[email] [ComfortRX drugs botnet] (smithyty.com - dongodown.com) SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*, CIPRO, MERIDI*, CELEBRE*, VALIU* thats
TomezNet
IP 212.198.148.217 s217.dhcp212-198-148.noos.fr
(at nyctale.cybercable.fr)
Spamvert botnet:
smithyTY.cOm
www.smithyty.com resolved to IP 82.32.247.109, 12.183.169.243,
82.230.49.50, 59.56.54.225, 82.230.49.50
More Comfort RX sightings:
http://groups.google.com/groups/search?q=ComfortRX+group%3A*abuse
ComfortRX is VIP Pharmacy aka PharmacyExpress.com
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 206.190.49.65; Sat, 29 Apr 2006
09:59:44 -0700
X-YahooFilteredBulk: 212.198.148.217
X-Originating-IP: [212.198.148.217]
Return-Path: <lipbk...@otn.net>
Authentication-Results: mta292.mail.mud.yahoo.com from=otn.net;
domainkeys=fail (bad syntax)
Received: from 212.198.148.217 (HELO s217.dhcp212-198-148.noos.fr)
(212.198.148.217) by mta292.mail.mud.yahoo.com with SMTP; Sat, 29 Apr
2006 09:59:44 -0700
Received: from [192.168.1.8] ([212.198.148.217]) by infoasis.com
(Sendmail 8.7.1) with ESMTP (SSL) id IYT21370 for <xx..xx@xx..xx.com>;
Sat, 29 Apr 2006 11:59:44 -0600
Message-ID: <742v260d...@infoasis.com>
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=evening.principle;
d=infoasis.com;
b=FZFhjG05j9zxIPtcYCNgSJzHINZHYyZbhFCItTRzRobcWOAofcTtSINMzXyvMuSt0GjWpQ6GHatIypql;
Date: Sat, 29 Apr 2006 11:59:44 -0600
From:"Suellen Shanae" <lipbk...@otn.net>
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xx..xx@xx..xx.com
Subject: SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*,
CIPRO, MERIDI*, CELEBRE*, VALIU* thats
Content-Type: multipart/related; boundary="------------03643442==.MRA"
Content-Length: 925
<html><head>
<xmeta http-equiv="Content-Type" content="text; charset=iso-8859-1">
</head>
<xbody>
<font color=FFA4D1 size=1>similar teach rich very. supposedto he music.
few out love bought immediate.</font>
<table border=10 cellspacing=0 cellpadding=3 width=520
bordercolor=CDFF59>
<tr><td bgcolor=ffffff bordercolor=000000><center>
<font size=2 face=arial color=CC0000>
<font size=4 color=000000><b>Quality Meds Selling At Cheeap<br><font
color=EA0000>We dont keep ur record (not even your
name)</font><br><font color=AEAE00>You just pay & we ship, No Question
form to fill</font><br><font color=FF5EAE>We ship to all
countries</b></center></font></font><br><font color=000000
size=2>Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro,
Meridi*, Celebre*, Valiu*, Zoloft & Many More Meds arms<br><center>
<a target="_blank" href=http://www.smithyTY.cOm ><font size=4
color=5E5EFF><u>sandwich <b>C11ck Here for Huge Saving</b>
reply</font></u></a></font></center><br></td></tr></table><font
color=FFA4D1 size=1>parents corner teach, added here pretty.<br>
force friends slow wanted, beautiful my companion why very yours. is
carefully somewhere next promised?<br>
again arms is servants miserable, being already yours leader hard,
purpose promised end music very servants.<br>
is arms am back.<br>
wrong least tying. companion did respect we.<br>
friends respect find miserable wife.<br></font>
</xbody>
</html></font>
-- END OF SPAM --
See:
IP 212.198.148.217 s217.dhcp212-198-148.noos.fr
http://cbl.abuseat.org/lookup.cgi?ip=212.198.148.217
http://www.spamhaus.org/query/bl?ip=212.198.148.217
inetnum: 212.198.148.0 - 212.198.148.255
netname: NOOS-NETBLK
descr: NOOS IP DHCP for End-User CPE
role: Lyonnaise Communications Administrative Role Account
country: FR
route: 212.198.128.0/17
descr: NOOS
origin: AS6678
mnt-by: AS6678-MNT
changed: hostm...@noos.net
http://www.cidr-report.org/cgi-bin/as-report?as=6678
1 SBL/ROKSO listings for IPs under the responsibility of noos.fr
http://www.spamhaus.org/sbl/listings.lasso?isp=noos.fr
1 SBL listings for IPs under the responsibility of noos.net
http://www.spamhaus.org/sbl/listings.lasso?isp=noos.net
Spamvert:
smithyTY.cOm
www.smithyty.com A IN 180 82.32.247.109
www.smithyty.com A IN 180 12.183.169.243
www.smithyty.com A IN 180 82.230.49.50
www.smithyty.com A IN 180 59.56.54.225
www.smithyty.com A IN 180 82.230.49.50
ns5.dongodown.com [60.166.147.148]
ns5.dongodown.com [219.140.59.181]
ns1.wdonnelly.com.ns-not-in-service.com [72.3.235.19]
ns3.wdonnelly.com.ns-not-in-service.com [82.241.153.203]
82.32.247.109 PTR record:
82-32-247-109.cable.ubr11.newt.blueyonder.co.uk
at ns2.cableinet.co.uk
12.183.169.243 NO PTR Record
at ns2.dmisi.com / AT&T
82.230.49.50 PTR record: bsy91-1-82-230-49-50.fbx.proxad.net
59.56.54.225 PTR record: pc225.broad.dynamic.fz.fj.cn.cndata.com
at dns1.fz.fj.cn
Let see whois (was):
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Domain Name.......... smithyty.com
Creation Date........ 2006-04-22
Registration Date.... 2006-04-22
Expiry Date.......... 2007-04-22
Organisation Name.... Douglass Smith
Organisation Address. 161 East 91st St., Apt. 4D
Organisation Address.
Organisation Address. New York
Organisation Address. 10128
Organisation Address. NY
Organisation Address. UNITED STATES
Admin Name........... Douglass Smith
Admin Address........ 161 East 91st St., Apt. 4D
Admin Address........
Admin Address........ New York
Admin Address........ 10128
Admin Address........ NY
Admin Address........ UNITED STATES
Admin Email.......... smithyty[]hotmail.com
Admin Phone.......... +1.2129965975
Admin Fax............
Tech Name............ Douglass Smith
Tech Address......... 161 East 91st St., Apt. 4D
Tech Address.........
Tech Address......... New York
Tech Address......... 10128
Tech Address......... NY
Tech Address......... UNITED STATES
Tech Email........... smit...@hotmail.com
Tech Phone........... +1.2129965975
Tech Fax.............
Name Server.......... ns1.wdonnelly.com
Name Server.......... ns2.thomasw1.com
Name Server.......... ns3.wdonnelly.com
Name Server.......... ns4.thomasw1.com
Name Server.......... ns5.dongodown.com
See:
ns5.dongodown.com [60.166.147.148]
Let see whois:
Registrar: TUCOWS INC.
Registrant:
david A miles
1615
james st
escalon CA, Outside US/Canada 95320
CA
Domain name: DONGODOWN.COM
Administrative Contact:
A miles, david james[]hotmail.com
1615
james st
escalon CA, Outside US/Canada 95320
CA
+2096499403
Technical Contact:
A miles, david ja...@hotmail.com
1615
james st
escalon CA, Outside US/Canada 95320
CA
+2096499403
Registration Service Provider:
DiscountDomainRegistry.com
http://DiscountDomainRegistry.com
Register your domain for only $14.99 at
http://DiscountDomainRegistry.com !
Customers may contact us for domain login/passwords, DNS/Nameserver
changes, and general domain support questions at
http://discountdomainregistry.com/crm/ .
Registrar of Record: TUCOWS, INC.
Record last updated on 27-Apr-2006.
Record expires on 27-Apr-2008.
Record created on 27-Apr-2006.
Domain servers in listed order:
NS1.DONGODOWN.COM 82.230.49.50
NS2.DONGODOWN.COM 204.85.79.158
NS3.DONGODOWN.COM 82.32.247.109
NS4.DONGODOWN.COM 24.10.115.109
NS5.DONGODOWN.COM 60.166.147.148
Domain status: ACTIVE
More dongodown.com sightings:
http://groups.google.com/groups/search?q=dongodown.com+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/8142e392b11c7ae7
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: