Canadian Pharmacy Spam – tirethem.com

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

warning1

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Behind The Online Pharma

Today a shadowy, transnational network of illicit drug manufacturers, traders, doctors, Web site operators, spammers and criminals makes up the online pharma world.

Header Analysis

The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
131.114.69.63 Italy (Serra)* Whois Google DNSStuff Urgentmessage.org
207.115.20.186 United States (Richardson)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Douglas Andrews Thu Jul 16 15:16:43 2009
Return-Path:
Authentication-Results: mta118.sbc.mail.mud.yahoo.com from=yeoy.fi; domainkeys=neutral (no sig); from=yeoy.fi; dkim=neutral (no sig)
Received: from 131.114.69.63 (EHLO flpi184.prodigy.net) (207.115.20.186)
by mta118.sbc.mail.mud.yahoo.com with SMTP; Thu, 16 Jul 2009 15:18:09 -0700
Received: from zelgti4 (verita.vet.unipi.it [131.114.69.63] (may be forged))
by flpi184.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n6GMGhA2014995;
Thu, 16 Jul 2009 15:18:06 -0700

Message-ID: <000701ca0663$19d4dcf0$627e2c0a@yeoy.fi>
Reply-To: “Douglas Andrews”   <douglas.andrewsip@yeoy.fi>
From: “Douglas Andrews”   <douglas.andrewsip@yeoy.fi>
To: ,
Subject: Have No Problem in BeD, RxMeds online!
Date: Thu, 16 Jul 2009 15:16:43 -0700
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 136

An Incredible Canadian_Pharmacy is available at your Fingertips!
No Doctor Needed! Browse our Site Today! -> http://tirethem.com

_________________________________________________________________________

Header Analysis

The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
97.93.204.30 United States (Granbury)* Whois Google DNSStuff Urgentmessage.org
207.115.36.96 United States (Richardson)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Humberto Wade Thu Jul 16 12:23:14 2009
Return-Path:
Authentication-Results: mta167.sbc.mail.mud.yahoo.com from=cw-chamber.co.uk; domainkeys=neutral (no sig); from=cw-chamber.co.uk; dkim=neutral (no sig)
Received: from 97.93.204.30 (EHLO nlpi080.prodigy.net) (207.115.36.96)
by mta167.sbc.mail.mud.yahoo.com with SMTP; Thu, 16 Jul 2009 12:21:16 -0700
Received: from vyg3oj2 (static.unknown.charter.com
[97.93.204.30] (may be forged))
by nlpi080.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n6GJKlgD004846;
Thu, 16 Jul 2009 14:21:10 -0500
Message-ID: <000701ca064a$dd1d9350$431333e2@cw-chamber.co.uk>
Reply-To: “Humberto Wade” <hwade_ms@cw-chamber.co.uk>
From: “Humberto Wade”
To: , ,
Subject: great web offer
Date: Thu, 16 Jul 2009 14:23:14 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 137

An Incredible Canadian_Pharmacy is available at your Fingertips!
No Doctor Needed! Browse our Site Today! -> http://liveevery.com

____________________________________________________________-

Header Analysis

The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
65.126.184.100 United States (Telluride)* Whois Google DNSStuff Urgentmessage.org
207.115.36.161 United States (Richardson)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Lucille J. Stringer Thu Jul 16 10:02:34 2009
Return-Path:
Authentication-Results: mta111.sbc.mail.gq1.yahoo.com from=crs-ltd.co.uk; domainkeys=neutral (no sig); from=crs-ltd.co.uk; dkim=neutral (no sig)
Received: from 65.126.184.100 (EHLO nlpi147.prodigy.net) (207.115.36.161)
by mta111.sbc.mail.gq1.yahoo.com with SMTP; Thu, 16 Jul 2009 10:05:49 -0700
Received: from 1blry72 ([65.126.184.100])
by nlpi147.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n6GH54dn028723;
Thu, 16 Jul 2009 12:05:42 -0500

Message-ID: <000701ca0637$36f56420$d828ea62@crs-ltd.co.uk>
Reply-To: “Lucille J. Stringer”   <lucille_stringer_es@crs-ltd.co.uk>
From: “Lucille J. Stringer”   <lucille_stringer_es@crs-ltd.co.uk>
To: , ,
Subject: Feeling unneeded in bedroom? We can change that..
Date: Thu, 16 Jul 2009 12:02:34 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 137

An Incredible Canadian_Pharmacy is available at your Fingertips!
No Doctor Needed! Browse our Site Today! -> http://liveevery.com

________________________________________________

Header Analysis

The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
207.115.20.133 United States (Richardson)* Whois Google DNSStuff Urgentmessage.org
140.117.64.102 Taiwan (Kaohsiung)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Ashley J. Novak Thu Jul 16 02:30:44 2009
Return-Path:
Authentication-Results: mta143.sbc.mail.mud.yahoo.com from=londonthing.co.uk; domainkeys=neutral (no sig); from=londonthing.co.uk; dkim=neutral (no sig)
Received: from 207.115.20.133 (EHLO flpd123.prodigy.net) (207.115.20.133)
by mta143.sbc.mail.mud.yahoo.com with SMTP; Thu, 16 Jul 2009 05:32:34 -0700
Received: from yj6l901 ([140.117.64.102])
by flpd123.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n6GCWUvG019198;
Thu, 16 Jul 2009 05:32:32 -0700
Message-ID: <000701ca05f8$181184b0$627e2b9a@londonthing.co.uk>
Reply-To: “Ashley J. Novak”  <ashleyjnovaksv@londonthing.co.uk>
From: “Ashley J. Novak”
To: ,
Subject: Make her climax multiple times
Date: Thu, 16 Jul 2009 05:30:44 -0400
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 136

Content-Length: 136

An Incredible Canadian_Pharmacy is available at your Fingertips!
No Doctor Needed! Browse our Site Today! -> http://tirethem.com

Address lookup

canonical name tirethem.com.
aliases
addresses 60.191.239.150
203.93.208.86
218.75.144.6

Domain Whois record

Queried whois.internic.net with “dom tirethem.com“…

   Domain Name: TIRETHEM.COM
   Registrar: CHINA SPRINGBOARD INC.
   Whois Server: whois.namerich.cn
   Referral URL: http://www.namerich.cn
   Name Server: NS1.GROWFOUR.COM
   Name Server: NS2.GROWFOUR.COM
   Name Server: NS3.COUNTFROM.RU
   Name Server: NS4.COUNTFROM.RU
   Name Server: NS5.SIXTHE.COM
   Name Server: NS6.SIXTHE.COM
   Status: ok
   Updated Date: 14-jul-2009
   Creation Date: 14-jul-2009
   Expiration Date: 14-jul-2010

Last update of whois database: Fri, 17 Jul 2009 04:46:46 UTC <<<

Queried whois.namerich.cn with “tirethem.com“…

 DomainName : tirethem.com

RSP: China Springboard Inc.
URL: http://www.namerich.cn      

Name Server......................NS5.SIXTHE.COM
Name Server......................NS1.GROWFOUR.COM
Name Server......................NS6.SIXTHE.COM
Name Server......................NS2.GROWFOUR.COM
Name Server......................NS3.COUNTFROM.RU
Name Server......................NS4.COUNTFROM.RU
Status...........................ok
Creation  Date ..................2009-07-14
Expiration Date .................2010-07-14
Last Update  Date ...............2009-07-14

Registrant ID ...................V-X-59142-15723
Registrant Name .................DING JIANHUA
Registrant Organization .........DING JIANHUA
Registrant Address ..............YUHUIDADAO31
Registrant City..................DL
Registrant Province/State .......LN
Registrant Country Code .........CN
Registrant Postal Code ..........116008
Registrant Phone Number .........+86.041128805269
Registrant Fax ..................+86.041128805269
Registrant Email ................loansfg@163.com

Administrative ID ...............V-X-59142-15723
Administrative Name .............DING JIANHUA
Administrative Organization .....DING JIANHUA
Administrative Address ..........YUHUIDADAO31
Administrative City..............DL
Administrative Province/State ...LN
Administrative Country Code .....CN
Administrative Postal Code ......116008
Administrative Phone Number .....+86.041128805269
Administrative Fax ..............+86.041128805269
Administrative Email ............loansfg@163.com

Billing ID ......................V-X-59142-15723
Billing Name ....................DING JIANHUA
Billing Organization ............DING JIANHUA
Billing Address .................YUHUIDADAO31
Billing City.....................DL
Billing Province/State ..........LN
Billing Country Code ............CN
Billing Postal Code .............116008
Billing Phone Number ............+86.041128805269
Billing Fax .....................+86.041128805269
Billing Email ...................loansfg@163.com

Technical ID ....................V-X-59142-15723
Technical Name ..................DING JIANHUA
Technical Organization...........DING JIANHUA
Technical Address ...............YUHUIDADAO31
Technical City...................DL
Technical Province/State.........LN
Technical Country Code ..........CN
Technical Postal Code ...........116008
Technical Phone Number ..........+86.041128805269
Technical Fax ...................+86.041128805269
Technical Email .................loansfg@163.com

; Please register your domains at
; http://www.namerich.cn

Network Whois record

Queried whois.apnic.net with “60.191.239.150“…

inetnum:      60.191.239.0 - 60.191.239.255
netname:      JINHUA-TELECOM-LTD
country:      CN
descr:        Jinhua Telecom Co.,ltd
descr:
admin-c:      LW945-AP
tech-c:       CJ54-AP
status:       ASSIGNED NON-PORTABLE
changed:      auto-dbm@dcb.hz.zj.cn 20060824
mnt-by:       MAINT-CN-CHINANET-ZJ-JH
source:       APNIC

role:         CHINANET-ZJ Jinhua
address:      No.155 Xishi street,Jinhua,Zhejiang.321000
country:      CN
phone:        +86-579-2300779
fax-no:       +86-579-2330035
e-mail:       anti_spam@mail.jhptt.zj.cn
trouble:      send spam reports to anti_spam@mail.jhptt.zj.cn
trouble:      and abuse reports to anti_spam@mail.jhptt.zj.cn
trouble:      Please include detailed information and times in UTC
admin-c:      CH55-AP
tech-c:       CH55-AP
nic-hdl:      CJ54-AP
mnt-by:       MAINT-CHINANET-ZJ
changed:      master@dcb.hz.zj.cn 20031204
source:       APNIC

person:       Lujiang Wang
nic-hdl:      LW945-AP
e-mail:       anti_spam@mail.jhptt.zj.cn
address:      NO.155 Xishi Street,Jinhua,Zhejiang.Postcode:321000
phone:        +86-579-3285460
country:      CN
changed:      auto-dbm@dcb.hz.zj.cn 20060824
mnt-by:       MAINT-CN-CHINANET-ZJ-JH
source:       APNIC

DNS records

DNS query for 150.239.191.60.in-addr.arpa returned an error from the server: NameError

name class type data time to live
tirethem.com IN A 203.93.208.86 10800s (03:00:00)
tirethem.com IN A 218.75.144.6 10800s (03:00:00)
tirethem.com IN A 60.191.239.150 10800s (03:00:00)

— end —


Canadian Pharmacy Spam – liveevery.com

An Incredible Canadian_Pharmacy is available at your Fingertips!
No Doctor Needed! Browse our Site Today! -> http://liveevery.com

An Incredible Canadian_Pharmacy is available at your Fingertips!
No Doctor Needed! Browse our Site Today! -> http://cornerdeep.com

An Incredible Canadian_Pharmacy is available at your Fingertips!
No Doctor Needed! Browse our Site Today! -> http://widevaried.com

An Incredible Canadian_Pharmacy is available at your Fingertips!
No Doctor Needed! Browse our Site Today! -> http://widevaried.com

tiny dimension is your hidden shame, no need to worry, we ll help you! http://mialo.bgacipiq.cn/

An Incredible CanadianPharmacy is available at your_Fingertips!
No Doctor Needed! Browse our Site Today! -> http://sexytangy.com

An Incredible CanadianPharmacy is available at your_Fingertips!
No Doctor Needed! Browse our Site Today! -> http://sexytangy.com

Address lookup

canonical name liveevery.com.
aliases
addresses 203.93.208.86
218.75.144.6
60.191.239.150

Domain Whois record

Queried whois.internic.net with “dom liveevery.com“…

   Domain Name: LIVEEVERY.COM
   Registrar: CHINA SPRINGBOARD INC.
   Whois Server: whois.namerich.cn
   Referral URL: http://www.namerich.cn
   Name Server: NS1.GROWFOUR.COM
   Name Server: NS2.GROWFOUR.COM
   Name Server: NS3.COUNTFROM.RU
   Name Server: NS4.COUNTFROM.RU
   Name Server: NS5.SIXTHE.COM
   Name Server: NS6.SIXTHE.COM
   Status: ok
   Updated Date: 14-jul-2009
   Creation Date: 14-jul-2009
   Expiration Date: 14-jul-2010

>>> Last update of whois database: Thu, 16 Jul 2009 08:03:17 UTC <<<

Queried whois.namerich.cn with “liveevery.com“…

 DomainName : liveevery.com

RSP: China Springboard Inc.
URL: http://www.namerich.cn      

Name Server......................NS5.SIXTHE.COM
Name Server......................NS1.GROWFOUR.COM
Name Server......................NS6.SIXTHE.COM
Name Server......................NS2.GROWFOUR.COM
Name Server......................NS3.COUNTFROM.RU
Name Server......................NS4.COUNTFROM.RU
Status...........................ok
Creation  Date ..................2009-07-14
Expiration Date .................2010-07-14
Last Update  Date ...............2009-07-14

Registrant ID ...................V-X-59142-15723
Registrant Name .................DING JIANHUA
Registrant Organization .........DING JIANHUA
Registrant Address ..............YUHUIDADAO31
Registrant City..................DL
Registrant Province/State .......LN
Registrant Country Code .........CN
Registrant Postal Code ..........116008
Registrant Phone Number .........+86.041128805269
Registrant Fax ..................+86.041128805269
Registrant Email ................loansfg@163.com

Administrative ID ...............V-X-59142-15723
Administrative Name .............DING JIANHUA
Administrative Organization .....DING JIANHUA
Administrative Address ..........YUHUIDADAO31
Administrative City..............DL
Administrative Province/State ...LN
Administrative Country Code .....CN
Administrative Postal Code ......116008
Administrative Phone Number .....+86.041128805269
Administrative Fax ..............+86.041128805269
Administrative Email ............loansfg@163.com

Billing ID ......................V-X-59142-15723
Billing Name ....................DING JIANHUA
Billing Organization ............DING JIANHUA
Billing Address .................YUHUIDADAO31
Billing City.....................DL
Billing Province/State ..........LN
Billing Country Code ............CN
Billing Postal Code .............116008
Billing Phone Number ............+86.041128805269
Billing Fax .....................+86.041128805269
Billing Email ...................loansfg@163.com

Technical ID ....................V-X-59142-15723
Technical Name ..................DING JIANHUA
Technical Organization...........DING JIANHUA
Technical Address ...............YUHUIDADAO31
Technical City...................DL
Technical Province/State.........LN
Technical Country Code ..........CN
Technical Postal Code ...........116008
Technical Phone Number ..........+86.041128805269
Technical Fax ...................+86.041128805269
Technical Email .................loansfg@163.com

; Please register your domains at
; http://www.namerich.cn

Network Whois record

Queried whois.apnic.net with “203.93.208.86“…

inetnum:      203.93.0.0 - 203.93.255.255
netname:      UNICOM-CN
descr:        China Unicom IP network
descr:        China Unicom
country:      CN
admin-c:      CH1302-AP
tech-c:       CH1302-AP
mnt-by:       APNIC-HM
mnt-lower:    MAINT-CNCGROUP
mnt-routes:   MAINT-CNCGROUP-RR
status:       ALLOCATED PORTABLE
changed:      hm-changed@apnic.net 20040116
changed:      hm-changed@apnic.net 20060124
changed:      hm-changed@apnic.net 20090507
changed:      hm-changed@apnic.net 20090508
source:       APNIC

person:       ChinaUnicom Hostmaster
nic-hdl:      CH1302-AP
e-mail:       abuse@chinaunicom.cn
address:      No.21,Jin-Rong Street
address:      Beijing,100140
address:      P.R.China
phone:        +86-10-82993155
fax-no:       +86-10-82993144
country:      CN
changed:      abuse@chinaunicom.cn 20090408
mnt-by:       MAINT-CNCGROUP
source:       APNIC

DNS records

DNS query for 86.208.93.203.in-addr.arpa returned an error from the server: NameError

name class type data time to live
liveevery.com IN A 203.93.208.86 10800s (03:00:00)
liveevery.com IN A 218.75.144.6 10800s (03:00:00)
liveevery.com IN A 60.191.239.150 10800s (03:00:00)

— end —

Address lookup

canonical name cornerdeep.com.
aliases
addresses 218.75.144.6
60.191.239.150
203.93.208.86

Domain Whois record

Queried whois.internic.net with “dom cornerdeep.com“…

   Domain Name: CORNERDEEP.COM
   Registrar: CHINA SPRINGBOARD INC.
   Whois Server: whois.namerich.cn
   Referral URL: http://www.namerich.cn
   Name Server: NS1.GROWFOUR.COM
   Name Server: NS2.GROWFOUR.COM
   Name Server: NS3.COUNTFROM.RU
   Name Server: NS4.COUNTFROM.RU
   Name Server: NS5.SIXTHE.COM
   Name Server: NS6.SIXTHE.COM
   Status: ok
   Updated Date: 14-jul-2009
   Creation Date: 14-jul-2009
   Expiration Date: 14-jul-2010

>>> Last update of whois database: Thu, 16 Jul 2009 08:04:19 UTC <<<

Queried whois.namerich.cn with “cornerdeep.com“…

 DomainName : cornerdeep.com

RSP: China Springboard Inc.
URL: http://www.namerich.cn      

Name Server......................NS5.SIXTHE.COM
Name Server......................NS1.GROWFOUR.COM
Name Server......................NS6.SIXTHE.COM
Name Server......................NS2.GROWFOUR.COM
Name Server......................NS3.COUNTFROM.RU
Name Server......................NS4.COUNTFROM.RU
Status...........................ok
Creation  Date ..................2009-07-14
Expiration Date .................2010-07-14
Last Update  Date ...............2009-07-14

Registrant ID ...................V-X-59142-15723
Registrant Name .................DING JIANHUA
Registrant Organization .........DING JIANHUA
Registrant Address ..............YUHUIDADAO31
Registrant City..................DL
Registrant Province/State .......LN
Registrant Country Code .........CN
Registrant Postal Code ..........116008
Registrant Phone Number .........+86.041128805269
Registrant Fax ..................+86.041128805269
Registrant Email ................loansfg@163.com

Administrative ID ...............V-X-59142-15723
Administrative Name .............DING JIANHUA
Administrative Organization .....DING JIANHUA
Administrative Address ..........YUHUIDADAO31
Administrative City..............DL
Administrative Province/State ...LN
Administrative Country Code .....CN
Administrative Postal Code ......116008
Administrative Phone Number .....+86.041128805269
Administrative Fax ..............+86.041128805269
Administrative Email ............loansfg@163.com

Billing ID ......................V-X-59142-15723
Billing Name ....................DING JIANHUA
Billing Organization ............DING JIANHUA
Billing Address .................YUHUIDADAO31
Billing City.....................DL
Billing Province/State ..........LN
Billing Country Code ............CN
Billing Postal Code .............116008
Billing Phone Number ............+86.041128805269
Billing Fax .....................+86.041128805269
Billing Email ...................loansfg@163.com

Technical ID ....................V-X-59142-15723
Technical Name ..................DING JIANHUA
Technical Organization...........DING JIANHUA
Technical Address ...............YUHUIDADAO31
Technical City...................DL
Technical Province/State.........LN
Technical Country Code ..........CN
Technical Postal Code ...........116008
Technical Phone Number ..........+86.041128805269
Technical Fax ...................+86.041128805269
Technical Email .................loansfg@163.com

; Please register your domains at
; http://www.namerich.cn

Network Whois record

Queried whois.apnic.net with “218.75.144.6“…

inetnum:      218.75.128.0 - 218.75.159.255
netname:      CHINANET-HN-CD
country:      CN
descr:        CHINANET-HN changde node network
descr:        hunan Telecom
admin-c:      CHC8-AP
tech-c:       CH636-AP
status:       ALLOCATED NON-PORTABLE
changed:      ipaddress@hntelecom.net.cn 20050823
mnt-by:       MAINT-CHINANET-HN
mnt-lower:    MAINT-CHINANET-HN-CD
source:       APNIC

role:         CHINANET HuNan ChangDe
address:      The middle of Wuling Street,Changde 415000
country:      CN
phone:        +86 736 7229427
fax-no:       +86 736 7267027
e-mail:       abuse.cd@2118.com.cn
trouble:      send spam reports to spam.cd@2118.com.cn
trouble:      and abuse reports to abuse.cd@2118.com.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      CM1092-AP
tech-c:       CM1092-AP
nic-hdl:      CHC8-AP
notify:       abuse.cd@2118.com.cn
mnt-by:       MAINT-CHINANET-HN-CD
changed:      ipaddress@hntelecom.net.cn 20050818
source:       APNIC

role:         CHINANET HUNAN
address:      No.1 TuanJie road,ChangSha,Hunan 410005
country:      CN
phone:        +86 731 4792092
fax-no:       +86 731 4792007
e-mail:       abuse.szx@2118.com.cn
trouble:      send spam reports to spam.szx@2118.com.cn
trouble:      and abuse reports to abuse.szx@2118.com.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      CH632-AP
tech-c:       CS499-AP
nic-hdl:      CH636-AP
mnt-by:       MAINT-CHINANET-HN
changed:      ipaddress@hntelecom.net.cn 20050816
source:       APNIC

DNS records

DNS query for 6.144.75.218.in-addr.arpa returned an error from the server: NameError

name class type data time to live
cornerdeep.com IN A 218.75.144.6 10800s (03:00:00)
cornerdeep.com IN A 60.191.239.150 10800s (03:00:00)
cornerdeep.com IN A 203.93.208.86 10800s (03:00:00)

— end —

cornerdeep.com