[email] [drugs - American Pharmacy] (marktooth.com - 80.86.83.166 - dartnet.info - wizardup.info - lofhick.info - molefancy.info) Re:
TomezNet
IP 148.221.78.105 dup-148-221-78-105.prodigy.net.mx
(at )
Spamvert:
marktooth.com IP 60.248.85.221
(SBL44232) (at hinet.net)
Yambo Pharmacy image hosting:
http://80.86.83.166:8080/usd/images/
IP 80.86.83.166
80.86.83.166 PTR record: fresno156.webperoni.de
at ns02.webperoni.de
Web:
Title - American Pharmacy
Copiright Š 2003-2006 USDrugs.
See American Pharmacy aka USDrugs aka Canadian Pharmacy more sightings:
http://groups.google.com/groups/search?q=%22American+Pharmacy%22+group%3A*abuse&start=0&scoring=d&
Plenty of Forged certificates and logos.
More info below:
====================
X-SID-PRA: Ruble G. Desired <rtr...@giovannifalzone.com>
X-SID-Result: TempError
X-Message-Info: txF49lGdW42yG3f8mpRi5/XWk0+EFN8wSLM9hXvsjMU=
Received: from tomts26-srv.bellnexxia.net ([209.226.175.189]) by
bay0-pamc1-f11.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Mon, 21 Aug 2006 23:44:04 -0700
Received: from [MUNGED]
by toip2.bellnexxia.net with ESMTP; 22 Aug 2006 02:43:55 -0400
Received: (qmail 5672 invoked by uid 110); 22 Aug 2006 02:43:54 -0400
Delivered-To: [MUNGED]
Received: (qmail 5607 invoked from network); 22 Aug 2006 02:43:44 -0400
Received: from dup-148-221-78-105.prodigy.net.mx (HELO -1211137808)
(148.221.78.105)
by [MUNGED] with SMTP; 22 Aug 2006 02:43:44 -0400
Received: from giovannifalzone.com (-1210535640 [-1210550440])
by dup-148-221-78-105.prodigy.net.mx (Qmailv1) with ESMTP id
4971E4E18C
for <[MUNGED]>; Tue, 22 Aug 2006 02:42:01 -0700
Date: Tue, 22 Aug 2006 02:42:01 -0700
From: "Ruble G. Desired" <rtr...@giovannifalzone.com>
X-Mailer: The Bat! (v2.00.2) Personal
X-Priority: 3
Message-ID: <5624713656.2...@giovannifalzone.com>
To: [MUNGED]
Subject: Re:
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-AntiVirus: Checked by Dr.Web (http://www.drweb.net)
Return-Path: rtr...@giovannifalzone.com
X-OriginalArrivalTime: 22 Aug 2006 06:44:05.0185 (UTC)
FILETIME=[5C6AA310:01C6C5B6]
we lcome to the best pharmacy http://marktooth.com/
-- END OF SPAM --
Forged certificates and logos.
* FDA approved
* USDrugs is a Soltrus Secure Site
Status: Valid
Validity Period: 11-NOV-05 - 11-NOV-07
Server ID Information:
Country = CA
State = Ontario
Locality = Toronto
Organization = Technical Consultants and Experts Group Inc
Organizational Unit = TCE Group
Organizational Unit = Terms of use at Verisign (c) 04
Organizational Unit = Authenticated by Verisign
Organizational Unit = Member, VeriSign Trust Network
Common Name = USDrugs
* Verified by Visa
* Worldwide Delivery
United States by United States Postal Service
See also more USDrugs sightings:
http://groups.google.com/groups/search?q=USDrugs+group%3A*abuse&start=0&scoring=d&
Address:
Main Office (headquaters)
6362 Lakeshore Road, NY
ICS International Certified Stocks
Kamdhenu Complex, Opp. Bombay, India
USDRUGS LTD is licensed by Minnesota Board of Pharmacy
licence.jpg => 404 not found at:
http://80.86.83.166:8080/usd/usd/images/licence.jpg
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/6d0dd68091b92ebf
See:
IP 148.221.78.105 dup-148-221-78-105.prodigy.net.mx
http://www.moensted.dk/spam/?addr=148.221.78.105
http://www.spamhaus.org/query/bl?ip=148.221.78.105
http://cbl.abuseat.org/lookup.cgi?ip=148.221.78.105
route: 148.221.0.0/16
descr: Netblock-11 through UNINET
origin: AS8151
remarks: tech contact: Centro de Operaciones c...@prodigy.net.mx
mnt-by: MAINT-AS8151
changed: hza...@reduno.com.mx
route: 148.221.64.0/19
descr: telentente-cust
origin: AS8151
remarks: Telentente customer or transit route
notify: hostm...@telentente.com
notify: upd...@ops.telentente.com
mnt-by: MAINT-TELENT
changed: d...@telentente.com
ASN: 8151
ASN Name: LACNIC-8151
Country IP Range: 148.208.0.0 to 148.223.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=8151
2 SBL listings for IPs under the responsibility of prodigy.net.mx
http://www.spamhaus.org/sbl/listings.lasso?isp=prodigy.net.mx
See:
marktooth.com IP 60.248.85.221
ns1.dartnet.info [201.6.155.6 (NO GLUE)] [BR]
ns1.wizardup.info [212.52.166.78 (NO GLUE)] [HU]
ns2.lofhick.info [209.102.132.41 (NO GLUE)] [US]
ns2.molefancy.info [201.231.50.189 (NO GLUE)] [AR]
NS records at nameservers are:
ns2.marktooth.com [60.248.85.221] [TTL=600]
ns3.marktooth.com [109.51.200.45] [TTL=600]
ns1.marktooth.com [60.248.85.221] [TTL=600]
marktooth.com has no MX records
60.248.85.221 PTR record: 60-248-85-221.HINET-IP.hinet.net
at vns1.hinet.net
http://www.moensted.dk/spam/?addr=60.248.85.221
http://www.spamhaus.org/query/bl?ip=60.248.85.221
inetnum: 60.248.0.0 - 60.248.255.255
netname: HINET-NET
country: TW [Taiwan]
descr: CHTD, Chunghwa Telecom Co.,Ltd.
changed: hm-ch...@apnic.net
e-mail: netwo...@hinet.net
changed: hostm...@twnic.net
person: HINET Network-Center
inetnum: 60.248.85.0 - 60.248.85.255
netname: HINET-NET
e-mail: network...@hinet.net
descr: Chunghwa Telecom Data Communication Business Group
descr: Taipei Taiwan
changed: fkc...@ms1.hinet.net
route: 60.248.0.0/16
descr: (HiNet) Chunghwa Telecom Co., Ltd.
origin: AS3462
member-of: RS-COMM_NSFNET
mnt-by: MAINT-AS3462
changed: cyk...@ms1.hinet.net
ASN: 3462
ASN Name: HINET (Data Communication Business Group)
Country IP Range: 60.248.0.0 to 60.248.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=3462
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL44232
60.248.85.221/32 is listed on the Spamhaus Block List (SBL/ROKSO)
08-Jul-2006 18:11 GMT | SR20
Yambo Financials
Yambo nameservers, web sites
53 SBL/ROKSO listings for IPs under the responsibility of hinet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=hinet.net
Let see whois.itsyourdomain.com:
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COMDomain: marktooth.com
Registrant
Shirely Kuder
Shirely Kuder
ertliu10jp[]yahoo.com
12358 Marionwood Ct
HERNDON, VA 20171 US
+1.7036489034
Administrative
Shirely Kuder
Shirely Kuder
ertli...@yahoo.com
12358 Marionwood Ct
HERNDON, VA 20171 US
+40.7036489034
Billing
Shirely Kuder
Shirely Kuder
ertli...@yahoo.com
12358 Marionwood Ct
HERNDON, VA 20171 US
+40.7036489034
Technical
Shirely Kuder
Shirely Kuder
ertli...@yahoo.com
12358 Marionwood Ct
HERNDON, VA 20171 US
+40.7036489034
Record created on July 08, 2006
Record last updated on July 21, 2006
Record expires on July 08, 2007
Domain Name Servers:
NS1.WIZARDUP.INFO
NS2.MOLEFANCY.INFO
NS1.DARTNET.INFO
NS2.LOFHICK.INFO
Status:ACTIVE
See:
ns1.dartnet.info IP 201.6.155.6
201.6.155.6 PTR record: c9069b06.static.spo.virtua.com.br
at dns1.virtua.com.BR
More dartnet.info sightings:
http://groups.google.com/groups/search?q=dartnet.info+group%3A*abuse&start=0&scoring=d&
See:
ns1.wizardup.info IP 212.52.166.78 => SBL39594
212.52.166.78 PTR record: bongeszde.hu
at dns1.hu
More wizardup.info sightings:
http://groups.google.com/groups/search?q=wizardup.info+group%3A*abuse&start=0&scoring=d&
See:
ns2.lofhick.info IP 209.102.132.41 => SBL44181 / Yambo Financials
209.102.132.41 PTR record: 209-102-132-41.adsl.gulftel.net
at dns1.madisonriver.net
More lofhick.info sightings:
http://groups.google.com/groups/search?q=lofhick.info+group%3A*abuse&start=0&scoring=d&
See:
ns2.molefancy.info IP 201.231.50.189
No PTR records exist for 211.230.186.96 at rev2.kornet.net
More molefancy.info sightings:
http://groups.google.com/groups/search?q=molefancy.info+group%3A*abuse&start=0&scoring=d&
See image hosting:
IP 80.86.83.166
80.86.83.166 PTR record: fresno156.webperoni.de
http://www.moensted.dk/spam/?addr=80.86.83.166
More 80.86.83.166 sightings:
http://groups.google.com/groups/search?q=80.86.83.166+group%3A*abuse
inetnum: 80.86.83.0 - 80.86.83.255
netname: WPROOT02
descr: webperoni GmbH server hosting
country: DE [Germany]
route: 80.86.80.0/20
descr: webperoni GmbH
origin: AS39928
mnt-by: WEBPERONI-MNT
mnt-routes: WEBPERONI-MNT
changed: ri...@webperoni.de
route: 80.86.80.0/20
descr: Webperoni via LambdaNet
origin: AS13237
mnt-by: LNC-MNT
mnt-routes: WEBPERONI-MNT
changed: regi...@undeliverable.lambdanet.net
ASN: 39928
ASN Name: WEBPERONI-AS (webperoni GmbH autonomous system)
Country IP Range: 80.86.80.0 to 80.86.95.255
http://www.cidr-report.org/cgi-bin/as-report?as=39928
3 SBL listings for IPs under the responsibility of lambdanet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=lambdanet.net
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/abdd0da207fc905d
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/e5ea5384b16fc3b8
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: