[email] [USDrugs] [86.42.209.70] (bidderner.com - cheeseflick.info - fatbast.com - guardlessrod.com - lebee4ae.com - champakdagon.com) Presentation [new US e-shop]
TomezNet
IP 86.42.209.70
(at eircom.net)
Spamvert:
www.bidderner.com IP 219.158.69.114
(SBL51496 - ROK3095) (at cncgroup-cn)
Yambo Pharmacy domain image hosting again on Yahoo:
cheeseflick.info
Resolved cheeseflick.info to 68.142.212.117 to 68.142.212.137 to
68.142.212.138 to 68.142.212.139 to 68.142.212.140 to 68.142.212.141
Web:
Copiright Š 2003-2007 USDrugs. All Rights Reserved.
More Yambo Financials USDrugs sightings:
http://groups.google.com/groups/search?q=USDrugs+group%3A*abuse&start=0&scoring=d&
Plenty of Forged Certificates and logos as always.
More info below:
====================
X-SID-PRA: Dante Bullard <gradient'sunha...@lionlover.com>
X-SID-Result: SoftFail
X-Message-Info: txF49lGdW42zBEVkX7QYfkzkg+q5AD1/g7gYcZaZmKc=
Received: from tomts30-srv.bellnexxia.net ([209.226.175.104]) by bay0-
pamc1-f13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Thu, 8 Mar 2007 03:38:26 -0800
Received: from [MUNGED]
by toip21.srvr.bell.ca with ESMTP; 08 Mar 2007 06:38:17 -0500
Received: (qmail 26623 invoked by uid 110); 8 Mar 2007 06:38:17 -0500
Delivered-To: [MUNGED]
Received: (qmail 26617 invoked from network); 8 Mar 2007 06:38:17
-0500
Received: from unknown (HELO in1.smtp.messagingengine.com)
(86.42.209.70)
by [MUNGED] with SMTP; 8 Mar 2007 06:38:17 -0500
Return-Path: <gradient'sunha...@lionlover.com>
Received: from 64.233.183.27 (HELO ASPMX2.GOOGLEMAIL.com)
by [MUNGED] with esmtp (-=Q0.CNUAA: )K1T)
id =HO(2C-'01Q**-08
for [MUNGED]; Thu, 8 Mar 2007 11:38:14 +0000
From: "Dante Bullard" <gradient'sunha...@lionlover.com>
To: [MUNGED]
Subject: Presentation [new US e-shop]
Date: Thu, 8 Mar 2007 11:38:14 +0000
Message-ID: <01c76176$41e10690$6c822ecf@gradient'sunhappiest>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C76176.41E10690"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158
Thread-Index: Aca6Q3CF6+-@>V,0G>16H042*0M1AS==
X-OriginalArrivalTime: 08 Mar 2007 11:38:26.0362 (UTC)
FILETIME=[4916E1A0:01C76176]
This is a multi-part message in MIME format.
------=_NextPart_000_0006_01C76176.41E10690
Content-Type: text/plain;
charset="windows-1250"
Content-Transfer-Encoding: 7bit
Dear valued member!
This is a letter from United Medical Research Organization. We just
wanted to ask you to be as attentive as possible when buying drugs on
the Web.
The drugs you purchase on the Web are in many ways similar to a time
bomb ń malicious elements found in low-quality meds accumulate in
human organism damaging the organs they should be curing. Our
Association recommends you to buy your drugs from USDrugs pharmacy
since itís one of very few e-shops selling ONLY generic drugs.
Please, be more discerning when choosing your Web pharmacy.Click here
to learn more.
With Best Regards, Dante Bullard
USDrugs B.V.
http://www.bidderner.com/
------=_NextPart_000_0006_01C76176.41E10690
Content-Type: text/html;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable
<html xmlns:o=3D"urn:schemas-microsoft-com:office:office"
xmlns:w=3D"urn:sc=
hemas-microsoft-com:office:word" xmlns=3D"http://www.w3.org/TR/REC-
html40">
<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html;
charset=3Dwindows-1250">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered
medium)">
</head>
<body>
<html>
<body bgcolor=3D"#FFFFFF" link=3D"#0000FF">
Dear valued member!<br>
<br>
This is a letter from United Medical Research Organization. We just
wanted =
to ask you to be as attentive as possible when buying drugs on the
Web.<br>
<br>
The drugs you purchase on the Web are in many ways similar to a time
bomb =
=96 malicious elements found in low-quality meds accumulate in human
organi=
sm damaging the organs they should be curing. Our Association
recommends yo=
u to buy your drugs from <a href=3D"http://
www.bidderner.com/">USDrugs</a> =
pharmacy since it=92s one of very few e-shops selling ONLY generic
drugs.<b=
r>
<br>
Please, be more discerning when choosing your Web pharmacy.<br>
<br>
<a href=3D"http://www.bidderner.com/">Click here to learn more.</
a><br>
<br><br>
With Best Regards, Dante Bullard<br>
USDrugs B.V.<br>
http://www.bidderner.com/
</body>
</html>
</body>
</html>
------=_NextPart_000_0006_01C76176.41E10690--
-- END OF SPAM --
See:
IP 86.42.209.70
http://www.moensted.dk/spam/?addr=86.42.209.70
http://www.spamhaus.org/query/bl?ip=86.42.209.70
http://cbl.abuseat.org/lookup.cgi?ip=86.42.209.70
More eircom.net sightings:
http://groups.google.com/groups/search?q=eircom.net+group%3A*abuse&start=0&scoring=d&
inetnum: 86.40.0.0 - 86.43.255.255
netname: EIRCOM
descr: eircom Ltd
descr: IP network infrastructure
** Send spam/hack/virus complaints to ab...@eircom.net => ???
abuse[]eircom.net is listed in rfc-ignorant.org database
ASN: 5466
ASN Name: EIRCOM (Eircom)
Country (per IP registrar): IE [Ireland]
Country IP Range: 86.40.0.0 to 86.47.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=5466
1 SBL listings for IPs under the responsibility of eircom.net
http://www.spamhaus.org/sbl/listings.lasso?isp=eircom.net
See:
www.bidderner.com IP 219.158.69.114
ns1.fatbast.com. [85.136.20.235] [TTL=172800] [ES]
ns1.guardlessrod.com. [63.223.11.14] [TTL=172800] [US]
ns2.lebee4ae.com. [63.223.11.14] [TTL=172800] [US]
www.bidderner.com has no MX records -> bidderner.com has no MX records
http://www.moensted.dk/spam/?addr=219.158.69.114
http://www.spamhaus.org/query/bl?ip=219.158.69.114
inetnum: 219.158.0.0 - 219.158.255.255
netname: CNCGROUP
country: CN
descr: CNC group
role: CNCGroup Hostmaster
e-mail: ab...@cnc-noc.net => ???
whois, bogusmx, postmaster and abuse[]cnc-noc.net are listed in rfc-
ignorant.org database
Prefix: 219.158.69.0/24
ASN: 4837
ASN Name: China Network Communications Group China Network
Communications (CNC Group)
Country (per IP registrar): *P [[APNIC Unlisted]]
Country IP Range: 219.0.0.0 to 219.255.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4837
Aliases on the same IP:
eum.suprapturousz.com
ns1.suprapturousz.com
ns2.suprapturousz.com
getjuaik.hk
ns1.getjuaik.hk
ns2.getjuaik.hk
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL51496
219.158.69.114/32 is listed on the Spamhaus Block List (SBL/ROKSO)
20-Feb-2007 16:21 GMT | SR22
Yambo Financials.
Spam webhosting - miqa.hk
1 SBL/ROKSO listings for IPs under the responsibility of cncgroup-cn
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-cn
More bidderner.com sightings:
http://groups.google.com/groups/search?q=bidderner.com+group%3A*abuse&start=0&scoring=d&
SEE NEW Yambo Pharmacy domain image hosting on Yahoo:
cheeseflick.info
Resolved cheeseflick.info to 68.142.212.117 to 68.142.212.137 to
68.142.212.138 to 68.142.212.139 to 68.142.212.140 to 68.142.212.141
More cheeseflick.info sightings:
http://groups.google.com/groups/search?q=cheeseflick.info+group%3A*abuse
See:
ns1.fatbast.com IP 85.136.20.235 => SBL49493
ns1.fatbast.com has no MX records -> [fatbast.com has 1 MX record
mail.fatbast.com (10)]
See:
ns1.fatbast.com IP 63.223.11.14 => SBL49084
More fatbast.com sightings:
http://groups.google.com/groups/search?q=fatbast.com+group%3A*abuse
See:
ns1.guardlessrod.com IP 63.223.11.14 => SBL49084
ns1.guardlessrod.com has no MX records -> [guardlessrod.com has 1 MX
record mail.guardlessrod.com (10)]
More guardlessrod.com sightings:
http://groups.google.com/groups/search?q=guardlessrod.com+group%3A*abuse
See:
ns2.lebee4ae.com IP 63.223.11.14 => SBL49084
ns2.lebee4ae.com has no MX records -> [lebee4ae.com has 1 MX record
mail.lebee4ae.com (10)]
See:
ns2.lebee4ae.com IP 83.15.82.74 => SBL50921
83.15.82.74 PTR record: eja74.internetdsl.tpnet.pl
at ns2.tpnet.pl / telekomunikacja.pl
More lebee4ae.com sightings:
http://groups.google.com/groups/search?q=lebee4ae.com+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/6e3001f86cb3b320
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: