[email] [drugs - Pharmacy Express] [189.13.73.158] (rx555.com - hertunjinkdastion.com - vckionldesunjas.com) Re: hi
TomezNet
IP 189.13.73.158 18913073158.user.veloxzone.com.br
(at ns4.telemar.net.BR)
Spamvert:
www.rx555.com IP 61.31.214.78
(SBL48511 - ROK4932) (at tfn.net.tw / a78.xxking.com)
Web title: Pharmacy Express
© 2006 PharmacyExpress.com All Rights Reserved.
See also plenty forged site certificates and logos served from the same
domain this time.
More spammer sightings:
http://groups.google.com/groups/search?q=%22Pharmacy+Express%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.168; Thu, 23 Nov 2006
13:55:15 -0800
X-YahooFilteredBulk: 189.13.73.158
X-Originating-IP: [189.13.73.158]
Return-Path: <wehne...@magnachem.com>
Authentication-Results: mta333.mail.re4.yahoo.com from=magnachem.com;
domainkeys=neutral (no sig)
Received: from 189.13.73.158 (HELO abicon.com) (189.13.73.158) by
mta333.mail.re4.yahoo.com with SMTP; Thu, 23 Nov 2006 13:55:15 -0800
Message-ID: <01c70f4a$0e357750$9e490dbd@micro>
Date: Thu, 23 Nov 2006 18:55:14 -0300
X-Priority: 3
X-MSMail-Priority: Normal
Reply-to: "Apostolis Leung" <wehne...@magnachem.com>
From: "Apostolis Leung" <wehne...@magnachem.com>
To: [MUNGED]
Subject: Re: hi
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0003_01C70F30.ADC71220"
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Content-Length: 4687
Hi
*** REMOVED Attachment: caretake25.gif (0.01 MB) ****
Decoded base64 text:
VALIUM from $1.21 per pill
Meridia
Viagra from $3.33 per pill
Ambien
Soma
Prozac
Xanax
Cialis from $3.75 per pill
SAVE OVER 50% with
WWW.RX555.COM
( don't click,
type www.rx555.com into your browser
- END of decoded text -
-- END OF SPAM --
Filter evasion tactic. Animated gif asking to key web site in browser.
"Please don`t click. Type URL in your browser"
Google also the same tactics sighting for drugs domains like
kvakrx.com or fonfel.com
See:
IP 189.13.73.158 18913073158.user.veloxzone.com.br
http://www.moensted.dk/spam/?addr=189.13.73.158
http://cbl.abuseat.org/lookup.cgi?ip=189.13.73.158
http://www.spamhaus.org/query/bl?ip=189.13.73.158
More verizon.net sightings:
http://groups.google.com/groups/search?q=verizon.net+group%3A*abuse&start=0&scoring=d&
whois, postmaster and abuse[]telemar.net.br are listed in
rfc-ignorant.org database
dns, postmaster and abuse[]veloxzone.com.br are listed in
rfc-ignorant.org database
inetnum: 189.12/15
aut-num: AS7738
abuse-c: CGR13
owner: Telemar Norte Leste S.A.
ownerid: 002.558.134/0001-58
responsible: Marlemar Telgon
route: 189.13.0.0/17
descr: TELEMAR cidr block
origin: AS7738
mnt-by: MAINT-AS7738
changed: b...@telemar.net.br
route: 189.13.0.0/17
descr: Brasil Telecom Network
origin: AS8167
notify: b...@brasiltelecom.net.br
mnt-by: BRASILTELECOM-MNT
Country (per IP registrar): BR [Brazil]
Country IP Range: 189.0.0.0 to 189.31.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=7738
8 SBL/ROKSO listings for IPs under the responsibility of telemar.net.br
http://www.spamhaus.org/sbl/listings.lasso?isp=telemar.net.br
1 SBL listings for IPs under the responsibility of veloxzone.com.br
http://www.spamhaus.org/sbl/listings.lasso?isp=veloxzone.com.br
See:
www.rx555.com IP 61.31.214.78
ns0.hertunjinkdastion.com [121.36.124.62] [TTL=172800] [CN]
ns0.vckionldesunjas.com [61.31.214.78] [TTL=172800] [TW]
www.rx555.com has no MX records -> [rx555.com has 1 MX record
mail.rx555.com (10)]
http://www.moensted.dk/spam/?addr=61.31.214.78
http://www.spamhaus.org/query/bl?ip=61.31.214.78
61.31.214.78 PTR record: a78.xxking.com
at dns1.tfn.net.tw
inetnum: 61.31.0.0 - 61.31.255.255
netname: TFN-NET
descr: Taiwan Fixed Network CO.,LTD.
descr: 7FI., No. 498, Ruei-Guang Rd., Nei-Hu
descr: Taipei Taiwan 114.
country: TW
admin-c: TT164-AP
tech-c: SH376-AP
mnt-by: MAINT-TW-TWNIC
changed: hostm...@twnic.net.tw
person: Ting Tseng
nic-hdl: TT164-AP
e-mail: ting_...@twfn.com.tw
e-mail: steve...@howin.com.tw
changed: ting_...@twfn.com.tw
route: 61.31.0.0/16
descr: Taiwna Fixed Network
origin: AS9924
notify: eri...@profond.com.tw
mnt-by: MAINT-AS9924
route: 61.31.0.0/16
descr: Proxy Announcement
origin: AS17444
remarks: Addresses from AS9924
remarks: Transit via AS17444
notify: radb_...@newworldtel.com
mnt-by: MAINT-AS17444
route: 61.31.0.0/16
origin: AS9924
descr: Taiwan Fixed Network
notify: eri...@twfn.com.tw
mnt-by: MAINT-AS9924
changed: ting_...@howin.com.tw
ASN: 9924
ASN Name: TFN-TW (Taiwan Fixed Network, Telco and Network Service
Provider.)
Country (per IP registrar): TW [Taiwan]
Country IP Range: 61.30.0.0 to 61.31.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=9924
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48511
61.31.214.78/32 is listed on the Spamhaus Block List (SBL/ROKSO)
24-Nov-2006 21:06 GMT | SR22
Leo Kuvayev / BadCow.
Spam webhosting - rinkionypindfunhadesm.com
6 SBL/ROKSO listings for IPs under the responsibility of tfn.net.tw
http://www.spamhaus.org/sbl/listings.lasso?isp=tfn.net.tw
Let see whois:
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Domain Name.......... rx555.com
Creation Date........ 2006-11-21 18:05:59
Registration Date.... 2006-11-21 18:05:59
Expiry Date.......... 2007-11-21 18:05:59
Organisation Name.... Bai Ming
Organisation Address. Bei Jing
Organisation Address.
Organisation Address. Bei Jing
Organisation Address. 100021
Organisation Address. BJ
Organisation Address. CN
Admin Name........... Bai Ming
Admin Address........ Bei Jing
Admin Address........
Admin Address........ Bei Jing
Admin Address........ 100021
Admin Address........ BJ
Admin Address........ CN
Admin Email.......... xxeqwe[]hotmail.com
Admin Phone.......... +86.1076885548
Admin Fax............ +86.1076885548
Tech Name............ Bai Ming
Tech Address......... Bei Jing
Tech Address.........
Tech Address......... Bei Jing
Tech Address......... 100021
Tech Address......... BJ
Tech Address......... CN
Tech Email........... xxe...@hotmail.com
Tech Phone........... +86.1076885548
Tech Fax............. +86.1076885548
Bill Name............ Bai Ming
Bill Address......... Bei Jing
Bill Address.........
Bill Address......... Bei Jing
Bill Address......... 100021
Bill Address......... BJ
Bill Address......... CN
Bill Email........... xxe...@hotmail.com
Bill Phone........... +86.1076885548
Bill Fax............. +86.1076885548
Name Server.......... ns0.hertunjinkdastion.com
Name Server.......... ns0.vckionldesunjas.com
More rx555.com sightings:
http://groups.google.com/groups/search?q=rx555.com+group%3A*abuse&start=0&scoring=d&
See:
ns0.hertunjinkdastion.com IP 121.36.124.62
ns0.hertunjinkdastion.com has no MX records -> hertunjinkdastion.com
has no MX records
http://www.moensted.dk/spam/?addr=121.36.124.62
http://www.spamhaus.org/query/bl?ip=121.36.124.62
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48531
121.36.124.62/32 is listed on the Spamhaus Block List (SBL/ROKSO)
25-Nov-2006 13:01 GMT | SR20
Leo Kuvayev / BadCow.
HealthSuite/PharmacyExpress etc
1 SBL/ROKSO listings for IPs under the responsibility of
china-motion.com
http://www.spamhaus.org/sbl/listings.lasso?isp=china-motion.com
More hertunjinkdastion.com sightings:
http://groups.google.com/groups/search?q=hertunjinkdastion.com+group%3A*abuse&start=0&scoring=d&
Let see whois:
Registrar: XIN NET TECHNOLOGY CORPORATION
Domain Name:hertunjinkdastion.com
Registrant:
Dima li
jungonglu1219hao
200093
Administrative Contact:
Dima li
Dima li
jungonglu1219hao
shang hai Shanghai 200093
China
tel: 86 021 76886639
fax: 86 021 76886639
mmlara[]163.com
Technical Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Billing Contact:
centaur doing
centaur doing
tty xi san qu 4#3101
bei jing Beijing 102218
China
tel: 86 010 64117521
fax: 86 010 64117521
mml...@163.com
Registration Date: 2006-09-14
Update Date: 2006-09-14
Expiration Date: 2007-09-14
Primary DNS: ns2.xinnetdns.com 210.51.170.48
Secondary DNS: ns2.xinnet.cn 210.51.170.67
http://www.cidr-report.org/cgi-bin/as-report?as=8915
See also more Registrant mml...@163.com sightings:
http://groups.google.com/groups/search?q=%22mmlara%40163.com%22+group%3A*abuse&start=0&scoring=d&
See:
ns0.vckionldesunjas.com IP 61.31.214.78
ns0.vckionldesunjas.com has no MX records -> vckionldesunjas.com has no
MX records
http://www.moensted.dk/spam/?addr=61.31.214.78
http://www.spamhaus.org/query/bl?ip=61.31.214.78
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48511
Let see whois:
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Domain Name.......... vckionldesunjas.com
Creation Date........ 2006-09-14 16:53:52
Registration Date.... 2006-09-14 16:53:52
Expiry Date.......... 2007-09-14 16:53:52
Organisation Name.... Wang Pang
Organisation Address. shanghai
Organisation Address.
Organisation Address. shanghai
Organisation Address. 120000
Organisation Address. SH
Organisation Address. CN
Admin Name........... Wang Pang
Admin Address........ shanghai
Admin Address........
Admin Address........ shanghai
Admin Address........ 120000
Admin Address........ SH
Admin Address........ CN
Admin Email.......... rabanimog[]yahoo.com.cn
Admin Phone.......... +86.1082345678
Admin Fax............ +86.1082345678
Tech Name............ Wang Pang
Tech Address......... shanghai
Tech Address.........
Tech Address......... shanghai
Tech Address......... 120000
Tech Address......... SH
Tech Address......... CN
Tech Email........... raba...@yahoo.com.cn
Tech Phone........... +86.1082345678
Tech Fax............. +86.1082345678
Bill Name............ Wang Pang
Bill Address......... shanghai
Bill Address.........
Bill Address......... shanghai
Bill Address......... 120000
Bill Address......... SH
Bill Address......... CN
Bill Email........... raba...@yahoo.com.cn
Bill Phone........... +86.1082345678
Bill Fax............. +86.1082345678
Name Server.......... ns1.dns.com.cn
Name Server.......... ns2.dns.com.cn
More vckionldesunjas.com sightings:
http://groups.google.com/groups/search?q=vckionldesunjas.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/cf326136da960d9f
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/4bb3f05133f5dcd7
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: