Canadian Pharmacy – sayfinish.com (Spam)

An Amazing Canadian Pharmacy is available_at your_Fingertips!
No Doctor Needed! Browse our Site Today! -> http://sayfinish.com

“Canadian Pharmacy” is property of some of the worst criminals on the Internet. Don’t let them fool you, as they lie just about everything. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you endanger your health by eating those drugs.

It’s your personal and credit card information they are after, and they’d do anything to get their filthy hands on that information. Their greed knows no measure, and they would probably sell their own mother for a quick buck. Of course they don’t have one, as this kind of filth breeds in drains.

Read more about this unrivaled fraud:
http://www.spamtrackers.eu/wiki/index.php/Canadian_Pharmacy

Header Analysis

The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
74.42.73.118 United States (Thorntown)* Whois Google DNSStuff Urgentmessage.org
207.115.36.102 United States (Richardson)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Randal Ford Wed Jun 10 15:40:56 2009
Return-Path:

Authentication-Results: mta141.sbc.mail.mud.yahoo.com from=datasul.com.br; domainkeys=neutral (no sig); from=datasul.com.br; dkim=neutral (no sig)
Received: from 74.42.73.118 (EHLO nlpi086.prodigy.net) (207.115.36.102)
by mta141.sbc.mail.mud.yahoo.com with SMTP; Wed, 10 Jun 2009 15:40:55 -0700
Received: from fa87sf1 (static-74-42-73-118.dr01.shlw.az.frontiernet.net [74.42.73.118])
by nlpi086.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n5AMeNjN013251;
Wed, 10 Jun 2009 17:40:53 -0500
Message-ID: <000701c9ea1c$851353b0$4a37416a@datasul.com.br>
Reply-To: “Randal Ford” <ford_rr@datasul.com.br>
From: “Randal Ford” <ford_rr@datasul.com.br>
To: ScamFraudAlert
Subject: We have anti anxiety medications!!
Date: Wed, 10 Jun 2009 17:40:56 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 134

Address lookup

canonical name sayfinish.com.
aliases
addresses 203.93.208.86
58.17.3.41

Domain Whois record

Queried whois.internic.net with “dom sayfinish.com“…

   Domain Name: SAYFINISH.COM
   Registrar: XIN NET TECHNOLOGY CORPORATION
   Whois Server: whois.paycenter.com.cn
   Referral URL: http://www.xinnet.com
   Name Server: NS1.WITHPIOUS.COM
   Name Server: NS2.WITHPIOUS.COM
   Name Server: NS3.DADOBJECT.COM
   Name Server: NS4.DADOBJECT.COM
   Name Server: NS5.CENTAROMA.IM
   Name Server: NS6.CENTAROMA.IM
   Status: ok
   Updated Date: 08-jun-2009
   Creation Date: 06-jun-2009
   Expiration Date: 06-jun-2010

>>> Last update of whois database: Thu, 11 Jun 2009 04:54:59 UTC <<<

Queried whois.paycenter.com.cn with “sayfinish.com“…

Domain Name      : sayfinish.com
PunnyCode        : sayfinish.com

Registrant:
  Organization   : CAO XINXIN
  Name           : CAO XINIXN
  Address        : DONGFANGLU26
  City           : SHANGHAI
  Province/State : Shanghai
  Country        : CN
  Postal Code    : 200269

Administrative Contact:
  Name           : CAO XINXIN
  Organization   : CAO XINIXN
  Address        : DONGFANGLU26
  City           : SHANGHAI
  Province/State : Shanghai
  Country        : CN
  Postal Code    : 200269
  Phone Number   : 86-021-69512325
  Fax            : 86-021-69512325
  Email          : CAOXINIXN566251@QQ.COM

Technical Contact:
  Name           : CAO XINXIN
  Organization   : CAO XINIXN
  Address        : DONGFANGLU26
  City           : SHANGHAI
  Province/State : Shanghai
  Country        : CN
  Postal Code    : 200269
  Phone Number   : 86-021-69512325
  Fax            : 86-021-69512325
  Email          : CAOXINIXN566251@QQ.COM

Billing Contact:
  Name           : CAO XINXIN
  Organization   : CAO XINIXN
  Address        : DONGFANGLU26
  City           : SHANGHAI
  Province/State : Shanghai
  Country        : CN
  Postal Code    : 200269
  Phone Number   : 86-021-69512325
  Fax            : 86-021-69512325
  Email          : CAOXINIXN566251@QQ.COM

Network Whois record

Queried whois.apnic.net with “203.93.208.86“…

inetnum:      203.93.0.0 - 203.93.255.255
netname:      UNICOM-CN
descr:        China Unicom IP network
descr:        China Unicom
country:      CN
admin-c:      CH1302-AP
tech-c:       CH1302-AP
mnt-by:       APNIC-HM
mnt-lower:    MAINT-CNCGROUP
mnt-routes:   MAINT-CNCGROUP-RR
status:       ALLOCATED PORTABLE
changed:      hm-changed@apnic.net 20040116
changed:      hm-changed@apnic.net 20060124
changed:      hm-changed@apnic.net 20090507
changed:      hm-changed@apnic.net 20090508
source:       APNIC

person:       ChinaUnicom Hostmaster
nic-hdl:      CH1302-AP
e-mail:       abuse@chinaunicom.cn
address:      No.21,Jin-Rong Street
address:      Beijing,100140
address:      P.R.China
phone:        +86-10-82993155
fax-no:       +86-10-82993144
country:      CN
changed:      abuse@chinaunicom.cn 20090408
mnt-by:       MAINT-CNCGROUP
source:       APNIC