[email] [drugs - Canadian Pharmacy botnet] [77.183.197.29] (downobserve.hk / piotiongandesunkdes.com / chitionkdetunlionpsa.com / fionkunjerunhedase.com / gedsactunjerion.com) Global sale before new project opening!
TomezNet
IP 77.183.197.29 dsbg-4db7c51d.pool.einsundeins.de
(at schlund.com / 1und1.de aka 1and1.com / oneandone.net /
telefonica.de)
downobserve.hk => botnet
inzqe.downobserve.hk Resolved to
© Copyright Canadian Pharmacy, 2003-2007. All Rights Reserved.
Much More Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
Plenty of Forged Certificates and logos as always.
Much More info below:
====================
Return-Path: <hwm...@br.nl.com>
Delivered-To: [MUNGED]
Received: (qmail 7299 invoked from network); 11 Jun 2007 10:46:57
-0400
Received: from dsbg-4db7c51d.pool.einsundeins.de (77.183.197.29)
by [MUNGED] with SMTP; 11 Jun 2007 10:46:57 -0400
Return-Path: <hwm...@br.nl.com>
Received: from 212.61.15.154 (HELO mailhub.vianetworks.nl)
by [MUNGED] with esmtp (EHUX8Q5TO BVLFA)
id [MUNGED]
for [MUNGED]; Mon, 11 Jun 2007 14:46:59 -0100
From: "Johnny Spears" <hwm...@br.nl.com>
To: <[MUNGED]>
Subject: Global sale before new project opening!
Date: Mon, 11 Jun 2007 14:46:59 -0100
Message-Id: <01c7ac37$5d6509f0$1dc5b74d@hwmbyt>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C7AC48.20EDD9F0"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
Thread-Index: Aca6Q76Y5IMAAIF5ETF6KB8HG7L8SI==
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html;
charset=iso-8859-1">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
</head>
<body>
<body bgcolor="#FFFFFF" link="#333366">
<font face="Verdana" size="2" color="#000000">Dear valued member.<br>
<br>
Extra discounts for our meds! Global sale before new project opening!
<br>
Our web page: <a href="http://inzqe.downobserve.hk/?
531506076898">http://inzqe.downobserve.hk/?531506076898</a><br>
<br>
<br>
Thank you and best regards<br>
Johnny Spears<br>
Email: hwm...@br.nl.com<br>
</body>
</html>
</body>
</html>
-- END OF SPAM --
WEB:
You may contact us at +1(210) 787-1711, please, keep your order I.D.
every time you make a call.
Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
See:
IP 77.183.197.29 dsbg-4db7c51d.pool.einsundeins.de
http://www.moensted.dk/spam/?addr=77.183.197.29
http://cbl.abuseat.org/lookup.cgi?ip=77.183.197.29
http://www.spamhaus.org/query/bl?ip=77.183.197.29
http://www.spamhaus.org/pbl/query/PBL115050
http://spamcop.net/w3m?action=checkblock&ip=77.183.197.29
http://www.apews.org/?page=test&C=130&E=187751&ip=77.183.197.29
More einsundeins.de sightings:
http://groups.google.com/groups/search?q=einsundeins.de+group%3A*abuse&start=0&scoring=d&
inetnum: 77.183.0.0 - 77.183.255.255
netname: ONEANDONE-DSL
descr: 1&1 Internet AG
descr: NCC#2006071591
country: DE
role: Schlund NCC
address: Schlund + Partner AG
route: 77.182.0.0/15
descr: 1&1 Internet AG
remarks: netname: DE-1AND1-20061117
origin: AS6805
mnt-by: MDA-Z
changed: i...@telefonica.de
http://www.cidr-report.org/cgi-bin/as-report?as=6805
8 SBL listings for IPs under the responsibility of schlund.de
http://www.spamhaus.org/sbl/listings.lasso?isp=schlund.de
Spamvert URL:
inzqe.downobserve.hk/?531506076898
See:
inzqe.downobserve.hk => botnet
NS0.CHITIONKDETUNLIONPSA.COM [58.177.185.106 (NO GLUE)] [HK]
NS0.GEDSACTUNJERION.COM [NO GLUE; No A record]
NS0.FIONKUNJERUNHEDASE.COM [218.254.246.173 (NO GLUE)] [HK]
NS0.PIOTIONGANDESUNKDES.COM [NO GLUE; No A record]
NS records at nameservers are:
ns0.fionkunjerunhedase.com [218.254.246.173] [TTL=300]
ns0.chitionkdetunlionpsa.com [68.20.20.220] [TTL=300]
ns0.gedsactunjerion.com [58.177.185.51] [TTL=300]
ns0.piotiongandesunkdes.com [218.253.152.67] [TTL=300]
halcax.burnshout.hk has no MX records -> burnshout.hk has no MX
records
ns ns0.chitionkdetunlionpsa.com 76.104.139.174(US)
ns ns0.fionkunjerunhedase.com 208.120.41.135(US)
ns ns0.gedsactunjerion.com 69.229.238.218(US)
ns ns0.piotiongandesunkdes.com 24.238.187.40(US)
SOA record [TTL=300] is:
Primary nameserver: ns0.chitionkdetunlionpsa.com
Hostmaster E-mail address:
www.downobserve.hk A 218.190.86.117 [TTL=300] [HK]
www.downobserve.hk A 61.92.31.78 [TTL=300] [HK]
www.downobserve.hk A 59.149.8.143 [TTL=300] [HK]
www.downobserve.hk A 61.216.151.184 [TTL=300] [TW]
www.downobserve.hk A 218.255.180.150 [TTL=300] [HK]
www.downobserve.hk A 221.124.239.60 [TTL=300] [HK]
www.downobserve.hk A 218.255.242.12 [TTL=300] [HK]
www.downobserve.hk A 75.17.63.208 [TTL=300] [US]
www.downobserve.hk A 68.125.30.66 [TTL=300] [US]
www.downobserve.hk A 66.177.73.244 [TTL=300] [US]
www.downobserve.hk A 75.28.103.72 [TTL=300] [US]
www.downobserve.hk A 70.237.237.179 [TTL=300] [US]
www.downobserve.hk A 74.102.18.163 [TTL=300] [CA]
18 domains sharing nameservers with downobserve.hk
anystood.hk
basicrx.org
blocubs.hk
bluebuzz.hk
chartheld.hk
colonysent.hk
datacolumn.hk
divamia.hk
fivetag.hk
flippulses.hk
kaylane.hk
lastlift.hk
masterheart.hk
neighborled.hk
repeatphrase.hk
ropeminute.hk
thousandhundred.hk
topfinal.hk
Let see whois:
Domain Name: DOWNOBSERVE.HK
Contract Version: HKDNR latest version
Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): MR TOM SAMSSON
Holder Chinese Name:
Email: Scott1123...@hotmail.com
Domain Name Commencement Date: 07-06-2007
Country: US
Expiry Date: 07-06-2008
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1907979T
Technical Contact:
First name: TOM
Last name: SAMSSON
Company Name: TOM SAMSSON
Name Servers Information:
NS0.FIONKUNJERUNHEDASE.COM
NS0.GEDSACTUNJERION.COM
NS0.PIOTIONGANDESUNKDES.COM
NS0.CHITIONKDETUNLIONPSA.COM
More downobserve.hk sightings:
http://groups.google.com/groups/search?q=downobserve.hk+group%3A*abuse&qt_s=Search
SEE Also more NS sightings:
More CHITIONKDETUNLIONPSA.COM sightings:
http://groups.google.com/groups/search?q=CHITIONKDETUNLIONPSA.COM+group%3A*abuse&start=0&scoring=d&
More fionkunjerunhedase.com sightings:
http://groups.google.com/groups/search?q=fionkunjerunhedase.com+group%3A*abuse&start=0&scoring=d&
More gedsactunjerion.com sightings:
http://groups.google.com/groups/search?q=gedsactunjerion.com+group%3A*abuse&start=0&scoring=d&
More piotiongandesunkdes.com sightings:
http://groups.google.com/groups/search?q=piotiongandesunkdes.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/aaf4ebcc04755088
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/a22833b596643a0e
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: