[email] RE: Internet Drugstore

USENET n.a.n-a.s reports

unread,

Jul 10, 2007, 4:30:23 PM7/10/07

to

This is guaranteed spam from unconfirmed opt-in mailing lists for spurious
addresses at poopypants.com or other vanity domains. hor...@fw.merk.com is a USENET spamtrap seed.

----------------------

From horn...@raunchysexmovies.com Tue Jul 10 16:29:51 2007
Received: from mx0.public.com (mx0.public.com [66.112.160.20])
by public.com (8.12.10/8.12.10) with ESMTP id
l6AKTp3v026876 for <x...@public.com>; Tue, 10 Jul 2007 16:29:51
-0400 (EDT)
Received: from usrer-25515b377 ([87.251.144.142]) by mx0.public.com
(8.11.6/8.11.6) with SMTP id l6AKTjc08733 for <ho...@fw.merk.com>;
Tue, 10 Jul 2007 16:29:48 -0400
Date: Tue, 10 Jul 2007 16:29:48 -0400
X-Originating-Ip: [602.71.17.9]
X-Originating-Email: [ho...@fw.merk.com]
X-Sender: ho...@fw.merk.com
Received: (qmail 3410 by uid 349); Wed, 11 Jul 2007 12:30:11 +0300
Message-ID: <20070711153011.3412.qmail@usrer-25515b377>
To: <ho...@fw.merk.com>
Subject: RE: Internet Drugstore
From: "Lu...@viagra.com" <ho...@fw.merk.com>
MIME-Version: 1.0
Importance: High
Content-Type: text/html
<style>

<!I have been lowcarbing for about 3months (had a week off over xmas) however,
back on induction....

If i do a small amount of cardio e.g 30 - 40 mins Bike; after - the endorphins
seem to flow and i don't feel too bad. However, if i do resistance training i
seem to feel really drained of energy and i am overcome by a generall feeling
of unwellness.

After resistance training today (feeling drained)i went and ate a low carb
breakfast, which seemed to pick me up but throughout the day i have still felt
pretty shitty...

Help anyone? I know this post is prob a bit vague but im hoping its just a
common hurdle that people know about...........

Wayne

><!HAHAHAHAHA. This cross-dressing loony is turning out to be a godsend
for the liberals.

(snip)

After we bomb North Korea, what's the next country we should invade?

"Iran. Though that's the beauty part of Iraq: It may well not be
necessary. Because precisely what I'm saying with nuking North
Korea-despite that wonderful peace deal Madeline Albright negotiated
with the North Koreans, six seconds before they feverishly began
developing nuclear weapons. They're a major threat. I just think it
would be fun to nuke them and have it be a warning to the rest of the
world."

(snip)
><
I'm gonna say I could take Ray Romano. Just 'cause I really want to. Here
are my faves from the above page:

The Onion: Who could you take in a fight?

Conan O'Brien: Let's see, who could I take in a fight? Definitely Ruth
Bader Ginsburg. Have you seen her? Her upper body is very frail. I think I
could take her if she was sleepy and I had a two-by-four. She'd go down
quickly.

The Onion: Who could you take in a fight?

Emo Philips: Hawking, Reeve. Not at the same time.

--
ironcladlou, keeper of faq, bringer of poop humor

"You are a pitiful excuses for a human beings." - tzakol
><!Hi,

I was wondering what is the best way to find out the person to whom a coat
of arms was granted. I have a list from Burke's Armory of Perry/Pery Arms
that were granted (about 15 in total) but most of them don't say which
particular person the Arms were granted to, although I know one or two of
them. I have found one of the families in the Herald's visitations, but it
doesn't say to whom the arms were granted, is the earliest person in the
pedigree the original bearer of the arms? I realise I can apply to the
College of Arms, but I was hoping there would be a slightly more inexpensive
option!

Thanks

Vicki

_________________________________________________________________
Match.com - Click Here To Find Singles In Your Area Today!

>

<!For those AFers contemplating a walking program this Spring, you may want to
pick up the April issue of Prevention. A special issue devoted to Walking
Smart.
Included is a 4 week pull-out plan specified for either the Walking Rookie or
the Walking Whiz. Lots of great tips. Also included is their test of Walking
Shoes including an excerpt on whether your foot is neutral, rigid or flexible
which should enter into your choice of shoes. Shoes tested were Adida, Asics,
New Balance, Nike, Reebox and Saucony. I have decided I must have the New
Balance 788WB as the testers commented on lots of space in the toe area. Also
lists the 12 best Walking Cities.
</style><a target="_blank" href="http://loversrxregion.com" ><img src="http://www.img9.org/uploads/ba100a88b931e3706826dad763afdf61.gif">
<style>
Remember Friday, April 2 is Prevention's National Walk to Work Day.

Plus a lot of other good articles.
Jo Ann

>

<!There used to be this show on Channel 7 (WXYZ in Detroit) Friday nights at
11:30 pm called "In Concert". I was an impressionable 13-yr-old just gettin'
in to rock music in the summer of 1974 when they showed parts of the
California Jam in sucessive weeks on TV. I was a Deep Purple freak (still
am) and sat glued to the set, enthralled with Ritchie Blackmore's stage
antics (trashing a television camera while it was filming him and 'blowing
up' his amps).

Well, "Deep Purple - Live In California '74" was released on DVD yesterday,
and it's just as enthralling (warts and all) as it was 26+ yeard ago. It may
not have been their best show, but it reminded me of the thrill I got when I
was a kid. I hope that thrill never goes away.

--
Steve >

<!Hi there, when I first turn on my computer for the day, it will run fine for
up to 3 minutes or so until I get a complete blue screen with an error
message which reads:
____________________________________________
*** HARDWARE MALFUNCTION
PLEASE CONTACT YOUR HARDWARE VENDOR (something like this)

*** The sv
____________________________________________

I can not do a CRTL-ALT-DEL reboot or anything....no response to anything
except for a complete hard reboot. After a reboot my computer will run
perfectly fine and won't see this message again.
I only get the error message when my computer is cold it seems. But after
running a while, it runs perfectly.

Has anyone had this problem, or can anyone shed some light into this issue
please?

Thank you very much for your help people.
Please respond to group. Thank you.

</style>

--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.

For a copy of the guidelines to this group, see:

http://www.killfile.org/~tskirvin/nana/

USENET n.a.n-a.s reports

unread,

Jul 10, 2007, 10:30:05 PM7/10/07

to

This is guaranteed spam from unconfirmed opt-in mailing lists for spurious
addresses at poopypants.com or other vanity domains. hor...@fw.merk.com is a USENET spamtrap seed.

----------------------

From horm...@smig.net Tue Jul 10 22:03:58 2007

Received: from mx0.public.com (mx0.public.com [66.112.160.20])
by public.com (8.12.10/8.12.10) with ESMTP id

l6B23v3v033396 for <x...@public.com>; Tue, 10 Jul 2007 22:03:58
-0400 (EDT)
Received: from prx.g-service.ru (border-R1.g-service.ru [84.22.140.216]
(may be forged)) by mx0.public.com (8.11.6/8.11.6) with SMTP id
l6B23uc04230 for <hor...@fw.merk.com>; Tue, 10 Jul 2007 22:03:57 -0400
Date: Tue, 10 Jul 2007 22:03:57 -0400
X-Originating-Ip: [458.51.4.3]
X-Originating-Email: [hor...@fw.merk.com]
X-Sender: hor...@fw.merk.com
Received: (qmail 2933 by uid 276); Wed, 11 Jul 2007 10:03:50 +0700
Message-ID: <200707111703...@prx.g-service.ru>
To: <hor...@fw.merk.com>
Subject: RE: Internet Drugstore
From: "Bo...@viagra.com" <hor...@fw.merk.com>

Wayne

(snip)

Thanks

Vicki

>

</style><a target="_blank" href="http://pillstopeight.com" ><img src="http://www.img9.org/uploads/5ae294ec03ee605ece254373c4649861.gif">

Sabahattin Gucukoglu

unread,

Jul 10, 2007, 10:30:43 PM7/10/07

to

If you want to follow up with me by email for some reason, please see
http://sabahattin-gucukoglu.com/ and do not reply to this post.

Below this line is a copy of the original message:
From fee...@milesdeacon.co.uk Wed Jul 11 02:33:49 2007
Return-Path: <fee...@milesdeacon.co.uk>
Received: FROM familia-1c3d91f (20179053047.user.veloxzone.com.br [201.79.53.47] (may be forged))
BY bloodstone.sabahattin-gucukoglu.com (Sendmail 8.13.8) WITH SMTP ID l6B1Xjg3029636
FOR <fee...@yamta.org>; Wed, 11 Jul 2007 02:33:47 +0100
Date: Wed, 11 Jul 2007 02:33:47 +0100
X-Originating-IP: [760.60.2.627]
X-Originating-Email: [fee...@yamta.org]
X-Sender: fee...@yamta.org
Received: (qmail 2602 by uid 110); Tue, 10 Jul 2007 10:35:06 -0300
Message-Id: <20070710073506.2604.qmail@familia-1c3d91f>
To: <fee...@yamta.org>
Subject: RE: Internet Drugstore
From: "Alf...@viagra.com" <fee...@yamta.org>

<style>

Wayne

(snip)

Thanks

Vicki

>

</style><a target="_blank" href="http://arriveband.com" ><img src="http://www.img9.org/uploads/5ae294ec03ee605ece254373c4649861.gif">

USENET n.a.n-a.s reports

unread,

Jul 11, 2007, 3:31:28 AM7/11/07

to

This is guaranteed spam from unconfirmed opt-in mailing lists for spurious
addresses at poopypants.com or other vanity domains. hor...@fw.merk.com is a USENET spamtrap seed.

----------------------

From ho...@serveit21.com Wed Jul 11 02:40:57 2007

Received: from mx0.public.com (mx0.public.com [66.112.160.20])
by public.com (8.12.10/8.12.10) with ESMTP id

l6B6ev3v002041 for <x...@public.com>; Wed, 11 Jul 2007 02:40:57
-0400 (EDT)
Received: from node-29-129.adsl.tula.net (node-28-129.tula.net
[212.12.28.129] (may be forged)) by mx0.public.com (8.11.6/8.11.6)
with SMTP id l6B6euc07019 for <horm...@fw.merk.com>; Wed, 11 Jul 2007
02:40:56 -0400
Date: Wed, 11 Jul 2007 02:40:56 -0400
X-Originating-Ip: [75.7.121.56]
X-Originating-Email: [horm...@fw.merk.com]
X-Sender: horm...@fw.merk.com
Received: (qmail 3490 by uid 798); Wed, 11 Jul 2007 10:41:14 +0300
Message-ID: <200707111341...@node-29-129.adsl.tula.net>
To: <horm...@fw.merk.com>
Subject: RE: Internet Drugstore
From: "Abi...@viagra.com" <horm...@fw.merk.com>

Wayne

(snip)

Thanks

Vicki

>

</style><a target="_blank" href="http://readysea.com" ><img src="http://www.img9.org/uploads/5978cf7ad3ccf985b6083921cc63ec98.gif">

USENET n.a.n-a.s reports

unread,

Jul 11, 2007, 3:31:31 AM7/11/07

to

This is guaranteed spam from unconfirmed opt-in mailing lists for spurious
addresses at poopypants.com or other vanity domains. hor...@fw.merk.com is a USENET spamtrap seed.

----------------------

From ho...@yahoo.co.uk Wed Jul 11 02:40:59 2007

Received: from mx0.public.com (mx0.public.com [66.112.160.20])
by public.com (8.12.10/8.12.10) with ESMTP id

l6B6ew3v002063 for <x...@public.com>; Wed, 11 Jul 2007 02:40:59

-0400 (EDT)
Received: from node-29-129.adsl.tula.net (node-28-129.tula.net
[212.12.28.129] (may be forged)) by mx0.public.com (8.11.6/8.11.6)

with SMTP id l6B6evc07024 for <horm...@fw.merk.com>; Wed,
11 Jul 2007 02:40:58 -0400
Date: Wed, 11 Jul 2007 02:40:58 -0400

X-Originating-Ip: [75.7.121.56]
X-Originating-Email: [horm...@fw.merk.com]
X-Sender: horm...@fw.merk.com

Received: (qmail 3502 by uid 798); Wed, 11 Jul 2007 10:41:16 +0300

USENET n.a.n-a.s reports

unread,

Jul 11, 2007, 3:31:34 AM7/11/07

to

This is guaranteed spam from unconfirmed opt-in mailing lists for spurious
addresses at poopypants.com or other vanity domains. hor...@fw.merk.com is a USENET spamtrap seed.

----------------------

From ho...@yahoo.co.uk Wed Jul 11 02:40:58 2007

Received: from mx0.public.com (mx0.public.com [66.112.160.20])
by public.com (8.12.10/8.12.10) with ESMTP id

l6B6ew3v002051 for <x...@public.com>; Wed, 11 Jul 2007 02:40:58

-0400 (EDT)
Received: from node-29-129.adsl.tula.net (node-28-129.tula.net
[212.12.28.129] (may be forged)) by mx0.public.com (8.11.6/8.11.6)

with SMTP id l6B6euc07020 for <hor...@fw.merk.com>; Wed, 11 Jul 2007

02:40:56 -0400
Date: Wed, 11 Jul 2007 02:40:56 -0400
X-Originating-Ip: [75.7.121.56]

X-Originating-Email: [hor...@fw.merk.com]
X-Sender: hor...@fw.merk.com
Received: (qmail 3492 by uid 798); Wed, 11 Jul 2007 10:41:14 +0300
Message-ID: <200707111341...@node-29-129.adsl.tula.net>
To: <hor...@fw.merk.com>
Subject: RE: Internet Drugstore
From: "Abi...@viagra.com" <hor...@fw.merk.com>

USENET n.a.n-a.s reports

unread,

Jul 11, 2007, 3:31:50 AM7/11/07

to

This is guaranteed spam from unconfirmed opt-in mailing lists for spurious
addresses at poopypants.com or other vanity domains. hor...@fw.merk.com is a USENET spamtrap seed.

----------------------

From horlo...@boryad.org Wed Jul 11 02:42:21 2007

Received: from mx0.public.com (mx0.public.com [66.112.160.20])
by public.com (8.12.10/8.12.10) with ESMTP id

l6B6g83v002423 for <x...@public.com>; Wed, 11 Jul 2007 02:42:21
-0400 (EDT)
Received: from cable56-86.corlu.kablonet.com.tr
(cable56-86.corlu.kablonet.com.tr [195.174.56.86] (may be forged)) by
mx0.public.com (8.11.6/8.11.6) with SMTP id l6B6g2c07226 for
<horm...@fw.merk.com>; Wed, 11 Jul 2007 02:42:05 -0400
Date: Wed, 11 Jul 2007 02:42:05 -0400
X-Originating-Ip: [77.863.70.574]
X-Originating-Email: [horm...@fw.merk.com]
X-Sender: horm...@fw.merk.com
Received: (qmail 3217 by uid 667); Wed, 11 Jul 2007 09:39:55 +0200
Message-ID: <200707111139...@cable56-86.corlu.kablonet.com.tr>
To: <horm...@fw.merk.com>
Subject: RE: Internet Drugstore
From: "Nor...@viagra.com" <horm...@fw.merk.com>

Wayne

(snip)

Thanks

Vicki

>

</style><a target="_blank" href="http://ratherfour.com" ><img src="http://www.img9.org/uploads/5978cf7ad3ccf985b6083921cc63ec98.gif">

USENET n.a.n-a.s reports

unread,

Jul 11, 2007, 3:32:00 AM7/11/07

to

This is guaranteed spam from unconfirmed opt-in mailing lists for spurious
addresses at poopypants.com or other vanity domains. hor...@fw.merk.com is a USENET spamtrap seed.

----------------------

From ho...@lupinpharma.com Wed Jul 11 02:42:48 2007

Received: from mx0.public.com (mx0.public.com [66.112.160.20])
by public.com (8.12.10/8.12.10) with ESMTP id

l6B6gg3v002478 for <x...@public.com>; Wed, 11 Jul 2007 02:42:48

-0400 (EDT)
Received: from cable56-86.corlu.kablonet.com.tr
(cable56-86.corlu.kablonet.com.tr [195.174.56.86] (may be forged)) by

mx0.public.com (8.11.6/8.11.6) with SMTP id l6B6gZc07385 for
<ho...@fw.merk.com>; Wed, 11 Jul 2007 02:42:36 -0400
Date: Wed, 11 Jul 2007 02:42:36 -0400
X-Originating-Ip: [77.863.70.574]
X-Originating-Email: [ho...@fw.merk.com]
X-Sender: ho...@fw.merk.com
Received: (qmail 3261 by uid 667); Wed, 11 Jul 2007 09:40:26 +0200
Message-ID: <200707111140...@cable56-86.corlu.kablonet.com.tr>
To: <ho...@fw.merk.com>
Subject: RE: Internet Drugstore
From: "Nor...@viagra.com" <ho...@fw.merk.com>

spam...@nil.nil

unread,

Jul 11, 2007, 1:37:16 PM7/11/07

to

SPAM: RE: Internet Drugstore

Illegal sale of prescription drugs without prescription
webcom...@ora.fda.gov
---
Fraudulent VeriSign seal at http://bestmedguess.com/img/award1.gif
ab...@verisign.com,ab...@verisign.org
---

Spam FROM: IP address 190.20.109.175
on terra.cl
tech...@CORP.TERRA.CL,ab...@terra.cl,
postm...@terra.cl,sup...@terra.cl

Spam CONTENTS [image]: http://www.img9.org/uploads/5ae294ec03ee605ece254373c4649861.gif
at IP address 74.208.30.121
on 1and1.com
ab...@1and1.com,postm...@1and1.com,sup...@1and1.com,
ab...@img9.org,postm...@img9.org,sup...@img9.org,ad...@img9.org

Spamvertized URL: http://bestmedguess.com
run on a botnet with nameservers
NAMESERVER: ns0.biknasufadupo.com
NAMESERVER: ns0.rubakopesanm.com

How can a system use a botnet by hostname (instead
of simple IP address) when it requires responsible
authorities to supply NS records and address records
for those nameservers in the root servers to enable
the resolution of the hostnames and enable the abuse
of the compromised zombies (the "bots")?
The spammer requires compliant registrars to supply
those records to the root servers for the registered
domains.
The *com domain hosts require an ICANN accredited registrar.
This activity by this registrar (nameservers) has been
reported to ICANN. The lack of (effective) action
on their part seems to indicate that ICANN, like
their accredited registrar, now feels that the
commercial nature of the 'net makes acceptable the
sale of illegal drugs on a botnet enabled by their
activities.

REGISTRARS: (enabling the botnet)
===========
WEBHOST DOMAIN: bestmedguess.com
These are serviced by BIZCN.COM, also the SOA for
the spammer's "support" domain, canadianpharmsupport.com
ab...@fjdcb.fz.fj.cn,postm...@bizcn.com,
ab...@bizcn.com,sup...@bizcn.com,le...@bizcn.com,
ad...@bizcn.com

NAMESERVER DOMAIN: biknasufadupo.com
NAMESERVER DOMAIN: rubakopesanm.com
These are serviced by XIN NET TECHNOLOGY CORPORATION,paycenter.com.cn
li...@xinnet.com,
postm...@xinnet.com,ad...@xinnet.com,sup...@xinnet.com,le...@xinnet.com,secu...@xinnet.com,he...@xinnet.com,
in...@xinnet.com,ab...@xinnet.com
postm...@paycenter.com.cn,ad...@paycenter.com.cn,sup...@paycenter.com.cn,le...@paycenter.com.cn,secu...@paycenter.com.cn,he...@paycenter.com.cn,
in...@paycenter.com.cn,ab...@paycenter.com.cn
ICANN ACCREDITED BOTNET SUPPORT: an ICANN accredited registar
ic...@icann.org,comm...@icann.org,accr...@icann.org,
ad...@icann.org,le...@icann.org,ab...@icann.org,
sup...@icann.org,le...@icann.org,
as this is an ongoing problem, so that ICANN cannot claim
they didn't know about any problems, I will inform two members
of their board of directors as well (I would hate to have ICANN
be able to say "What botnet service?" when the sh*t hits the fan)
nj...@wananchi.com,api...@servidor.unam.mx

SPAMVERTIZED SUPPORT CONTACT [email]: support_AT_canadianpharmsupport.com
with MX at mail.canadianpharmsupport.com
at IP address 82.146.53.121 on nac.net/ipserver.com
ab...@ispserver.com,postm...@ispserver.com,sup...@ispserver.com,
ab...@nac.net,postm...@nac.net,sup...@nac.net,
ad...@ispserver.com,ad...@nac.net,le...@nac.net,secu...@nac.net

==========
[DETAILS:]

SPAM FROM: IP address 190.20.109.175
Which forged my email address as the "From:" address,
"X-Originating-Email:" address and "X-Sender:" address
while addressing the spam to an old format of my email
address used years ago for USENET posting.

inetnum: 190.20/16
status: allocated
owner: Terra Networks Chile S.A.
country: CL
nserver: NS.TERRA.CL
nserver: NS2.TERRA.CL
e-mail: tech...@CORP.TERRA.CL
Address 190.20.109.175 maps to 175-109-20-190.adsl.terra.cl
Checking 175-109-20-190.adsl.terra.cl address 190.20.109.175
[whois.abuse.net]
tech...@CORP.TERRA.CL (for terra.cl)
postm...@terra.cl (for terra.cl)

SPAM CONTENTS [image]: http://www.img9.org/uploads/5ae294ec03ee605ece254373c4649861.gif
SPAMVERTIZED URL: http://bestmedguess.com

'[style](junk text - not styles)[/style]
[a target="_blank" href="http://bestmedguess.com" ]
[img src="http://www.img9.org/uploads/5ae294ec03ee605ece254373c4649861.gif"]'
[style](junk text - not styles)[/style]'

SPAM CONTENTS [image]: http://www.img9.org/uploads/5ae294ec03ee605ece254373c4649861.gif

Often the image is on the botnet, but this time they have
found hosting for it on:

============================================================
For the host:
"www.img9.org"

NAMESERVERS listed in the root servers for img9.org:
----------------------------------------------------
img9.org NS ns51.1and1.com
img9.org NS ns52.1and1.com
ns51.1and1.com A 74.208.2.8
ns52.1and1.com A 74.208.3.7

[extract from dig]
------------------
dig @74.208.2.8
www.img9.org
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE
www.img9.org A 74.208.30.121

dig @74.208.3.7
www.img9.org
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE
www.img9.org A 74.208.30.121
============================================================

OrgName: 1&1 Internet Inc.
OrgID: 11INT
City: Chesterbrook
StateProv: PA
CIDR: 74.208.0.0/18, 74.208.64.0/20
RAbuseEmail: ab...@1and1.com

Textual content of the image:
=====================================================
CHEAPEST PRICES

We are the only store wich
gives this great deal you!

The USA Licensed Save huge 70 %
Online Pharmacy on all the orders with us!

VIAGRA VIAGRA SOFT CIALIS CIALIS SOFT
XANAX SOMA AMBIEN TRAMADOL
VALIUM MERIDIA
=====================================================
(The product names were titles of small pill images.)
This is the same image used by this spammer when he spams
for Yambo botnet hosted pharmacy sites.

SPAMVERTIZED URL: http://bestmedguess.com

============================================================
For the host:
"bestmedguess.com"

NAMESERVERS listed in the root servers for bestmedguess.com:
------------------------------------------------------------
bestmedguess.com NS ns0.biknasufadupo.com
bestmedguess.com NS ns0.rubakopesanm.com
ns0.biknasufadupo.com A 221.126.9.147
ns0.rubakopesanm.com A 76.104.9.196

[extract from dig]
------------------
dig @76.104.9.196
bestmedguess.com
A +noqu +noadd +noau +norec
;; flags: qr aa ra <-- AUTHORITATIVE and NON-RECURSIVE
bestmedguess.com A 91.148.24.119
bestmedguess.com A 123.195.47.238
bestmedguess.com A 210.6.220.47
bestmedguess.com A 221.126.9.147
bestmedguess.com A 59.149.106.157
bestmedguess.com A 61.93.55.163
bestmedguess.com A 71.194.73.254
bestmedguess.com A 76.104.9.196
bestmedguess.com A 78.106.3.174
bestmedguess.com A 78.106.13.16
bestmedguess.com A 80.66.253.137
bestmedguess.com A 82.35.197.211
bestmedguess.com A 89.178.64.224
bestmedguess.com A 89.178.124.135
bestmedguess.com A 90.224.28.63

dig @221.126.9.147
bestmedguess.com
A +noqu +noadd +noau +norec
;; flags: qr aa ra <-- AUTHORITATIVE and NON-RECURSIVE
bestmedguess.com A 123.195.47.238
bestmedguess.com A 210.6.220.47
bestmedguess.com A 221.126.9.147
bestmedguess.com A 59.149.106.157
bestmedguess.com A 61.93.55.163
bestmedguess.com A 71.194.73.254
bestmedguess.com A 76.104.9.196
bestmedguess.com A 78.106.3.174
bestmedguess.com A 78.106.13.16
bestmedguess.com A 80.66.253.137
bestmedguess.com A 82.35.197.211
bestmedguess.com A 89.178.64.224
bestmedguess.com A 89.178.124.135
bestmedguess.com A 90.224.28.63
bestmedguess.com A 91.148.24.119
============================================================

and where are these hosted?

221.126.9.147 has no PTR record
inetnum: 221.124.0.0 - 221.127.255.255
netname: HGC
descr: Hutchison Global Communications
country: HK
e-mail: hgcne...@hgc.com.hk

76.104.9.196 has PTR record c-76-104-9-196.hsd1.va.comcast.net

59.149.106.157 has PTR record 059149106157.ctinets.com

61.93.55.163 has PTR record 061093055163.ctinets.com

71.194.73.254 has PTR record c-71-194-73-254.hsd1.il.comcast.net

76.104.9.196 has PTR record c-76-104-9-196.hsd1.va.comcast.net

78.106.3.174 has no PTR record
inetnum: 78.106.0.0 - 78.106.63.255
netname: CORBINA-BROADBAND
descr: Broadband customers in Moscow
country: RU
remarks: User support, general questions: sup...@corbina.net
remarks: Routing, peering, security: n...@corbina.net
remarks: Report spam and abuse: ab...@corbina.net
remarks: Mail and news: postm...@corbina.net
remarks: DNS: hostm...@corbina.net

78.106.13.16 has no PTR record
inetnum: 78.106.0.0 - 78.106.63.255
netname: CORBINA-BROADBAND
descr: Broadband customers in Moscow
country: RU
remarks: User support, general questions: sup...@corbina.net
remarks: Routing, peering, security: n...@corbina.net
remarks: Report spam and abuse: ab...@corbina.net
remarks: Mail and news: postm...@corbina.net
remarks: DNS: hostm...@corbina.net

80.66.253.137 has PTR record 80-66-253-137.kj.up.ee

82.35.197.211 has PTR record 82-35-197-211.cable.ubr01.enfi.blueyonder.co.uk

89.178.64.224 has PTR record 89-178-64-224.broadband.corbina.ru

89.178.124.135 has PTR record 89-178-124-135.broadband.corbina.ru

90.224.28.63 has PTR record 90-224-28-63-no112.tbcn.telia.com

91.148.24.119 has no PTR record
inetnum: 91.148.0.0 - 91.148.63.255
netname: SK-MARTICO-20061109
descr: MARTICO s.r.o.
country: SK
e-mail: mar...@martico.sk

123.195.47.238 has PTR record 123-195-47-238.ethome-ip.ethome.com.tw

210.6.220.47 has PTR record 210006220047.ctinets.com

221.126.9.147 has no PTR record
inetnum: 221.124.0.0 - 221.127.255.255
netname: HGC
descr: Hutchison Global Communications
country: HK
e-mail: hgcne...@hgc.com.hk

Let's see ... quite a few comcast users, blueyonder.co.uk,
telia.com, Hutchison, etc.
BOTNET!

NAMESERVER: ns0.biknasufadupo.com
NAMESERVER: ns0.rubakopesanm.com

NAMESERVER DOMAINS:
-------------------
biknasufadupo.com
Domain Name: BIKNASUFADUPO.COM
Registrar: XIN NET TECHNOLOGY CORPORATION
Whois Server: whois.paycenter.com.cn
Referral URL: http://www.xinnet.com
rubakopesanm.com
Domain Name: RUBAKOPESANM.COM
Registrar: XIN NET TECHNOLOGY CORPORATION
Whois Server: whois.paycenter.com.cn
Referral URL: http://www.xinnet.com

Well, the nameserver domains changed from prior spam BUT this is the
SAME registrar providing support to the botnet herder. This is the
SAME registrar as repeatedly reported to ICANN who is reponsible for
"accrediting" registrars and who apparently now are not interested in
"the internet" but are interested in "exploiting systems connected to the
internet" for commercial (including illegal drug sales on hacked home
user systems) purposes.

WEBHOST DOMAIN
--------------
bestmedguess.com
Domain Name: BESTMEDGUESS.COM
Registrar: BIZCN.COM, INC.
Whois Server: whois.bizcn.com
Referral URL: http://www.bizcn.com
Gee ... the SOA for the spammer's support site is dnsc...@bizcn.com

As is common for these spamvertized pharmacy sites, this one
has a fraudulent VeriSign seal (http://[hostname]/img/award1.gif,
e.g. http://bestmedguess.com/img/award1.gif, the same directory and
file name as for the old hostnames in prior spam).

"Licensed by The College of Pharmacists of British Columbia.
If you have any questions or concerns you can contact the college at
200-1765 West 8th Ave. Vancouver, BC, Canada V6J 5C6
You may contact us at +1(210) 787-1711, please, keep your order I.D.
every time you make a call.
(C) Copyright Canadian Pharmacy, 2003-2007. All Rights Reserved."

The site assures one of a secure purchase,
(C) 2007 Secure.Order.Form (it used to be 2006)
"Rest assured that our online order system makes use of the latest
Security encryption technology to ensure that your credit card
information is submitted safely and with the highest level of
protection."
"For your safety we use highly secure order processing server with our
own secure certificate."
(this is precisely the same text as found using the other hostnames)
though one's order (including credit card) data,
item_name[300]=Viagra
&item_name[1947]=Viagra
&item_name[642]=Delivery type
&item_price[300]=60.23
&item_price[1947]=0
&item_price[642]=10
&item_description[300]=30 pills X 50 mg
&item_description[1947]=4 pills X 100 mg
&item_description[642]=AirMail
&item_quantity[300]=1
&item_quantity[1947]=1
&item_quantity[642]=1
&checksum=
&Customer_FirstName=[victim's name: first]
&Customer_LastName=[victim's name: last]
&street=[victim's address: street]
&city=[victim's address: city]
&zip=[victim's address: zip code]
&state=[victim's address: state]
&country=USA
&phone1=[victim's phone number: country code]
&phone2=[victim's phone number: area code]
&phone3=[victim's phone number: exchange]
&phone4=[victim's phone number: number]
&Email=[victim's address: email]
&aemail=[victim's address: alternate email: optional]
&messenger=
&messenger_contact=
&birthday=
&ssn=
&client_time= [empty this time. In prior cases it was nettime: number of seconds since 1 Jan 1970]
&ship_eq=
&sname_first=[victim's name: first]
&sname_last=[victim's name: last]
&sstreet=[victim's address: street]
&scity=[victim's address: city]
&szip=[victim's address: zip code]
&sstate=[victim's address: state]
&scountry=USA
&method_by=CC
&cardholder=[victim's name: full: as on credit card]
&card_no=[victim's credit card number]
&exp_m=[credit card: expiration date: month]
&exp_y=[credit card: expiration date: year]
&cvc=[credit card: private security number]
&comments=
&check_your_name=
&check_bank_name=
&check_account_owner=
&check_routing_number=
&check_account_number=
&comments1=
&renew_days=30
&chekout.x=61
&chekout.y=14
&DOB_Day=1
&DOB_Month=January
&DOB_Year=
&Weight=
&Weight_Measure=lbs
&Height=4ft. 0in.
&received=
&medicalConditions=
&currentMedications=
&plannedMedications=
&allergies=
&surgeries=
&medicalHistory=

*: This time I clicked the earlier SUBMIT button
which appears before the medical questionaire.
It seems that filling out that questionaire
is optional.

is submitted unencrypted and insecurely to
http://bestmedguess.com/process_order.php
(there are two DIVs on the page, cc_div and echeck_div
with a radio box which sets the display to "none"
for one and "block" for the other. One can select payment
by credit card or by electronic check. The above data is
for a credit card submission. For using echeck, the credit
card data is missing (of course) and
&check_your_name=[victim's name: bank account]
&check_bank_name=[checking account: bank name]
&check_account_owner=[checking account]
&check_routing_number=[bank routing number]
&check_account_number=[check number]
is submitted).
This is, of course, identical to the order data format as
reported previously for the other hostnames.

Upon submission of the order one receives a response:
"If you need any help, please, contact our support via e-mail:
[a href="mailto:sup...@canadianpharmsupport.com"]sup...@canadianpharmsupport.com[/a]'

** THIS IS A CHANGE! It used to be globalpharmsupport.com *and* there used bo be a link
to a support site at www.globalpharmsupport.com

SPAMVERTIZED SUPPORT CONTACT [email]: sup...@canadianpharmsupport.com

====================================================================
For the host:
"canadianpharmsupport.com"

NAMESERVERS listed in the root servers for canadianpharmsupport.com:
--------------------------------------------------------------------
canadianpharmsupport.com NS ns3.cnmsn.com
canadianpharmsupport.com NS ns4.cnmsn.com
ns3.cnmsn.com A 207.106.235.80
ns4.cnmsn.com A 205.209.167.5

[extract from dig]
------------------
dig @205.209.167.5
canadianpharmsupport.com
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE

dig @207.106.235.80
canadianpharmsupport.com
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE
====================================================================

====================================================================
For the host:
"www.canadianpharmsupport.com"

NAMESERVERS listed in the root servers for canadianpharmsupport.com:
--------------------------------------------------------------------
canadianpharmsupport.com NS ns3.cnmsn.com
canadianpharmsupport.com NS ns4.cnmsn.com
ns3.cnmsn.com A 207.106.235.80
ns4.cnmsn.com A 205.209.167.5

[extract from dig]
------------------
dig @205.209.167.5
www.canadianpharmsupport.com
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE

dig @207.106.235.80
www.canadianpharmsupport.com
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE
====================================================================

Hmmm ... the SOA for canadianpharmsupport.com is
ns3.cnmsn.com dnsc...@bizcn.com
It has no address record for either canadianpharmsupport.com or
www.canadianpharmsupport.com (well, the old version has a link
to a support page at www.globalpharmsupport.com but the new one
only has an email link). It does give an MX record,
dig @ns3.cnmsn.com canadianpharmsupport.com mx +norec
;; flags: qr aa <-- AUTHORITATIVE AND NON-RECURSIVE
canadianpharmsupport.com. 600 IN MX 10 mail.canadianpharmsupport.com.
and address for mail.canadianpharmsupport.com.
dig @ns3.cnmsn.com mail.canadianpharmsupport.com +norec
;; flags: qr aa <-- AUTHORITATIVE AND NON-RECURSIVE
mail.canadianpharmsupport.com. 600 IN A 82.146.53.121

inetnum: 82.146.52.0 - 82.146.55.255
netname: ISPSYSTEM
descr: ISPsystem at NAC
country: US
person: Dmitry Sidorov
address: PoBox 30, 664017, Irkutsk, Russia
phone: +7 495 727 38 79
e-mail: in...@ispserver.com
remarks: ab...@ispserver.com
This is on Autonomous System Number 8001
ASNumber: 8001
ASName: NET-ACCESS-CORP
ASHandle: AS8001
RTechEmail: al...@nac.net

TCPTRACEROUTE to port 25 on 82.146.53.121 shows:
...
6: vlan31.esd1.tl9.nac.net (209.123.11.69)
7: 12.ae0.gbr1.tl9.nac.net (209.123.11.71)
8: 0.so-5-0-0.gbr1.mmu.nac.net (209.123.11.53)
9: mydomain.com (82.146.53.121) [TCP Syn Ack]

Domain Name: CANADIANPHARMSUPPORT.COM
Registrar: BIZCN.COM, INC.
Whois Server: whois.bizcn.com
Referral URL: http://www.bizcn.com
Registrant Contact: CanadianRX ltd
Alan Tompson ro...@canadianpharmsupport.com
4169264684 fax:
208 Douglas Dr
Toronto Toronto M4W 2B8
ca
Created: 2007-04-25
Expires: 2008-04-25
[whois.abuse.net]
ab...@fjdcb.fz.fj.cn (for bizcn.com)
postm...@bizcn.com (for bizcn.com)

A few drugs:
------------
Abana
Aceon
Acne-n-Pimple Cream [*]
Acomplia
ActoPlus Met
Actos
Allegra
Altace
Amaryl
Ambien [*]
Amoxil [*]
Ansaid
Arimidex [*]
Aristocort
Ashwagandha [*]
Ativan [*]
Augmentin
Avandamet
Avandia
AyurSlim [*]
Azulfidine
Bactroban
Beconase AQ [*]
Betapace
Brahmi [*]
Breast Intense [*]
Capoten
Cardizem
Cardura [*]
Casodex
Celebrex
Cephalexin
Chitosan [*]
Cialis
Cialis Soft Tabs
Cipro
CLA (conjugated linoleic acid) [*]
Clarina
Claritin
Confido
Copegus
Coreg
Cozaar
Crestor
Cyklokapron
Cystone
Cytotec
Danazol
Deltasone
Desyrel
Diabecon [*]
Diarex
Didronel [*]
Diet Maxx [*]
Differin [*]
Diflucan
Diovan
Effexor
Efudex [*]
Emsam [*]
Epivir-HBV [*]
Evecare
Evista [*]
Exelon [*]
Famvir
Feldene [*]
Femara [*]
Flomax
Flovent
Fosamax
Gasex
Geodon
Geriforte
Glucophage
Glucotrol XL [*]
Green tea [*]
Grifulvin V and Gris-PEG [*]
Hair Loss Cream [*]
Herbal Maxx [*]
Herbal Phentermine
Herbolax
High Love [*]
Himcolin
Himplasia [*]
Hoodia [*]
Hytrin
Imitrex
Imovane [*]
InnoPran XL [*]
Kamagra
Karela [*]
Keftab [*]
Kemadrin
Kytril
Lamictal
Lamisil
Lariam
Lasix [*]
Lasuna [*]
Leukeran
Levaquin
Levitra
Levlen
Lincocin
Lipitor
Lisinopril [*]
Liv.52 [*]
Lopid
Loprox
Lotensin
Lotrisone [*]
Loxitane
Lozol
Lukol
Lynoral
Mavik
Maxaquin
Menosan
Mentat
Mentax
Mesterolone
Mevacor [*]
Mexitil
Miacalcin
Micardis
Motrin [*]
Myambutol
Mysoline
Naprosyn
Neurontin
Nexium
Nimotop
Nizoral [*]
Noroxin
Norpace CR [*]
Norvasc [*]
Omnicef
Ophthacare [*]
Oruvail
Oxytrol
Paxil
Phentermine [*]
Pilex
Plan B [*]
Plavix
Plendil
Prandin
Pravachol
Prednisone
Premarin
Prevacid
Prilosec
Prograf
Prometrium [*]
Propecia
Prozac
pulmicort inhaler [*]
Purim
Purinethol
Quibron-T [*]
Relafen
Reosto
Requip
Retin-A
Ridaura
Rimonabant [*]
Rocaltrol
Rumalaya
Rythmol SR [*]
Sarafem
Septilin
Shallaki [*]
Shuddha Guggulu [*]
Sinequan [*]
Singulair
Soma
Speman [*]
Starlix
Stromectol
Styplon
Sumycin
Superloss Multi [*]
Superman [*]
Sustiva
Tagamet
Tenormin
Tentex forte
Tentex Royal
Testosterone
Testosterone gel [*]
Tiberius Erectus [*]
Topamax
Trandate [*]
Trimox
Triphala [*]
Tulasi [*]
Tylenol
Urispas
Valium [*]
Vantin
Vasodilan
Vasotec
V-Gel [*]
Viagra
Viagra Jelly
Viagra Soft Tabs
Viramune
Vytorin
Wellbutrin SR
Xanax [*]
Xeloda
Xenical [*]
Zanaflex [*]
Zebeta [*]
Zelnorm [*]
Zerit [*]
Zimulti [*]
Zithromax
Zocor
Zoloft
Zovirax
Zyban [*]
Zyloprim
Zyrtec
Zyvox [*]

*: New additions.
Also, the following seem to have been removed from
the listing
Aldactone Aleve Antabuse
Buspar Diabinese Pepcid
Procardia Soltamox Ultram

===========================================================
[ORIGINAL SPAM: with angle brackets, such as "<", converted
to square brackets, such as "[", so as not
to affect HTML enabled mail/news readers.]

Return-Path: <jmcg...@francisburt.com.au>
X-Spam-DCC: _DCCB_: _DCCR_
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on
_my_isp_
X-Spam-Level: **********************
X-Spam-Status: Yes, score=22.4 required=5.0 tests=BAYES_99,DK_POLICY_SIGNSOME,
HTML_90_100,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,
RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CF_RANGE_E8_51_100,
RAZOR2_CHECK,SARE_FROM_DRUGS,URIBL_AB_SURBL,URIBL_JP_SURBL,URIBL_OB_SURBL,
URIBL_WS_SURBL autolearn=spam version=3.1.8
X-Spam-Report:
* 1.7 SARE_FROM_DRUGS From a drug
* 0.0 DK_POLICY_SIGNSOME Domain Keys: policy says domain signs some mails
* 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 2.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
* above 50%
* [cf: 100]
* 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
* 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
* above 50%
* [cf: 100]
* 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
* [cf: 100]
* 3.8 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
* [URIs: img9.org]
* 4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
* [URIs: bestmedguess.com]
* 2.1 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
* [URIs: bestmedguess.com]
* 3.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
* [URIs: bestmedguess.com]
* 1.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Received: from _my_isp_ (_my_isp_ [xxx.xxx.xxx.xxx])
by _my_isp_ (xxx) with ESMTP id l6B2d20i009720
for <_my_email_address_>; Tue, 10 Jul 2007 22:39:03 -0400 (EDT)
(envelope-from jmcg...@francisburt.com.au)
Date: Tue, 10 Jul 2007 22:39:02 -0400 (EDT)
Received: from [190.20.109.175] (helo=x-3168a5f097e04)
by _my_isp_ with smtp (Exim 4.66 (FreeBSD))
(envelope-from <jmcg...@francisburt.com.au>)
id 1I8S92-000F6x-Le
for _my_email_address_; Tue, 10 Jul 2007 22:41:39 -0400
X-Originating-IP: [47.9.938.0]
X-Originating-Email: [_my_email_address_]
X-Sender: _my_email_address_
Received: (qmail 3494 by uid 393); Tue, 10 Jul 2007 10:42:00 -0400
Message-Id: <20070710064200.3496.qmail@x-3168a5f097e04>
To: <xxx>
Subject: RE: Internet Drugstore
From: "All...@viagra.com" <_my_email_address_>
xxxMIME-Version: 1.0
Importance: High
xxxContent-Type: text/html
X-UIDL: >gI"!@dg!!7X\"!DK*"!
Status: RO
X-Status:
X-Keywords:
X-UID: 34

[style]

Wayne

(snip)

Thanks

Vicki

]

[/style][a target="_blank" href="http://bestmedguess.com" ][img src="http://www.img9.org/uploads/5ae294ec03ee605ece254373c4649861.gif"]
[style]

David Bolt

unread,

Jul 11, 2007, 6:30:43 PM7/11/07

to

>From db...@house.idaho.gov Wed Jul 11 08:07:34 2007
Return-Path: <db...@house.idaho.gov>
Received: from localhost ([192.168.0.3]) by dev.null.davjam.org with ESMTP
id <F1hD28t2...@dev.null.davjam.org> for <db...@my-ste.demon.co.uk>;
Wed, 11 Jul 2007 08:07:34 +0100
Received: from pop3.demon.co.uk
by localhost with POP3 (fetchmail-6.2.5)
for db...@my-ste.demon.co.uk (multi-drop); Wed, 11 Jul 2007 08:07:34 +0100 (BST)
Received: from punt3.mail.demon.net by mailstore
for db...@my-ste.demon.co.uk id 1I8Qbe-1gBVbs-07-E6D;
Wed, 11 Jul 2007 01:03:02 +0000
Received: from [194.217.242.77] (lhlo=anchor-hub.mail.demon.net)
by punt3.mail.demon.net with lmtp id 1I8Qbe-1gBVbs-07
for db...@my-ste.demon.co.uk; Wed, 11 Jul 2007 01:03:02 +0000
Received: from [80.5.245.203] (helo=cpc4-with3-0-0-cust458.bagu.cable.ntl.com)
by anchor-hub.mail.demon.net with smtp id 1I8Qbe-0000BA-3t
for db...@my-ste.demon.co.uk; Wed, 11 Jul 2007 01:03:02 +0000
X-Originating-IP: [765.8.994.05]
X-Originating-Email: [db...@my-ste.demon.co.uk]
X-Sender: db...@my-ste.demon.co.uk
Received: (qmail 28479 by uid 493); Wed, 11 Jul 2007 02:03:04 GMT
Message-Id: <2007071102030...@cpc4-with3-0-0-cust458.bagu.cable.ntl.com>
To: <db...@my-ste.demon.co.uk>
Subject: RE: Internet Drugstore
From: Ta...@viagra.com <db...@my-ste.demon.co.uk>

MIME-Version: 1.0
Importance: High
Content-Type: text/html

<style>

Wayne

(snip)

Thanks

Vicki

>

</style><a target="_blank" href="http://stillarrive.com" ><img src="http://www.img9.org/uploads/5ae294ec03ee605ece254373c4649861.gif">

USENET n.a.n-a.s reports

unread,

Jul 13, 2007, 7:32:43 PM7/13/07

to

This is guaranteed spam from unconfirmed opt-in mailing lists for spurious
addresses at poopypants.com or other vanity domains. hor...@fw.merk.com is a USENET spamtrap seed.

----------------------

From hormo...@centralalumi.com Fri Jul 13 19:20:55 2007

Received: from mx0.public.com (mx0.public.com [66.112.160.20])
by public.com (8.12.10/8.12.10) with ESMTP id

l6DNKtse073820 for <x...@public.com>; Fri, 13 Jul 2007 19:20:55
-0400 (EDT)
Received: from ALyon-253-1-27-146.w83-205.abo.wanadoo.fr
(ALyon-253-1-27-146.w83-205.abo.wanadoo.fr [83.205.154.146]) by
mx0.public.com (8.11.6/8.11.6) with SMTP id l6DNKsR13634 for
<ho...@fw.merk.com>; Fri, 13 Jul 2007 19:20:54 -0400
Date: Fri, 13 Jul 2007 19:20:54 -0400
X-Originating-Ip: [959.52.2.39]
X-Originating-Email: [ho...@fw.merk.com]
X-Sender: ho...@fw.merk.com
Received: (qmail 31839 by uid 626); Sat, 14 Jul 2007 01:20:38 +0100
Message-ID: <2007071402203...@ALyon-253-1-27-146.w83-205.abo.wanadoo.fr>
To: <ho...@fw.merk.com>
Subject: RE: Internet Drugstore
From: "Espe...@viagra.com" <ho...@fw.merk.com>

MIME-Version: 1.0
Importance: High
Content-Type: text/html

<!
/tipi/

/Hertfordshire/favoured/3chip/edirtiest/equelles/dalloy/9Gene/cDefensor/2ICT/pworselet/37/WINRAR/COTTER/b
ovine/Peter/Hemorrhoids/Madsen/gång/violin/investor/Envía/magnetism/encrusted/inhibitors/Jenn/
>
<!
/soulmate/Judas/keyboard/UNDP/Corporate/Panacea/pumps/kage/Perched/Set/Labeling/SDD/fallen/militias/jhtm
l/E3/modifications/Noir/928/están/Oswego/existing/spoiled/622/everyone/
>
<!
/Dyson/Timmy/defensementhey/Jihad/YouTube/CABALLERO/11321/Carlson/måste/demonstrate/Eurotunnel/Swimming/W
imbledon/Aichi/Boston/punishable/Administrativ/Gash/colossus/unmonitored/Treasurys/flood/Surprise/powerles
s/Cottrell/
>
<!
/7771/2129/Reelection/driver/spero/Sherwood/artwork/Settlements/drinking/resized/Overkill/970/Lenny/Chong
qing/bombardment/Greenwich/noted/531545/sobbing/usdoj/fichier/fainted/Markoff/transit/pinwheel/
>
<!
/about_problem/tabled/classy/creamer/584/betrekking/ideas/0222/Berndt/yellowed/Warranty/senior/lesson/PAP/
outage/CHRISTINE/chock/paramilitary/Weekly/Matteo/Conservatoire/1291/raided/wayside/boosts/
>
<!
/sociable/825o1/Rupee/baffled/2425/talet/facilitation/138/Marlborough/Tran/Restlessness/matted/PAT/FoU/1
3/cualquier/525/donnent/wards/redundancy/utilisateur/possible/bookings/Doris/värd/
>
<!
/rebates/
``Solar/Riviera/Polic/conflict/affichent/inequity/Matty/September/congressmen/homosexual/qui/basketball/Vo
IP/leftAny/helm/Spacewalk/719/swimwear/title/stipend/March/socialize/awaken/Discussie/
>
<!
/1036/starlight/additionals_send_pri/original/Filo/reinvented/Revitalization/matches/snorkel/available/Ned
erlands/encode_base64/Dar/Speciellt/fidelity/spacer/envol/faxed/coping/McMahon/noWrap/Wretch/c10/Roosevelt
/336699/
>
<!
/Prudential/institutionalized/693/drought/hurling/462123/soluble/715725/sis_Infection_Glance/spacious/cr
iticizing/likely/Cleveland/consequence/218/Cincinnati/Proc/regel/dialed/Hillman/Zappos/MJ/inventors/Ancho
rs/chanting/
>
<!
/offenders/clubbers/Jesus/speeding/big--/args/094/completed/costbenefit/bouquet/Hist/recognition/exploiti
ng/2½/1280/Podcast/levels/apple/ABS/458/Glitz/Nancy/instructions/TKS/Recordinglargely/
>
<!
/Lyra/Picchu/Landis/Pincus/oops/810/OctopusTravel/Siesta/1699/realized/fluency/Breathless/estamos/canoes/
shelve/asked/2030/copia/whim/stylesheet/Godard/Hauch/proposals/_width/Mephisto/

/2514/
``presented/KE/3134/battle/not/heure/Sayers/Conrad/6201/grandmother/munchies/Darwin/correspond/Cabbage/can
dor/Note/Angelika/soda/boarded/su/C2P3eed9/
/planta/Whyte/lyse/iSCSI/SCOUTS/pathways/Hubby/wife/Federated/ballooning/thighs/588/6101/troublesome/Occid