Canadian Pharmacy Spam – cheaprxpharmonline.com

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

warning1

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Behind The Online Pharma

Today a shadowy, transnational network of illicit drug manufacturers, traders, doctors, Web site operators, spammers and criminals makes up the online pharma world.

cheaprxpharmonline

Header Analysis

The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
122.56.218.44 New Zealand (Auckland)* Whois Google DNSStuff Urgentmessage.org
207.115.20.183 United States (Richardson)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Harold Messer Wed Jul 29 18:44:25 2009
Return-Path:
Authentication-Results: mta153.sbc.mail.mud.yahoo.com from=sm.luth.se; domainkeys=neutral (no sig); from=sm.luth.se; dkim=neutral (no sig)
Received: from 122.56.218.44 (EHLO flpi181.prodigy.net) (207.115.20.183)
by mta153.sbc.mail.mud.yahoo.com with SMTP; Wed, 29 Jul 2009 18:44:40 -0700
Received: from 7n8k622 (122-56-218-44.mobile.telecom.co.nz [122.56.218.44] (may be forged))
by flpi181.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n6U1hWEk003354;
Wed, 29 Jul 2009 18:44:37 -0700
Message-ID: <000701ca10b7$44cbffc0$627e0202@sm.luth.se>
Reply-To: “Harold Messer” <haroldmesser_zw@sm.luth.se
From: “Harold Messer” <haroldmesser_zw@sm.luth.se
To: , ,
Subject: Need some help focusing?.. get Ritalin!
Date: Wed, 29 Jul 2009 18:44:25 -0700
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 219

VicodinES, XanaxAmbien, Codeine, Phentermin and many more!
No Doctor or Prescription Needed! Brand & Generic Names Available!
Fast Trackable USPS Shipping!
Browse Our Site Today –> http://cheaprxpharmonline.com

SmartFilter Category: Not Categorized
Make Category Suggestions
IP: 60.12.166.154
Nameservers: ns1.cheaprxpharmonline.comns2.cheaprxpharmonline.com

ns3.cheaprxpharmonline.com

ns4.cheaprxpharmonline.com

nameservers missing in zone
hot1gaming.com X X
ns1.bd4ns.com X X
ns1.cheaprxpharmonline.com


X X
ns2.cheaprxpharmonline.com


X X
ns2.ef2ns.com X X
ns3.br4ns.com X X
ns3.cheaprxpharmonline.com


X X
ns4.cheaprxpharmonline.com


X X
sdavaiteres.com

hostnames sharing ip with a-records
*.sdavaiteres.com


hot1gaming.com


ns1.listendns.com


ns1.sdavaiteres.com


ns2.sdavaiteres.com


ns3.fa6ns.com


ns3.sdavaiteres.com


ns4.sdavaiteres.com


sdavaiteres.com


www.softokors.com

Address lookup

canonical name cheaprxpharmonline.com.
aliases
addresses 60.12.166.154

Domain Whois record

Queried whois.internic.net with “dom cheaprxpharmonline.com“…

   Domain Name: CHEAPRXPHARMONLINE.COM
   Registrar: XIAMEN ENAME NETWORK TECHNOLOGY CORPORATION LIMITED DBA ENAME CORP
   Whois Server: whois.ename.com
   Referral URL: http://www.ename.com
   Name Server: NS1.BD4NS.COM
   Name Server: NS2.EF2NS.COM
   Name Server: NS3.BR4NS.COM
   Status: clientDeleteProhibited
   Status: clientTransferProhibited
   Updated Date: 28-jul-2009
   Creation Date: 03-apr-2009
   Expiration Date: 03-apr-2010

 Last update of whois database: Thu, 30 Jul 2009 15:12:12 UTC <<<

Queried whois.ename.com with “cheaprxpharmonline.com“…

Domain Name : cheaprxpharmonline.com

Registrant Contact Information :
XINGYUNRI
XINGYUNRI
baobao7802@hotmail.com
TONGLUOWAN15, 026974
tel: +86 086482179624
fax: +86 086482179624 

Administrative Contact Information :
XINGYUNRI
XINGYUNRI
baobao7802@hotmail.com
TONGLUOWAN15, 026974
tel: +86 086482179624
fax: +86 086482179624 

Technical Contact Information :
XINGYUNRI
XINGYUNRI
baobao7802@hotmail.com
TONGLUOWAN15, 026974
tel: +86 086482179624
fax: +86 086482179624 

Billing Contact Information :
XINGYUNRI
XINGYUNRI
baobao7802@hotmail.com
TONGLUOWAN15, 026974
tel: +86 086482179624
fax: +86 086482179624 

Status :
clientDeleteProhibited
clientTransferProhibited

Domain Name Server :
ns1.bd4ns.com
ns2.ef2ns.com
ns3.br4ns.com

Registration Date :2009-4-3
Expiration Date : 2010-4-3

For more information, please go to http://whois.ename.com.

Network Whois record

Queried whois.apnic.net with “60.12.166.154“…

inetnum:      60.12.0.0 - 60.12.255.255
netname:      UNICOM-ZJ
descr:        China Unicom Zhejiang province network
descr:        China Unicom
country:      CN
admin-c:      CH1302-AP
tech-c:       JQ16-AP
remarks:      service provider
mnt-by:       APNIC-HM
mnt-lower:    MAINT-CNCGROUP-ZJ
mnt-routes:   MAINT-CNCGROUP-RR
status:       ALLOCATED PORTABLE
remarks:      -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks:      This object can only be updated by APNIC hostmasters.
remarks:      To update this object, please contact APNIC
remarks:      hostmasters and include your organisation's account
remarks:      name in the subject line.
remarks:      -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
changed:      hm-changed@apnic.net 20040629
changed:      hm-changed@apnic.net 20060124
changed:      hm-changed@apnic.net 20090507
changed:      hm-changed@apnic.net 20090508
source:       APNIC

route:        60.12.0.0/16
descr:        CNC Group CHINA169 Zhejiang Province Network
country:      CN
origin:       AS4837
mnt-by:       MAINT-CNCGROUP-RR
changed:      abuse@cnc-noc.net 20060118
source:       APNIC

person:       ChinaUnicom Hostmaster
nic-hdl:      CH1302-AP
e-mail:       abuse@chinaunicom.cn
address:      No.21,Jin-Rong Street
address:      Beijing,100140
address:      P.R.China
phone:        +86-10-66259940
fax-no:       +86-10-66259764
country:      CN
changed:      abuse@chinaunicom.cn 20090408
mnt-by:       MAINT-CNCGROUP
source:       APNIC

person:       Jianhuaq Qian
nic-hdl:      JQ16-AP
e-mail:       chenrenhai@china-netcom.com
address:      No 1,Hangzhou University Road,Hangzhou, Zhejiang,China
phone:        +86-571-28868063
fax-no:       +86-571-28868069
country:      CN
changed:      wuhong@china-netcom.com 20050421
mnt-by:       MAINT-CNCGROUP-ZJ
source:       APNIC

DNS records

DNS query for 154.166.12.60.in-addr.arpa returned an error from the server: NameError

name class type data time to live
cheaprxpharmonline.com IN SOA
server: ns1.domain.com
email: admin.domain.com
serial: 1
refresh: 300
retry: 300
expire: 300
minimum ttl: 86400
86400s (1.00:00:00)
cheaprxpharmonline.com IN NS ns3.cheaprxpharmonline.com 86400s (1.00:00:00)
cheaprxpharmonline.com IN NS ns2.cheaprxpharmonline.com 86400s (1.00:00:00)
cheaprxpharmonline.com IN NS ns1.cheaprxpharmonline.com 86400s (1.00:00:00)
cheaprxpharmonline.com IN A 60.12.166.154 86400s (1.00:00:00)
cheaprxpharmonline.com IN NS ns4.cheaprxpharmonline.com 86400s (1.00:00:00)

Service scan

FTP – 21 Error: ConnectionRefused
SMTP – 25 Error: ConnectionRefused
HTTP – 80
POP3 – 110 Error: ConnectionRefused
IMAP – 143 Error: ConnectionRefused

— end —

Canadian Pharmacy Spam – ispvds.com

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

warning1

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Behind The Online Pharma

Today a shadowy, transnational network of illicit drug manufacturers, traders, doctors, Web site operators, spammers and criminals makes up the online pharma world.

Address lookup

canonical name vdsking3.ispvds.com.
aliases
addresses 82.146.53.165

Domain Whois record

Queried whois.internic.net with “dom ispvds.com“…

   Domain Name: ISPVDS.COM
   Registrar: TUCOWS INC.
   Whois Server: whois.tucows.com
   Referral URL: http://domainhelp.opensrs.net
   Name Server: NS1.ISPVDS.COM
   Name Server: NS2.ISPVDS.COM
   Status: ok
   Updated Date: 06-aug-2008
   Creation Date: 05-sep-2001
   Expiration Date: 05-sep-2009

>>> Last update of whois database: Thu, 30 Jul 2009 12:44:52 UTC <<<

Queried whois.tucows.com with “ispvds.com“…

Registrant:
 ISPsystem
 P.0. Box 30
 Irkutsk,  664017
 RU

 Domain name: ISPVDS.COM

 Administrative Contact:
    Master, DNS  domain@ispserver.com
    P.0. Box 30
    Irkutsk,  664017
    RU
    +7.4957273879    Fax: +7.4957273879

 Technical Contact:
    Master, DNS  domain@ispserver.com
    P.0. Box 30
    Irkutsk,  664017
    RU
    +7.4957273879    Fax: +7.4957273879

 Registrar of Record: TUCOWS, INC.
 Record last updated on 06-Aug-2008.
 Record expires on 05-Sep-2009.
 Record created on 05-Sep-2001.

 Registrar Domain Name Help Center:
    http://domainhelp.tucows.com

 Domain servers in listed order:
    NS1.ISPVDS.COM   82.146.35.18
    NS2.ISPVDS.COM   82.146.55.39

 Domain status: ok

Network Whois record

Queried whois.ripe.net with “-B 82.146.53.165“…

% Information related to '82.146.48.0 - 82.146.55.255'

inetnum:        82.146.48.0 - 82.146.55.255
netname:        ISPSYSTEM
descr:          ISPsystem at NAC
country:        US
admin-c:        PAS28-RIPE
tech-c:         AB11726-RIPE
status:         ASSIGNED PA
mnt-by:         ISPSYSTEM-MNT
changed:        inet@ispserver.com 20080919
source:         RIPE

person:         Peter A Svistunov
address:        ISPsystem, Raduzhny 34a
address:        Irkutsk, 664017, Russian Federation
phone:          +7 3952 525789
abuse-mailbox:  abuse@ispserver.com
nic-hdl:        PAS28-RIPE
notify:         sad@ispsystem.com
changed:        ilya@ispsystem.com 20090727
source:         RIPE

person:         Alexandr Brukhanov
address:        PoBox30, 664017, Irkutsk, Russia
phone:          +7 495 727 38 79
nic-hdl:        AB11726-RIPE
changed:        inet@ispserver.com 20061209
source:         RIPE

% Information related to '82.146.48.0/21AS29182'

route:          82.146.48.0/21
descr:          ISPsystem-US
origin:         AS29182
mnt-by:         ISPSYSTEM-MNT
remarks:        **************************************
remarks:        * For spamming or other abuse issues
remarks:        * please send your requests to
remarks:        *       abuse@ispserver.com
remarks:        **************************************
changed:        inet@ispserver.com 20060201
source:         RIPE

DNS records

name class type data time to live
vdsking3.ispvds.com IN SOA
server: ns1.ispvds.com
email: root.vdsking3.ispvds.com
serial: 2009022000
refresh: 10800
retry: 3600
expire: 604800
minimum ttl: 86400
3600s (01:00:00)
vdsking3.ispvds.com IN NS ns2.ispvds.com 3600s (01:00:00)
vdsking3.ispvds.com IN NS ns1.ispvds.com 3600s (01:00:00)
vdsking3.ispvds.com IN A 82.146.53.165 3600s (01:00:00)
vdsking3.ispvds.com IN MX
preference: 10
exchange: mail.vdsking3.ispvds.com
3600s (01:00:00)
vdsking3.ispvds.com IN MX
preference: 20
exchange: mail.vdsking3.ispvds.com
3600s (01:00:00)
vdsking3.ispvds.com IN TXT v=spf1 ip4:82.146.53.165 a mx ~all 3600s (01:00:00)
ispvds.com IN SOA
server: ns1.ispvds.com
email: root.ispserver.com
serial: 2008012416
refresh: 10800
retry: 3600
expire: 604800
minimum ttl: 86400
3600s (01:00:00)
ispvds.com IN NS ns1.ispvds.com 3600s (01:00:00)
ispvds.com IN NS ns2.ispvds.com 3600s (01:00:00)
ispvds.com IN A 82.146.40.40 3600s (01:00:00)
165.53.146.82.in-addr.arpa IN PTR vdsking3.ispvds.com 3600s (01:00:00)

— end —