[email] [drugs - HealthSuite] (citofrana.com - thoumaybe.com) Premier
TomezNet
IP 82.57.12.66 host66-12.pool8257.interbusiness.it
(at dnsti.interbusiness.it / telecomitalia.it)
Spamvert:
citofrana.com IP 211.144.69.243
(at dns2.cableplus.com.cn / a.in-addr.cn / scn.com.cn)
(SBL39667 / SBL42192 - ROK4932)
More Premier Pharfmacy aka HealthSuite aka Medic Suite LTD. sightings
http://groups.google.com/groups?q=%22HealthSuite%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 206.190.48.171; Fri, 09 Jun 2006
15:09:47 -0700
X-YahooFilteredBulk: 82.57.12.66
X-Originating-IP: [82.57.12.66]
Return-Path: <gold...@grandforksgov.com>
Authentication-Results: mta177.mail.re2.yahoo.com
from=grandforksgov.com; domainkeys=neutral (no sig)
Received: from 207.228.2..... (EHLO xxx.web-hosting.com)
(207.228.2....) by mta177.mail.re2.yahoo.com with SMTP; Fri, 09 Jun
2006 15:09:47 -0700
Received: from -1215229880 (host66-12.pool8257.interbusiness.it
[82.57.12.66]) by xxx.web-hosting.com (8.11.6/8.11.1) with SMTP id
k59M9cV18301 for <xx..xx@xx..xx.com>; Fri, 9 Jun 2006 18:09:39 -0400
(EDT)
Received: from grandforksgov.com (-1215298048 [-1215131896]) by
host66-12.pool8257.interbusiness.it (Qmailv1) with ESMTP id FC50C5ACAB
for <xx..xx@xx..xx.com>; Fri, 09 Jun 2006 18:10:09 -0400
Date: Fri, 09 Jun 2006 18:10:09 -0400
From: "Moody C. Temptresses" <gold...@grandforksgov.com>
X-Mailer: The Bat! (v2.00.7) Personal
X-Priority: 3
Message-ID: <0851254521.2...@grandforksgov.com>
To: xx..xx@xx..xx.com
Subject: Premier
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----------7C40B081D144F70"
X-RAV-Antivirus: This e-mail has been scanned for viruses on host:
host66-12.pool8257.interbusiness.it
Content-Length: 868
<html>
<xbody>
Man's Health<br>
Anti-Depressants<br>
Antibiotics<br>
Cholesterol<br>
Diabetes<br>
Diuretic<br>
Pain Relief<br>
Sexual Health<br>
Sleep Aids<br>
Weight Loss
<p>and more on <a target="_blank"
href="http://citofrana.com/?UHJENDRldRWVRCRlZGdVJaVllBVFEdW0dW"
>Premier Pharsmacy</a></p>
<br>
<br>
<br>
<br>
<br>
<br>
asdffgjd RldRWVRCRlZGdVJaVllBVFEdW0dW
</xbody>
</html>
-- END OF SPAM --
More Morph of Premier Pharfmacy / Pharsmacy sightings:
http://groups.google.com/groups/search?q=%22Premier+Pharsmacy%22+group%3A*abuse&start=0&scoring=d&
See:
IP 82.57.12.66 host66-12.pool8257.interbusiness.it
http://www.moensted.dk/spam/?addr=82.57.12.66
http://cbl.abuseat.org/lookup.cgi?ip=82.57.12.66
http://www.spamhaus.org/query/bl?ip=82.57.12.66
http://spamcop.net/w3m?action=checkblock&ip=82.57.12.66
inetnum: 82.56.0.0 - 82.59.255.255
netname: TELECOM-ADSL-6
descr: Telecom Italia S.p.A. TIN EASY LITE
country: IT [Italy]
route: 82.57.0.0/16
descr: INTERBUSINESS
origin: AS3269
notify: net...@cgi.interbusiness.it
mnt-by: TIWS-MNT
mnt-routes: INTERB-MNT
changed: net...@telecomitalia.it
ASN Name: ASN-IBSNAZ (TELECOM ITALIA)
Country IP Range: 82.48.0.0 to 82.63.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=3269
42 SBL/ROKSO listings for IPs under the responsibility of
interbusiness.it
http://www.spamhaus.org/sbl/listings.lasso?isp=interbusiness.it
See:
citofrana.com IP 211.144.69.243
ns0.thoumaybe.com [211.144.69.243]
ns0.sinacessi.com [211.144.68.59]
www.citofrana.com has no MX records -> citofrana.com has no MX records
http://www.moensted.dk/spam/?addr=211.144.69.243
[1] dns2you/zhousvr/name2you, see http://spews.org/html/S2319.html
http://www.spamhaus.org/query/bl?ip=211.144.69.243
211.144.69.243 PTR record: reserve.cableplus.com.cn
More 211.144.69.243 sightings:
http://groups.google.com/groups/search?q=211.144.69.243+group%3A*abuse&start=0&scoring=d&
inetnum: 211.144.69.1 - 211.144.69.255
netname: CHANGNING1POPNET
descr: Cable OnLine Network CHANGNING1POPNet
descr: Internet Service Provider shnet.edu.cn
descr: Shanghai China
country: CN
route: 211.144.64.0/19
descr: Asia Netcom (proxy-registered route object)
origin: AS9812
route: 211.144.64.0/20
descr: CHINA NETCOM
origin: AS9929
mnt-by: MAINT-AS9929
changed: xu...@china-netcom.com
http://www.cidr-report.org/cgi-bin/as-report?as=9929
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL39667
211.144.69.0/24 is listed on the Spamhaus Block List (SBL)
06-Jun-2006 06:58 GMT | SR02
Dirty block: businessguide4u.net ; etc
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL39667
211.144.69.0/24 is listed on the Spamhaus Block List (SBL/ROKSO)
22-May-2006 00:00 GMT | SR02
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL42192
211.144.69.243/32 is listed on the Spamhaus Block List (SBL/ROKSO)
22-May-2006 03:27 GMT | SR09
Leo Kuvayev / BadCow
Numerous pill domains.
Main Info:
http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Leo%20Kuvayev%20/%20BadCow
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4932
5 SBL/ROKSO listings for IPs under the responsibility of asianetcom.net
http://www.spamhaus.org/sbl/listings.lasso?isp=asianetcom.net
17 SBL/ROKSO listings for IPs under the responsibility of scn.com.cn
http://www.spamhaus.org/sbl/listings.lasso?isp=scn.com.cn
Let see whois:
Registrar: BULKREGISTER, LLC.
no
77 Liskivska str. 2/71
Kiev, Kiev 01001
UA
Domain Name: CITOFRANA.COM
Administrative Contact
Evtuh Oleg-> ukrboys[]hotmail.com
no
77 Liskivska str. 2/71
Kiev, Kiev 01001
UA
Phone +380 63 4667701
Fax
Technical Contact
Evtuh Oleg-> ukr...@hotmail.com
no
77 Liskivska str. 2/71
Kiev, Kiev 01001
UA
Phone +380 63 4667701
Fax
Billing Contact
Evtuh Oleg-> ukr...@hotmail.com
no
77 Liskivska str. 2/71
Kiev, Kiev 01001
UA
Phone +380 63 4667701
Fax
Record updated on-> 2006-05-29 08:02:41
Record created on-> 2006-05-29
Record expiring date-> 2007-05-29
Database last updated on-> 2006-06-06 06:42:42 EST
Domain servers in listed order:
NS0.SINACESSI.COM 211.144.68.59,211.156.120.9
NS0.THOUMAYBE.COM 211.144.69.243,222.208.183.164
More thoumaybe.com sightings:
http://groups.google.com/groups/search?q=thoumaybe.com+group%3A*abuse&start=0&scoring=d&
See also ukrboys[]hotmail.com sightings:
http://groups.google.com/groups/search?q=%22uk...@hotmail.com%22+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/c157415dc8b34191
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: