American operation with Philippines, Russian and Canadian 
connections, this large spam operation mostly promotes fake pharmaceuticals using classic “snowshoe” methods with countless IP ranges and domains. Many fictitious identities and aliases.
Google Publisher ID: pub-7476377478004764
Quick Cart Pro AKA: naturalllc.com (Natural Lotus LLC)/Ailos Mordechai
Natural Lotus LLC
Ailos Mordechai
223 East Flagler Street, Suite 218
Miami FL 33131
naturallotus@gmail.com
https://encrypted.google.com/search?q=Mordechai+Eilos
____________________
IPs 64.27.1.245-250
%rwhois V-1.0,V-1.5:00090h:00 manage.steadfast.net (Ubersmith RWhois Server V-1.8.2)
autharea=208.100.0.0/18
xautharea=208.100.0.0/18
network:Class-Name:network
network:Auth-Area:208.100.0.0/18
network:ID:NET-13818.208.100.27.56
network:Network-Name:Secondary IPs
network:IP-Network:208.100.27.56
network:IP-Network-Block:208.100.27.56
network:Org-Name:Natural Lotus LLC
network:Street-Address:223 East Flagler St, Suite 218
network:City:Miami
network:State:FL
network:Postal-Code:33131
network:Country-Code:US
network:Tech-Contact:MAINT-13818.208.100.27.56
network:Created:20110307181144000
network:Updated:20110307181144000
network:Updated-By:noc@steadfast.net
contact:POC-Name:Steadfast Networks Network Operations Center
contact:POC-Email:noc@steadfast.net
contact:POC-Phone:+1-312-602-2689
contact:Tech-Name:Steadfast Networks Network Operations Center
contact:Tech-Email:noc@steadfast.net
contact:Tech-Phone:+1-312-602-2689
contact:Abuse-Name:Steadfast Networks Abuse Department
contact:Abuse-Email:abuse@steadfast.net
%ok
______________________
%rwhois V-1.5:003fff:00 rwhois.softlayer.com (by Network Solutions, Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:NETBLK-SOFTLAYER.50.23.128.0/18
network:Auth-Area:50.23.128.0/18
network:Network-Name:SOFTLAYER-50.23.128.0
network:IP-Network:50.23.160.92/30
network:IP-Network-Block:50.23.160.92-50.23.160.95
network:Organization;I:naturallotus
network:Street-Address:223 East Flagler Street, Suite 218
network:City:Miami
network:State:FL
network:Postal-Code:33131
network:Country-Code:US
network:Tech-Contact;I:sysadmins@softlayer.com
network:Abuse-Contact;I:abuse@naturalllc.com
network:Admin-Contact;I:IPADM258-ARIN
network:Created:20110304
network:Updated:20110304
network:Updated-By:ipadmin@softlayer.com
_______________________
Domain lost to domainer?
Domain Name: NATURALLLC.COM
Registrar: TURNCOMMERCE, INC. DBA NAMEBRIGHT.COM
Whois Server: whois.namebright.com
Referral URL: http://www.namebright.com
Name Server: NS1.NAMEBRIGHTDNS.COM
Name Server: NS2.NAMEBRIGHTDNS.COM
Status: clientTransferProhibited
Updated Date: 22-sep-2010
Creation Date: 25-jul-2009
Expiration Date: 25-jul-2011
Results:
Registrant:
HugeDomains domains@hugedomains.com
THIS DOMAIN IS FOR SALE
535 Clarkson Street
Denver, CO 80218
US
(303) 893-0552
Registrar: NameBright.com (http://www.namebright.com)
Domain Name: NaturalLlc.com
Creation Date: 7/25/2009
Expiration Date: 7/25/2011
Last Updated Date: 9/8/2010
Domain Locked: True
Administrative Contact:
HugeDomains domains@hugedomains.com
THIS DOMAIN IS FOR SALE
535 Clarkson Street
Denver, CO 80218
US
(303) 893-0552
Technical Contact:
HugeDomains domains@hugedomains.com
THIS DOMAIN IS FOR SALE
535 Clarkson Street
Denver, CO 80218
US
(303) 893-0552
Nameservers:
ns1.namebrightdns.com
ns2.namebrightdns.com
___________________
The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is: http://www.spamhaus.org/rokso/evidence/ROK9632/quick-cart-pro/AKA: naturalllc.com (Natural Lotus LLC)/Ailos Mordechai
http://www.spamhaus.org/rokso/evidence/ROK9451/quick-cart-pro/aka-naturalllc.com-natural-lotus-llc-ailos-mordechai
212.100.249.166 resolves to web1.flowerangels.com.
The following A records are set to 212.100.249.166:
- flowerangels.com
- hipio.com
- intense-events.com
- intenseevents.com
- isitdodgy.com
- m8u.com
- mad4portugal.com
- ns.flowerangels.com
- ns.hipio.com
- ns.intense-events.com
- ns.intenseevents.com
- ns.m8u.com
- ns.mad4portugal.com
- ns.the-xfactor.biz
- ns.theglobalopen.com
- ns2.m8u.com
- ns2.the-xfactor.biz
- scamadviser.com
- scamadvisor.com
- scamadvisors.com
- scambouncers.com
- the-xfactor.biz
Address lookup
canonical name scamadvisor.com
aliases
addresses 212.100.249.166
Domain Whois record
Queried whois.internic.net with “dom scamadvisor.com
Domain Name: SCAMADVISOR.COM
Registrar: TURNCOMMERCE, INC. DBA NAMEBRIGHT.COM
Whois Server: whois.namebright.com
Referral URL: http://www.namebright.com
Name Server: NS1.RACKSPACE.COM
Name Server: NS2.RACKSPACE.COM
Status: clientTransferProhibited
Updated Date: 13-mar-2012
Creation Date: 28-may-2009
Expiration Date: 28-may-2013
Last update of whois database: Sun, 27 May 2012 14:25:10 UTC
Queried whois.namebright.com with “scamadvisor.com”…
Registrant:
domain_admin@scamadviser.com
Scamadviser Ltd (Company No.: 07999420)
SCAMADVISER LIMITED
3 CHARNWOOD STREET
DERBY, DE1 2GY
United Kingdom
+448712309525
Registrar: NameBright.com (http://www.namebright.com)
Domain Name: ScamAdvisor.com
Creation Date: 5/28/2012
Expiration Date: 5/28/2013
Last Updated Date: 3/13/2012
Domain Locked: True
Administrative Contact:
domain_admin@scamadviser.com
Scamadviser Ltd (Company No.: 07999420)
SCAMADVISER LIMITED
3 CHARNWOOD STREET
DERBY, DE1 2GY
United Kingdom
+448712309525
Technical Contact:
domain_admin@scamadviser.com
Scamadviser Ltd (Company No.: 07999420)
SCAMADVISER LIMITED
3 CHARNWOOD STREET
DERBY, DE1 2GY
United Kingdom
+448712309525
Nameservers:
ns1.rackspace.com
ns2.rackspace.com
Network Whois record
Queried whois.ripe.net with “-B 212.100.249.166″…
Information related to ‘212.100.249.128 – 212.100.249.191’
inetnum: 212.100.249.128 – 212.100.249.191
netname: RSPC-UK-RACKSPACE-INTERNAL
remarks:
descr: Rackspace Managed Hosting
country: GB
admin-c: IA247-RIPE
tech-c: IA247-RIPE
remarks: rev-srv: ns.rackspace.com
status: ASSIGNED PA
notify: hostmaster@rackspace.com
mnt-by: RSPC-MNT
changed: hostmaster@rackspace.com 20060515
source: RIPE
remarks: rev-srv attribute deprecated by RIPE NCC on 02/09/2009
person: IP Admin
address: Rackspace Managed Hosting
112 E. Pecan St. Suite 600
San Antonio, Texas 78205
phone: +1 210 892 4000
fax-no: +1 210 892 4329
e-mail: ipadmin@rackspace.com
nic-hdl: IA247-RIPE
remarks: ### Rackspace Abuse Department
remarks: ### Please send any complaints to the following:
remarks: ### abuse@rackspace.com
notify: ipadmin@rackspace.com
mnt-by: RSPC-MNT
changed: ipadmin@rackspace.com 20021021
source: RIPE
% Information related to ‘212.100.224.0/19AS15395’
route: 212.100.224.0/19
descr: RSPC
origin: AS15395
mnt-by: RSPC-MNT
changed: hostmaster@rackspace.com 20031017
source: RIPE
% This query was served by the RIPE Database Query Service version 1.9.3 (WHOIS2)
DNS records
name class type data time to live
scamadvisor.com IN SOA
server: ns.rackspace.com
email: hostmaster@rackspace.com
serial: 1335593503
refresh: 3600
retry: 300
expire: 1814400
minimum ttl: 300
300s (00:05:00)
scamadvisor.com IN NS ns.rackspace.com 86400s (1.00:00:00)
scamadvisor.com IN NS ns2.rackspace.com 86400s (1.00:00:00)
scamadvisor.com IN A 212.100.249.166 86400s (1.00:00:00)
166.249.100.212.in-addr.arpa IN PTR web1.flowerangels.com 300s (00:05:00)
249.100.212.in-addr.arpa IN SOA
server: ns.rackspace.com
email: hostmaster@rackspace.com
serial: 1332838907
refresh: 3600
retry: 300
expire: 1814400
minimum ttl: 300
86400s (1.00:00:00)
249.100.212.in-addr.arpa IN RRSIG
type covered: NSEC (47)
algorithm: RSA/SHA-1 (5)
labels: 5
original ttl: 7200 (02:00:00)
signature expiration: 2012-06-26 10:00:42Z
signature inception: 2012-05-27 09:00:42Z
key tag: 41410
signer’s name: 212.in-addr.arpa
signature:
(1024 bits)
7AB57FB7ACCE3A5B484F8EC9A2A0BE3C
E8205FBB49E8FFB3F6D24752DFEFC8C5
61CBC7F43608D5C84EB349445C5A532B
FB837D2736EDA0EB09C2092FF29C6A4B
08DBC888EF30FA20D623B75B151F99FA
59D6C8561912AE74A724C2D5D90E2E5F
596AB502FB49C6D669DDCE17174C3362
16C398E0C6BD403F69D5030A35730B43
7200s (02:00:00)
249.100.212.in-addr.arpa IN NSEC
next domain name: 250.100.212.in-addr.arpa
record types: NS RRSIG NSEC
7200s (02:00:00)
249.100.212.in-addr.arpa IN NS ns2.rackspace.com 3600s (01:00:00)
249.100.212.in-addr.arpa IN NS ns.rackspace.com 3600s (01:00:00)
— end —
Address lookup
canonical name mad4stuff.co.uk
aliases
addresses 212.100.249.166
Domain Whois record
Queried whois.nic.uk with “mad4stuff.co.uk
Domain name:
mad4stuff.co.uk
Registrant:
Marc Roberts
Registrant type:
UK Individual
Registrant’s address:
Chapel House Barn
Thurvaston Lane
Longford Ashbourne
DE6 3DU
United Kingdom
Registrar:
Webfusion Ltd t/a 123-reg [Tag = 123-REG]
URL: http://www.123-reg.co.uk
Relevant dates:
Registered on: 18-Nov-2005
Expiry date: 18-Nov-2013
Last updated: 06-Jan-2012
Registration status:
Registered until expiry date.
Name servers:
ns.mad4stuff.co.uk 212.100.249.166
ns.rackspace.com
WHOIS lookup made at 15:22:29 27-May-2012
Network Whois record
Queried whois.ripe.net with “-B 212.100.249.166
Information related to ‘212.100.249.128 – 212.100.249.191’
inetnum: 212.100.249.128 – 212.100.249.191
netname: RSPC-UK-RACKSPACE-INTERNAL
remarks:
descr: Rackspace Managed Hosting
country: GB
admin-c: IA247-RIPE
tech-c: IA247-RIPE
remarks: rev-srv: ns.rackspace.com
status: ASSIGNED PA
notify: hostmaster@rackspace.com
mnt-by: RSPC-MNT
changed: hostmaster@rackspace.com 20060515
source: RIPE
remarks: rev-srv attribute deprecated by RIPE NCC on 02/09/2009
person: IP Admin
address: Rackspace Managed Hosting
112 E. Pecan St. Suite 600
San Antonio, Texas 78205
phone: +1 210 892 4000
fax-no: +1 210 892 4329
e-mail: ipadmin@rackspace.com
nic-hdl: IA247-RIPE
remarks: ### Rackspace Abuse Department
remarks: ### Please send any complaints to the following:
remarks: ### abuse@rackspace.com
notify: ipadmin@rackspace.com
mnt-by: RSPC-MNT
changed: ipadmin@rackspace.com 20021021
source: RIPE
Information related to ‘212.100.224.0/19AS15395’
route: 212.100.224.0/19
descr: RSPC
origin: AS15395
mnt-by: RSPC-MNT
changed: hostmaster@rackspace.com 20031017
source: RIPE
% This query was served by the RIPE Database Query Service version 1.9.3 (WHOIS2)
DNS records
name class type data time to live
mad4stuff.co.uk IN MX
preference: 10
exchange: mail.mad4stuff.co.uk
86400s (1.00:00:00)
mad4stuff.co.uk IN SOA
server: ns.mad4stuff.co.uk
email: marc@hipio.com
serial: 1219912985
refresh: 10800
retry: 3600
expire: 604800
minimum ttl: 10800
86400s (1.00:00:00)
mad4stuff.co.uk IN NS ns.mad4stuff.co.uk 86400s (1.00:00:00)
mad4stuff.co.uk IN A 212.100.249.166 86400s (1.00:00:00)
166.249.100.212.in-addr.arpa IN PTR web1.flowerangels.com 300s (00:05:00)
249.100.212.in-addr.arpa IN SOA
server: ns.rackspace.com
email: hostmaster@rackspace.com
serial: 1332838907
refresh: 3600
retry: 300
expire: 1814400
minimum ttl: 300
86400s (1.00:00:00)
249.100.212.in-addr.arpa IN RRSIG
type covered: NSEC (47)
algorithm: RSA/SHA-1 (5)
labels: 5
original ttl: 7200 (02:00:00)
signature expiration: 2012-06-26 10:00:42Z
signature inception: 2012-05-27 09:00:42Z
key tag: 41410
signer’s name: 212.in-addr.arpa
signature:
(1024 bits)
7AB57FB7ACCE3A5B484F8EC9A2A0BE3C
E8205FBB49E8FFB3F6D24752DFEFC8C5
61CBC7F43608D5C84EB349445C5A532B
FB837D2736EDA0EB09C2092FF29C6A4B
08DBC888EF30FA20D623B75B151F99FA
59D6C8561912AE74A724C2D5D90E2E5F
596AB502FB49C6D669DDCE17174C3362
16C398E0C6BD403F69D5030A35730B43
7200s (02:00:00)
249.100.212.in-addr.arpa IN NSEC
next domain name: 250.100.212.in-addr.arpa
record types: NS RRSIG NSEC
7200s (02:00:00)
249.100.212.in-addr.arpa IN NS ns2.rackspace.com 3600s (01:00:00)
249.100.212.in-addr.arpa IN NS ns.rackspace.com 3600s (01:00:00)
— end —
Whois Server Version 2.0
Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.
Domain Name: NAMEBRIGHTDNS.COM
Registrar: TURNCOMMERCE, INC. DBA NAMEBRIGHT.COM
Whois Server: whois.namebright.com
Referral URL: http://www.namebright.com
Name Server: NS1.AUTHORITATIVEDNS.COM
Name Server: NS2.AUTHORITATIVEDNS.COM
Status: ok
Updated Date: 05-jul-2011
Creation Date: 15-jun-2009
Expiration Date: 15-jun-2012
Lasst update of whois database: Sun, 27 May 2012 14:47:52 UTC
The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.Registrant:
Andrew Reberry andrew_reberry@hotmail.com
1422 Delgany Street
Suite 400
Denver, CO 80202
US
+1.303.249.9750
Registrar: NameBright.com (http://www.namebright.com)
Domain Name: NameBrightDNS.com
Creation Date: 6/15/2009
Expiration Date: 6/15/2012
Last Updated Date: 6/9/2011
Administrative Contact:
Andrew Reberry andrew_reberry@hotmail.com
1422 Delgany Street
Suite 400
Denver, CO 80202
US
+1.303.249.9750
Technical Contact:
Andrew Reberry andrew_reberry@hotmail.com
1422 Delgany Street
Suite 400
Denver, CO 80202
US
+1.303.249.9750
Nameservers:
NS2.AUTHORITATIVEDNS.COM
NS1.AUTHORITATIVEDNS.COM
scamFRAUDalert®Pharmacies Checker 