[email] [ComfortRX drugs botnet] (anuppa.net - mokonan.com) SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*, CIPRO, MERIDI*, CELEBRE*, VALIU* mentioned
TomezNet
IP 219.145.98.42
(at ns1.apnic.net / CHINANET-SN)
Spamvert:
xwm.aNUPpa.net resolved to 24.160.154.135 to 80.56.149.25 to
81.57.23.33 to 82.237.50.56 to 85.107.136.152
Spamvert drugs botnet:
anuppa.net
mokonan.com
More Comfort RX sightings:
http://groups.google.com/groups/search?q=ComfortRX+group%3A*abuse
ComfortRX is VIP Pharmacy aka PharmacyExpress.com
See forged site certificates and logos by ComfortRX Ltd / Canadian RX
Corp:
* VeriSign Secure VeriSign Secure Server ID authenticated by Soltrus
Country = US
State = FL
Locality PharmacyChecker = Canada / Toronto
Organization = Technical Consultants and Experts Group Inc
Organizational Unit = TCE Group
Logos and support by Visa "Verified by Visa"
BBBOnLine Reliability
Cipa Certification/Membership "Certified Member"
Organization: MyCanadianPharmacy
Licence #: 91959
by PharmacyChecker
Canadian RX Corp
1592 Wilson Avenue,
Toronto, ON M3L 1A6
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 206.190.49.62; Fri, 21 Apr 2006
12:43:07 -0700
X-YahooFilteredBulk: 219.145.98.42
X-Originating-IP: [219.145.98.42]
Return-Path: <nubal...@inlandnet.com>
Authentication-Results: mta253.mail.mud.yahoo.com
from=inlandnet.com; domainkeys=fail (bad syntax)
Received: from 219.145.98.42 (HELO 4.79.181.15) (219.145.98.42) by
mta253.mail.mud.yahoo.com with SMTP; Fri, 21 Apr 2006 12:43:06 -0700
Received: from [192.168.1.3] ([219.145.98.42]) by innercite.com
(Sendmail 8.7.7) with ESMTP (SSL) id IYT75985 for <xx..xx@xx..xx.com>;
Fri, 21 Apr 2006 14:42:54 -0600
Message-ID: <580e728a...@innercite.com>
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=end.fly;
d=innercite.com;
b=dnczoe6wUHNdQVBJlKkJZ5TudKRmUGXg72jYfz8yiPHbay2il5B7gXEszMIA6MBuD1ho8eQMv605rUAV;
Date: Fri, 21 Apr 2006 14:42:54 -0600
From: "Myong Candelaria" <nubal...@inlandnet.com>
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xx..xx@xx..xx.com
Subject: SAVE 82%: VIAGR*, AMBIE*, CIALI*, XANA*, RIVOTRI*, LEVITR*,
CIPRO, MERIDI*, CELEBRE*, VALIU* mentioned
Content-Type: multipart/related;
boundary="------------42202845==.MRA"
Content-Length: 889
---------------------------------
he light promised raise he promised.Quality Meds Selling At Cheeap
We dont keep ur record (not even your name)
You just pay & we ship, No Question form to fill
We ship to all countries
Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro, Meridi*,
Celebre*, Valiu*, Zoloft & Many More Meds suddenly
raise C11ck Here for Huge Saving added
anybody yours here carefully bad social. is commit goes end.
news mischievous young suddenly here wrong.
use money latter back somewhere, arms pretty light.
money whom teach filled already. end out young profession reading fly,
my commit we slow?
he profession supposedto out my, arms pretty gym.
respect friends speaking use teach.
<html>
<head>
<xmeta http-equiv="Content-Type" content="text; charset=iso-8859-1">
</head>
<xbody>
<font color=FFA4D1 size=1>he light promised raise he promised.</font>
<table border=10 cellspacing=0 cellpadding=3 width=520
bordercolor=CDFF59>
<tr><td bgcolor=ffffff bordercolor=000000><center>
<font size=2 face=arial color=CC0000>
<font size=4 color=000000><b>Quality Meds Selling At Cheeap<br><font
color=EA0000>We dont keep ur record (not even your
name)</font><br><font color=AEAE00>You just pay & we ship, No Question
form to fill</font><br><font color=FF5EAE>We ship to all
countries</b></center></font></font><br><font color=000000
size=2>Viagr*, Ambie*, Ciali*, Xana*, Rivotri*, Levitr*, Cipro,
Meridi*, Celebre*, Valiu*, Zoloft & Many More Meds suddenly<br><center>
<a target="_blank" href=http://xwm.aNUPpa.net ><font size=4
color=5E5EFF><u>raise <b>C11ck Here for Huge Saving</b>
added</font></u></a></font></center><br></td></tr></table><font
color=FFA4D1 size=1>anybody yours here carefully bad social. is commit
goes end.<br>
news mischievous young suddenly here wrong.<br>
use money latter back somewhere, arms pretty light.<br>
money whom teach filled already. end out young profession reading fly,
my commit we slow?<br>
he profession supposedto out my, arms pretty gym.<br>
respect friends speaking use teach.<br></font>
</xbody>
</html>
</font>
-- END OF SPAM --
More Canadian RX sightings:
http://groups.google.com/groups/search?q=%22Canadian+RX%22+group%3A*abuse&start=0&scoring=d&
See:
IP 219.145.98.42
http://www.moensted.dk/spam/?addr=219.145.98.42
http://cbl.abuseat.org/lookup.cgi?ip=219.145.98.42
http://www.spamhaus.org/query/bl?ip=219.145.98.42
inetnum: 219.144.0.0 - 219.145.255.255
netname: CHINANET-SN
descr: CHINANET shanxi(SN) province network
descr: China Telecom
route: 219.144.0.0/15
descr: China Telecom Shanxi Province
origin: AS4134
mnt-by: MAINT-AS4134
changed: li...@ns.chinanet.cn.net
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
http://www.cidr-report.org/cgi-bin/as-report?as=4134
1 SBL listings for IPs under the responsibility of CHINANET-SN
http://www.spamhaus.org/sbl/listings.lasso?isp=CHINANET-SN
20 SBL/ROKSO listings for IPs under the responsibility of APNIC
http://www.spamhaus.org/sbl/listings.lasso?isp=APNIC
See:
xwm.aNUPpa.net
xwm.anuppa.net A IN 180 24.160.154.135
xwm.anuppa.net A IN 180 81.57.23.33
xwm.anuppa.net A IN 180 80.56.149.25
xwm.anuppa.net A IN 180 85.107.136.152
xwm.anuppa.net A IN 180 82.237.50.56
ns1.mokonan.com [24.14.78.90]
ns2.mokonan.com [24.160.154.135]
ns3.mokonan.com [84.132.8.50]
ns4.mokonan.com [82.225.73.204]
ns5.mokonan.com [80.96.206.123]
xwm.aNUPpa.net has no MX records -> aNUPpa.net has no MX records
Let see whois:
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Domain Name.......... anuppa.net
Creation Date........ 2006-04-14
Registration Date.... 2006-04-14
Expiry Date.......... 2007-04-14
Organisation Name.... Anupa Patel
Organisation Address. 11412 Woodglen Lane
Organisation Address.
Organisation Address. Burr Ridge
Organisation Address. 60527
Organisation Address. IL
Organisation Address. UNITED STATES
Admin Name........... Anupa Patel
Admin Address........ 11412 Woodglen Lane
Admin Address........
Admin Address........ Burr Ridge
Admin Address........ 60527
Admin Address........ IL
Admin Address........ UNITED STATES
Admin Email.......... paschal21[]hotmail.com
Admin Phone.......... +1.6306620418
Admin Fax............
Tech Name............ Anupa Patel
Tech Address......... 11412 Woodglen Lane
Tech Address.........
Tech Address......... Burr Ridge
Tech Address......... 60527
Tech Address......... IL
Tech Address......... UNITED STATES
Tech Email........... pasc...@hotmail.com
Tech Phone........... +1.6306620418
Tech Fax.............
Name Server.......... ns1.mokonan.com
Name Server.......... ns2.mokonan.com
Name Server.......... ns3.mokonan.com
Name Server.......... ns4.mokonan.com
Name Server.......... ns5.mokonan.com
See:
mokonan.com
Let see whois:
Registrar: TUCOWS INC.
Registrant:
Roland Tembo
2013 Buchanan St.
San Francisco, California 94115
US
Domain name: MOKONAN.COM
Administrative Contact:
Tembo, Roland temb...@yahoo.com
2013 Buchanan St.
San Francisco, California 94115
US
+8314266841
Technical Contact:
Tembo, Roland temb...@yahoo.com
2013 Buchanan St.
San Francisco, California 94115
US
+8314266841
Registration Service Provider:
DiscountDomainRegistry.com
http://DiscountDomainRegistry.com
Register your domain for only $14.99 at
http://DiscountDomainRegistry.com !
Customers may contact us for domain login/passwords, DNS/Nameserver
changes, and general domain support questions at
http://discountdomainregistry.com/crm/ .
Registrar of Record: TUCOWS, INC.
Record last updated on 17-Apr-2006.
Record expires on 06-Apr-2007.
Record created on 06-Apr-2006.
Domain servers in listed order:
NS1.MOKONAN.COM 24.14.78.90
NS2.MOKONAN.COM 24.160.154.135
NS3.MOKONAN.COM 84.132.8.50
NS4.MOKONAN.COM 82.225.73.204
NS5.MOKONAN.COM 82.230.8.131
More mokonan.com sightings:
http://groups.google.com/groups/search?q=mokonan.com+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/75ff2c095e1e11d4
AND:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/5bf764db48dfdd2a
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: