[email] [drugs botnet - Patch Rx] (vitsits.com - obesor.net - gubrel.com - pozgel.com) Lean and mean is in!
TomezNet
IP 82.207.16.46 46-16-207-82.pool.ukrtel.net
(at ns2.ukrtelecom.ua)
Spamvert:
www.obesor.net
Resolved to 61.24.4.39 to 82.46.200.157 to 124.96.169.3 to
220.219.244.168 to 222.76.102.107
www.vitsits.com IP 58.20.108.121
(at CNCGROUP-HN)
www.vitsits.com IP 60.28.239.29
(SBL45606) (at cncgroup-tj)
Additional Name Server domains on spammer network:
gubrel.com, pozgel.com, insanepope.com, perfectmov.com, ysored.com,
mocdes.com
AND timver.net
Resolved to 82.229.253.231 to 124.50.65.180 to 210.6.24.185 to
218.95.163.83 to 222.191.66.170
Web - both sites:
Advanced Laboratories Inc.
Copyright Penis Enlarge Patch Rx 2005
More Penis Enlarge Patch Rx sightings:
http://groups.google.com/groups/search?q=%22Enlarge+Patch+Rx%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: Sammie <490...@e-gloryon.com>
X-SID-Result: TempError
X-Message-Info: txF49lGdW42hdBdbUE9/ALHE+tNbpKU2WG5saFweNIs=
Received: from tomts32-srv.bellnexxia.net ([209.226.175.106]) by
bay0-pamc1-f10.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Fri, 18 Aug 2006 05:45:22 -0700
Received: from [MUNGED]
by toip3.bellnexxia.net with ESMTP; 18 Aug 2006 08:45:11 -0400
Message-Id: <594t48$4m...@toip3.bellnexxia.net>
Received: (qmail 28100 invoked by uid 110); 18 Aug 2006 08:45:10 -0400
Delivered-To: [MUNGED]
Received: (qmail 28077 invoked from network); 18 Aug 2006 08:45:10
-0400
Received: from 46-16-207-82.pool.ukrtel.net (HELO
fpuiepaa.e0x3zu.optonline.net) (82.207.16.46)
by [MUNGED] with SMTP; 18 Aug 2006 08:45:10 -0400
From: "Sammie" <490...@e-gloryon.com >
To: [MUNGED]
Subject: Lean and mean is in!
Date: Fri, 18 Aug 2006 15:43:57 +0300
MIME-Version: 1.0
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Thread-Index: uSPGf9WKmjqRbTbvCB1s5fMqzWjn9o33rlDv
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 8bit
Return-Path: 75p...@dependablehost.com
X-OriginalArrivalTime: 18 Aug 2006 12:45:22.0567 (UTC)
FILETIME=[2B7DA170:01C6C2C4]
Hi [MUNGED].
Amazing weight loss stories here:
http://www.vitsits.com/n/?52&custodyboost
I've always had trouble with my weight ever since I was young. Of
course I tried all the "best" fat loss products, nothing helped very
much. It wasn't til I tried Anatrim that I saw the pounds seriously
start to melt away! Nothing helped me lose weight faster. I literally
saw 15 pounds melt away within the first few weeks! There's nothing
more exciting than watching pounds disappear, especially when you've
tried all sorts of different methods and products before. I've since
read up on Anatrim and am amazed at the number of people who have
benefited from its amazing results. I'm halfway to my goal, Anatrim
will get me the rest of the way ;)
Jordan McKenzie, New York
http://www.obesor.net/hd/?52&afterwordacetylene
-- END OF SPAM --
See:
IP 82.207.16.46 46-16-207-82.pool.ukrtel.net
http://www.moensted.dk/spam/?addr=82.207.16.46
http://cbl.abuseat.org/lookup.cgi?ip=82.207.16.46
http://www.spamhaus.org/query/bl?ip=82.207.16.46
inetnum: 82.207.16.0 - 82.207.31.255
netname: UKRTELNET
descr: Ukrtelecom IP access network in Kiev
descr: JSC Ukrtelecom
descr: NCC#2006081215
country: UA [Ukraine]
route: 82.207.0.0/17
descr: AGGREGATE BLOCK FOR UKRTELECOM
origin: AS6849
mnt-by: AS6849-MNT
changed: are...@ukrtel.net
ASN: 6849
ASN Name: UKRTELNET (JSC UKRTELECOM,)
Country IP Range: 82.207.0.0 to 82.207.127.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=6849
3 SBL/ROKSO listings for IPs under the responsibility of ukrtel.net
http://www.spamhaus.org/sbl/listings.lasso?isp=ukrtel.net
See:
www.obesor.net
Resolved to 61.24.4.39 to 82.46.200.157 to 124.96.169.3 to
220.219.244.168 to 222.76.102.107
www.obesor.net A IN 180 124.96.169.3
www.obesor.net A IN 180 220.219.244.168
www.obesor.net A IN 180 82.46.200.157
www.obesor.net A IN 180 222.76.102.107
www.obesor.net A IN 180 61.24.4.39
ns1.insanepope.com [61.67.143.62] [TTL=172800] [TW]
ns1.perfectmov.com [61.67.143.62] [TTL=172800] [TW]
ns2.insanepope.com [222.36.74.85] [TTL=172800] [CN]
ns3.insanepope.com [83.84.194.226] [TTL=172800] [NL]
ns4.perfectmov.com [60.186.220.15] [TTL=172800] [CN]
ns5.perfectmov.com [86.66.164.44] [TTL=172800] [FR]
www.obesor.net has no MX records -> obesor.net has no MX records
124.96.169.3 PTR record: p1003-ipbf206oomichi.oita.ocn.ne.jp
ns-kn002.ocn.ad.jp
220.219.244.168 PTR record: ntfksm037168.fksm.nt.adsl.ppp.infoweb.ne.jp
ns3.hyper.web.ad.jp
82.46.200.157 PTR record: 82-46-200-157.stb.ubr04.king.blueyonder.co.uk
ns2.cableinet.co.uk
222.76.102.107 PTR record: pc107.broad.dynamic.fz.fj.cn.cndata.com
dns.fz.fj.cn
61.24.4.39 PTR record: 61-24-4-39.rev.home.ne.jp
ns1.home.ne.jp
Let see whois:
Registrar: XIN NET TECHNOLOGY CORPORATION
Domain Name:obesor.net
Registrant:
liu fang
guang zhou
516006
Administrative Contact:
liu fang
liu fang
guang zhou
guang zhou Guangdong 516006
China
tel: 86 20 38780802
fax: 86 20 38780802
admin[]timver.net
Technical Contact:
liu fang
liu fang
guang zhou
guang zhou Guangdong 516006
China
tel: 86 20 38780802
fax: 86 20 38780802
ad...@timver.net
Billing Contact:
liu fang
liu fang
guang zhou
guang zhou Guangdong 516006
China
tel: 86 20 38780802
fax: 86 20 38780802
ad...@timver.net
Registration Date: 2006-07-23
Update Date: 2006-07-26
Expiration Date: 2007-07-23
Primary DNS: ns1.ysored.com 58.20.185.3
Secondary DNS: ns1.mocdes.com 221.206.5.45
More obesor.net sightings:
http://groups.google.com/groups/search?q=obesor.net+group%3A*abuse&start=0&scoring=d&
See:
www.vitsits.com IP 58.20.108.121
www.vitsits.com IP 60.28.239.29
ns1.gubrel.com [125.208.6.216] [TTL=172800] [CN]
ns2.pozgel.com [58.20.108.121] [TTL=172800] [CN]
Primary nameserver: ns1.pozgel.com
Hostmaster E-mail address: root.pozgel.com
www.vitsits.com has no MX records -> [vitsits.com has 1 MX record
relay.vitsits.com (10)]
http://www.moensted.dk/spam/?addr=60.28.239.29
http://www.spamhaus.org/query/bl?ip=60.28.239.29
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45606
60.28.239.29/32 is listed on the Spamhaus Block List (SBL)
17-Aug-2006 23:08 GMT | SR02
penis enlargement spammer
6 SBL listings for IPs under the responsibility of cncgroup-tj
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-tj
See:
www.vitsits.com IP 58.20.108.121
http://www.moensted.dk/spam/?addr=58.20.108.121
More 58.20.108.121 sightings:
http://groups.google.com/groups/search?q=58.20.108.121+group%3A*abuse&start=0&scoring=d&
inetnum: 58.20.0.0 - 58.20.255.255
netname: CNCGROUP-HN
descr: CNC Group HuNan province network
ASN: 9929
ASN Name: CNCNET-CN (China Netcom Corp.)
Country IP Range: 58.16.0.0 to 58.23.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=9929
3 SBL/ROKSO listings for IPs under the responsibility of CNCGROUP-HN
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGROUP-HN
Let see whois.leadnetworks.com:
Registrar: LEAD NETWORKS DOMAINS PVT. LTD.
Domain Name: VITSITS.COM
Registrant:
vitsits
Nhi DoAn (falllout2[]europe.com)
12566 Sugar Pine Way
Garden Grove
California,92843
US
Tel. +001.7149713940
Creation Date: 06-Aug-2006
Expiration Date: 06-Aug-2007
Domain servers in listed order:
ns2.pozgel.com
ns1.gubrel.com
Administrative Contact:
vitsits
Nhi DoAn (fall...@europe.com)
12566 Sugar Pine Way
Garden Grove
California,92843
US
Tel. +001.7149713940
Technical Contact:
vitsits
Nhi DoAn (fall...@europe.com)
12566 Sugar Pine Way
Garden Grove
California,92843
US
Tel. +001.7149713940
Billing Contact:
vitsits
Nhi DoAn (fall...@europe.com)
12566 Sugar Pine Way
Garden Grove
California,92843
US
Tel. +001.7149713940
Status:LOCKED
More 60.28.239.29 sightings:
http://groups.google.com/groups/search?q=60.28.239.29+group%3A*abuse&start=0&scoring=d&
See:
ns1.insanepope.com IP 61.67.143.62
More insanepope.com sightings:
http://groups.google.com/groups/search?q=insanepope.com+group%3A*abuse
61.67.143.62 PTR record: 61-67-143-host62.kbtelecom.net.tw
ns1.kbtelecom.net
See:
ns1.perfectmov.com IP 61.67.143.62
More perfectmov.com sightings:
http://groups.google.com/groups/search?q=perfectmov.com+group%3A*abuse
See:
ns2.insanepope.com IP 222.36.74.85
More insanepope.com sightings:
http://groups.google.com/groups/search?q=insanepope.com+group%3A*abuse
No PTR records exist for 222.36.74.85 at crc.net.cn
See:
ns3.insanepope.com IP 83.84.194.226
83.84.194.226 PTR record: 5354C2E2.cable.casema.nl
at cas-dns5.casema.nl
See:
ns4.perfectmov.com IP 60.186.220.15
60.186.220.15 PTR record: 15.220.186.60.broad.hz.zj.dynamic.cndata.com
dns-noc.zjhzptt.net.cn
See:
ns5.perfectmov.com IP 86.66.164.44
86.66.164.44 PTR record: 44.164.66-86.rev.gaoland.net
dns1.gaoland.net
See:
ns1.ysored.com IP 58.20.185.3, 217.20.30.40
More ysored.com sightings:
http://groups.google.com/groups/search?q=ysored.com+group%3A*abuse
See:
ns1.mocdes.com IP 221.206.5.45
More mocdes.com sightings:
http://groups.google.com/groups/search?q=mocdes.com+group%3A*abuse
See:
timver.net
Resolved to 82.229.253.231 to 124.50.65.180 to 210.6.24.185 to
218.95.163.83 to 222.191.66.170
ns1.insanepope.com [203.66.89.124] [TTL=172800] [TW]
ns1.perfectmov.com [203.66.89.124] [TTL=172800] [TW]
ns2.insanepope.com [222.214.219.52] [TTL=172800] [CN]
ns3.insanepope.com [82.38.0.13] [TTL=172800] [GB]
ns4.perfectmov.com [60.186.220.15] [TTL=172800] [CN]
ns5.perfectmov.com [86.66.164.44] [TTL=172800] [FR]
Let see whois:
Registrar: XIN NET TECHNOLOGY CORPORATION
Domain Name: timver.net
Registrant:
liu fang
guang zhou
516006
Administrative Contact:
liu fang
liu fang
guang zhou
guang zhou Guangdong 516006
China
tel: 86 20 38780802
fax: 86 20 38780802
admin[]timver.net
Technical Contact:
liu fang
liu fang
guang zhou
guang zhou Guangdong 516006
China
tel: 86 20 38780802
fax: 86 20 38780802
ad...@timver.net
Billing Contact:
liu fang
liu fang
guang zhou
guang zhou Guangdong 516006
China
tel: 86 20 38780802
fax: 86 20 38780802
ad...@timver.net
Registration Date: 2006-07-23
Update Date: 2006-07-29
Expiration Date: 2007-07-23
Primary DNS: ns1.zafrel.com 58.20.108.94
Secondary DNS: ns1.ysored.com 58.20.185.3
More timver.net sightings:
http://groups.google.com/groups/search?q=timver.net+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/59c4768f4b3da949
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/25a9fd3f0f2cb105
http://groups.google.com/group/news.admin.net-abuse.email/msg/379cb3bd63152a15
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: