318
==================================================
John Lushine Email: 11595212...@nowhoisspam.com
John Lushine
20 Hillside Cove
CABOT, AR 72023
US
Phone: +1.5016059526
==================================================
= Admin Contact ======================= CID: 26318
==================================================
John Lushine Email: 11595212...@nowhoisspam.com
John Lushine
20 Hillside Cove
CABOT, AR 72023
US
Phone: +1.5016059526
==================================================
= Technical Contact =================== CID: 26318
==================================================
John Lushine Email: 11595212...@nowhoisspam.com
John Lushine
20 Hillside Cove
CABOT, AR 72023
US
Phone: +1.5016059526
==================================================
= Name Servers ===================================
==================================================
ns1.babymore.info
ns2.whizsugar.info
More harrowbroth.com sightings:
http://groups.google.com/groups?q=harrowbroth.com+group%3A*abuse
See:
ns2.whizsugar.info IP 209.102.132.41
ns2.whizsugar.info has no MX records -> whizsugar.info has no MX
records
http://www.moensted.dk/spam/?addr=209.102.132.41
http://www.spamhaus.org/query/bl?ip=209.102.132.41
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL44181
209.102.132.41/32 is listed on the Spamhaus Block List (SBL/ROKSO)
07-Jul-2006 20:38 GMT | SR20
Yambo Financials
Yambo nameservers and web host
1 SBL/ROKSO listings for IPs under the responsibility of
madisonriver.net
http://www.spamhaus.org/sbl/listings.lasso?isp=madisonriver.net
More whizsugar.info sightings:
http://groups.google.com/groups/search?q=whizsugar.info+group%3A*abuse&start=0&scoring=d&
See:
ns1.babymore.info IP 213.150.164.154
ns1.babymore.info has no MX records -> babymore.info has no MX records
http://www.moensted.dk/spam/?addr=213.150.164.154
http://www.spamhaus.org/query/bl?ip=213.150.164.154
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45161
213.150.164.154/32 is listed on the Spamhaus Block List (SBL/ROKSO)
03-Aug-2006 00:00 GMT | SR23
Yambo Financials
Spammer controlled nameserver / compromised host
1 SBL/ROKSO listings for IPs under the responsibility of ati.tn
http://www.spamhaus.org/sbl/listings.lasso?isp=ati.tn
More babymore.info sightings:
http://groups.google.com/groups/search?q=babymore.info+group%3A*abuse&start=0&scoring=d&
See (pharma image hosting in as always Germany):
IP 80.86.83.166 fresno156.webperoni.de
80.86.83.166 PTR record: fresno156.webperoni.de
at ns02.webperoni.de
http://www.moensted.dk/spam/?addr=80.86.83.166
inetnum: 80.86.83.0 - 80.86.83.255
netname: WPROOT02
descr: webperoni GmbH server hosting
country: DE [Germany]
route: 80.86.80.0/20
descr: webperoni GmbH
origin: AS39928
mnt-by: WEBPERONI-MNT
mnt-routes: WEBPERONI-MNT
changed: ri...@webperoni.de
route: 80.86.80.0/20
descr: Webperoni via LambdaNet
origin: AS13237
mnt-by: LNC-MNT
mnt-routes: WEBPERONI-MNT
changed: regi...@undeliverable.lambdanet.net
ASN: 39928
ASN Name: WEBPERONI-AS (webperoni GmbH autonomous system)
Country IP Range: 80.86.80.0 to 80.86.95.255
http://www.cidr-report.org/cgi-bin/as-report?as=39928
3 SBL listings for IPs under the responsibility of lambdanet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=lambdanet.net
And (MyCanadianPharmacy):
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/23cfc76ac4893356
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: