Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] [drugs - Canadian Pharmacy botnet] [88.222.68.59] (legfound.com / axrpss.com / lutrwpghd.com / sjrbofa.com / vqwgds.com / xinnetdns.com / xinnet.cn) tubelom

0 views

Skip to first unread message

TomezNet

unread,

Mar 25, 2008, 4:46:23 AM3/25/08

Received From:
IP 88.222.68.59
(at dokeda.lt / LT-MEGANET)

Spamvert:
www.legfound.com => botnet
legfound.com Resolved to 218.152.22.71 to 58.77.110.212 to
58.233.67.10 to 65.3.134.105 to 67.191.255.83 to 68.34.45.204 to
68.119.114.232 to 69.245.174.253 to 75.64.63.230 to 75.131.212.177 to
76.102.248.125 to 98.204.185.40 to 118.32.144.6 to 118.33.168.97 to
118.37.33.154 to 125.131.0.251 to 125.142.87.117 to 211.62.103.127 to
211.192.194.58 to 218.49.163.158

ns0.axrpss.com IP 92.226.140.12
ns0.axrpss.com IP 89.112.22.252
ns0.lutrwpghd.com IP 222.108.47.106
ns0.sjrbofa.com IP 59.149.48.223
ns0.vqwgds.com IP 12.21.215.23
ns0.vqwgds.com IP 58.77.110.212

Title: European Pharmacy (aka Canadian Pharmacy)

WEB:
Š Copyright Canadian Pharmacy, 2003-2008. All Rights Reserved.

Much More Canadian Pharmacy sightings:
http://groups.google.com/groups/search?q=%22Canadian+Pharmacy%22+group%3A*abuse&start=0&scoring=d&

Plenty of Forged Certificates and logos as always.

More info below:
==================X-SID-PRA: Bird Cardona <Bird-...@writepact.com>
X-Message-Info: 6sSXyD95QpVzT2ENlBqW/VNdfbMWw/
l6fi5VlZpORg6ulJFzVzaGecfX+76M+5UKEN2wCN8y9GppHv5z29gmDw=Received: from tomts1-srv.bellnexxia.net ([209.226.175.113]) by bay0-
pamc1-f6.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Mon, 24 Mar 2008 22:42:54 -0700
Received: from toip18.srvr.bell.ca ([67.69.240.20])
by toip44.srvr.bell.ca with ESMTP; 25 Mar 2008 01:42:41 -0400
Received: from [MUNGED]
by toip18.srvr.bell.ca with ESMTP; 25 Mar 2008 01:42:40 -0400
Received: (qmail 32248 invoked by uid 110); 25 Mar 2008 01:42:40 -0400
Delivered-To: [MUNGED]
Received: (qmail 32147 invoked from network); 25 Mar 2008 01:42:40
-0400
Received: from unknown (HELO ?88.222.68.59?) (88.222.68.59)
by [MUNGED] with SMTP; 25 Mar 2008 01:42:40 -0400
Message-ID: <000a01c88e3b$0bd56c10$3b44de58@migle>
From: "Bird Cardona" <Bird-...@writepact.com>
To: [MUNGED]
Subject: tubelom
Date: Tue, 25 Mar 2008 07:42:43 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--------=_NextPart_000_0006_01C88E4B.CF5E3C10"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
Return-Path: Bird-...@writepact.com
X-OriginalArrivalTime: 25 Mar 2008 05:42:54.0482 (UTC)
FILETIME=[12828F20:01C88E3B]

----------=_NextPart_000_0006_01C88E4B.CF5E3C10
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Revolution in the PE science
Your chixxxx can never forget these wonderful nights!
----------=_NextPart_000_0006_01C88E4B.CF5E3C10
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.3199" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT Arial size=3D2>Revolution in the PE science</FONT></DIV>
<A href="http://legfound.com">Your chixxxx can never forget these wonderful=20
nights!</A></BODY></HTML>
----------=_NextPart_000_0006_01C88E4B.CF5E3C10--

-- END OF SPAM --

Identical spam as for collectwhole.com, planerise.com, seapast.com,
moonshort.com, letterclock, pleaseselect.com, liftplural.com,
samegentle.com => All Botnet

OLD Listing:
SBL61248 - ROK4932 / SBL61418, SBL61896, SBL62483

http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4932

WEB:
Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
You may contact us at +1(210) 888-9089, please, keep your order I.D.
every time you make a call
Š Copyright Canadian Pharmacy, 2003-2008. All Rights Reserved.

More spammer sightings:
http://groups.google.com/groups/search?q=%22September+70%25%22+group%3A*abuse&start=0&scoring=d&

See:
IP 88.222.68.59

http://moensted.dk/spam/?addr=88.222.68.59
Listed in PSBL, see http://psbl.surriel.com/listing?ip=88.222.68.59

inetnum: 88.222.64.0 - 88.222.79.255
netname: LT-MEGANET
descr: Kaunas megaNET area10 network
country: LT
role: Dokeda networks hostmasters
address: Dokeda NOC
address: megaNET network
address: Savanoriu pr. 287
address: Kaunas, 50127
address: Lithuania

route: 88.222.64.0/19
descr: LT-MEGANET-KNS-G3
origin: AS39354
mnt-by: DNH-MNT
changed: hostm...@dokeda.lt
AS Name: DOKEDA megaNET network
http://www.cidr-report.org/cgi-bin/as-report?as=39354

1 SBL listings for IPs under the responsibility of dokeda.lt
http://www.spamhaus.org/sbl/listings.lasso?isp=dokeda.lt

legfound.com has no MX records

New:
ns2.xinnetdns.com IP 210.51.170.48
ns2.xinnet.cn IP 210.51.170.67

Old:
ns.xinnetdns.com IP 210.51.170.66
ns.xinnet.cn IP 210.51.171.209

AND New IP:
ns0.axrpss.com IP 92.226.140.12
ns0.axrpss.com IP 89.112.22.252
ns0.lutrwpghd.com IP 222.108.47.106
ns0.sjrbofa.com IP 59.149.48.223
ns0.vqwgds.com IP 12.21.215.23
ns0.vqwgds.com IP 58.77.110.212

Also Old one's:
ns0.axrpss.com IP 222.166.132.30
ns0.axrpss.com IP 222.167.203.112
ns0.axrpss.com IP 62.143.161.186
ns0.lutrwpghd.com = 123.202.194.61
ns0.lutrwpghd.com = 60.47.214.194
ns0.lutrwpghd.com IP 221.126.94.65
ns0.lutrwpghd.com IP 84.245.204.131
ns0.sjrbofa.com IP 202.126.117.43
ns0.sjrbofa.com = 59.149.165.117
ns0.sjrbofa.com = 124.218.67.36
ns0.vqwgds.com IP 221.127.245.4
ns0.vqwgds.com IP 79.164.123.55
ns0.vqwgds.com = 123.202.90.32

See IP rDNS on botnet:
218.152.22.71 no PTR at KORnet / kt.co.kr / Korea
58.77.110.212 no PTR at DACOM / powercomm.com / Korea
58.233.67.10 no PTR at HANARO / HANANET / thrunet.com / Korea
65.3.134.105 = adsl-3-134-105.mia.bellsouth.net
67.191.255.83 = c-67-191-255-83.hsd1.ga.comcast.net
68.34.45.204 = c-68-34-45-204.hsd1.dc.comcast.net
68.119.114.232 = 68-119-114-232.dhcp.jcsn.tn.charter.com
69.245.174.253 = c-69-245-174-253.hsd1.in.comcast.net
75.64.63.230 = c-75-64-63-230.hsd1.tn.comcast.net
75.131.212.177 no PTR at CHARTER-NET-HKY-NC / wvfiber.net /
charter.net
76.102.248.125 = c-76-102-248-125.hsd1.ca.comcast.net
98.204.185.40 = c-98-204-185-40.hsd1.md.comcast.net
118.32.144.6 no PTR at KORnet / kt.co.kr / Korea
118.33.168.97 no PTR at KORnet / kt.co.kr / Korea
118.37.33.154 no PTR at KORnet / kt.co.kr / Korea
125.131.0.251 no PTR at KORnet / kt.co.kr / Korea
125.142.87.117 no PTR at KORnet / kt.co.kr / Korea
211.62.103.127 no PTR at KITINET / ktn.co.kr / groupnet.co.kr / Korea
211.192.194.58 no PTR at KORnet / kt.co.kr / Korea
218.49.163.158 no PTR at HANARO / HANANET / Korea

Let see whois.paycenter.com.cn:
Domain Name: legfound.com

Registrant:
li hao
hai kou
891000

Administrative Contact:
haohao
li hao
hai kou
hai kou Beijing 891000
CN
tel: 898 1234567
fax: 898 1234567
yay...@163.com

Technical Contact:
haohao
li hao
hai kou
hai kou Beijing 891000
CN
tel: 1234567
fax: 1234567
yay...@163.com

Billing Contact:
haohao
li hao
hai kou
hai kou Beijing 891000
CN
tel: 1234567
fax: 1234567
yay...@163.com

Registration Date: 2008-03-14
Update Date: 2008-03-22
Expiration Date: 2009-03-14

Primary DNS: ns0.sjrbofa.com 59.149.48.223
Secondary DNS: ns0.axrpss.com 89.112.22.252

More legfound.com sightings:
http://groups.google.com/groups/search?q=legfound.com+group%3A*abuse*&qt_s=Search

SEE:
IP 92.226.140.12 no PTR at HANSENET / Korea
IP 89.112.22.252 = 89.112.22.252.pppoe.eltel.net
IP 222.108.47.106 no PTR at KORnet / kt.co.kr / Korea
IP 59.149.48.223 = 059149048223.ctinets.com
IP 12.21.215.23 = rdbk-9478.mtaonline.net
IP 58.77.110.212 no PTR at DACOM / powercomm.com / Korea

See IP rDNS on botnet for DNS servers:
IP 222.166.132.30 = cm222-166-132-30.hkcable.com.hk
IP 222.167.203.112 = cm222-167-203-112.hkcable.com.hk
IP 62.143.161.186 = ip-62-143-161-186.1211F-CUD12K-02.ish.de
IP 123.202.194.61 = 123202194061.ctinets.com
IP 60.47.214.194 = i60-47-214-194.s02.a006.ap.plala.or.jp
IP 221.126.94.65 no PTR at HUTCHISON / hutchcity.com / hgc.com.hk
IP 84.245.204.131 = customer-204.131.livas.lv
IP 202.126.117.43 no PTR at HAIONNET / haion.net / Korea
IP 59.149.165.117 = 059149165117.ctinets.com
IP 124.218.67.36 = 124-218-67-36.cm.dynamic.apol.com.tw
IP 221.127.245.4 no PTR at HUTCHISON / hutchcity.com / hgc.com.hk
IP 79.164.123.55 = host-79-164-123-55.qwerty.ru at cnt.ru
IP 123.202.90.32 = 123202090032.ctinets.com

More axrpss.com sightings:
http://groups.google.com/groups/search?q=axrpss.com+group%3A*abuse*&qt_s=Search

More lutrwpghd.com sightings:
http://groups.google.com/groups/search?q=lutrwpghd.com+group%3A*abuse*&qt_s=Search

More sjrbofa.com sightings:
http://groups.google.com/groups/search?q=sjrbofa.com+group%3A*abuse*&qt_s=Search

More vqwgds.com sightings:
http://groups.google.com/groups/search?q=vqwgds.com+group%3A*abuse*&qt_s=Search

And:
http://groups.google.com/group/news.admin.net-abuse.email/browse_thread/thread/b954923637316fdb/efecf5dda73fe039#efecf5dda73fe039

And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/759359adfc45d074

Cheers, Tomez

--
All postings to news.admin.net-abuse.sightings are unconfirmed and unverified
unless stated otherwise by the moderators. All opinions expressed above are
considered the opinions of the original poster, not the moderators or their
respective employers. For a copy of the guidelines to this group, see:
http://www.killfile.org/~tskirvin/nana/

0 new messages