An Incredible Canadian~Pharmacy is available at your Fingertips!
NO_Doctor_Needed! Click Here => http://rosefight.com

 

An Incredible Canadian~Pharmacy is available at your_Fingertips!
NO_Doctor_Needed! Click Here => http://causebreezy.com

 

An Incredible CanadianPharmacy is available at your Fingertips!
NO Doctor Needed! Click Here -> http://zealstay.com

Header Analysis

The following IP addresses were extracted from your headers:

IP Address	Probable Country	Additional Info
60.198.140.245	Taiwan (Taipei)*	Whois	Google	DNSStuff	Urgentmessage.org
207.115.20.195	United States (Richardson)*	Whois	Google	DNSStuff	Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Amanda King Wed Jun 3 19:08:30 2009 
Return-Path: 
Authentication-Results: mta124.sbc.mail.mud.yahoo.com from=anglianet.co.uk; domainkeys=neutral (no sig); from=anglianet.co.uk; dkim=neutral (no sig) 
Received: from 60.198.140.245 (EHLO flpi193.prodigy.net) (207.115.20.195) 
by mta124.sbc.mail.mud.yahoo.com with SMTP; Wed, 03 Jun 2009 19:08:30 -0700 
Received: from wd4l8b2 (60-198-140-245.dynamic.tfn.ent.tw [60.198.140.245] (may be forged)) 
by flpi193.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n5427Wlt003373; 
Wed, 3 Jun 2009 19:08:27 -0700 
Message-ID: <000701c9e4b9$5af491b0$4a37416a@anglianet.co.uk> 
Reply-To: “Amanda King”  <a_kingjf@anglianet.co.uk>
From: “Amanda King”    <a_kingjf@anglianet.co.uk>
To: ScamFraudAlert
Subject: We have all the best Rxmed Out! 
Date: Wed, 03 Jun 2009 21:08:30 -0500 
MIME-Version: 1.0 
Content-Type: text/plain; 
format=flowed; 
charset=”windows-1250″ 
reply-type=original 
Content-Transfer-Encoding: 7bit 
Content-Length: 124 

 

Header Analysis

The following IP addresses were extracted from your headers:

IP Address	Probable Country	Additional Info
194.254.168.135	France (Sannois)*	Whois	Google	DNSStuff	Urgentmessage.org
207.115.36.113	United States (Richardson)*	Whois	Google	DNSStuff	Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

 

From Louie Hicks Fri Jun 5 02:48:58 2009 
Return-Path: 
Authentication-Results: mta138.sbc.mail.re3.yahoo.com from=sparebank1.no; domainkeys=neutral (no sig); from=sparebank1.no; dkim=neutral (no sig) 
Received: from 194.254.168.135 (EHLO nlpi097.prodigy.net) (207.115.36.113) 
by mta138.sbc.mail.re3.yahoo.com with SMTP; Fri, 05 Jun 2009 02:48:58 -0700 
Received: from 9brjah2 ([194.254.168.135]) 
by nlpi097.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n559mm9j001639; 
Fri, 5 Jun 2009 04:48:57 -0500 
Message-ID: <000701c9e5c2$d939a6a0$4a37416a@sparebank1.no> 
Reply-To: “Louie Hicks”  louiehicks_ig@sparebank1.no
From: “Louie Hicks”  louiehicks_ig@sparebank1.no
To: , , 
Subject: Have long strong night in BED! 
Date: Fri, 05 Jun 2009 04:48:58 -0500 
MIME-Version: 1.0 
Content-Type: text/plain; 
format=flowed; 
charset=”windows-1250″ 
reply-type=original 
Content-Transfer-Encoding: 7bit 
Content-Length: 128

 

 

 

 

Address lookup

canonical name	rosefight.com.
aliases
addresses	203.93.208.86 58.17.3.41 60.191.239.181

Domain Whois record

Queried whois.internic.net with “dom rosefight.com“…

   Domain Name: ROSEFIGHT.COM
   Registrar: XIN NET TECHNOLOGY CORPORATION
   Whois Server: whois.paycenter.com.cn
   Referral URL: http://www.xinnet.com
   Name Server: NS1.FELTTWENTY.COM
   Name Server: NS2.FELTTWENTY.COM
   Name Server: SP151.DELETEDNS.COM
   Name Server: SP152.DELETEDNS.COM
   Name Server: SP153.DELETEDNS.COM
   Name Server: SP154.DELETEDNS.COM
   Status: ok
   Updated Date: 04-jun-2009
   Creation Date: 03-jun-2009
   Expiration Date: 03-jun-2010

>>> Last update of whois database: Sat, 06 Jun 2009 22:46:50 UTC <<<

Queried whois.paycenter.com.cn with “rosefight.com“…

Domain Name      : rosefight.com
PunnyCode        : rosefight.com

Registrant:
  Organization   : TIANCHUNLIN
  Name           : TIANCHUNLING
  Address        : daxuenanlu29
  City           : xinxiangshi
  Province/State : henansheng
  Country        : china
  Postal Code    : 453039

Administrative Contact:
  Name           : TIANCHUNLING
  Organization   : TIANCHUNLIN
  Address        : daxuenanlu29
  City           : xinxiangshi
  Province/State : henansheng
  Country        : china
  Postal Code    : 453039
  Phone Number   : 86-0373-61255412
  Fax            : 86-0373-61255412
  Email          : TIANCHUNLIN@139.COM

Technical Contact:
  Name           : TIANCHUNLING
  Organization   : TIANCHUNLIN
  Address        : daxuenanlu29
  City           : xinxiangshi
  Province/State : henansheng
  Country        : china
  Postal Code    : 453039
  Phone Number   : 86-0373-61255412
  Fax            : 86-0373-61255412
  Email          : TIANCHUNLIN@139.COM

Billing Contact:
  Name           : TIANCHUNLING
  Organization   : TIANCHUNLIN
  Address        : daxuenanlu29
  City           : xinxiangshi
  Province/State : henansheng
  Country        : china
  Postal Code    : 453039
  Phone Number   : 86-0373-61255412
  Fax            : 86-0373-61255412
  Email          : TIANCHUNLIN@139.COM

Network Whois record

Queried whois.apnic.net with “203.93.208.86“…

inetnum:      203.93.0.0 - 203.93.255.255
netname:      UNICOM-CN
descr:        China Unicom IP network
descr:        China Unicom
country:      CN
admin-c:      CH1302-AP
tech-c:       CH1302-AP
mnt-by:       APNIC-HM
mnt-lower:    MAINT-CNCGROUP
mnt-routes:   MAINT-CNCGROUP-RR
status:       ALLOCATED PORTABLE
changed:      hm-changed@apnic.net 20040116
changed:      hm-changed@apnic.net 20060124
changed:      hm-changed@apnic.net 20090507
changed:      hm-changed@apnic.net 20090508
source:       APNIC

person:       ChinaUnicom Hostmaster
nic-hdl:      CH1302-AP
e-mail:       abuse@chinaunicom.cn
address:      No.21,Jin-Rong Street
address:      Beijing,100140
address:      P.R.China
phone:        +86-10-82993155
fax-no:       +86-10-82993144
country:      CN
changed:      abuse@chinaunicom.cn 20090408
mnt-by:       MAINT-CNCGROUP
source:       APNIC

DNS records

DNS query for 86.208.93.203.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
rosefight.com	IN	A	60.191.239.181	3600s	(01:00:00)
rosefight.com	IN	A	58.17.3.41	3600s	(01:00:00)
rosefight.com	IN	A	203.93.208.86	3600s	(01:00:00)