[email] [meds - PharmacyExpress.com] (harorelev.com) Re: doubling futurology
TomezNet
IP 84.17.233.223 dp-misp.rekom.ru
(at ns2.rekom.ru / mts.ru)
Spamvert:
www.harorelev.com IP 221.7.209.69
(SBL35655 / SBL35677) (at cncgroup-gx)
www.PharmacyExpress.com IP 203.97.56.43
www.expressgroup.co.nz IP 203.97.56.43
(at manux.co.nz / telstraclear.co.nz)
Canadian Pharm Spamhaus => PharmacyExpress.com
Pharmacy Express a.k.a PharmaExpress
Pyxis Holdings Limited and/or Express Group Limited
Technical Consultants and Experts Group Inc aka TCE Group
Forged false site "certificates"
Logos and support by Visa and MasterCard
Visa, CIPA (Licence #91959), BBB (Participant through 12/30/2005),
Verisign (Validity Period: 13-OCT-04 - 13-OCT-05)
PHARMACYEXPRESS.CO.NZ / CHEMISTSHOP.COM / expressgroup.co.nz
See Also the same spammer most recent:
relatisandi.com, pharmacyexpressgroup.com, anodefen.com, ebantene.com,
specioser.com, turinwads.com, chemistshop.com, freighteo.manyuman.com,
variousrevitalization.com, toplevelcombination.com,
mixesandtopvalue.com, rightfromtoddlingweb.com, offamilyniceweb.com,
elofanxiet.com, orredecte.com, morreser.com, inrealisti.com,
needonsan.com, estemegins.com, noculat.com, morsavem.com, chestain.com,
comoconta.com, ajersau.com, rustratix.com, Etc .....
All above domains websites were marked as ©2005 PharmacyExpress.com
All Rights Reserved.
Search of CIPA website did NOT verify use of CIPA Seal
http://www.ciparx.ca/
Sorry, no results found based on any criteria or method regarding any
corporate name, domain name, etc ...
Received at an address harvested from domain registration.
More Pharmacy Express sightings:
http://groups.google.com/groups?q=%22Pharmacy+Express%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: Odysseus Sorber <sor...@max.state.ia.us>
X-SID-Result: TempError
X-Message-Info: 6sSXyD95QpX2cMNeynlhfqYdCP6OubE/PJp/lvxre6Q=
Received: from tomts19-srv.bellnexxia.net ([209.226.175.73]) by
bay0-pamc1-f11.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
Sat, 24 Dec 2005 16:37:18 -0800
Received: from xxx.superb.net (HELO xxx.web-hosting.com)
([207.228.238.14])
by toip7.bellnexxia.net with ESMTP; 24 Dec 2005 19:46:14 -0500
Received: from max.state.ia.us (dp-misp.rekom.ru [84.17.233.223] (may
be forged))
by xxx.web-hosting.com (8.11.6/8.11.1) with SMTP id jBP0bDv17024
for <xx..xx@xx..xx.com>; Sat, 24 Dec 2005 19:37:13 -0500 (EST)
Message-ID: <000001c608eb$4bb52fa0$1ebda8c0@compliant>
Reply-To: "Odysseus Sorber" <sor...@max.state.ia.us>
From: "Odysseus Sorber" <sor...@max.state.ia.us>
To: "Batul Bertram" <xx..xx@xx..xx.com>
Subject: Re: doubling futurology
Date: Sat, 24 Dec 2005 19:36:50 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C608C1.62DF27A0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Originating-IP: [0]
Return-Path: sor...@max.state.ia.us
X-OriginalArrivalTime: 25 Dec 2005 00:37:18.0776 (UTC)
FILETIME=[5C6F1B80:01C608EB]
This is a multi-part message in MIME format.
------=_NextPart_000_0001_01C608C1.62DF27A0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
=20
http://www.harorelev.com <http://www.harorelev.com>=20
=20
M
V
L
V
P
S
C
A
X
e ridia
ia gra
ev itra
aliu m
rop ecia
om a
ia lis
mbi en
an ax
=20
from $3'35 per one pilI
=20
from $1'25 per one pilI
=20
=20
from $3'85 per one pilI
=20
=20
------=_NextPart_000_0001_01C608C1.62DF27A0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial></FONT> </DIV>
<DIV><FONT face=3DArial><A href=3D"http://www.harorelev.com"><FONT =
face=3DArial>http://www.harorelev.com</FONT></A></FONT></DIV>
<DIV><FONT face=3DArial></FONT> </DIV>
<DIV style=3D"FLOAT: left"><FONT face=3DArial>M<BR>
<DIV><FONT face=3DArial><STRONG>V</STRONG></FONT></DIV>
<DIV><FONT face=3DArial>L</FONT></DIV><B>V</B><BR>
<DIV><FONT face=3DArial>P</FONT></DIV>S<BR>
<DIV><FONT face=3DArial><STRONG>C</STRONG></FONT></DIV>
<DIV><FONT face=3DArial>A</FONT></DIV>X<BR></FONT></DIV>
<DIV style=3D"FLOAT: left"><FONT face=3DArial>e ridia<BR><B>ia =
gra</B><BR>ev itra<BR><STRONG>aliu m</STRONG><BR>rop ecia<BR>
<DIV><FONT face=3DArial>om a</FONT></DIV><STRONG>ia lis</STRONG><BR>
<DIV><FONT face=3DArial>mbi en</FONT></DIV>an ax<BR></FONT></DIV>
<DIV style=3D"FLOAT: left"><FONT face=3DArial> <BR>
<DIV><FONT face=3DArial><STRONG>from $3'35 per one =
pilI</STRONG></FONT></DIV> <BR><STRONG>from $1'25 per one =
pilI</STRONG><BR> <BR> <BR><B>from $3'85 per one pilI</B><BR>
<DIV><FONT face=3DArial> </FONT></DIV>
<DIV><FONT face=3DArial> </FONT></DIV></FONT></DIV></BODY></HTML>
------=_NextPart_000_0001_01C608C1.62DF27A0--
-- END OF SPAM --
More Technical Consultants and Experts Group sightings:
http://groups.google.com/groups?q=%22Technical+Consultants+and+Experts+Group%22+group%3A*abuse&start=0&scoring=d&
See:
IP 84.17.233.223 dp-misp.rekom.ru
http://www.moensted.dk/spam/?addr=84.17.233.223
http://cbl.abuseat.org/lookup.cgi?ip=84.17.233.223
http://www.spamhaus.org/query/bl?ip=84.17.233.223
inetnum: 84.17.232.0 - 84.17.233.255
netname: ReCom
descr: JSC ReCom ISP
country: RU
route: 84.17.224.0/20
descr: JSC ReCom
origin: AS16256
mnt-by: rekom-mnt
changed: sa...@orel.mts.ru
See:
www.harorelev.com IP 221.7.209.69
ns0.canalsactasa.com A IN 154192 221.7.209.69
ns0.canalsactasa.com A IN 154192 201.49.143.64 (OLD IP
58.20.160.16)
ns0.canalsactasa.com A IN 154192 221.5.2.102
www.harorelev.com ALL record at ns0.ameseers.com [218.201.43.140]
www.harorelev.com has no MX records -> harorelev.com has no MX records
http://www.moensted.dk/spam/?addr=221.7.209.69
Spam source - http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=221.7.209.69
http://www.abuse.net/sbl.phtml?IP=221.7.209.69
More 221.7.209.69 sightings:
http://groups.google.com/groups?q=221.7.209.69+group%3A*abuse&start=0&scoring=d&
http://www.spamhaus.org/query/bl?ip=221.7.209.69
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL35655
221.7.209.69/32 is listed on the Spamhaus Block List (SBL)
15-Dec-2005 04:05 GMT | SR03
iseasieto.com ; etc.
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL35677
221.7.209.0/24 is listed on the Spamhaus Block List (SBL)
17-Dec-2005 19:13 GMT | SR21
China Netcom Group Dirty Block: CNC Guilin Internet network
3 SBL listings for IPs under the responsibility of cncgroup-gx
http://www.spamhaus.org/SBL/listings.lasso?isp=cncgroup-gx
Let see whois:
ICANN Registrar: NAMEBAY
Domain Name : HARORELEV.COM
Created On : 2005-12-22
Expiration Date : 2006-12-22
Status : ACTIVE
Registrant Name : jason gamino
Registrant Street1 : 92 IDAHO CREEK RD NE
Registrant City : RIO RANCHO
Registrant State/Province : NM
Registrant Postal Code : 87124-2521
Registrant Country : US
Admin Handle : JG87698
Admin Name : jason gamino
Admin Street1 : 92 IDAHO CREEK RD NE
Admin City : RIO RANCHO
Admin State/Province : NM
Admin Postal Code : 87124-2521
Admin Country : US
Admin Phone : +1.5052179224
Admin Email : centamisio[]yahoo.com
Tech Handle : JG87698
Tech Name : jason gamino
Tech Street1 : 92 IDAHO CREEK RD NE
Tech City : RIO RANCHO
Tech State/Province : NM
Tech Postal Code : 87124-2521
Tech Country : US
Tech Phone : +1.5052179224
Tech Email : centa...@yahoo.com
Billing Handle : JG87698
Billing Name : jason gamino
Billing Street1 : 92 IDAHO CREEK RD NE
Billing City : RIO RANCHO
Billing State/Province : NM
Billing Postal Code : 87124-2521
Billing Country : US
Billing Phone : +1.5052179224
Billing Email : centamisio[]yahoo.com
Name Server : NS0.AMESEERS.COM
Name Server : NS0.CANALSACTASA.COM
Registrar Name : NAMEBAY
Registrar WebSite : http://www.namebay.com
More harorelev.com sightings:
http://groups.google.com/groups?q=harorelev.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/86dba4e21dc9f867
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: