Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] [drugs - MyCanadianPharmacy] [221.8.163.237] (mumrq.hk - 217.170.77.210 - mucronated.com - quaternalist.com - tetscope.com - matronizeer.com) Don't have time to visit local drug store?

0 views

Skip to first unread message

TomezNet

unread,

Feb 18, 2007, 6:00:41 AM2/18/07

Received From:
IP 221.8.163.237
(at ns2.jljlptt.net.cn / CNCGROUP-JL)

Spamvert:
mumrq.hk IP 200.255.33.2
(at ns1.datagrupo.com.BR / nat.datagrupo.com.br / embratel.net.br)

NEW Yambo Pharmacy image hosting:
http://217.170.77.210:8080/p/images/verify.gif

IP 217.170.77.210
(SBL50632) (at ns2.spaceweb.ru / eltel.net)

More Yambo MyCanadianPharmacy aka MyCanadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22MyCanadianPharmacy%22+group%3A*abuse&start=0&scoring=d&

Plenty of Forged Certificates and logos.

More info below:
====================

X-SID-PRA: Efficacy S. Skeletal <be...@glasswells.co.uk>
X-Message-Info: txF49lGdW40SWqMIoXytuxmLsisU3TFEVFwYp3rPIDw=
Received: from tomts34-srv.bellnexxia.net ([209.226.175.108]) by bay0-
pamc1-f5.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sun, 18 Feb 2007 00:31:22 -0800
Received: from [MUNGED]
by toip16.srvr.bell.ca with ESMTP; 18 Feb 2007 03:31:16 -0500
Received: (qmail 23995 invoked by uid 110); 18 Feb 2007 03:31:15 -0500
Delivered-To: [MUNGED]
Received: (qmail 23989 invoked from network); 18 Feb 2007 03:31:13
-0500
Received: from unknown (HELO -1211609672) (221.8.163.237)
by [MUNGED] with SMTP; 18 Feb 2007 03:31:13 -0500
Received: from glasswells.co.uk (-1211125080 [-1211124784])
by goldmailbox.com (Qmailv1) with ESMTP id 849CC0D410
for <[MUNGED]>; Sun, 18 Feb 2007 00:39:03 -0500
Date: Sun, 18 Feb 2007 00:39:03 -0500
From: "Efficacy S. Skeletal" <be...@glasswells.co.uk>
X-Mailer: The Bat! (v2.00.4) Personal
X-Priority: 3
Message-ID: <8114452228.2...@glasswells.co.uk>
To: [MUNGED]
Subject: Don't have time to visit local drug store?
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: Norton
Return-Path: be...@glasswells.co.uk
X-OriginalArrivalTime: 18 Feb 2007 08:31:22.0301 (UTC)
FILETIME=[2B9796D0:01C75337]

That can be real! Just buy any medications you need at Legal Rx
Medications store! Best quality drugs, instant shipping WORLDWIDE,
friendly support! Lowest prices on the web!
http://mumrq.hk/

Absolutely legal, licensed and CHEAP pills at your choice.
Confidential purchase. Instant shipping!

-- END OF SPAM --

See:
IP 221.8.163.237

http://www.moensted.dk/spam/?addr=221.8.163.237
http://tqmcube.com/cgi-bin/rbltqm?ip=221.8.163.237

inetnum: 221.8.0.0 - 221.9.255.255
netname: CNCGROUP-JL
descr: No.156,Fu-Xing-Men-Nei Street,
descr: CNC Group JILIN province network
descr: China Network Communications Group Corporation

route: 221.8.0.0/15
descr: CNC Group
origin: AS4837
mnt-by: MAINT-AS4837
changed: I...@cnc-noc.net
ASN: 4837
ASN Name: CHINA169-Backbone (CNCGROUP China169 Backbone)
Country (per IP registrar): CN [China]
Country IP Range: 221.8.0.0 to 221.11.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4837

3 SBL/ROKSO listings for IPs under the responsibility of CNCGROUP-JL
http://www.spamhaus.org/sbl/listings.lasso?isp=CNCGROUP-JL

Yambo Pharmacy image hosting:
http://217.170.77.210:8080/p/images/cipa2.gif

IP 217.170.77.210

217.170.77.210 PTR record: db2.sorenssystem.com
at ns2.spaceweb.ru / eltel.net

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL50632
217.170.77.210/32 is listed on the Spamhaus Block List (SBL/ROKSO)

30-Jan-2007 19:03 GMT | SR20

Yambo botnet image proxying/hosting (compromised sytems)

4 SBL/ROKSO listings for IPs under the responsibility of eltel.net
http://www.spamhaus.org/sbl/listings.lasso?isp=eltel.net

See:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/daf18552e0db01f2

See:
mumrq.hk IP 200.255.33.2
NS1.MUCRONATED.COM [63.223.11.14 (NO GLUE)] [US]
NS1.MATRONIZEER.COM [63.223.11.14 (NO GLUE)] [US]
NS2.TETSCOPE.COM [210.34.0.101 (NO GLUE)] [CN]
NS2.QUATERNALIST.COM [64.94.117.200 (NO GLUE)] [US]

[mumrq.hk has 1 MX record mail.mumrq.hk (10)]

http://www.moensted.dk/spam/?addr=200.255.33.2

200.255.33.2 PTR record: nat.datagrupo.com.br
ns1.datagrupo.com.BR / embratel.net.br

More datagrupo.com.br sightings:
http://groups.google.com/groups/search?q=datagrupo.com.br+group%3A*abuse

NetRange: 200.0.0.0 - 200.255.255.255
CIDR: 200.0.0.0/8

inetnum: 200.255.33/24
aut-num: AS4230
abuse-c: GSE6
owner: Naja In Comercio e Sistema Ltda
ownerid: 002.465.492/0001-16
responsible: Pedro Lima
nic-hdl-br: NIL54
person: Naja In Comércio e Sistemas LTDA
e-mail: pe...@datagrupo.com.br

route: 200.255.0.0/16
descr: EMBRATEL BRAZIL
origin: AS4230
notify: neta...@embratel.net.br
mnt-by: EMBRATEL
ASN: 4230
ASN Name: LACNIC-4230
Country (per IP registrar): BR [Brazil]
Country IP Range: 200.128.0.0 to 200.255.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4230

10 SBL/ROKSO listings for IPs under the responsibility of
embratel.net.br
http://www.spamhaus.org/sbl/listings.lasso?isp=embratel.net.br

Let see whois.hkdnr.net.hk:
Domain Name: MUMRQ.HK

Registrant Contact Information:
Holder English Name (It should be the same as your legal name on your
HKID card or other relevant documents): MICHELE MORCOM
Holder Chinese Name:
Email: greyt...@yahoo.com
Domain Name Commencement Date: 2007-01-16
Country: US
Expiry Date: 2008-01-17
Re-registration Status: Complete
Name of Registrar: HKDNR
Account Name: HK1785268T

Technical Contact:
First name: MICHELE
Last name: MORCOM
Company Name: MICHELE MORCOM

Name Servers Information:
NS1.MUCRONATED.COM
NS2.QUATERNALIST.COM
NS1.MATRONIZEER.COM
NS2.TETSCOPE.COM

More mumrq.hk sightings:
http://groups.google.com/groups/search?q=mumrq.hk+group%3A*abuse&start=0&scoring=d&

See:
NS1.MUCRONATED.COM IP 63.223.11.14

NS1.MUCRONATED.COM has no MX records -> [MUCRONATED.COM has 1 MX
record mail.MUCRONATED.COM (10)]

http://www.moensted.dk/spam/?addr=63.223.11.14
http://www.spamhaus.org/query/bl?ip=63.223.11.14

No PTR records exist for 63.223.11.14
at ns1.wvfiber.net / ns.cais.com

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49084
63.223.11.14/32 is listed on the Spamhaus Block List (SBL/ROKSO)

02-Feb-2007 00:49 GMT | SR21

Yambo Financials.
Spam DNS Server

14 SBL/ROKSO listings for IPs under the responsibility of
pccwglobal.com
http://www.spamhaus.org/sbl/listings.lasso?isp=pccwglobal.com

Let see whois:
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Domain Name.......... mucronated.com
Creation Date........ 2007-01-16 00:22:10
Registration Date.... 2007-01-16 00:22:10
Expiry Date.......... 2008-01-16 00:22:10
Organisation Name.... huang ming
Organisation Address. guang zhou
Organisation Address.
Organisation Address. guang zhou
Organisation Address. 321000
Organisation Address. GD
Organisation Address. CN

Admin Name........... huang ming
Admin Address........ guang zhou
Admin Address........
Admin Address........ guang zhou
Admin Address........ 321000
Admin Address........ GD
Admin Address........ CN
Admin Email.......... admin[]galleyfoisted.com
Admin Phone.......... +86.2032100022
Admin Fax............ +86.2032100022

Tech Name............ huang ming
Tech Address......... guang zhou
Tech Address.........
Tech Address......... guang zhou
Tech Address......... 321000
Tech Address......... GD
Tech Address......... CN
Tech Email........... ad...@galleyfoisted.com
Tech Phone........... +86.2032100022
Tech Fax............. +86.2032100022

Bill Name............ huang ming
Bill Address......... guang zhou
Bill Address.........
Bill Address......... guang zhou
Bill Address......... 321000
Bill Address......... GD
Bill Address......... CN
Bill Email........... ad...@galleyfoisted.com
Bill Phone........... +86.2032100022
Bill Fax............. +86.2032100022
Name Server.......... ns2.mucronated.com
Name Server.......... ns1.mucronated.com

More mucronated.com sightings:
http://groups.google.com/groups?q=MUCRONATED.COM+group%3A*abuse&start=0&scoring=d&

More Registrant Contact domain galleyfoisted.com sightings:
http://groups.google.com/groups/search?q=galleyfoisted.com+group%3A*abuse

Let see whois:
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Domain Name.......... galleyfoisted.com
Creation Date........ 2007-01-16 00:22:16
Registration Date.... 2007-01-16 00:22:16
Expiry Date.......... 2008-01-16 00:22:16
Organisation Name.... huang ming
Organisation Address. guang zhou
Organisation Address.
Organisation Address. guang zhou
Organisation Address. 321000
Organisation Address. GD
Organisation Address. CN

Bill Name............ huang ming
Bill Address......... guang zhou
Bill Address.........
Bill Address......... guang zhou
Bill Address......... 321000
Bill Address......... GD
Bill Address......... CN
Bill Email........... ad...@galleyfoisted.com
Bill Phone........... +86.2032100022
Bill Fax............. +86.2032100022
Name Server.......... ns2.galleyfoisted.com
Name Server.......... ns1.galleyfoisted.com

See:
NS1.MATRONIZEER.COM IP 63.223.11.14

NS1.MATRONIZEER.COM has no MX records -> [MATRONIZEER.COM has 1 MX
record mail.MATRONIZEER.COM (10)]

http://www.moensted.dk/spam/?addr=63.223.11.14
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49084

Let see whois
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Domain Name.......... matronizeer.com
Creation Date........ 2007-01-16 00:22:06
Registration Date.... 2007-01-16 00:22:06
Expiry Date.......... 2008-01-16 00:22:06
Organisation Name.... huang ming
Organisation Address. guang zhou
Organisation Address.
Organisation Address. guang zhou
Organisation Address. 321000
Organisation Address. GD
Organisation Address. CN

Bill Name............ huang ming
Bill Address......... guang zhou
Bill Address.........
Bill Address......... guang zhou
Bill Address......... 321000
Bill Address......... GD
Bill Address......... CN
Bill Email........... ad...@galleyfoisted.com
Bill Phone........... +86.2032100022
Bill Fax............. +86.2032100022
Name Server.......... ns2.matronizeer.com
Name Server.......... ns1.matronizeer.com

More matronizeer.com sightings:
http://groups.google.com/groups/search?q=MATRONIZEER.COM+group%3A*abuse&start=0&scoring=d&

See:
NS2.TETSCOPE.COM IP 210.34.0.101

NS2.TETSCOPE.COM has no MX records -> [TETSCOPE.COM has 1 MX record
mail.TETSCOPE.COM (10)]

http://www.moensted.dk/spam/?addr=210.34.0.101
http://www.spamhaus.org/query/bl?ip=210.34.0.101

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48902
210.34.0.101/32 is listed on the Spamhaus Block List (SBL/ROKSO)

10-Dec-2006 15:44 GMT | SR20

Yambo Financials
Yambo nameserver (compromised system)

4 SBL/ROKSO listings for IPs under the responsibility of net.edu.cn
http://www.spamhaus.org/sbl/listings.lasso?isp=net.edu.cn

Let see whois:
Registrar: MONIKER ONLINE SERVICES, INC.
Domain Name: TETSCOPE.COM

Registrant [565814]:
Steve Gosa
13817 Deise Ave
Cleveland
OH
44110
US

Administrative Contact [565814]:
Steve Gosa nyb7vert[]yahoo.com
13817 Deise Ave
Cleveland
OH
44110
US
Phone: +1.2162683684

Billing Contact [565814]:
Steve Gosa nyb7...@yahoo.com
13817 Deise Ave
Cleveland
OH
44110
US
Phone: +1.2162683684

Technical Contact [565814]:
Steve Gosa nyb7...@yahoo.com
13817 Deise Ave
Cleveland
OH
44110
US
Phone: +1.2162683684

Domain servers in listed order:
NS1.TETSCOPE.COM 65.43.7.170
NS2.TETSCOPE.COM 210.34.0.101

Record created on: 2006-12-26 07:53:07.0
Database last updated on: 2007-02-07 03:17:01.97
Domain Expires on: 2007-12-26 07:53:08.0

More tetscope.com sightings:
http://groups.google.com/groups/search?q=TETSCOPE.COM+group%3A*abuse&start=0&scoring=d&

See:
NS2.QUATERNALIST.COM IP 64.94.117.200

NS2.QUATERNALIST.COM has no MX records -> QUATERNALIST.COM has no MX
records

http://www.moensted.dk/spam/?addr=64.94.117.200

More 64.94.117.200 sightings:
http://groups.google.com/groups/search?q=64.94.117.200+group%3A*abuse&start=0&scoring=d&

No PTR records exist for 64.94.117.200
at ns1.sef.pnap.net / ns2.pnap.net / internap.com

Internap Network Services PNAP-05-2000 (NET-64-94-0-0-1)
64.94.0.0 - 64.95.255.255
DOTSTER INC INAP-SEF-DOTSTER-7067 (NET-64-94-117-192-1)
64.94.117.192 - 64.94.117.223

OrgName: DOTSTER INC
OrgID: DOTST-1
NetRange: 64.94.117.192 - 64.94.117.223
CIDR: 64.94.117.192/27
NetName: INAP-SEF-DOTSTER-7067
NetHandle: NET-64-94-117-192-1
Parent: NET-64-94-0-0-1
NetType: Reassigned

route: 64.94.112.0/20
descr: PNAP-SEF
SEF PNAP
origin: AS14744
mnt-by: INAP-MAINT-RADB
changed: dun...@internap.com
ASN: 14744
ASN Name: INTERNAP-BLOCK-4
Country (per IP registrar): US [United States]
Country IP Range: 64.94.0.0 to 64.95.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=14744

1 SBL listings for IPs under the responsibility of dotster.com
http://www.spamhaus.org/sbl/listings.lasso?isp=dotster.com

25 SBL/ROKSO listings for IPs under the responsibility of internap.com
http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com

Let see whois:
Registrar: DSTR ACQUISITION VII, LLC
Registrant:
Pazek Terkovic (QUATERNALIST-COM-DOM)
Str. Pridvorului, No. 7, Bl. 2c, Entr. B, Apt. 14
Bucuresti, Sector 4 013682
Romania
+040.0213102145
+040.0213102145
pazek_t...@yahoo.com

Domain Name: QUATERNALIST.COM

Administrative Contact:
Pazek Terkovic pazek_terkovic[]yahoo.com
Str. Pridvorului, No. 7, Bl. 2c, Entr. B, Apt. 14
Bucuresti, Sector 4 013682
Romania
+040.0213102145
Fax- +040.0213102145

Technical Contact, Zone Contact:
Pazek Terkovic pazek_t...@yahoo.com
Str. Pridvorului, No. 7, Bl. 2c, Entr. B, Apt. 14
Bucuresti, Sector 4 013682
Romania
+040.0213102145
Fax- +040.0213102145

Record last updated on 05-Feb-2007.
Record expires on 15-Jan-2008.
Record created on 15-Jan-2007.

Domain servers in listed order:
Name Server: ns1.quaternalist.com
Name Server: ns2.quaternalist.com

More quaternalist.com sightings:
http://groups.google.com/groups/search?q=QUATERNALIST.COM+group%3A*abuse&start=0&scoring=d&

And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/011ee5ce55af288f

Cheers, Tomez

--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.

For a copy of the guidelines to this group, see:

http://www.killfile.org/~tskirvin/nana/

0 new messages