[email] [drugs - Yambo] (nobelvan.com - 80.86.83.166 - friendstb.com - 194.145.201.202) International Legal RX
TomezNet
IP 218.168.97.79 218-168-97-79.dynamic.hinet.net
(at ipdns2.hinet.net)
Spamvert:
nobelvan.com IP 60.248.85.221
(SBL44232 - ROK3095) (at hinet.net)
Web Title: American Pharmacy
Copiright © 2003-2006 USDrugs. All Rights Reserved.
Yambo Pharmacy image hosting:
http://80.86.83.166:8080/usd/images/
IP 80.86.83.166 fresno156.webperoni.de
(ns02.webperoni.de)
friendstb.com IP 200.213.167.71
(SBL44910 - SBL43389 - ROK3095) (at embratel.net.br)
Web Title: MyCanadianPharmacy
Second Yambo Pharmacy image hosting:
http://194.145.201.202:8080/p/images/
IP 194.145.201.202 ts4-202.twistspace.com
(SBL45225) (at compukos.nl)
Yambo as an American Pharmacy aka USDrugs aka Canadian Pharmacy, see
more sightings:
http://groups.google.com/groups/search?q=%22American+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: Hibernation G. Rosaries <dpl...@girlsource.org>
X-SID-Result: TempError
X-Message-Info: txF49lGdW42hdBdbUE9/ABx++UspK11DTIWMUfOc64E=
Received: from tomts49-srv.bellnexxia.net ([209.226.175.193]) by
bay0-pamc1-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Wed, 16 Aug 2006 06:12:49 -0700
Received: from [MUNGED]
by toip5.bellnexxia.net with ESMTP; 16 Aug 2006 09:12:42 -0400
Received: (qmail 22490 invoked by uid 110); 16 Aug 2006 08:27:38 -0400
Delivered-To: [MUNGED]
Received: (qmail 22470 invoked from network); 16 Aug 2006 08:27:36
-0400
Received: from 218-168-97-79.dynamic.hinet.net (HELO -1210613968)
(218.168.97.79)
by [MUNGED] with SMTP; 16 Aug 2006 08:27:36 -0400
Received: from girlsource.org (-1213580568 [-1213784040])
by 218-168-97-79.dynamic.hinet.net (Qmailv1) with ESMTP id
952A6D2AB3
for <[MUNGED]>; Wed, 16 Aug 2006 08:26:03 -0700
Date: Wed, 16 Aug 2006 08:26:03 -0700
From: "Hibernation G. Rosaries" <dpl...@girlsource.org>
X-Mailer: The Bat! (v2.00.9) Personal
X-Priority: 3
Message-ID: <4313442959.2...@girlsource.org>
To: [MUNGED]
Subject: International Legal RX
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----------56CBDA92EBA4E33"
X-Virus-Scanned: by AMaViS perl-11 mion
Return-Path: dpl...@girlsource.org
X-OriginalArrivalTime: 16 Aug 2006 13:12:50.0096 (UTC)
FILETIME=[ACAB1B00:01C6C135]
This is a multi-part message in MIME format.
------------56CBDA92EBA4E33
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
more than 100 products for your 100% health
dfglirsjiel QkZGUFxeclJaXFxTQRlNXhxQW1g=
------------56CBDA92EBA4E33
Content-Type: text/html
Content-Transfer-Encoding: 7bit
<html>
<body>
more than 100 products for your 100% health<br>
<a href="http://nobelvan.com/">our site</a>
</body>
</html>
------------56CBDA92EBA4E33--
-- END OF SPAM --
Also forged certificates and logos:
FDA Approved Drugs
VERISIGN SECURE SITE
VERIFIED BY VISA
Worldwide Delivery by United States Postal Service
See:
IP 218.168.97.79 218-168-97-79.dynamic.hinet.net
http://www.moensted.dk/spam/?addr=218.168.97.79
http://cbl.abuseat.org/lookup.cgi?ip=218.168.97.79
http://www.spamhaus.org/query/bl?ip=218.168.97.79
inetnum: 218.160.0.0 - 218.175.255.255
netname: HINET
descr: CHTD, Chunghwa Telecom Co.,Ltd.
descr: Data-Bldg.6F, No.21, Sec.21, Hsin-Yi Rd.
descr: Taipei Taiwan 100
country: TW [Taiwan]
route: 218.168.0.0/13
descr: (HiNet) Chunghwa Telecom Co., Ltd.
origin: AS3462
member-of: RS-COMM_NSFNET
mnt-by: MAINT-AS3462
changed: cyk...@ms1.hinet.net
ASN: 3462
ASN Name: HINET (Data Communication Business Group)
Country IP Range: 218.160.0.0 to 218.175.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=3462
54 SBL/ROKSO listings for IPs under the responsibility of hinet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=hinet.net
See:
nobelvan.com IP 60.248.85.221
ns1.dartnet.info [194.29.49.1 (NO GLUE)] [GR]
ns1.wizardup.info [212.52.166.78 (NO GLUE)] [HU]
ns2.lofhick.info [NO GLUE; No A record]
ns2.molefancy.info [62.38.209.210 (NO GLUE)] [GR]
ns2.nobelvan.com [60.248.85.221]
ns3.nobelvan.com [109.51.200.45]
ns1.nobelvan.com [60.248.85.221]
http://www.moensted.dk/spam/?addr=60.248.85.221
http://www.spamhaus.org/query/bl?ip=60.248.85.221
60.248.85.221 PTR record: 60-248-85-221.HINET-IP.hinet.net
at vns2.hinet.net
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL44232
60.248.85.221/32 is listed on the Spamhaus Block List (SBL/ROKSO)
08-Jul-2006 18:11 GMT | SR20
Yambo Financials
Yambo nameservers, web sites.
More 60.248.85.221 sightings:
http://groups.google.com/groups/search?q=60.248.85.221+group%3A*abuse&start=0&scoring=d&
See image hosting:
IP 80.86.83.166
80.86.83.166 PTR record: fresno156.webperoni.de
http://www.moensted.dk/spam/?addr=80.86.83.166
More 80.86.83.166 sightings:
http://groups.google.com/groups/search?q=80.86.83.166+group%3A*abuse
inetnum: 80.86.83.0 - 80.86.83.255
netname: WPROOT02
descr: webperoni GmbH server hosting
country: DE [Germany]
route: 80.86.80.0/20
descr: webperoni GmbH
origin: AS39928
mnt-by: WEBPERONI-MNT
mnt-routes: WEBPERONI-MNT
changed: ri...@webperoni.de
route: 80.86.80.0/20
descr: Webperoni via LambdaNet
origin: AS13237
mnt-by: LNC-MNT
mnt-routes: WEBPERONI-MNT
changed: regi...@undeliverable.lambdanet.net
ASN: 39928
ASN Name: WEBPERONI-AS (webperoni GmbH autonomous system)
Country IP Range: 80.86.80.0 to 80.86.95.255
http://www.cidr-report.org/cgi-bin/as-report?as=39928
3 SBL listings for IPs under the responsibility of lambdanet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=lambdanet.net
See:
friendstb.com IP 200.213.167.71
ns1.dartnet.info [194.29.49.1 (NO GLUE)] [GR]
ns1.wizardup.info [212.52.166.78 (NO GLUE)] [HU]
ns2.lofhick.info [NO GLUE; No A record]
ns2.molefancy.info [62.38.209.210 (NO GLUE)] [GR]
http://www.moensted.dk/spam/?addr=200.213.167.71
http://www.spamhaus.org/query/bl?ip=200.213.167.71
200.213.167.71 is listed in the SBL, in the following records:
Listed: SBL43389 and SBL44910
10 SBL/ROKSO listings for IPs under the responsibility of
embratel.net.br
http://www.spamhaus.org/sbl/listings.lasso?isp=embratel.net.br
See Second Yambo Pharmacy image hosting:
http://194.145.201.202:8080/p/images/
IP 194.145.201.202
194.145.201.202 PTR record: ts4-202.twistspace.com
at ns1.twistspace.com
http://www.moensted.dk/spam/?addr=194.145.201.202
http://www.spamhaus.org/query/bl?ip=194.145.201.202
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45225
194.145.201.202/32 is listed on the Spamhaus Block List (SBL/ROKSO)
05-Aug-2006 19:54 GMT | SR23
Yambo Financials
Image spam hosting / compromised host
1 SBL/ROKSO listings for IPs under the responsibility of compukos.nl
http://www.spamhaus.org/sbl/listings.lasso?isp=compukos.nl
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/22b06036b87abbaa
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/11bd2601fdcf76f0
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: