[email] [meds - PharmacyExpress.com] (southbeatz.com) SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*, CIPRO, MERIDI*, CELEBRE*, VALIU* already
TomezNet
IP 220.83.78.157
(at rev2.kornet.net)
Spamvert URL:
http://au.geocities.com/marlo48890gigi40675/
Redirected to:
http://147.46.133.109/pharmacy/
AND next Redirected to:
http://fewfew.southbeatz.com
Spamvert:
fewfew.southbeatz.com IP 59.188.12.81
(ROK5460 - SBL38265) (at newworldtel.com)
More 0l23.com by the same spammer (PharmacyExpress.com) sightings:
http://groups.google.com/groups?q=0l23.com+group%3A*abuse*&start=0&scoring=d&
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 206.190.49.52; Fri, 17 Feb 2006
22:05:53 -0800
X-Originating-IP: [220.83.78.157]
Return-Path: <ybfk...@tenforward.com>
Authentication-Results: mta256.mail.mud.yahoo.com
from=tenforward.com; domainkeys=fail (bad syntax)
Received: from 220.83.78.157 (HELO 4.79.181.15) (220.83.78.157) by
mta256.mail.mud.yahoo.com with SMTP; Fri, 17 Feb 2006 22:05:52 -0800
Received: from [192.168.1.3] ([220.83.78.157]) by webnexus.com
(Sendmail 8.7.3) with ESMTP (SSL) id IYT35267 for <xx..xx@xx..xx.com>;
Sat, 18 Feb 2006 00:05:54 -0600
Message-ID: <331u115r...@webnexus.com>
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=mischievous.prison; d=webnexus.com;
b=Jb2WlCUFS5OxbpQftuJ6NfdykE2xgFGtNhFOE1k6oBGlYCTFa1NBJmUxC4lmRyxAAde30fiwhKLbbBjy;
Date: Sat, 18 Feb 2006 00:05:54 -0600
From: "Eustolia Elke" <ybfk...@tenforward.com>
User-Agent: Mozilla Thunderbird 1.5 (Windows/2006011)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xx..xx@xx..xx.com
Subject: SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*,
CIPRO, MERIDI*, CELEBRE*, VALIU* already
Content-Type: multipart/related;
boundary="------------87284282==.MRA"
Content-Length: 1154
All Popular meds At 82% Disccount
U Just Pay & We Ship, We Dont Keep Ur Record
http://au.geocities.com/marlo48890gigi40675/ (Click this link to
enjoy 82% disccount)
turning did similar social news. added benefit tying mischievous
night appearance. prison carefully news. you am use respect. similar
we corner. already different fly.
---------------------------------
fascinate latter studied reply mischievous slow?
slow reading different fire studied, motor gym out bad did. friends
thus end taught friends.
servants a whom reference already. raise pride fascinate is,
All Popular meds At 82% Disccount
U Just Pay & We Ship, Dont Keep Ur Record
All Countries Shipping
Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro, Meridi*,
Celebre*, Valiu*, Ativa*, Zoloft, Clonazepa*, Amoxicili & Many More
Meds fascinate how
drew Click Here To Enjoy 82% Savingboughthappened servants side explain
disappoint?
across next bad steps? letters he sandwich how pretty. wife leader
servants?
speaking make leader.
back thats fly young. thus least gym.
happened embarrass shining. reading sugar carefully off sandwich slow.
rich shining slow added. similar respect off,
nothing few evening.
<html><head>
<meta http-equiv="Content-Type" content="text; charset=iso-8859-1">
</head><body> <font color=FFA4D1 size=1>fascinate latter studied reply
mischievous slow?<br>
slow reading different fire studied, motor gym out bad did. friends
thus end taught friends.<br>
servants a whom reference already. raise pride fascinate is,<br>
</font><center><table border=5 cellspacing=1 cellpadding=10 width=550
bordercolor=E6FD42>
<tr><td bgcolor=ffffff align=center bordercolor=2020FF>
<font size=1 face=arial color=000000>
<font size=5 color=FF5353><b>All Popular meds At 82% Disccount<br><font
color=E10000 size=3>U Just Pay & We Ship, Dont Keep Ur Record<br><font
color=B70000>All Countries Shipping</font></b></font></font><br><font
color=000000 size=2>Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*,
Cipro, Meridi*, Celebre*, Valiu*, Ativa*, Zoloft, Clonazepa*, Amoxicili
& Many More Meds fascinate how</font><br><br>
<center>
<a href= http://au.geocities.com/marlo48890gigi40675/
target=_blank>drew
<font size=4 color=0000E8 size=arial><b><u> Click Here To Enjoy 82%
Saving </font></u></b>bought</a></center></td></tr></table><font
color=F5A7FE size=1>happened servants side explain disappoint?<br>
across next bad steps? letters he sandwich how pretty. wife leader
servants?<br>
speaking make leader.<br>
back thats fly young. thus least gym.<br>
happened embarrass shining. reading sugar carefully off sandwich
slow.<br>
rich shining slow added. similar respect off,<br>
nothing few evening.<br></font>
</body></html>
-- END OF SPAM --
See:
IP 220.83.78.157
http://www.moensted.dk/spam/?addr=220.83.78.157
http://cbl.abuseat.org/lookup.cgi?ip=220.83.78.157
http://www.spamhaus.org/query/bl?ip=220.83.78.157
http://korea.services.net/blocked.phtml?addr=220.83.78.157
Org Name : Korea Telecom (kornet.net)
Service Name : KORNET
ASN: 4766
ASN Name: KIXS-AS-KR (Korea Telecom)
IP range connectivity: 5
Registrar (per ASN): APNIC
Country (per IP registrar): KR [Korea-KR]
Country Currency: KRW [Korea (South) Won]
Country IP Range: 220.64.0.0 to 220.95.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4766
32 SBL/ROKSO listings for IPs under the responsibility of kornet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=kornet.net
See:
IP 147.46.133.109 rockeng.snu.ac.kr
rockeng.snu.ac.kr. has no MX records -> [snu.ac.kr has 1 MX record
smtp.snu.ac.kr (0)]
http://www.moensted.dk/spam/?addr=147.46.133.109
http://korea.services.net/blocked.phtml?addr=147.46.133.109
IPv4 Address : 147.46.0.0-147.46.255.255
Network Name : NET-SNU
Registration Date : 20040625
Organization ID : ORG384075
ASN: 9488
ASN Name: SNU-AS-KR (Seoul National University)
http://www.cidr-report.org/cgi-bin/as-report?as=9488
See:
fewfew.southbeatz.com IP 59.188.12.81
ns2.0l23.com [222.217.221.139]
ns1.0l23.com [59.188.12.81]
147.46.133.109 PTR record: rockeng.snu.ac.kr
at ercc.snu.ac.kr / ns.kren.nm.kr
No PTR records exist for 59.188.12.81
at dns1.nwtgigalink.com / newworldtel.com
http://www.moensted.dk/spam/?addr=59.188.12.81
http://www.spamhaus.org/query/bl?ip=59.188.12.81
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL38265
59.188.12.81/32 is listed on the Spamhaus Block List (SBL/ROKSO)
22-Feb-2006 19:02 GMT | SR22
Taiwan Media Ltd
ns1.0l23.com / internetrxstore.com
Main info:
http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Taiwan%20Media%20Ltd
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK5460
31 SBL listings for IPs under the responsibility of newworldtel.com
http://www.spamhaus.org/sbl/listings.lasso?isp=newworldtel.com
Let see whois:
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
domain: southbeatz.com
owner: Ilan O'tell
email: ad...@przc.com
address: Calle /Str 38
city: San Jose
state: --
postal-code: SJ
country: CR
phone: (506) 255-2031
fax: (506) 255-1946
admin-c: admin[]przc.com#0
tech-c: ad...@przc.com#0
billing-c: ad...@przc.com#0
reseller: Registered through Corona-Domains.com
reseller: Your first offshore domain registrar
reseller: La Presa 2313, Mexico City, 10200, Mexico
reseller: Forward abuses to ab...@corona-domains.com
nserver: ns1.0l23.com 59.188.12.81
nserver: ns2.0l23.com 222.217.221.139
status: lock
created: 2006-02-14 15:04:32 UTC
modified: 2006-02-14 15:04:32 UTC
expires: 2007-02-14 10:02:03 UTC
source: joker.com live whois service
query-time: 0.01558
db-updated: 2006-02-23 02:17:46
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/34e86edf4658d9b6
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: