Stolen Identity Canadian Pharmacy – pfizer-incorporated.com

July 4, 2009Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Address lookup

canonical name	pfizer-incorporated.com.
aliases
addresses	91.207.4.202

Domain Whois record

Queried whois.internic.net with “dom pfizer-incorporated.com“…

   Domain Name: PFIZER-INCORPORATED.COM
   Registrar: ONLINENIC, INC.
   Whois Server: whois.onlinenic.com
   Referral URL: http://www.OnlineNIC.com
   Name Server: NS1.PFIZER-INCORPORATED.COM
   Name Server: NS2.PFIZER-INCORPORATED.COM
   Name Server: NS3.PFIZER-INCORPORATED.COM
   Name Server: NS4.PFIZER-INCORPORATED.COM
   Status: clientTransferProhibited
   Updated Date: 02-jul-2009
   Creation Date: 02-jul-2009
   Expiration Date: 02-jul-2010

>>> Last update of whois database: Sat, 04 Jul 2009 11:41:46 UTC <<<

Queried whois.onlinenic.com with “pfizer-incorporated.com“…

Registrant:
	 Deloris P Perticone fake_4b72bf7b5551be0072b6f3e6d6925864@smartdesign.by +7.4294967295
	 N/A
	 ul. Tsentral'naya, d. 18, kv. 11
	 Moskva,Moskovskaya obl.,RUSSIAN FEDERATION 101000

Domain Name:pfizer-incorporated.com 
Record last updated at 2009-07-02 10:19:48
Record created on 2009/7/2
Record expired on 2010/7/2

Domain servers in listed order:
	 ns1.pfizer-incorporated.com 	 ns2.pfizer-incorporated.com 

Administrator:
	 name: Deloris P Perticone
 mail: fake_4b72bf7b5551be0072b6f3e6d6925864@smartdesign.by tel: +7.4294967295
	 org: N/A

address: ul. Tsentral'naya, d. 18, kv. 11
	 city: Moskva
,province: Moskovskaya obl.
,country: RUSSIAN FEDERATION
 postcode: 101000

Technical Contactor:
	 name: Deloris P Perticone
 mail: fake_4b72bf7b5551be0072b6f3e6d6925864@smartdesign.by tel: +7.4294967295
	 org: N/A

address: ul. Tsentral'naya, d. 18, kv. 11
	 city: Moskva
,province: Moskovskaya obl.
,country: RUSSIAN FEDERATION
 postcode: 101000

Billing Contactor:
	 name: Deloris P Perticone
 mail: fake_4b72bf7b5551be0072b6f3e6d6925864@smartdesign.by tel: +7.4294967295
	 org: N/A

address: ul. Tsentral'naya, d. 18, kv. 11
	 city: Moskva
,province: Moskovskaya obl.
,country: RUSSIAN FEDERATION
 postcode: 101000

Registration Service Provider:
	name: Serpino Berbeto 
	tel: +1.2128848801
 	fax: +1.2128848801
 	web:

Network Whois record

Queried whois.ripe.net with “-B 91.207.4.202“…

% Information related to '91.207.4.0 - 91.207.9.255'

inetnum:        91.207.4.0 - 91.207.9.255
netname:        SteepHost-DC-UA
descr:          SteepHost.COM Datacentre Allocation
descr:          +380-63-618-45-00
descr:          +380-67-375-27-03
remarks:        Please send all spam/scam/fraud abuse to abuse@steephost.com
country:        UA
org:            ORG-SH7-RIPE
admin-c:        SH3855-RIPE
tech-c:         SH3855-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-HM-PI-MNT
mnt-by:         SH3855-MNT
mnt-lower:      RIPE-NCC-HM-PI-MNT
mnt-routes:     SH3855-MNT
mnt-domains:    SH3855-MNT
changed:        hostmaster@ripe.net 20080911
source:         RIPE

organisation:   ORG-SH7-RIPE
org-name:       SteepHost DC-UA
descr:          SteepHost.COM Datacentre Allocation
org-type:       OTHER
address:        Kosmicheskaya 21 of.310
address:        61072, Kharkiv, Ukraine
phone:          +380-63-618-45-00
phone:          +380-67-375-27-03
e-mail:         noc@steephost.com
abuse-mailbox:  abuse@steephost.com
mnt-ref:        SH3855-MNT
mnt-by:         SH3855-MNT
changed:        vvs@teleportsv.net 20080421
changed:        hostmaster@ripe.net 20080911
source:         RIPE

role:           SteepHost DC-UA
address:        Kosmicheskaya 21 of.310
address:        61072, Kharkiv, Ukraine
phone:          +380-63-618-45-00
phone:          +380-67-375-27-03
e-mail:         noc@steephost.com
abuse-mailbox:  abuse@steephost.com
admin-c:        AK5709-RIPE
tech-c:         AK5709-RIPE
nic-hdl:        SH3855-RIPE
mnt-by:         SH3855-MNT
changed:        vvs@teleportsv.net 20080421
source:         RIPE

% Information related to '91.207.4.0/22AS47142'

route:          91.207.4.0/22
descr:          SteepHost DC-UA
descr:          SteepHost.COM Datacentre Allocation
descr:          +380-67-375-27-03
descr:          +380-63-618-45-00
descr:          Please send all spam/scam/fraud abuse to abuse@steephost.com
origin:         AS47142
mnt-by:         SH3855-MNT
changed:        noc@steephost.com 20080911
source:         RIPE

DNS records

DNS query for 202.4.207.91.in-addr.arpa returned an error from the server: ServerFailure

name	class	type	data	time to live
pfizer-incorporated.com	IN	A	91.207.4.202	3600s	(01:00:00)

— end —

MyNewCanadianPharmacy – www.bulnalei.net

July 4, 2009Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Address lookup

canonical name	bulnalei.net.
aliases
addresses	212.174.200.111

Domain Whois record

Queried whois.internic.net with “dom bulnalei.net“…

   Domain Name: BULNALEI.NET
   Registrar: ONLINE SAS
   Whois Server: whois.bookmyname.com
   Referral URL: http://www.bookmyname.com
   Name Server: NS1.BV9.RU
   Name Server: NS2.THEPILLRX.COM
   Status: clientTransferProhibited
   Updated Date: 19-jun-2009
   Creation Date: 15-jun-2009
   Expiration Date: 15-jun-2010

Last update of whois database: Sat, 04 Jul 2009 17:16:43 UTC <<<

Queried whois.bookmyname.com with “bulnalei.net“…

Date: 2009/07/04 19:17:10

Domain Name:bulnalei.net
Domain registrar_creation:2009-06-15 21:49:02
Domain registrar_expiration:2010-06-15 21:49:02
Domain registry_creation:2009-06-15 21:49:02
Domain registry_expiration:2010-06-15 21:49:02
Domain lastupdate:2009-06-19 21:03:58
Name Server:ns1.bv9.ru
Name Server:ns2.thepillrx.com

Owner ID: FREE-ORG-258998
Owner Name: Suzanne STRINGER
Owner Street1: 2502 Nettlow Ln
Owner City: WIMAUMA
Owner Postal Code: 33598
Owner Country: UNITED STATES OF AMERICA
Owner Phone: +1.8136330406
Owner Email: 58ae9edc.258998@contacts.nospam.free.org
Owner lastupdate: 2009-06-15 21:48:28

Admin ID: FREE-ORG-258998
Admin Name: Suzanne STRINGER
Admin Street1: 2502 Nettlow Ln
Admin City: WIMAUMA
Admin Postal Code: 33598
Admin Country: UNITED STATES OF AMERICA
Admin Phone: +1.8136330406
Admin Email: 58ae9edc.258998@contacts.nospam.free.org
Admin lastupdate: 2009-06-15 21:48:28

Tech ID: FREE-ORG-258998
Tech Name: Suzanne STRINGER
Tech Street1: 2502 Nettlow Ln
Tech City: WIMAUMA
Tech Postal Code: 33598
Tech Country: UNITED STATES OF AMERICA
Tech Phone: +1.8136330406
Tech Email: 58ae9edc.258998@contacts.nospam.free.org
Tech lastupdate: 2009-06-15 21:48:28

Bill ID: FREE-ORG-258998
Bill Name: Suzanne STRINGER
Bill Street1: 2502 Nettlow Ln
Bill City: WIMAUMA
Bill Postal Code: 33598
Bill Country: UNITED STATES OF AMERICA
Bill Phone: +1.8136330406
Bill Email: 58ae9edc.258998@contacts.nospam.free.org
Bill lastupdate: 2009-06-15 21:48:28

For support or more information about this domain name please contact
<a href="http://www.bookmyname.com/">http://www.bookmyname.com/</a>

Network Whois record

Queried whois.ripe.net with “-B 212.174.200.111“…

% Information related to '212.174.200.96 - 212.174.200.127'

inetnum:        212.174.200.96 - 212.174.200.127
netname:        StarBilisim
descr:          Tunali Hilmi Caddesi. No:8/C ANKARA
country:        TR
admin-c:        MA9158-RIPE
tech-c:         MA9158-RIPE
status:         ASSIGNED PA
mnt-by:         AS9121-MNT
changed:        ipg@turktelekom.com.tr 20090420
source:         RIPE

person:         Mustafa Aktul
remarks:        StarBilisim
address:        Tunali Hilmi Caddesi. No:8/C ANKARA
e-mail:         ip@starbilisim.org
phone:          +903124439388
nic-hdl:        MA9158-RIPE
changed:        ipg@turktelekom.com.tr 20090420
source:         RIPE

% Information related to '212.174.0.0/16AS9121'

route:        212.174.0.0/16
descr:        TurkTelecom
origin:       AS9121
mnt-by:       AS9121-MNT
changed:      dnsadmin@turnet.net.tr 19990803
source:       RIPE

% Information related to '212.174.128.0/17AS9121'

route:        212.174.128.0/17
descr:        TurkTelecom
origin:       AS9121
mnt-by:       AS9121-MNT
changed:      ipg@turktelekom.com.tr 20041214
source:       RIPE

DNS records

DNS query for 111.200.174.212.in-addr.arpa returned an error from the server: NameError

name

class

type

data

time to live

bulnalei.net

SOA

server:	ns1.bulnalei.net
email:	admin.bulnalei.net
serial:	2005000000
refresh:	600
retry:	900
expire:	1209600
minimum ttl:	43200

600s

(00:10:00)

bulnalei.net

ns1.bulnalei.net

600s

(00:10:00)

bulnalei.net

ns2.bulnalei.net

600s

(00:10:00)

bulnalei.net

preference:	10
exchange:	mail.bulnalei.net

600s

(00:10:00)

bulnalei.net

212.174.200.111

600s

(00:10:00)

— end —

MyCanadianPharmacy Scam – greatpharmacyrxpads.net

July 4, 2009Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Behind The Online Pharmacy

Today a shadowy, transnational network of illicit drug manufacturers, traders, doctors, Web site operators, spammers and criminals makes up the online pharmacy world.

Buying Medication Online Can Be Safe

There are many options out there when it comes to buying medication online. We have looked at websites after websites. Some sites feature offshore pharmacies that do not require a prior prescription. Others feature licensed pharmacies that do require a prescription from your doctor.
Before making a purchase that can effect your health, we strongly recommend that you consult your physician & DO NOT self-medicate. Ordering medication online can be a safe, money-saving experience. When done through licensed online pharmacies that require a prescription, you can be assured that the medication you get is exactly what you need to treat your ailments.

Address lookup

canonical name	greatpharmacyrxpads.net.
aliases
addresses	212.174.200.111

Domain Whois record

Queried whois.internic.net with “dom greatpharmacyrxpads.net“…

   Domain Name: GREATPHARMACYRXPADS.NET
   Registrar: 12 REGISTER BV
   Whois Server: whois.yoursrs.com
   Referral URL: http://www.yoursrs.com
   Name Server: NS1.BH4.RU
   Name Server: NS2.BESTPHARMACYOUTLET.NET
   Status: ok
   Updated Date: 17-jun-2009
   Creation Date: 19-may-2009
   Expiration Date: 19-may-2010

>>> Last update of whois database: Sat, 04 Jul 2009 16:51:38 UTC <<<

Queried whois.yoursrs.com with “greatpharmacyrxpads.net“…

Domain Name:greatpharmacyrxpads.net
Name Server:ns1.bh4.ru
Name Server:ns2.bestpharmacyoutlet.net
Created On:2009-05-19
Last Updated On:2009-06-17
Expiration Date:2010-05-19
Dealer:xss
Registrant ID:AntonNikiforov
Registrant Name:Anton Nikiforov
Registrant Organization:
Registrant Street1:ulitsa Smolnaya d.21 kv.360
Registrant Street2:
Registrant Street3:
Registrant City:Moskva
Registrant State/Province:Moskva
Registrant Postal Code:125445
Registrant Country:RU
Registrant Phone:+7.4957412992
Registrant Fax:
Registrant Email:nikiforov@seostudio.at
Admin ID:AlexanderBarkhatov
Admin Name:Alexander Barkhatov
Admin Organization:
Admin Street1:Perviy Mikrorajon dom 23 kv.177
Admin Street2:
Admin Street3:
Admin City:Kurganskaya oblast
Admin State/Province:Kurgan
Admin Postal Code:640024
Admin Country:RU
Admin Phone:+7.3522462300
Admin Fax:
Admin Email:barhatov@seostudio.at
Billing ID:AlexanderBarkhatov
Billing Name:Alexander Barkhatov
Billing Organization:
Billing Street1:Perviy Mikrorajon dom 23 kv.177
Billing Street2:
Billing Street3:
Billing City:Kurganskaya oblast
Billing State/Province:Kurgan
Billing Postal Code:640024
Billing Country:RU
Billing Phone:+7.3522462300
Billing Fax:
Billing Email:barhatov@seostudio.at
Tech ID:AlexanderBarkhatov
Tech Name:Alexander Barkhatov
Tech Organization:
Tech Street1:Perviy Mikrorajon dom 23 kv.177
Tech Street2:
Tech Street3:
Tech City:Kurganskaya oblast
Tech State/Province:Kurgan
Tech Postal Code:640024
Tech Country:RU
Tech Phone:+7.3522462300
Tech Fax:
Tech Email:barhatov@seostudio.at

Network Whois record

Queried whois.ripe.net with “-B 212.174.200.111“…

% Information related to '212.174.200.96 - 212.174.200.127'

inetnum:        212.174.200.96 - 212.174.200.127
netname:        StarBilisim
descr:          Tunali Hilmi Caddesi. No:8/C ANKARA
country:        TR
admin-c:        MA9158-RIPE
tech-c:         MA9158-RIPE
status:         ASSIGNED PA
mnt-by:         AS9121-MNT
changed:        ipg@turktelekom.com.tr 20090420
source:         RIPE

person:         Mustafa Aktul
remarks:        StarBilisim
address:        Tunali Hilmi Caddesi. No:8/C ANKARA
e-mail:         ip@starbilisim.org
phone:          +903124439388
nic-hdl:        MA9158-RIPE
changed:        ipg@turktelekom.com.tr 20090420
source:         RIPE

% Information related to '212.174.0.0/16AS9121'

route:        212.174.0.0/16
descr:        TurkTelecom
origin:       AS9121
mnt-by:       AS9121-MNT
changed:      dnsadmin@turnet.net.tr 19990803
source:       RIPE

% Information related to '212.174.128.0/17AS9121'

route:        212.174.128.0/17
descr:        TurkTelecom
origin:       AS9121
mnt-by:       AS9121-MNT
changed:      ipg@turktelekom.com.tr 20041214
source:       RIPE

DNS records

DNS query for 111.200.174.212.in-addr.arpa returned an error from the server: NameError

name

class

type

data

time to live

greatpharmacyrxpads.net

SOA

server:	ns1.greatpharmacyrxpads.net
email:	admin.greatpharmacyrxpads.net
serial:	2005000000
refresh:	600
retry:	900
expire:	1209600
minimum ttl:	43200

600s

(00:10:00)

greatpharmacyrxpads.net

ns1.greatpharmacyrxpads.net

600s

(00:10:00)

greatpharmacyrxpads.net

ns2.greatpharmacyrxpads.net

600s

(00:10:00)

greatpharmacyrxpads.net

preference:	10
exchange:	mail.greatpharmacyrxpads.net

600s

(00:10:00)

greatpharmacyrxpads.net

212.174.200.111

600s

(00:10:00)

— end —

medsyourhealth.com – Canadian Health&Care Mall ALANTRON BLTD.
superdrugtoretablets.com – Canadian Health&Care Mall COMMUNIGAL COMMUNICATIONS LTD
avkjiw.cn – Canadian Health&Care Mall ENAME.COM
vmkhiue.cn – Canadian Health&Care Mall ENAME.COM
nyovbaibgeu.com – Canadian Health&Care Mall GLOBEDOM DATENKOMMUNIKATIONS GMBH
sdolezyql.com – Canadian Health&Care Mall GLOBEDOM DATENKOMMUNIKATIONS GMBH
meardepryr.com – Canadian Health&Care Mall KEY-SYSTEMS GMBH
epoxfyud.com – Canadian Health&Care Mall MONIKER ONLINE SERVICES, INC.
rysvapjoed.com – Canadian Health&Care Mall REGISTER.COM, INC.
greatpharmacyrxpads.net – My Canadian Pharmacy 12 REGISTER BV
apnerpov.com – My Canadian Pharmacy EASYDNS TECHNOLOGIES, INC.
medshealthdrugstoresite.com – My Canadian Pharmacy VISESH INFOTECNICS LTD
bulnalei.com – MyNewCanadianPharmacy 1 & 1 INTERNET AG
umzimsotu.com – MyNewCanadianPharmacy 101DOMAIN, INC.
bulnalei.net – MyNewCanadianPharmacy ONLINE SAS
elpulkut.com – MyNewCanadianPharmacy ONLINE SAS
elpulkut.net – USDrugs RANGER REGISTRATION (MADEIRA) LLC.
pharmacytabletspill.net – USDrugs 12 REGISTER BV
healthgiftstore.com – USDrugs COMMUNIGAL COMMUNICATIONS LTD
pipzulaw.com – USDrugs DIRECTNIC.COM
healthplansmarket.com – USDrugs IA REGISTRY
hlounykry.com – USDrugs WEBNAMES.CA INC.

Canadian Pharmacy – Vision Rx – pharmacyvis.com

July 4, 2009Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Address lookup

canonical name	pharmacyvis.com.
aliases
addresses	87.117.238.179

Domain Whois record

Queried whois.internic.net with “dom pharmacyvis.com“…

   Domain Name: PHARMACYVIS.COM
   Registrar: NAMESCOUT CORP
   Whois Server: whois.namescout.com
   Referral URL: http://www.namescout.com
   Name Server: NS1.PHARMACYVIS.COM
   Name Server: NS2.PHARMACYVIS.COM
   Status: ok
   Updated Date: 15-dec-2008
   Creation Date: 16-jul-2007
   Expiration Date: 16-jul-2011

Last update of whois database: Sat, 04 Jul 2009 09:19:16 UTC

Queried whois.namescout.com with “pharmacyvis.com“…

Domain: pharmacyvis.com

  Date Registered: 12/15/08
    Date Modified: 12/15/08
      Expiry Date: 07/16/11
      	     DNS1: ns1.pharmacyvis.com
      	     DNS2: ns2.pharmacyvis.com

  Registrant

                   VISION RX LTD
                   VISION RX
                   303 Aarti Chamber
                   Victoria, -- (SC)
                   0000

  Administrative Contact

                   VISION RX
                   VISION RX
                   303 Aarti Chamber
                   Victoria, -- (SC)
                   0000
                   support@rxvis.com
                   +08.5462578

  Technical Contact

                   VISION RX
                   VISION RX
                   303 Aarti Chamber
                   Victoria, -- (SC)
                   0000
                   support@rxvis.com
                   +08.5462578

        Registrar: Namescout.com

Register your domain now at www.Namescout.com

Network Whois record

Queried whois.ripe.net with “-B 87.117.238.179“…

% Information related to '87.117.238.0 - 87.117.238.255'

inetnum:        87.117.238.0 - 87.117.238.255
netname:        EUKHOST-2
descr:          EUKHOST LTD
country:        GB
admin-c:        RK3101-RIPE
tech-c:         RK3101-RIPE
status:         ASSIGNED PA
mnt-by:         RAPIDSWITCH-MNT
changed:        abuse@rapidswitch.com 20070212
source:         RIPE

person:         Robert King
address:        EUKHOST Ltd
address:        24 Clarence Street
address:        Bowburn,
address:        Durham,
address:        DH6 5BB
address:        England, UK
phone:          +44 (0)7753 341080
e-mail:         sales@eukhost.com
nic-hdl:        RK3101-RIPE
changed:        abuse@rapidswitch.com 20061110
mnt-by:         RAPIDSWITCH-MNT
source:         RIPE

% Information related to '87.117.192.0/18AS29131'

route:          87.117.192.0/18
descr:          RapidSwitch Ltd
origin:         AS29131
mnt-by:         RAPIDSWITCH-MNT
changed:        abuse@rapidswitch.com 20051119
source:         RIPE

DNS records

name

class

type

data

time to live

pharmacyvis.com

preference:	0
exchange:	pharmacyvis.com

14400s

(04:00:00)

pharmacyvis.com

SOA

server:	ns1.pharmacyvis.com
email:	dnsadmin.vps5437.webhosting.uk.com
serial:	2009011400
refresh:	86400
retry:	7200
expire:	3600000
minimum ttl:	86400

86400s

(1.00:00:00)

pharmacyvis.com

ns1.pharmacyvis.com

86400s

(1.00:00:00)

pharmacyvis.com

ns2.pharmacyvis.com

86400s

(1.00:00:00)

pharmacyvis.com

87.117.238.179

14400s

(04:00:00)

179.238.117.87.in-addr.arpa

PTR

pharmacyvis.com

10800s

(03:00:00)

— end —

WhoIs 89.189.191.95 – warez-free-all

July 3, 2009Leave a comment

Consumer & Business Alert – Stolen Identity!!!!
This Is A Fraudulent Website
Phishing or Identity Theft
Do Not Conduct or Transact Business With Them

89.189.191.95

Address lookup

canonical name	gw-95.211.ru.
aliases
addresses	89.189.191.95

Domain Whois record

Queried whois.ripn.net with “211.ru“…

warez-free-all.blogspot.com/
Author : Virtualia (IP: 89.189.191.95 , gw-95.211.ru)
E-mail : virt@gmail.com

% By submitting a query to RIPN's Whois Service
% you agree to abide by the following terms of use:
% http://www.ripn.net/about/servpol.html#3.2 (in Russian)
% http://www.ripn.net/about/en/servpol.html#3.2 (in English).

domain:     211.RU
type:       CORPORATE
nserver:    ns.211.ru. 193.238.131.195
nserver:    ns2.211.ru. 89.189.191.224
state:      REGISTERED, DELEGATED
org:        Ltd. "Siberian Networks"
phone:      +7 383 2209211
phone:      +7 383 2209280
fax-no:     +7 383 2209211
e-mail:     noc@211.ru
registrar:  RUCENTER-REG-RIPN
created:    2004.06.16
paid-till:  2010.06.16
source:     TC-RIPN

Last updated on 2009.07.04 04:54:11 MSK/MSD

Network Whois record

Queried whois.ripe.net with “-B 89.189.191.95“…

% Information related to '89.189.184.0 - 89.189.191.255'

inetnum:        89.189.184.0 - 89.189.191.255
netname:        RU-ISP-SIBNET-NSK-2
descr:          Siberian Networks
country:        RU
admin-c:        SAS-RIPE
tech-c:         SAS-RIPE
status:         ASSIGNED PA
mnt-by:         CityNetLtd-MNT
changed:        rage@kuz.ru 20070301
source:         RIPE

person:         Stanislav A. Svirid
address:        Siberian Networks
address:        21/1, Dachnaya Street
address:        630082, Novosibirsk
address:        Russia
phone:          +7 383 2209280
fax-no:         +7 383 2209211
nic-hdl:        SAS-RIPE
e-mail:         count@211.ru
notify:         count@211.ru
notify:         noc@211.ru
mnt-by:         SIBNET-NSK-MNT
changed:        sva@riss-telecom.ru 20001102
changed:        frolov@riss-telecom.ru 20021218
changed:        count@211.ru 20070322
source:         RIPE

% Information related to '89.189.184.0/21AS34757'

route:          89.189.184.0/21
descr:          Siberian Networks ltd Autonomous System
origin:         AS34757
mnt-by:         CityNetLtd-MNT
changed:        rage@kuz.ru 20070322
source:         RIPE

% Information related to '89.189.176.0/20AS34757'

route:          89.189.176.0/20
descr:          Siberian Networks ltd Autonomous System
origin:         AS34757
mnt-by:         CityNetLtd-MNT
changed:        rage@kuz.ru 20080328
source:         RIPE

DNS records

name

class

type

data

time to live

gw-95.211.ru

89.189.191.95

43200s

(12:00:00)

211.ru

SOA

server:	ns2.211.ru
email:	noc.211.ru
serial:	2009063002
refresh:	43200
retry:	3600
expire:	1209600
minimum ttl:	86400

43200s

(12:00:00)

211.ru

TXT

v=spf1 ip4:193.238.128.0/22 ip4:89.189.176.0/20 ip4:80.64.168.0/21 ip4:217.106.28.136/30 mx ptr mx:193.238.131.194 ~all

43200s

(12:00:00)

211.ru

193.238.131.200

43200s

(12:00:00)

211.ru

preference:	0
exchange:	mx.211.ru

43200s

(12:00:00)

211.ru

ns.211.ru

43200s

(12:00:00)

211.ru

ns2.211.ru

43200s

(12:00:00)

95.191.189.89.in-addr.arpa

PTR

gw-95.211.ru

Canadian Pharmacy Spam – visitslip.com

July 3, 2009Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Header Analysis

The following IP addresses were extracted from your headers:

IP Address	Probable Country	Additional Info
207.115.20.46	United States (Richardson)*	Whois	Google	DNSStuff	Urgentmessage.org
211.186.220.30	Korea, Republic of (Seoul)*	Whois	Google	DNSStuff	Urgentmessage.org
* The last IP listed is usually the originating IP address

An Incredible Canadian Pharmacy is available at your Fingertips!
*No~Doctor~Needed*! Browse our Site Today! -> http://visitslip.com

From Kristin B. Jacobs Tue Jun 30 12:07:48 2009
Return-Path: <kristin_b.jacobsks@zip.co.nz>
Authentication-Results: mta129.sbc.mail.re3.yahoo.com from=zip.co.nz; domainkeys=neutral (no sig); from=zip.co.nz; dkim=neutral (no sig)
Received: from 207.115.20.46 (EHLO flph263.prodigy.net) (207.115.20.46)
by mta129.sbc.mail.re3.yahoo.com with SMTP; Tue, 30 Jun 2009 03:20:01 -0700
Received: from cmh7fb2 ([211.186.220.30])
by flph263.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n5UAJv6O009087;
Tue, 30 Jun 2009 03:19:59 -0700
Message-ID: <000701c9f9b6$0f0093f0$ae8bf302@zip.co.nz>
Reply-To: “Kristin B. Jacobs” <kristin_b.jacobsks@zip.co.nz>
From: “Kristin B. Jacobs” <kristin_b.jacobsks@zip.co.nz>
To:
Subject: Make you wife moan in pleasure!
Date: Tue, 30 Jun 2009 15:07:48 -0400
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 139

Address lookup

canonical name	visitslip.com.
aliases
addresses	61.191.191.241 119.39.238.2 203.93.208.86 218.75.144.6 222.241.150.146

Domain Whois record

Queried whois.internic.net with “dom visitslip.com“…

   Domain Name: VISITSLIP.COM
   Registrar: CHINA SPRINGBOARD INC.
   Whois Server: whois.namerich.cn
   Referral URL: http://www.namerich.cn
   Name Server: NS1.HEARTCORNER.IN
   Name Server: NS2.HEARTCORNER.IN
   Name Server: NS3.HEAVYMEEK.RU
   Name Server: NS4.HEAVYMEEK.RU
   Name Server: NS5.BLUEAWAKE.COM
   Name Server: NS6.BLUEAWAKE.COM
   Status: ok
   Updated Date: 26-jun-2009
   Creation Date: 26-jun-2009
   Expiration Date: 26-jun-2010

Last update of whois database: Fri, 03 Jul 2009 08:19:02 UTC <<<

Queried whois.namerich.cn with “visitslip.com“…

 DomainName : visitslip.com

RSP: China Springboard Inc.
URL: http://www.namerich.cn      

Name Server......................NS5.BLUEAWAKE.COM
Name Server......................NS6.BLUEAWAKE.COM
Name Server......................NS3.HEAVYMEEK.RU
Name Server......................NS4.HEAVYMEEK.RU
Name Server......................NS1.HEARTCORNER.IN
Name Server......................NS2.HEARTCORNER.IN
Status...........................ok
Creation  Date ..................2009-06-26
Expiration Date .................2010-06-26
Last Update  Date ...............2009-06-26

Registrant ID ...................V-X-58203-13799
Registrant Name .................DU QIAOWEN
Registrant Organization .........DU QIAOWEN
Registrant Address ..............YIYANGLU46
Registrant City..................YY
Registrant Province/State .......HN
Registrant Country Code .........CN
Registrant Postal Code ..........413069
Registrant Phone Number .........+86.073768512419
Registrant Fax ..................+86.073768512419
Registrant Email ................soangka@163.com

Administrative ID ...............V-X-58203-13799
Administrative Name .............DU QIAOWEN
Administrative Organization .....DU QIAOWEN
Administrative Address ..........YIYANGLU46
Administrative City..............YY
Administrative Province/State ...HN
Administrative Country Code .....CN
Administrative Postal Code ......413069
Administrative Phone Number .....+86.073768512419
Administrative Fax ..............+86.073768512419
Administrative Email ............soangka@163.com

Billing ID ......................V-X-58203-13799
Billing Name ....................DU QIAOWEN
Billing Organization ............DU QIAOWEN
Billing Address .................YIYANGLU46
Billing City.....................YY
Billing Province/State ..........HN
Billing Country Code ............CN
Billing Postal Code .............413069
Billing Phone Number ............+86.073768512419
Billing Fax .....................+86.073768512419
Billing Email ...................soangka@163.com

Technical ID ....................V-X-58203-13799
Technical Name ..................DU QIAOWEN
Technical Organization...........DU QIAOWEN
Technical Address ...............YIYANGLU46
Technical City...................YY
Technical Province/State.........HN
Technical Country Code ..........CN
Technical Postal Code ...........413069
Technical Phone Number ..........+86.073768512419
Technical Fax ...................+86.073768512419
Technical Email .................soangka@163.com

; Please register your domains at
; http://www.namerich.cn

Network Whois record

Queried whois.apnic.net with “61.191.191.241“…

inetnum:      61.191.0.0 - 61.191.255.255
netname:      CHINANET-AH
descr:        CHINANET Anhui province network
descr:        China Telecom
descr:        A12,Xin-Jie-Kou-Wai Street
descr:        Beijing 100088
country:      CN
admin-c:      CH93-AP
tech-c:       AT318-AP
mnt-by:       MAINT-CHINANET
mnt-lower:    MAINT-CHINANET-AH
status:       ALLOCATED NON-PORTABLE
changed:      hm-changed@apnic.net 20060314
source:       APNIC

role:         ANHUI TELECOM
address:      305 Changjiang West Road
address:      Hefei Anhui China
country:      CN
phone:        +86 0551 5185089
fax-no:       +86 0551 5185500
e-mail:       wanglinlin2@anhuitelecom.com
trouble:      send spam reports to abuse@ah163.com
trouble:      and abuse reports to abuse@ah163.com
trouble:      Please include detailed information and
trouble:      times in GMT+8:00
admin-c:      LW604-AP
tech-c:       LW604-AP
nic-hdl:      AT318-AP
remarks:      http://www.ah163.net
notify:       wanglinlin2@anhuitelecom.com
mnt-by:       MAINT-CHINANET-AH
changed:      wanglinlin2@anhuitelecom.com 20060323
source:       APNIC

person:       Chinanet Hostmaster
nic-hdl:      CH93-AP
e-mail:       anti-spam@ns.chinanet.cn.net
address:      No.31 ,jingrong street,beijing
address:      100032
phone:        +86-10-58501724
fax-no:       +86-10-58501724
country:      CN
changed:      dingsy@cndata.com 20070416
mnt-by:       MAINT-CHINANET
source:       APNIC

DNS records

DNS query for 241.191.191.61.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
visitslip.com	IN	A	119.39.238.2	10800s	(03:00:00)
visitslip.com	IN	A	203.93.208.86	10800s	(03:00:00)
visitslip.com	IN	A	222.241.150.146	10800s	(03:00:00)
visitslip.com	IN	A	61.191.191.241	10800s	(03:00:00)
visitslip.com	IN	A	218.75.144.6	10800s	(03:00:00)

— end —

Canadian Pharmacy Spam – magnetaroma.com

July 3, 2009Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Header Analysis

The following IP addresses were extracted from your headers:

IP Address	Probable Country	Additional Info
202.22.220.7	Japan (Kiryu)*	Whois	Google	DNSStuff	Urgentmessage.org
207.115.20.191	United States (Richardson)*	Whois	Google	DNSStuff	Urgentmessage.org
7.220.22.202	United States*	Whois	Google	DNSStuff	Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

An Incredible Canadian Pharmacy is available at your Fingertips!
*No~Doctor~Needed*! Browse our Site Today! -> http://magnetaroma.com

From Augustine Chung Mon Jun 29 04:16:55 2009
Return-Path: <a_chung_jh@charters.com.au>
Authentication-Results: mta165.sbc.mail.mud.yahoo.com from=charters.com.au; domainkeys=neutral (no sig); from=charters.com.au; dkim=neutral (no sig)
Received: from 202.22.220.7 (EHLO flpi189.prodigy.net) (207.115.20.191)
by mta165.sbc.mail.mud.yahoo.com with SMTP; Mon, 29 Jun 2009 04:18:55 -0700
Received: from x687a82 (7.220.22.202.ktv.ne.jp [202.22.220.7])
by flpi189.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n5TBHsNa023999;
Mon, 29 Jun 2009 04:18:52 -0700
Message-ID: <000701c9f8ab$1c7f4a50$d828ea62@charters.com.au>
Reply-To: “Augustine Chung” <a_chung_jh@charters.com.au>
From: “Augustine Chung” <a_chung_jh@charters.com.au>
To:
Subject: Want great sex? Get..
Date: Mon, 29 Jun 2009 06:16:55 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 141

Address lookup

canonical name	magnetaroma.com.
aliases
addresses	218.75.144.6 222.241.150.146 61.191.191.241 119.39.238.2 203.93.208.86

Domain Whois record

Queried whois.internic.net with “dom magnetaroma.com“…

   Domain Name: MAGNETAROMA.COM
   Registrar: CHINA SPRINGBOARD INC.
   Whois Server: whois.namerich.cn
   Referral URL: http://www.namerich.cn
   Name Server: NS1.HEARTCORNER.IN
   Name Server: NS2.HEARTCORNER.IN
   Name Server: NS3.HEAVYMEEK.RU
   Name Server: NS4.HEAVYMEEK.RU
   Name Server: NS5.BLUEAWAKE.COM
   Name Server: NS6.BLUEAWAKE.COM
   Status: ok
   Updated Date: 26-jun-2009
   Creation Date: 26-jun-2009
   Expiration Date: 26-jun-2010

Last update of whois database: Fri, 03 Jul 2009 08:00:22 UTC <<<

Queried whois.namerich.cn with “magnetaroma.com“…

 DomainName : magnetaroma.com

RSP: China Springboard Inc.
URL: http://www.namerich.cn      

Name Server......................NS5.BLUEAWAKE.COM
Name Server......................NS6.BLUEAWAKE.COM
Name Server......................NS3.HEAVYMEEK.RU
Name Server......................NS4.HEAVYMEEK.RU
Name Server......................NS1.HEARTCORNER.IN
Name Server......................NS2.HEARTCORNER.IN
Status...........................ok
Creation  Date ..................2009-06-26
Expiration Date .................2010-06-26
Last Update  Date ...............2009-06-26

Registrant ID ...................V-X-58203-13799
Registrant Name .................DU QIAOWEN
Registrant Organization .........DU QIAOWEN
Registrant Address ..............YIYANGLU46
Registrant City..................YY
Registrant Province/State .......HN
Registrant Country Code .........CN
Registrant Postal Code ..........413069
Registrant Phone Number .........+86.073768512419
Registrant Fax ..................+86.073768512419
Registrant Email ................soangka@163.com

Administrative ID ...............V-X-58203-13799
Administrative Name .............DU QIAOWEN
Administrative Organization .....DU QIAOWEN
Administrative Address ..........YIYANGLU46
Administrative City..............YY
Administrative Province/State ...HN
Administrative Country Code .....CN
Administrative Postal Code ......413069
Administrative Phone Number .....+86.073768512419
Administrative Fax ..............+86.073768512419
Administrative Email ............soangka@163.com

Billing ID ......................V-X-58203-13799
Billing Name ....................DU QIAOWEN
Billing Organization ............DU QIAOWEN
Billing Address .................YIYANGLU46
Billing City.....................YY
Billing Province/State ..........HN
Billing Country Code ............CN
Billing Postal Code .............413069
Billing Phone Number ............+86.073768512419
Billing Fax .....................+86.073768512419
Billing Email ...................soangka@163.com

Technical ID ....................V-X-58203-13799
Technical Name ..................DU QIAOWEN
Technical Organization...........DU QIAOWEN
Technical Address ...............YIYANGLU46
Technical City...................YY
Technical Province/State.........HN
Technical Country Code ..........CN
Technical Postal Code ...........413069
Technical Phone Number ..........+86.073768512419
Technical Fax ...................+86.073768512419
Technical Email .................soangka@163.com

; Please register your domains at
; http://www.namerich.cn

Network Whois record

Queried whois.apnic.net with “218.75.144.6“…

inetnum:      218.75.128.0 - 218.75.159.255
netname:      CHINANET-HN-CD
country:      CN
descr:        CHINANET-HN changde node network
descr:        hunan Telecom
admin-c:      CHC8-AP
tech-c:       CH636-AP
status:       ALLOCATED NON-PORTABLE
changed:      ipaddress@hntelecom.net.cn 20050823
mnt-by:       MAINT-CHINANET-HN
mnt-lower:    MAINT-CHINANET-HN-CD
source:       APNIC

role:         CHINANET HuNan ChangDe
address:      The middle of Wuling Street,Changde 415000
country:      CN
phone:        +86 736 7229427
fax-no:       +86 736 7267027
e-mail:       abuse.cd@2118.com.cn
trouble:      send spam reports to spam.cd@2118.com.cn
trouble:      and abuse reports to abuse.cd@2118.com.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      CM1092-AP
tech-c:       CM1092-AP
nic-hdl:      CHC8-AP
notify:       abuse.cd@2118.com.cn
mnt-by:       MAINT-CHINANET-HN-CD
changed:      ipaddress@hntelecom.net.cn 20050818
source:       APNIC

role:         CHINANET HUNAN
address:      No.1 TuanJie road,ChangSha,Hunan 410005
country:      CN
phone:        +86 731 4792092
fax-no:       +86 731 4792007
e-mail:       abuse.szx@2118.com.cn
trouble:      send spam reports to spam.szx@2118.com.cn
trouble:      and abuse reports to abuse.szx@2118.com.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      CH632-AP
tech-c:       CS499-AP
nic-hdl:      CH636-AP
mnt-by:       MAINT-CHINANET-HN
changed:      ipaddress@hntelecom.net.cn 20050816
source:       APNIC

DNS records

DNS query for 6.144.75.218.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
magnetaroma.com	IN	A	218.75.144.6	10800s	(03:00:00)
magnetaroma.com	IN	A	119.39.238.2	10800s	(03:00:00)
magnetaroma.com	IN	A	203.93.208.86	10800s	(03:00:00)
magnetaroma.com	IN	A	222.241.150.146	10800s	(03:00:00)
magnetaroma.com	IN	A	61.191.191.241	10800s	(03:00:00)

Canadian Pharmacy – www.flattry.com – www.tendereach.com

June 29, 2009Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Address lookup

canonical name	www.flattry.com.
aliases
addresses	203.93.208.86 218.75.144.6 60.191.239.153 61.191.191.241 119.39.238.2

Domain Whois record

Queried whois.internic.net with “dom flattry.com“…

   Domain Name: FLATTRY.COM
   Registrar: ONLINENIC, INC.
   Whois Server: whois.onlinenic.com
   Referral URL: http://www.OnlineNIC.com
   Name Server: NS1.FLATTRY.COM
   Name Server: NS2.FLATTRY.COM
   Name Server: NS3.FLATTRY.COM
   Name Server: NS4.FLATTRY.COM
   Status: clientTransferProhibited
   Updated Date: 23-jun-2009
   Creation Date: 10-jun-2009
   Expiration Date: 10-jun-2010

>>> Last update of whois database: Mon, 29 Jun 2009 13:36:22 UTC <<<

Queried whois.onlinenic.com with “flattry.com“…

Registrant:
	 Merido Vallici ad667@safe-mail.net +1.2128843301
	 Merido Vallici
	 4033 po box
	 New York,NY,US 10137

Domain Name:flattry.com
Record last updated at 2009-06-23 07:38:35
Record created on 2009/6/10
Record expired on 2010/6/10

Domain servers in listed order:
	 ns1.flattry.com 	 ns2.flattry.com 

Administrator:
	 name: Merido Vallici
 mail: ad667@safe-mail.net tel: +1.2128843301
	 org: Merido Vallici

address: 4033 po box
	 city: New York
,province: NY
,country: US
 postcode: 10137

Technical Contactor:
	 name: Merido Vallici
 mail: ad667@safe-mail.net tel: +1.2128843301
	 org: Merido Vallici

address: 4033 po box
	 city: New York
,province: NY
,country: US
 postcode: 10137

Billing Contactor:
	 name: Merido Vallici
 mail: ad667@safe-mail.net tel: +1.2128843301
	 org: Merido Vallici

address: 4033 po box
	 city: New York
,province: NY
,country: US
 postcode: 10137

Registration Service Provider:
	name: Serpino Berbeto
	tel: +1.2128848801
 	fax: +1.2128848801
 	web:

Network Whois record

Queried whois.apnic.net with “203.93.208.86“…

inetnum:      203.93.0.0 - 203.93.255.255
netname:      UNICOM-CN
descr:        China Unicom IP network
descr:        China Unicom
country:      CN
admin-c:      CH1302-AP
tech-c:       CH1302-AP
mnt-by:       APNIC-HM
mnt-lower:    MAINT-CNCGROUP
mnt-routes:   MAINT-CNCGROUP-RR
status:       ALLOCATED PORTABLE
changed:      hm-changed@apnic.net 20040116
changed:      hm-changed@apnic.net 20060124
changed:      hm-changed@apnic.net 20090507
changed:      hm-changed@apnic.net 20090508
source:       APNIC

person:       ChinaUnicom Hostmaster
nic-hdl:      CH1302-AP
e-mail:       abuse@chinaunicom.cn
address:      No.21,Jin-Rong Street
address:      Beijing,100140
address:      P.R.China
phone:        +86-10-82993155
fax-no:       +86-10-82993144
country:      CN
changed:      abuse@chinaunicom.cn 20090408
mnt-by:       MAINT-CNCGROUP
source:       APNIC

DNS records

DNS query for 86.208.93.203.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
http://www.flattry.com	IN	A	60.191.239.153	10800s	(03:00:00)
http://www.flattry.com	IN	A	61.191.191.241	10800s	(03:00:00)
http://www.flattry.com	IN	A	119.39.238.2	10800s	(03:00:00)
http://www.flattry.com	IN	A	203.93.208.86	10800s	(03:00:00)
http://www.flattry.com	IN	A	218.75.144.6	10800s	(03:00:00)
flattry.com	IN	A	218.75.144.6	10800s	(03:00:00)
flattry.com	IN	A	119.39.238.2	10800s	(03:00:00)
flattry.com	IN	A	203.93.208.86	10800s	(03:00:00)
flattry.com	IN	A	60.191.239.153	10800s	(03:00:00)
flattry.com	IN	A	61.191.191.241	10800s	(03:00:00)

— end —

Address lookup

canonical name	www.tendereach.com.
aliases
addresses	119.39.238.2 203.93.208.86 218.75.144.6 60.191.239.153 61.191.191.241

Domain Whois record

Queried whois.internic.net with “dom tendereach.com“…

   Domain Name: TENDEREACH.COM
   Registrar: ONLINENIC, INC.
   Whois Server: whois.onlinenic.com
   Referral URL: http://www.OnlineNIC.com
   Name Server: NS1.TENDEREACH.COM
   Name Server: NS2.TENDEREACH.COM
   Name Server: NS3.TENDEREACH.COM
   Name Server: NS4.TENDEREACH.COM
   Status: clientTransferProhibited
   Updated Date: 24-jun-2009
   Creation Date: 23-jun-2009
   Expiration Date: 23-jun-2010

>>> Last update of whois database: Mon, 29 Jun 2009 13:43:47 UTC <<<

Queried whois.onlinenic.com with “tendereach.com“…

Registrant:
	 Lorenv Cerre ad0@safe-mail.net +1.2138848801
	 Lorenv Cerre
	 4033 po box
	 New York,NY,US 10337

Domain Name:tendereach.com
Record last updated at 2009-06-24 08:21:43
Record created on 2009/6/23
Record expired on 2010/6/23

Domain servers in listed order:
	 ns1.tendereach.com 	 ns2.tendereach.com 

Administrator:
	 4033 po box
	 New York
NY,
US
 10337

	 name:(Lorenv Cerre)
mail:(ad0@safe-mail.net) +1.2138848801
	 Lorenv Cerre
Technical Contactor:
	 4033 po box
	 New York
NY,
US
 10337

	 name:(Lorenv Cerre)
mail:(ad0@safe-mail.net) +1.2138848801
	 Lorenv Cerre
Billing Contactor:
	 4033 po box
	 New York
NY,
US
 10337

	 name:(Lorenv Cerre)
mail:(ad0@safe-mail.net) +1.2138848801
	 Lorenv Cerre

Registration Service Provider:
	name: Serpino Berbeto
	tel: +1.2128848801
 	fax: +1.2128848801
 	web:

Network Whois record

Queried whois.apnic.net with “119.39.238.2“…

inetnum:      119.39.232.0 - 119.39.239.255
netname:      yueyang
country:      CN
descr:        CNC Group HuNan YueYang network
descr:        SanHui building ,WuLiPai Street,
descr:        YueYang 411104
admin-c:      CH444-AP
tech-c:       CH444-AP
status:       ASSIGNED NON-PORTABLE
changed:      zoulei@chinaunicom.cn 20081215
mnt-by:       MAINT-CNCGROUP-HN
source:       APNIC

route:        119.39.0.0/16
descr:        CNC Group CHINA169 Hunan Province Network
country:      CN
origin:       AS4837
mnt-by:       MAINT-CNCGROUP-RR
changed:      abuse@cnc-noc.net 20080102
source:       APNIC

person:       CNCGroup Hostmaster
nic-hdl:      CH444-AP
e-mail:       abuse@cnc-noc.net
address:      No.156,Fu-Xing-Men-Nei Street,
address:      Beijing,100031,P.R.China
phone:        +86-10-82993155
fax-no:       +86-10-82993144
country:      CN
changed:      abuse@cnc-noc.net 20041220
mnt-by:       MAINT-CNCGROUP
source:       APNIC

DNS records

DNS query for 2.238.39.119.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
http://www.tendereach.com	IN	A	218.75.144.6	10800s	(03:00:00)
http://www.tendereach.com	IN	A	60.191.239.153	10800s	(03:00:00)
http://www.tendereach.com	IN	A	61.191.191.241	10800s	(03:00:00)
http://www.tendereach.com	IN	A	119.39.238.2	10800s	(03:00:00)
http://www.tendereach.com	IN	A	203.93.208.86	10800s	(03:00:00)
tendereach.com	IN	A	119.39.238.2	10800s	(03:00:00)
tendereach.com	IN	A	203.93.208.86	10800s	(03:00:00)
tendereach.com	IN	A	60.191.239.153	10800s	(03:00:00)
tendereach.com	IN	A	61.191.191.241	10800s	(03:00:00)
tendereach.com	IN	A	218.75.144.6	10800s	(03:00:00)

Canadian Pharmacy – canadiannetmall.com

June 29, 2009Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you endanger you health by taking those dangerous counterfeit drugs.

Address lookup

canonical name	canadiannetmall.com.
aliases
addresses	94.76.196.49

Domain Whois record

Queried whois.internic.net with “dom canadiannetmall.com“…

   Domain Name: CANADIANNETMALL.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.CANADIANNETMALL.COM
   Name Server: NS2.CANADIANNETMALL.COM
   Status: clientTransferProhibited
   Updated Date: 23-dec-2008
   Creation Date: 03-mar-2008
   Expiration Date: 03-mar-2010

>>> Last update of whois database:

Mon, 29 Jun 2009 12:10:38 UTC <<<

Queried whois.enom.com with “canadiannetmall.com“…

Visit AboutUs.org for more information about canadiannetmall.com
<a href="http://www.aboutus.org/canadiannetmall.com">AboutUs: canadiannetmall.com</a>

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: canadiannetmall.com

Registrant Contact:
   WhoisGuard
   WhoisGuard Protected ()

   Fax:
   8939 S. Sepulveda Blvd. #110 - 732
   Westchester, CA 90045
   US

Administrative Contact:
   WhoisGuard
   WhoisGuard Protected (2cff3071e8e6460a9344b23d586d00e8.protect@whoisguard.com)
   +1.6613102107
   Fax: +1.6613102107
   8939 S. Sepulveda Blvd. #110 - 732
   Westchester, CA 90045
   US

Technical Contact:
   WhoisGuard
   WhoisGuard Protected (2cff3071e8e6460a9344b23d586d00e8.protect@whoisguard.com)
   +1.6613102107
   Fax: +1.6613102107
   8939 S. Sepulveda Blvd. #110 - 732
   Westchester, CA 90045
   US

Status: Locked

Name Servers:
   ns1.canadiannetmall.com
   ns2.canadiannetmall.com

Creation date: 03 Mar 2008 14:53:00
Expiration date: 03 Mar 2010 14:53:00

Get Noticed on the Internet!  Increase visibility for this domain name by listing it at www.whoisbusinesslistings.com

Network Whois record

Queried whois.ripe.net with “-B 94.76.196.49“…

% Information related to '94.76.196.48 - 94.76.196.55'

inetnum:        94.76.196.48 - 94.76.196.55
netname:        Poundhost-3253
descr:          Poundhost customer server
remarks: ##############################################################
remarks:        Please report abuse incidents to abuse@poundhost.com.
remarks:        Messages sent to other contact addresses may not be acted upon.
remarks: ##############################################################
country:        GB
admin-c:        BLO2-RIPE
tech-c:         BLO2-RIPE
status:         ASSIGNED PA
mnt-by:         blueconnex-mnt
mnt-routes:     blueconnex-mnt
source:         RIPE
changed:        pete.bristow@bluesquaredata.com 20090114

role:           BlueConnex Ltd Operators
address:        BlueConnex Ltd
address:        BlueSquare House
address:        Priors Way
address:        Maidenhead
address:        Berkshire
address:        SL62HP
remarks:        For abuse please contact abuse@blueconnex.net
phone:          +44 (0)1628 673131
admin-c:        PETE3-RIPE
admin-c:        MM5420-RIPE
admin-c:        ROB153-RIPE
tech-c:         MM5420-RIPE
tech-c:         ROB153-RIPE
mnt-by:         blueconnex-mnt
tech-c:         PETE3-RIPE
nic-hdl:        BLO2-RIPE
changed:        support@pcs-net.com 20081012
source:         RIPE
e-mail:         abuse@blueconnex.net

% Information related to '94.76.192.0/18AS29550'

route:          94.76.192.0/18
descr:          Blueconnex Networks Ltd
origin:         AS29550
remarks:        ***********************************
remarks:        *                                 *
remarks:        * Abuse: abuse@blueconnex.net     *
remarks:        *                                 *
remarks:        * Peering: peering@blueconnex.net *
remarks:        *                                 *
remarks:        ***********************************
mnt-by:         blueconnex-mnt
source:         RIPE
changed:        pete.bristow@bluesquaredata.com 20080814

DNS records

name

class

type

data

time to live

canadiannetmall.com

preference:	10
exchange:	mail.canadiannetmall.com

14400s

(04:00:00)

canadiannetmall.com

TXT

v=spf1 a mx ip4:92.48.119.157 ~all

14400s

(04:00:00)

canadiannetmall.com

SOA

server:	ns1.canadiannetmall.com
email:	root.canadiannetmall.com
serial:	2008122300
refresh:	14400
retry:	3600
expire:	1209600
minimum ttl:	86400

14400s

(04:00:00)

canadiannetmall.com

ns2.canadiannetmall.com

14400s

(04:00:00)

canadiannetmall.com

ns1.canadiannetmall.com

14400s

(04:00:00)

canadiannetmall.com

94.76.196.49

14400s

(04:00:00)

49.196.76.94.in-addr.arpa

PTR

94-76-196-49.static.as29550.net

86400s

(1.00:00:00)

— end —

Spam – Canadian Pharmacy 29.6.2009 80% 0FF on Pfizer

June 29, 2009Leave a comment

Header Analysis

The following IP addresses were extracted from your headers:

IP Address	Probable Country	Additional Info
80.244.229.67	Russian Federation (Moscow)*	Whois	Google	DNSStuff	Urgentmessage.org
6.5.4.3	United States*	Whois	Google	DNSStuff	Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

Delivered-To: scamfraudalert@gmail.com
Received: by 10.90.65.6 with SMTP id n6cs392298aga;
Mon, 29 Jun 2009 02:16:21 -0700 (PDT)
Received: by 10.204.116.69 with SMTP id l5mr6938906bkq.102.1246266978895;
Mon, 29 Jun 2009 02:16:18 -0700 (PDT)
Return-Path:
Received: from 229.67.artcoms.ru ([80.244.229.67])
by mx.google.com with SMTP id 12si10825252fks.51.2009.06.29.02.15.48;
Mon, 29 Jun 2009 02:16:18 -0700 (PDT)
Received-SPF: neutral (google.com: 80.244.229.67 is neither permitted nor denied by domain of ScamFraudAlert@gmail.com) client-ip=80.244.229.67;
Authentication-Results: mx.google.com; spf=neutral (google.com: 80.244.229.67 is neither permitted nor denied by domain of ScamFraudAlert@gmail.com) smtp.mail=ScamFraudAlert@gmail.com
Date: Mon, 29 Jun 2009 02:16:18 -0700 (PDT)
Content-Return: allowed
X-Mailer: CME-V6.5.4.3; MSN
Return-Path: communications_msn_cs_enus@cimail15.msn.com
Message-ID: <22be01c9f8bb$c2253180$43e5f450@user2>
To: ScamFraudAlert@gmail.com
Subject: Dear ScamFraudAlert@gmail.com 29.6.2009 80% 0FF on Pfizer.
From: Pfizer Inc 1916-2009.
MIME-Version: 1.0
Content-Type: text/html; charset=”ISO-8859-1″
Content-Transfer-Encoding: 7bit

rom	Pfizer Inc 1916-2009.<ScamFraudAlert@gmail.com>
to		ScamFraudAlert@gmail.com
date		Mon, Jun 29, 2009 at 2:16 AM
subject		Dear ScamFraudAlert@gmail.com 29.6.2009 80% 0FF on Pfizer.

hide details 2:16 AM (2 hours ago)

Warning: This message may not be from whom it claims to be. Beware of following any links in it or of providing the sender with any personal information. Learn more

About this mailing:
You are receiving this e-mail because you subscribed to MSN Featured Offers. If you do not wish to receive this MSN Featured Offers e-mail, please click the “Unsubscribe” link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers’ content nor any of the goods or service advertised. Prices and item availability subject to change without notice.

SFA

Canadian Pharmacy Spam – grewsix.com

June 28, 20091 Comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you endanger you health by taking those dangerous counterfeit drugs.

Header Analysis

The following IP addresses were extracted from your headers:

IP Address	Probable Country	Additional Info
129.10.63.40	United States (Boston)*	Whois	Google	DNSStuff	Urgentmessage.org
207.115.36.121	United States (Richardson)*	Whois	Google	DNSStuff	Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Terry G. Parks Fri Jun 26 10:09:27 2009
Return-Path:
Authentication-Results: mta107.sbc.mail.re3.yahoo.com from=vdc.lv; domainkeys=neutral (no sig); from=vdc.lv; dkim=neutral (no sig)
Received: from 129.10.63.40 (EHLO nlpi107.prodigy.net) (207.115.36.121)
by mta107.sbc.mail.re3.yahoo.com with SMTP; Fri, 26 Jun 2009 10:09:22 -0700
Received: from 329a0d2 ([129.10.63.40])
by nlpi107.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n5QH9Euq004296;
Fri, 26 Jun 2009 12:09:21 -0500
Message-ID: <000701c9f680$dcd89cc0$4a37416a@vdc.lv>
Reply-To: “Terry G. Parks” <tg_parkszh@vdc.lv>
From: “Terry G. Parks”
To:
Subject: eye opening
Date: Fri, 26 Jun 2009 12:09:27 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 135

An Incredible Canadian Pharmacy is available at your Fingertips!
N0~Doctor~Needed! Browse our site Today! -> http://grewsix.com

Address lookup

An Incredible Canadian Pharmacy is available at your Fingertips!
NO `Doctor `Needed! Browse our site Today! -> http://camebear.com

canonical name	grewsix.com.	aliases
addresses	218.75.144.6 60.191.221.117 60.191.239.153 61.191.191.241 119.39.238.2 203.93.208.86

Domain Whois record

Queried whois.internic.net with “dom grewsix.com“…

   Domain Name: GREWSIX.COM
   Registrar: CHINA SPRINGBOARD INC.
   Whois Server: whois.namerich.cn
   Referral URL: http://www.namerich.cn
   Name Server: NS1.RUNMOTHER.IN
   Name Server: NS2.RUNMOTHER.IN
   Name Server: NS3.LISTENFACE.RU
   Name Server: NS4.LISTENFACE.RU
   Name Server: NS5.WESUCH.PL
   Name Server: NS6.WESUCH.PL
   Status: ok
   Updated Date: 22-jun-2009
   Creation Date: 22-jun-2009
   Expiration Date: 22-jun-2010

>>> Last update of whois database: Sun, 28 Jun 2009 15:51:35 UTC <<<

Queried whois.namerich.cn with “grewsix.com“…

; This data is provided by China Springboard Inc.
; for information purposes, and to assist persons obtaining information
; about or related to domain name registration records.
; China Springboard Inc. does not guarantee its accuracy.
; By submitting a WHOIS query, you agree that you will use this data
; only for lawful purposes and that, under no circumstances, you will
; use this data to
; 1) allow, enable, or otherwise support the transmission of mass
; unsolicited, commercial advertising or solicitations via E-mail
; (spam); or
; 2) enable high volume, automated, electronic processes that apply
; to this WHOIS server.
; These terms may be changed without prior notice.
; By submitting this query, you agree to abide by this policy.

 DomainName : grewsix.com

RSP: China Springboard Inc.
URL: http://www.namerich.cn      

Name Server......................NS4.LISTENFACE.RU
Name Server......................NS2.RUNMOTHER.IN
Name Server......................NS6.WESUCH.PL
Name Server......................NS1.RUNMOTHER.IN
Name Server......................NS5.WESUCH.PL
Name Server......................NS3.LISTENFACE.RU
Status...........................ok
Creation  Date ..................2009-06-22
Expiration Date .................2010-06-22
Last Update  Date ...............2009-06-22

Registrant ID ...................V-X-57955-13465
Registrant Name .................ZHAO LET
Registrant Organization .........ZHAO LEI
Registrant Address ..............JIEFANGLU19
Registrant City..................DL
Registrant Province/State .......LN
Registrant Country Code .........CN
Registrant Postal Code ..........116019
Registrant Phone Number .........+86.04112880527
Registrant Fax ..................+86.04112880527
Registrant Email ................mklao9he@126.com

Administrative ID ...............V-X-57955-13465
Administrative Name .............ZHAO LET
Administrative Organization .....ZHAO LEI
Administrative Address ..........JIEFANGLU19
Administrative City..............DL
Administrative Province/State ...LN
Administrative Country Code .....CN
Administrative Postal Code ......116019
Administrative Phone Number .....+86.04112880527
Administrative Fax ..............+86.04112880527
Administrative Email ............mklao9he@126.com

Billing ID ......................V-X-57955-13465
Billing Name ....................ZHAO LET
Billing Organization ............ZHAO LEI
Billing Address .................JIEFANGLU19
Billing City.....................DL
Billing Province/State ..........LN
Billing Country Code ............CN
Billing Postal Code .............116019
Billing Phone Number ............+86.04112880527
Billing Fax .....................+86.04112880527
Billing Email ...................mklao9he@126.com

Technical ID ....................V-X-57955-13465
Technical Name ..................ZHAO LET
Technical Organization...........ZHAO LEI
Technical Address ...............JIEFANGLU19
Technical City...................DL
Technical Province/State.........LN
Technical Country Code ..........CN
Technical Postal Code ...........116019
Technical Phone Number ..........+86.04112880527
Technical Fax ...................+86.04112880527
Technical Email .................mklao9he@126.com

; Please register your domains at
; http://www.namerich.cn

Network Whois record

Queried whois.apnic.net with “218.75.144.6“…

inetnum:      218.75.128.0 - 218.75.159.255
netname:      CHINANET-HN-CD
country:      CN
descr:        CHINANET-HN changde node network
descr:        hunan Telecom
admin-c:      CHC8-AP
tech-c:       CH636-AP
status:       ALLOCATED NON-PORTABLE
changed:      ipaddress@hntelecom.net.cn 20050823
mnt-by:       MAINT-CHINANET-HN
mnt-lower:    MAINT-CHINANET-HN-CD
source:       APNIC

role:         CHINANET HuNan ChangDe
address:      The middle of Wuling Street,Changde 415000
country:      CN
phone:        +86 736 7229427
fax-no:       +86 736 7267027
e-mail:       abuse.cd@2118.com.cn
trouble:      send spam reports to spam.cd@2118.com.cn
trouble:      and abuse reports to abuse.cd@2118.com.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      CM1092-AP
tech-c:       CM1092-AP
nic-hdl:      CHC8-AP
notify:       abuse.cd@2118.com.cn
mnt-by:       MAINT-CHINANET-HN-CD
changed:      ipaddress@hntelecom.net.cn 20050818
source:       APNIC

role:         CHINANET HUNAN
address:      No.1 TuanJie road,ChangSha,Hunan 410005
country:      CN
phone:        +86 731 4792092
fax-no:       +86 731 4792007
e-mail:       abuse.szx@2118.com.cn
trouble:      send spam reports to spam.szx@2118.com.cn
trouble:      and abuse reports to abuse.szx@2118.com.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      CH632-AP
tech-c:       CS499-AP
nic-hdl:      CH636-AP
mnt-by:       MAINT-CHINANET-HN
changed:      ipaddress@hntelecom.net.cn 20050816
source:       APNIC

DNS records

DNS query for 6.144.75.218.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
grewsix.com	IN	A	203.93.208.86	10800s	(03:00:00)
grewsix.com	IN	A	60.191.221.117	10800s	(03:00:00)
grewsix.com	IN	A	60.191.239.153	10800s	(03:00:00)
grewsix.com	IN	A	61.191.191.241	10800s	(03:00:00)
grewsix.com	IN	A	218.75.144.6	10800s	(03:00:00)
grewsix.com	IN	A	119.39.238.2	10800s	(03:00:00)

xxxxxxxxxx

Canadian Pharmacy Spam – www.shop29.net aka www.shop75.net

June 28, 20092 Comments

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you endanger your health by taking those counterfeit drugs.

SmartFilter Category:

Malicious Sites
Make Category Suggestions

Namerservers on IP:

dns1.carryfit.com
dns1.deepworthy.com
dns1.drivefabled.com
dns1.duckspruce.com
dns1.fireideal.com
dns1.flipdollar.com
dns1.fullrail.com
dns1.grewmile.com
dns1.leadspitch.com
dns1.littletrue.com
dns1.luckyoxygen.com
dns1.nationreap.com
dns1.nightmodest.com
dns1.noseaglow.com
dns1.orclock.com
dns1.pamperextra.com
dns1.personsuffix.com
dns1.pleaseself.com
dns1.relaxrange.com
dns1.replyvoice.com
dns1.ropebird.com
dns1.saidplan.com
dns1.thingspend.com
dns1.towardhardy.com
dns1.trendylost.com
dns1.trendysit.com
dns1.varystart.com
dns1.vippast.com
dns1.wentcrisp.com
dns1.wheelfinish.com
dns1.whiteaware.com
dns1.winnertrue.com
dns1.wishlate.com
dns2.aftermulti.com
dns2.agreecrop.com
dns2.angerboat.com
dns2.boughtcreate.com
dns2.carryfit.com
dns2.createwere.com
dns2.dadfour.com
dns2.deepworthy.com
dns2.dreamylot.com
dns2.drivefabled.com
dns2.fireideal.com
dns2.greatyule.com
dns2.hasfeet.com
dns2.headraise.com
dns2.huntbring.com
dns2.leadspitch.com
dns2.littletrue.com
dns2.nationdimple.com
dns2.nationreap.com
dns2.noseaglow.com
dns2.orclock.com
dns2.pleaseself.com
dns2.pridenature.com
dns2.replyvoice.com
dns2.ropebird.com
dns2.saidplan.com
dns2.shallcoat.com
dns2.spotseason.com
dns2.tangyprime.com
dns2.towardhardy.com
dns2.trendysit.com
dns2.varystart.com
dns2.vippast.com
dns2.weekplease.com
dns3.aftermulti.com
dns3.agreecrop.com
dns3.andside.com
dns3.angerboat.com
dns3.aromaeager.com
dns3.beginwisdom.com
dns3.birdwinner.com
dns3.buyvalued.com
dns3.caringmodest.com
dns3.coldfull.com
dns3.createwere.com
dns3.dadwrote.com
dns3.dealusual.com
dns3.decenton.com
dns3.decidesmile.com
dns3.deepworthy.com
dns3.dependchoice.com
dns3.dressadd.com
dns3.drivefabled.com
dns3.duckspruce.com
dns3.eachmean.com
dns3.elsehear.com
dns3.enginemost.com
dns3.fireideal.com
dns3.flipdollar.com
dns3.fullrail.com
dns3.geniusyet.com
dns3.getensure.com
dns3.giftedproper.com
dns3.growverb.com
dns3.hasfeet.com
dns3.headraise.com
dns3.healthspeech.com

Address lookup

canonical name	www.shop29.net.
aliases
addresses	119.39.238.2 203.93.208.86 218.75.144.6 60.191.221.117 60.191.239.153 61.191.191.241

Domain Whois record

Queried whois.internic.net with “dom shop29.net“…

   Domain Name: SHOP29.NET
   Registrar: ONLINENIC, INC.
   Whois Server: whois.onlinenic.com
   Referral URL: http://www.OnlineNIC.com
   Name Server: NS3.BOTHSTART.RU
   Name Server: NS4.BOTHSTART.RU
   Name Server: NS5.CREASEON.PL
   Name Server: NS6.CREASEON.PL
   Status: clientTransferProhibited
   Updated Date: 22-jun-2009
   Creation Date: 20-jun-2009
   Expiration Date: 20-jun-2010

>>> Last update of whois database: Sun, 28 Jun 2009 13:16:16 UTC <<<

Queried whois.onlinenic.com with “shop29.net“…

Registrant:
	 Shad P Calnan fake_84262a12be10a771387c9fa12be66eda@smartdesign.by +7.4294967295
	 N/A
	 ul. Lenina, d. 18, kv. 6
	 Moskva,Moskovskaya obl.,RUSSIAN FEDERATION 101000

Domain Name:shop29.net
Record last updated at 2009-06-22 10:50:33
Record created on 2009/6/20
Record expired on 2010/6/20

Domain servers in listed order:
	 ns3.bothstart.ru 	 ns4.bothstart.ru 

Administrator:
	 name:(Shad P Calnan)
	Email:(fake_84262a12be10a771387c9fa12be66eda@smartdesign.by) tel-- +7.4294967295
	 N/A
	 ul. Lenina, d. 18, kv. 6
r
t Moskva
Moskovskaya obl.,
RUSSIAN FEDERATION

 zipcode:101000

Technical Contactor:
	 name:(Shad P Calnan)
	Email:(fake_84262a12be10a771387c9fa12be66eda@smartdesign.by) tel-- +7.4294967295
	 N/A
	 ul. Lenina, d. 18, kv. 6
r
t Moskva
Moskovskaya obl.,
RUSSIAN FEDERATION

 zipcode:101000

Billing Contactor:
	 name:(Shad P Calnan)
	Email:(fake_84262a12be10a771387c9fa12be66eda@smartdesign.by) tel-- +7.4294967295
	 N/A
	 ul. Lenina, d. 18, kv. 6
r
t Moskva
Moskovskaya obl.,
RUSSIAN FEDERATION

 zipcode:101000

Registration Service Provider:
	name: Serpino Berbeto
	tel: +1.2128848801
 	fax: +1.2128848801
 	web:

Network Whois record

Queried whois.apnic.net with “119.39.238.2“…

inetnum:      119.39.232.0 - 119.39.239.255
netname:      yueyang
country:      CN
descr:        CNC Group HuNan YueYang network
descr:        SanHui building ,WuLiPai Street,
descr:        YueYang 411104
admin-c:      CH444-AP
tech-c:       CH444-AP
status:       ASSIGNED NON-PORTABLE
changed:      zoulei@chinaunicom.cn 20081215
mnt-by:       MAINT-CNCGROUP-HN
source:       APNIC

route:        119.39.0.0/16
descr:        CNC Group CHINA169 Hunan Province Network
country:      CN
origin:       AS4837
mnt-by:       MAINT-CNCGROUP-RR
changed:      abuse@cnc-noc.net 20080102
source:       APNIC

person:       CNCGroup Hostmaster
nic-hdl:      CH444-AP
e-mail:       abuse@cnc-noc.net
address:      No.156,Fu-Xing-Men-Nei Street,
address:      Beijing,100031,P.R.China
phone:        +86-10-82993155
fax-no:       +86-10-82993144
country:      CN
changed:      abuse@cnc-noc.net 20041220
mnt-by:       MAINT-CNCGROUP
source:       APNIC

DNS records

DNS query for shop29.net failed: WouldBlock

DNS query for 2.238.39.119.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
http://www.shop29.net	IN	A	61.191.191.241	10799s	(02:59:59)
http://www.shop29.net	IN	A	119.39.238.2	10799s	(02:59:59)
http://www.shop29.net	IN	A	203.93.208.86	10799s	(02:59:59)
http://www.shop29.net	IN	A	218.75.144.6	10799s	(02:59:59)
http://www.shop29.net	IN	A	60.191.221.117	10799s	(02:59:59)
http://www.shop29.net	IN	A	60.191.239.153	10799s	(02:59:59)
shop29.net	IN	NS	ns6.creaseon.pl	172800s	(2.00:00:00)
shop29.net	IN	NS	ns4.bothstart.ru	172800s	(2.00:00:00)
shop29.net	IN	NS	ns3.bothstart.ru	172800s	(2.00:00:00)
shop29.net	IN	NS	ns5.creaseon.pl	172800s	(2.00:00:00)

— end —

Address lookup

canonical name	www.shop75.net.
aliases
addresses	61.191.191.241 119.39.238.2 203.93.208.86 218.75.144.6 60.191.221.117 60.191.239.153

Domain Whois record

Queried whois.internic.net with “dom shop75.net“…

   Domain Name: SHOP75.NET
   Registrar: ONLINENIC, INC.
   Whois Server: whois.onlinenic.com
   Referral URL: http://www.OnlineNIC.com
   Name Server: NS3.BOTHSTART.RU
   Name Server: NS4.BOTHSTART.RU
   Name Server: NS5.CREASEON.PL
   Name Server: NS6.CREASEON.PL
   Status: clientTransferProhibited
   Updated Date: 22-jun-2009
   Creation Date: 20-jun-2009
   Expiration Date: 20-jun-2010

>>> Last update of whois database: Sun, 28 Jun 2009 13:18:49 UTC <<<

Queried whois.onlinenic.com with “shop75.net“…

Registrant:
	 Shad P Calnan fake_84262a12be10a771387c9fa12be66eda@smartdesign.by +7.4294967295
	 N/A
	 ul. Lenina, d. 18, kv. 6
	 Moskva,Moskovskaya obl.,RUSSIAN FEDERATION 101000

Domain Name:shop75.net
Record last updated at 2009-06-22 10:50:38
Record created on 2009/6/20
Record expired on 2010/6/20

Domain servers in listed order:
	 ns3.bothstart.ru 	 ns4.bothstart.ru 

Administrator:
	 name: Shad P Calnan
 mail: fake_84262a12be10a771387c9fa12be66eda@smartdesign.by tel: +7.4294967295
	 org: N/A

address: ul. Lenina, d. 18, kv. 6
	 city: Moskva
,province: Moskovskaya obl.
,country: RUSSIAN FEDERATION
 postcode: 101000

Technical Contactor:
	 name: Shad P Calnan
 mail: fake_84262a12be10a771387c9fa12be66eda@smartdesign.by tel: +7.4294967295
	 org: N/A

address: ul. Lenina, d. 18, kv. 6
	 city: Moskva
,province: Moskovskaya obl.
,country: RUSSIAN FEDERATION
 postcode: 101000

Billing Contactor:
	 name: Shad P Calnan
 mail: fake_84262a12be10a771387c9fa12be66eda@smartdesign.by tel: +7.4294967295
	 org: N/A

address: ul. Lenina, d. 18, kv. 6
	 city: Moskva
,province: Moskovskaya obl.
,country: RUSSIAN FEDERATION
 postcode: 101000

Registration Service Provider:
	name: Serpino Berbeto
	tel: +1.2128848801
 	fax: +1.2128848801
 	web:

Network Whois record

Queried whois.apnic.net with “61.191.191.241“…

inetnum:      61.191.0.0 - 61.191.255.255
netname:      CHINANET-AH
descr:        CHINANET Anhui province network
descr:        China Telecom
descr:        A12,Xin-Jie-Kou-Wai Street
descr:        Beijing 100088
country:      CN
admin-c:      CH93-AP
tech-c:       AT318-AP
mnt-by:       MAINT-CHINANET
mnt-lower:    MAINT-CHINANET-AH
status:       ALLOCATED NON-PORTABLE
changed:      hm-changed@apnic.net 20060314
source:       APNIC

role:         ANHUI TELECOM
address:      305 Changjiang West Road
address:      Hefei Anhui China
country:      CN
phone:        +86 0551 5185089
fax-no:       +86 0551 5185500
e-mail:       wanglinlin2@anhuitelecom.com
trouble:      send spam reports to abuse@ah163.com
trouble:      and abuse reports to abuse@ah163.com
trouble:      Please include detailed information and
trouble:      times in GMT+8:00
admin-c:      LW604-AP
tech-c:       LW604-AP
nic-hdl:      AT318-AP
remarks:      http://www.ah163.net
notify:       wanglinlin2@anhuitelecom.com
mnt-by:       MAINT-CHINANET-AH
changed:      wanglinlin2@anhuitelecom.com 20060323
source:       APNIC

person:       Chinanet Hostmaster
nic-hdl:      CH93-AP
e-mail:       anti-spam@ns.chinanet.cn.net
address:      No.31 ,jingrong street,beijing
address:      100032
phone:        +86-10-58501724
fax-no:       +86-10-58501724
country:      CN
changed:      dingsy@cndata.com 20070416
mnt-by:       MAINT-CHINANET
source:       APNIC

DNS records

DNS query for 241.191.191.61.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
http://www.shop75.net	IN	A	60.191.239.153	10800s	(03:00:00)
http://www.shop75.net	IN	A	61.191.191.241	10800s	(03:00:00)
http://www.shop75.net	IN	A	119.39.238.2	10800s	(03:00:00)
http://www.shop75.net	IN	A	203.93.208.86	10800s	(03:00:00)
http://www.shop75.net	IN	A	218.75.144.6	10800s	(03:00:00)
http://www.shop75.net	IN	A	60.191.221.117	10800s	(03:00:00)
shop75.net	IN	A	61.191.191.241	10800s	(03:00:00)
shop75.net	IN	A	218.75.144.6	10800s	(03:00:00)
shop75.net	IN	A	119.39.238.2	10800s	(03:00:00)
shop75.net	IN	A	203.93.208.86	10800s	(03:00:00)
shop75.net	IN	A	60.191.221.117	10800s	(03:00:00)
shop75.net	IN	A	60.191.239.153	10800s	(03:00:00)

Canadian Pharmacy – best-drug.com

June 27, 2009Leave a comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Address lookup

canonical name	best-drug.com
aliases
addresses	195.95.155.3

Domain Whois record

Queried whois.internic.net with dom best-drug.com

   Domain Name: BEST-DRUG.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.NSCONTROL.COM
   Name Server: NS2.NSCONTROL.COM
   Name Server: NS3.NSCONTROL.COM
   Name Server: NS4.NSCONTROL.COM
   Name Server: NS5.NSCONTROL.COM
   Status: clientTransferProhibited
   Updated Date: 25-jun-2009
   Creation Date: 24-jun-2009
   Expiration Date: 24-jun-2010

Last update of whois database: Sat, 27 Jun 2009 20:46:56 UTC <<<

Queried whois.enom.com with “best-drug.com“…

Registration Service Provided By: -
Contact: director@climbing-games.com
Visit: http://www.ruler-domains.com

Domain name: best-drug.com
Registrant Contact:
   slay slayer
   Fax:
   grosse strasse 32,31
   erfurt,  2123
   DE

Administrative Contact:
   slay slayer (sslaayeerr@googlemail.com
   +310212121212
   Fax:
   grosse strasse 32,31
   erfurt,  2123
   DE

Technical Contact:
   slay slayer  sslaayeerr@googlemail.com
   +310212121212
   Fax:
   grosse strasse 32,31
   erfurt,  2123
   DE

Status: Locked
Name Servers:
   ns1.nscontrol.com
   ns2.nscontrol.com
   ns3.nscontrol.com
   ns4.nscontrol.com
   ns5.nscontrol.com

Creation date: 24 Jun 2009 18:34:09
Expiration date: 24 Jun 2010 18:34:09

Get Noticed on the Internet!  Increase visibility for this domain name by listing it at www.whoisbusinesslistings.com

Network Whois record

Queried whois.ripe.net with “-B 195.95.155.3“…

% Information related to '195.95.155.0 - 195.95.155.255'

inetnum:        195.95.155.0 - 195.95.155.255
netname:        MSKCOM-NET
descr:          MoskvaCom Ltd
country:        RU
org:            ORG-ML114-RIPE
admin-c:        PG5690-RIPE
tech-c:         PG5690-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-HM-PI-MNT
mnt-lower:      RIPE-NCC-HM-PI-MNT
mnt-by:         MSKCOM-MNT
mnt-routes:     MSKCOM-MNT
mnt-routes:     AS2118-MNT
mnt-domains:    MSKCOM-MNT
changed:        dilotto@gmail.com 20090224
source:         RIPE

organisation:   ORG-ML114-RIPE
org-name:       MoskvaCom Ltd
org-type:       OTHER
address:        Parusnyj pr. 49/2
address:        Moscow, Russia
phone:          +7 910 4311272
e-mail:         dilotto@gmail.com
mnt-ref:        MSKCOM-MNT
mnt-by:         MSKCOM-MNT
changed:        hostmaster@ripe.net 20090224
source:         RIPE

person:         Pavel Gorbunov
address:        Parusnyj pr. 49/2
address:        Moscow, Russia
phone:          +7 910 4311272
e-mail:         dilotto@gmail.com
nic-hdl:        PG5690-RIPE
mnt-by:         MSKCOM-MNT
changed:        hostmaster@ripe.net 20090224
source:         RIPE

% Information related to '195.95.155.0/24AS2118'

route:          195.95.155.0/24
descr:          RusDesign Autonomous System
origin:         AS2118
notify:         noc@relcom.net
mnt-by:         AS2118-MNT
changed:        andreyss@relcom.net 20090303
source:         RIPE

DNS records

DNS query for 3.155.95.195.in-addr.arpa returned an error from the server: NameError

name

class

type

data

time to live

best-drug.com

SOA

server:	ns1.nscontrol.com
email:	root.best-drug.com
serial:	2007100801
refresh:	28800
retry:	7200
expire:	604800
minimum ttl:	30

60s

(00:01:00)

best-drug.com

195.95.155.3

60s

(00:01:00)

best-drug.com

ns4.nscontrol.com

60s

(00:01:00)

best-drug.com

ns3.nscontrol.com

60s

(00:01:00)

best-drug.com

ns5.nscontrol.com

60s

(00:01:00)

best-drug.com

ns1.nscontrol.com

60s

(00:01:00)

best-drug.com

ns2.nscontrol.com

60s

(00:01:00)

WhoIs ns1.ispvds.com

June 26, 2009Leave a comment

Buying Prescription Drugs Online May Be Dangerous Says
Drug Enforcement Administration

National Association of Boards of Pharmacy (NABP)

Warning

“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Who's Behind Online Pharmacy

Today a shadowy, transnational network of illicit drug manufacturers, traders, doctors, Web site operators, spammers and criminals makes up the online pharmacy world.

Buying Medication Online Can Be Safe

There are many options out there when it comes to buying medication online. We have looked at websites after websites. Some sites feature offshore pharmacies that do not require a prior prescription. Others feature licensed pharmacies that do require a prescription from your doctor.
Before making a purchase that can effect your health, we strongly recommend that you consult your physician & DO NOT self-medicate. Ordering medication online can be a safe, money-saving experience. When done through licensed online pharmacies that require a prescription, you can be assured that the medication you get is exactly what you need to treat your ailments.

used as nameserver but missing in zone
0uk.net 5070.info 5z0.net absolute-portal.com alternatenet.net bakomatex.com banstock.com birdtower.com blueiontech.com blueorange.be bluepills-rx.net brandpills.net cafeschlag.com carlvdupre.com casino-consul.com ced-wb.org clearcutsemblance.com club-ip.net cvswebclient.net dikoepole.org diversionmedia.net dooopa.net ediz.ru egreenrx.net eis-ru.net entec-systems.com esposende.com etherealrealm.org facechange.com findadive.com finncrosse.com forexdvd.net foustok.net gabrielaschutz.com garden-office.net generationplus.net geniev.net get43.net go34.net goodweeks.biz gozetle.net gozetleme.net graszoden.be hard-exotique.com hard-lesbienne.com hard-mature.com hard-pipe.com hard-sodo.com imagesalon.net indylink.net inmedicines.net islandofmusic.com isp-server.com job-hunts.net kitetelecom.net koschalk.com kyotogames.com l0a.net lansman.org loftd.com matota.com max-price.net maxicus.com mbcbe.com mdcheap.net mdski.net mdsrx.net meds-cheap.net medsbuy.net mgastudios.net mobilia-online.com mobipic.net mosgu.net motorhomesscotland.net mouvementreformateur.net mymultitracker.net myspot.info nedved.net nervenne.com new-pharm.net nydragoes.com onlinerxmeds.net orangeblack.org pandaetu.info paradis-fiscaux.com paris-rent-apartment.com pmds.org promotion-theatre.org rxviagra.net salatmix.com samiasmahi.net selseg.com seo2you.com seohacker.net silvacabinetry.com slavmobile.com smartdietcenter.com sochiguide.net spectraimaging.net supereach.net svjatoshino.com svyatoshino.com sztdr.net telecharger-video-x.com telfordhouse.com thedreamstore.com ttsmaster.com ua-beckhoff.com umkabooks.com umpkb.com urozhay.com vitaminize.net webteriors.com welieverchevrolet.com wmplanet.net yourshopper.net zaboysultra.com znai.net

used as nameserver but missing in zone

0uk.net
5070.info
5z0.net
absolute-portal.com
alternatenet.net
bakomatex.com
banstock.com
birdtower.com
blueiontech.com
blueorange.be
bluepills-rx.net
brandpills.net
cafeschlag.com
carlvdupre.com
casino-consul.com
ced-wb.org
clearcutsemblance.com
club-ip.net
cvswebclient.net
dikoepole.org
diversionmedia.net
dooopa.net
ediz.ru
egreenrx.net
eis-ru.net
entec-systems.com
esposende.com
etherealrealm.org
facechange.com
findadive.com
finncrosse.com
forexdvd.net
foustok.net
gabrielaschutz.com
garden-office.net
generationplus.net
geniev.net
get43.net
go34.net
goodweeks.biz
gozetle.net
gozetleme.net
graszoden.be
hard-exotique.com
hard-lesbienne.com
hard-mature.com
hard-pipe.com
hard-sodo.com
imagesalon.net
indylink.net
inmedicines.net
islandofmusic.com
isp-server.com
job-hunts.net
kitetelecom.net
koschalk.com
kyotogames.com
l0a.net
lansman.org
loftd.com
matota.com
max-price.net
maxicus.com
mbcbe.com
mdcheap.net
mdski.net
mdsrx.net
meds-cheap.net
medsbuy.net
mgastudios.net
mobilia-online.com
mobipic.net
mosgu.net
motorhomesscotland.net
mouvementreformateur.net
mymultitracker.net
myspot.info
nedved.net
nervenne.com
new-pharm.net
nydragoes.com
onlinerxmeds.net
orangeblack.org
pandaetu.info
paradis-fiscaux.com
paris-rent-apartment.com
pmds.org
promotion-theatre.org
rxviagra.net
salatmix.com
samiasmahi.net
selseg.com
seo2you.com
seohacker.net
silvacabinetry.com
slavmobile.com
smartdietcenter.com
sochiguide.net
spectraimaging.net
supereach.net
svjatoshino.com
svyatoshino.com
sztdr.net
telecharger-video-x.com
telfordhouse.com
thedreamstore.com
ttsmaster.com
ua-beckhoff.com
umkabooks.com
umpkb.com
urozhay.com
vitaminize.net
webteriors.com
welieverchevrolet.com
wmplanet.net
yourshopper.net
zaboysultra.com
znai.net

domains using this as nameserver
3foisrien.com 4senses.ispvds.com 5070.info activebiometrix.com actualfree.com aksmarket.ru akvadar.ru al-multimix.ispvds.com allpets.ru amakan.ru amsu.ru apdsystem.com aries-hosting.com artec-group.com aska-shop.com.ua astropolis.net at-hosting.com avto-sait.ru bakomatex.com banstock.isp-server.com beffective.ca belgasite.be belsite.com betsee.com bossavit.com bruhost-2.ispvds.com bruhost.ispvds.com carrefourmedical.net cell-tissuetransplantation.com centreindigo.org chemport.ru chemy.ru chronorace.be cogendi.com cotejardins.ch cracnet.com cyberdepot.biz daniel.ispvds.com de-troyer.be deine-freunde.net drnd.be drvrn.com e-ticket.ru ediz.ru efireice.com elbase.ispvds.com esales.ru etobolsk.ru euroconsultants.be evm.ru fastorder.net foratel.com format21.com freekerrybook.org g9e.ru george.ispvds.com geot.ispvds.com gooddays.ru gouralnik.com graphic-lettering.be hote.net houebe.com idsbd.net intermedia-communication.biz ishango.ispvds.com isobel.be ispserver.com ispsystem.com ispvds.com itcomplex.ru jbsoares.net kgora.ru kinologia.ru labstyle.com ls.ispvds.com luxuryparlor.ispvds.com mail.amsu.ru markopizza.ru matota.com mdbt.be megaded.info merlin-worlds.ru merscomdocs.com mirronix.com momotaro.biz moving-storage.net mskhost-2.ispvds.com mskhost.ispvds.com multiactivist.com mykorzina.com norsite.net novgorod.su nyhost-2.ispvds.com nyk-backup.ispvds.com openforall.net pavel.ispvds.com planbweb.com progsight.be reanimator.ispvds.com redin.info rental-apartment-paris.com rolissisp.ispvds.com rus.aero rusaero.aero sdv2.antipode.info seli01.be sferaweb.ru sidora.net societe-internationale.com stagingarea3.com staquet.net synergir.com taxpolicy.ru tlnh.ru totogolo.com transmaster177.ru triniforce.ispvds.com vdelo.ru webcoop.org wildboarmusic.co

domains using this as nameserver

3foisrien.com
4senses.ispvds.com
5070.info
activebiometrix.com
actualfree.com
aksmarket.ru
akvadar.ru
al-multimix.ispvds.com
allpets.ru
amakan.ru
amsu.ru
apdsystem.com
aries-hosting.com
artec-group.com
aska-shop.com.ua
astropolis.net
at-hosting.com
avto-sait.ru
bakomatex.com
banstock.isp-server.com
beffective.ca
belgasite.be
belsite.com
betsee.com
bossavit.com
bruhost-2.ispvds.com
bruhost.ispvds.com
carrefourmedical.net
cell-tissuetransplantation.com
centreindigo.org
chemport.ru
chemy.ru
chronorace.be
cogendi.com
cotejardins.ch
cracnet.com
cyberdepot.biz
daniel.ispvds.com
de-troyer.be
deine-freunde.net
drnd.be
drvrn.com
e-ticket.ru
ediz.ru
efireice.com
elbase.ispvds.com
esales.ru
etobolsk.ru
euroconsultants.be
evm.ru
fastorder.net
foratel.com
format21.com
freekerrybook.org
g9e.ru
george.ispvds.com
geot.ispvds.com
gooddays.ru
gouralnik.com
graphic-lettering.be
hote.net
houebe.com
idsbd.net
intermedia-communication.biz
ishango.ispvds.com
isobel.be
ispserver.com
ispsystem.com
ispvds.com
itcomplex.ru
jbsoares.net
kgora.ru
kinologia.ru
labstyle.com
ls.ispvds.com
luxuryparlor.ispvds.com
mail.amsu.ru
markopizza.ru
matota.com
mdbt.be
megaded.info
merlin-worlds.ru
merscomdocs.com
mirronix.com
momotaro.biz
moving-storage.net
mskhost-2.ispvds.com
mskhost.ispvds.com
multiactivist.com
mykorzina.com
norsite.net
novgorod.su
nyhost-2.ispvds.com
nyk-backup.ispvds.com
openforall.net
pavel.ispvds.com
planbweb.com
progsight.be
reanimator.ispvds.com
redin.info
rental-apartment-paris.com
rolissisp.ispvds.com
rus.aero
rusaero.aero
sdv2.antipode.info
seli01.be
sferaweb.ru
sidora.net
societe-internationale.com
stagingarea3.com
staquet.net
synergir.com
taxpolicy.ru
tlnh.ru
totogolo.com
transmaster177.ru
triniforce.ispvds.com
vdelo.ru
webcoop.org
wildboarmusic.co

WhoIs GlavMed.com aka Canadian Pharmacy

June 26, 20091 Comment

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

National Association of Boards of Pharmacy (NABP)

Glavmed is the public-facing affiliate program which sponsors spammers to promote what are generally known to be illegal pharmacy websites. It appears to be a cover for the real sponsor organization behind all of these sites: Spamit. These include [Canadian Pharmacy], one of the most-spammed properties during 2006-2008. Glavmed is alternately known in the spammer community as the “Spamit” program, making it clear that this operation endorses and condones illegal spamming in the promotion of their properties.

This was learned from postings on bulkerforum.biz by username “kref”, who would invite users to promote for their properties. kref is also known as “fakir f” (his Skype username.)

Glavmed (Spamit) is believed to be based out of Moscow, and thought to be very closely related to the “Russian Business Network”, or “RBN.

Spamtracker.eu

Address lookup

canonical name	www.glavmed.com.
aliases
addresses	74.86.34.144

Domain Whois record

Queried whois.internic.net with “dom glavmed.com“…

   Domain Name: GLAVMED.COM
   Registrar: REGTIME LTD.
   Whois Server: whois.regtime.net
   Referral URL: http://www.webnames.ru
   Name Server: NS1.GLAVMED.COM
   Name Server: NS2.GLAVMED.COM
   Status: ok
   Updated Date: 23-jan-2009
   Creation Date: 14-mar-2006
   Expiration Date: 14-mar-2013

>>> Last update of whois database: Sat, 27 Jun 2009 02:40:08 UTC <<<

Queried whois.regtime.net with “glavmed.com“…

% Regtime Ltd. WHOIS server

Domain name: glavmed.com

Name servers:
    ns1.glavmed.com
    ns2.glavmed.com

Registrar: Regtime Ltd.
Creation date: 2009-01-15
Expiration date: 2013-03-14
Status: active

Registrant:
    PHARMOS LIMITED
    Email: info@glavmed.com
    Organization: PHARMOS LIMITED
    Address: 177 WHALLEY RANGE
    City: BLACKBURN
    State: LANCS
    ZIP: BB1 6NL
    Country: GB
    Phone: +1.8778062747
    Fax: +1.8778062747
Administrative Contact:
    PHARMOS LIMITED
    Email: info@glavmed.com
    Organization: PHARMOS LIMITED
    Address: 177 WHALLEY RANGE
    City: BLACKBURN
    State: LANCS
    ZIP: BB1 6NL
    Country: GB
    Phone: +1.8778062747
    Fax: +1.8778062747
Technical Contact:
    PHARMOS LIMITED
    Email: info@glavmed.com
    Organization: PHARMOS LIMITED
    Address: 177 WHALLEY RANGE
    City: BLACKBURN
    State: LANCS
    ZIP: BB1 6NL
    Country: GB
    Phone: +1.8778062747
    Fax: +1.8778062747
Billing Contact:
    PHARMOS LIMITED
    Email: info@glavmed.com
    Organization: PHARMOS LIMITED
    Address: 177 WHALLEY RANGE
    City: BLACKBURN
    State: LANCS
    ZIP: BB1 6NL
    Country: GB
    Phone: +1.8778062747
    Fax: +1.8778062747

Network Whois record

Queried whois.arin.net with “!NET-74-86-34-144-1“…

CustName:   Dmitry Fedorov
Address:    Ivanov st 31
City:       Moscow
StateProv:
PostalCode: 125725
Country:    RU
RegDate:    2009-03-19
Updated:    2009-03-19

NetRange:   74.86.34.144 - 74.86.34.151
CIDR:       74.86.34.144/29
NetName:    NET-74-86-34-144
NetHandle:  NET-74-86-34-144-1
Parent:     NET-74-86-0-0-1
NetType:    Reassigned
Comment:    Send abuse issues to abuse@softlayer.com
RegDate:    2009-03-19
Updated:    2009-03-19

RAbuseHandle: ABUSE1025-ARIN
RAbuseName:   Abuse
RAbusePhone:  +1-214-442-0605
RAbuseEmail:  abuse@softlayer.com 

RNOCHandle: IPADM258-ARIN
RNOCName:   IP Admin
RNOCPhone:  +1-214-442-0600
RNOCEmail:  ipadmin@softlayer.com 

RTechHandle: IPADM258-ARIN
RTechName:   IP Admin
RTechPhone:  +1-214-442-0600
RTechEmail:  ipadmin@softlayer.com 

OrgAbuseHandle: ABUSE1025-ARIN
OrgAbuseName:   Abuse
OrgAbusePhone:  +1-214-442-0605
OrgAbuseEmail:  abuse@softlayer.com

OrgTechHandle: IPADM258-ARIN
OrgTechName:   IP Admin
OrgTechPhone:  +1-214-442-0600
OrgTechEmail:  ipadmin@softlayer.com

# ARIN WHOIS database, last updated 2009-06-26 19:10

DNS records

name

class

type

data

time to live

http://www.glavmed.com

74.86.34.144

60s

(00:01:00)

glavmed.com

SOA

server:	ns1.glavmed.com
email:	root.glavmed.com
serial:	2009041832
refresh:	28800
retry:	7200
expire:	604800
minimum ttl:	30

60s

(00:01:00)

glavmed.com

ns1.glavmed.com

60s

(00:01:00)

glavmed.com

ns2.glavmed.com

60s

(00:01:00)

glavmed.com

preference:	10
exchange:	mail.glavmed.com

60s

(00:01:00)

glavmed.com

74.86.34.144

60s

(00:01:00)

144.34.86.74.in-addr.arpa

PTR

74.86.34.144-static.reverse.softlayer.com

3600s

(01:00:00)

— end —

Canadian Pharmacy – www.firmvictor.com

June 25, 2009Leave a comment

Header Analysis

The following IP addresses were extracted from your headers:

IP Address	Probable Country	Additional Info
151.95.186.133	Italy (Pignone)*	Whois	Google	DNSStuff	Urgentmessage.org
207.115.20.195	United States (Richardson)*	Whois	Google	DNSStuff	Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Lorena N. Livingston Mon Jun 22 17:26:07 2009
Return-Path: <llivingston_wt@avantgarde.de>
Authentication-Results: mta112.sbc.mail.gq1.yahoo.com from=avantgarde.de; domainkeys=neutral (no sig); from=avantgarde.de; dkim=neutral (no sig)
Received: from 151.95.186.133 (EHLO flpi193.prodigy.net) (207.115.20.195)
by mta112.sbc.mail.gq1.yahoo.com with SMTP; Tue, 23 Jun 2009 04:14:27 -0700
Received: from lqdbnh2 ([151.95.186.133])
by flpi193.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n5NBDbs2029631;
Tue, 23 Jun 2009 04:14:25 -0700
Message-ID: <000701c9f399$334e5fd0$627e2c7a@avantgarde.de>
Reply-To: “Lorena N. Livingston”
From: “Lorena N. Livingston” <llivingston_wt@avantgarde.de>
To: ScamFraudAlert
Subject: Stay Hard and Last Longer in Bed!
Date: Mon, 22 Jun 2009 17:26:07 -0700
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 126

From: Lorena N. Livingston <llivingston_wt@avantgarde.de>
To: ScamFraudAlert.com
Sent: Monday, June 22, 2009 5:26:07 PM
Subject: Stay Hard and Last Longer in Bed!

An Incredible Canadian Pharmacy is available at your Fingertips!
No_Doctor_Needed! Click Here -> http://firmvictor.com

This spam brand has the dubious distinction of being the most heavily spammed domain our staff receives.

The “Canadian Pharmacy” titled sites are the most common. They may also be labeled “European Pharmacy” for visitors from IP addresses located outside North America.

Other sites include “PharmSite” and “best online PHARMACY.” They are riddled with identical fraudulent claims.

For simplicity, this entry refers by default to Canadian Pharmacy, but the false claims apply equally to all of these.

The copyright statement in the trailers for “PharmSite” and “best online PHARMACY” actually contains the words Copyright Canadian Pharmacy.

Visitors to these sites are cautioned against placing an unsecure order for any of the products advertised. With so much obvious fraud in the set up of the web site, any reasonable person would be justified in having doubts about passing identity and credit card details to such blatant criminals.

See Spamtracker.eu – Canadian Pharmacy

Address lookup

canonical name	firmvictor.com.
aliases
addresses	119.39.238.2 203.93.208.86 218.75.144.6 60.191.221.117 60.191.239.153 61.191.191.241

Domain Whois record

Queried whois.internic.net with “dom firmvictor.com“…

   Domain Name: FIRMVICTOR.COM
   Registrar: CHINA SPRINGBOARD INC.
   Whois Server: whois.namerich.cn
   Referral URL: http://www.namerich.cn
   Name Server: NS1.SOUNDPRIZE.IN
   Name Server: NS2.SOUNDPRIZE.IN
   Name Server: NS3.GROUNDBED.COM
   Name Server: NS4.GROUNDBED.COM
   Name Server: NS5.CHANGESTORY.PL
   Name Server: NS6.CHANGESTORY.PL
   Status: ok
   Updated Date: 18-jun-2009
   Creation Date: 18-jun-2009
   Expiration Date: 18-jun-2010

>>> Last update of whois database: Thu, 25 Jun 2009 07:36:37 UTC <<<

Queried whois.namerich.cn with “firmvictor.com“…

; This data is provided by China Springboard Inc.
; for information purposes, and to assist persons obtaining information
; about or related to domain name registration records.
; China Springboard Inc. does not guarantee its accuracy.
; By submitting a WHOIS query, you agree that you will use this data
; only for lawful purposes and that, under no circumstances, you will
; use this data to
; 1) allow, enable, or otherwise support the transmission of mass
; unsolicited, commercial advertising or solicitations via E-mail
; (spam); or
; 2) enable high volume, automated, electronic processes that apply
; to this WHOIS server.
; These terms may be changed without prior notice.
; By submitting this query, you agree to abide by this policy.

 DomainName : firmvictor.com

RSP: China Springboard Inc.
URL: http://www.namerich.cn      

Name Server......................NS2.SOUNDPRIZE.IN
Name Server......................NS6.CHANGESTORY.PL
Name Server......................NS4.GROUNDBED.COM
Name Server......................NS5.CHANGESTORY.PL
Name Server......................NS1.SOUNDPRIZE.IN
Name Server......................NS3.GROUNDBED.COM
Status...........................ok
Creation  Date ..................2009-06-18
Expiration Date .................2010-06-18
Last Update  Date ...............2009-06-18

Registrant ID ...................V-X-57697-13132
Registrant Name .................GU FEI
Registrant Organization .........GU FEI
Registrant Address ..............FUZHOUGUANGCHANG29
Registrant City..................FZ
Registrant Province/State .......FJ
Registrant Country Code .........CN
Registrant Postal Code ..........350019
Registrant Phone Number .........+86.059175695124
Registrant Fax ..................+86.059175695124
Registrant Email ................baijakdfe@yeah.net

Administrative ID ...............V-X-57697-13132
Administrative Name .............GU FEI
Administrative Organization .....GU FEI
Administrative Address ..........FUZHOUGUANGCHANG29
Administrative City..............FZ
Administrative Province/State ...FJ
Administrative Country Code .....CN
Administrative Postal Code ......350019
Administrative Phone Number .....+86.059175695124
Administrative Fax ..............+86.059175695124
Administrative Email ............baijakdfe@yeah.net

Billing ID ......................V-X-57697-13132
Billing Name ....................GU FEI
Billing Organization ............GU FEI
Billing Address .................FUZHOUGUANGCHANG29
Billing City.....................FZ
Billing Province/State ..........FJ
Billing Country Code ............CN
Billing Postal Code .............350019
Billing Phone Number ............+86.059175695124
Billing Fax .....................+86.059175695124
Billing Email ...................baijakdfe@yeah.net

Technical ID ....................V-X-57697-13132
Technical Name ..................GU FEI
Technical Organization...........GU FEI
Technical Address ...............FUZHOUGUANGCHANG29
Technical City...................FZ
Technical Province/State.........FJ
Technical Country Code ..........CN
Technical Postal Code ...........350019
Technical Phone Number ..........+86.059175695124
Technical Fax ...................+86.059175695124
Technical Email .................baijakdfe@yeah.net

; Please register your domains at
; http://www.namerich.cn

Network Whois record

Queried whois.apnic.net with “119.39.238.2“…

inetnum:      119.39.232.0 - 119.39.239.255
netname:      yueyang
country:      CN
descr:        CNC Group HuNan YueYang network
descr:        SanHui building ,WuLiPai Street,
descr:        YueYang 411104
admin-c:      CH444-AP
tech-c:       CH444-AP
status:       ASSIGNED NON-PORTABLE
changed:      zoulei@chinaunicom.cn 20081215
mnt-by:       MAINT-CNCGROUP-HN
source:       APNIC

route:        119.39.0.0/16
descr:        CNC Group CHINA169 Hunan Province Network
country:      CN
origin:       AS4837
mnt-by:       MAINT-CNCGROUP-RR
changed:      abuse@cnc-noc.net 20080102
source:       APNIC

person:       CNCGroup Hostmaster
nic-hdl:      CH444-AP
e-mail:       abuse@cnc-noc.net
address:      No.156,Fu-Xing-Men-Nei Street,
address:      Beijing,100031,P.R.China
phone:        +86-10-82993155
fax-no:       +86-10-82993144
country:      CN
changed:      abuse@cnc-noc.net 20041220
mnt-by:       MAINT-CNCGROUP
source:       APNIC

DNS records

DNS query for 2.238.39.119.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
firmvictor.com	IN	A	218.75.144.6	10800s	(03:00:00)
firmvictor.com	IN	A	119.39.238.2	10800s	(03:00:00)
firmvictor.com	IN	A	203.93.208.86	10800s	(03:00:00)
firmvictor.com	IN	A	60.191.221.117	10800s	(03:00:00)
firmvictor.com	IN	A	60.191.239.153	10800s	(03:00:00)
firmvictor.com	IN	A	61.191.191.241	10800s	(03:00:00)

WHOIS www.ruler-domains.com

June 20, 2009Leave a comment

WHOIS informations for ruler-domains.com

AboutUs: ruler-domains.com

Registration Service Provided By: –
Contact: director@climbing-games.com
Visit: http://www.ruler-domains.com

Domain name: ruler-domains.com

Administrative Contact:
–
Sergey Ryabov director@climbing-games.com
+7.9219270961
Fax: +7.9219270961
Scherbakova st., 6-38
Saint-Petersburg, 197375
RU

Technical Contact:
–
Sergey Ryabov director@climbing-games.com
+7.9219270961
Fax: +7.9219270961
Scherbakova st., 6-38
Saint-Petersburg, 197375
RU

Registrant Contact:
–
Sergey Ryabov ()

Fax:
Scherbakova st., 6-38
Saint-Petersburg, 197375
RU

Status: Locked

Name Servers:
ns1.ruler-domains.com
ns2.ruler-domains.com

Creation date: 18 Nov 2008 00:58:03
Expiration date: 18 Nov 2010 00:58:00

Get Noticed on the Internet! Increase visibility for this domain name by listing it atwww.whoisbusinesslistings.com

We reserve the right to modify these terms at any time. By submitting
this query, you agree to abide by these terms.
Version 6.3 4/3/2002

Websites linked from ruler-domains.com:

WHOIS informations for megastock.ru

% By submitting a query to RIPN’s Whois Service
% you agree to abide by the following terms of use:
% http://www.ripn.net/about/servpol.html#3.2 (in Russian)
% http://www.ripn.net/about/en/servpol.html#3.2 (in English).

domain: MEGASTOCK.RU
type: CORPORATE
nserver: ns.molot.ru.
nserver: ns.relsoft.ru.
nserver: ns.relsoftcom.ru.
state: REGISTERED, DELEGATED
org: Joint Stock Company “Computing Forces”
phone: +7 495 7274333
fax-no: +7 495 7274333
e-mail: shalopin@webmoney.ru
registrar: RUCENTER-REG-RIPN
created: 2001.03.24
paid-till: 2010.03.27
source: TC-RIPN

Last updated on 2009.07.26 18:01:10 MSK/MSD

Websites linked from megastock.ru:

Domain
ruler-domains.com
richisoftware2.com
castoholder.com

Address lookup

canonical name	ruler-domains.com.
aliases
addresses	213.174.139.29

Domain Whois record

Queried whois.internic.net with “dom ruler-domains.com“…

   Domain Name: RULER-DOMAINS.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.RULER-DOMAINS.COM
   Name Server: NS2.RULER-DOMAINS.COM
   Status: clientTransferProhibited
   Updated Date: 17-may-2009
   Creation Date: 17-nov-2008
   Expiration Date: 17-nov-2010

>>> Last update of whois database: Sun, 26 Jul 2009 14:04:26 UTC <<<

Queried whois.enom.com with “ruler-domains.com“…

Visit AboutUs.org for more information about ruler-domains.com
<a href="http://www.aboutus.org/ruler-domains.com">AboutUs: ruler-domains.com</a>

Registration Service Provided By: -
Contact: director@climbing-games.com
Visit: http://www.ruler-domains.com

Domain name: ruler-domains.com

Administrative Contact:
   -
   Sergey Ryabov (director@climbing-games.com)
   +7.9219270961
   Fax: +7.9219270961
   Scherbakova st., 6-38
   Saint-Petersburg,  197375
   RU

Technical Contact:
   -
   Sergey Ryabov (director@climbing-games.com)
   +7.9219270961
   Fax: +7.9219270961
   Scherbakova st., 6-38
   Saint-Petersburg,  197375
   RU

Registrant Contact:
   -
   Sergey Ryabov ()

   Fax:
   Scherbakova st., 6-38
   Saint-Petersburg,  197375
   RU

Status: Locked

Name Servers:
   ns1.ruler-domains.com
   ns2.ruler-domains.com

Creation date: 18 Nov 2008 00:58:03
Expiration date: 18 Nov 2010 00:58:00

Get Noticed on the Internet!  Increase visibility for this domain name by listing it at www.whoisbusinesslistings.com

Network Whois record

Queried whois.ripe.net with “-B 213.174.139.29“…

% Information related to '213.174.136.0 - 213.174.139.255'

inetnum:        213.174.136.0 - 213.174.139.255
netname:        ADVANCEDHOSTERS-NET
descr:          Advanced Hosters
country:        US
admin-c:        AH36-RIPE
tech-c:         AH36-RIPE
status:         ASSIGNED PA
remarks:        INFRA-AW
remarks:        Send abuse reports to abuse@advancedhosters.com
mnt-by:         ADVANCEDHOSTERS-MNT
mnt-lower:      ADVANCEDHOSTERS-MNT
mnt-routes:     ADVANCEDHOSTERS-MNT
changed:        ripe@advancedhosters.com 20090402
source:         RIPE

role:           ADVANCEDHOSTERS LIMITED
address:        THE MERIDIAN 4 COPTHALL HOUSE, STATION SQUARE, COVENTRY,
address:        WEST MIDLANDS, CV1 2FL, United Kingdom
org:            ORG-AH11-RIPE
e-mail:         ripe@advancedhosters.com
admin-c:        OAVO1-RIPE
tech-c:         OAVO1-RIPE
nic-hdl:        AH36-RIPE
changed:        ripe@advancedhosters.com 20090331
source:         RIPE

% Information related to '213.174.128.0/19AS39572'

route:          213.174.128.0/19
descr:          Hosting segment
origin:         AS39572
mnt-by:         ADVANCEDHOSTERS-MNT
changed:        ripe@advancedhosters.com 20090403
source:         RIPE

% Information related to '213.174.136.0/22AS39572'

route:          213.174.136.0/22
descr:          Hosting segment
origin:         AS39572
mnt-by:         ADVANCEDHOSTERS-MNT
changed:        ripe@advancedhosters.com 20090403
source:         RIPE

DNS records

DNS query for 29.139.174.213.in-addr.arpa returned an error from the server: NameError

name

class

type

data

time to live

ruler-domains.com

213.174.139.29

86400s

(1.00:00:00)

ruler-domains.com

preference:	10
exchange:	mail.ruler-domains.com

86400s

(1.00:00:00)

ruler-domains.com

SOA

server:	localhost.ruler-domains.com
email:	root.ruler-domains.com
serial:	4
refresh:	10800
retry:	900
expire:	604800
minimum ttl:	86400

86400s

(1.00:00:00)

ruler-domains.com

ns1.ruler-domains.com

86400s

(1.00:00:00)

ruler-domains.com

ns2.ruler-domains.com

86400s

(1.00:00:00)

Traceroute

Tracing route to ruler-domains.com [213.174.139.29]…

hop

rtt

ip address

fully qualified domain name

70.84.211.97

61.d3.5446.static.theplanet.com

70.87.254.1

po101.dsr01.dllstx5.theplanet.com

70.85.127.105

po51.dsr01.dllstx3.theplanet.com

70.87.253.1

et3-1.ibr03.dllstx3.theplanet.com

70.87.253.190

be.fd.5746.static.theplanet.com

206.223.115.120

10g.r0.eqix.ash.va.us.iptp.net

87.239.188.250

213.174.139.29

Trace complete

Service scan

FTP – 21 220 (vsFTPd 2.0.5) 500 OOPS: vsf_sysutil_recv_peek: no data 500 OOPS: child died

SMTP – 25 220 localhost.localdomain ESMTP Sendmail 8.13.8/8.13.8; Sun, 26 Jul 2009 10:02:28 -0400

HTTP – 80

POP3 – 110 +OK Dovecot ready.

IMAP – 143 * OK Dovecot ready.

— end —

Crime – Canadian Pharmacy Spam Servers

June 18, 2009Leave a comment

Canadian Pharmacy Spam Servers

SmartFilter Category:	Spam URLs Make Category Suggestions
Namerservers on IP:	ns1.7594.org ns1.9307.org ns1.9736.org ns1.bedplain.com ns2.11121.org ns2.12332.org ns2.13231.org ns2.7594.org ns3.9736.org ns3.quietfree.ru ns4.13123.org ns4.7594.org ns4.9736.org ns4.quietfree.ru ns4.truereap.ru

Crime Canadian Pharmacy Spam Servers

June 18, 2009Leave a comment

SmartFilter Category:	Not Categorized Make Category Suggestions
IPs:	58.17.3.41 60.191.221.123 60.191.239.166 61.191.191.241 203.93.208.86

SmartFilter Category: Malicious Sites
Make Category Suggestions

Namerservers on IP: dns1.carryfit.com
dns1.deepworthy.com
dns1.drivefabled.com
dns1.duckspruce.com
dns1.fireideal.com
dns1.flipdollar.com
dns1.fullrail.com
dns1.grewmile.com
dns1.leadspitch.com
dns1.littletrue.com
dns1.luckyoxygen.com
dns1.nationreap.com
dns1.noseaglow.com
dns1.orclock.com
dns1.pamperextra.com
dns1.personsuffix.com
dns1.pleaseself.com
dns1.relaxrange.com
dns1.replyvoice.com
dns1.ropebird.com
dns1.saidplan.com
dns1.thingspend.com
dns1.towardhardy.com
dns1.trendylost.com
dns1.trendysit.com
dns1.varystart.com
dns1.vippast.com
dns1.wentcrisp.com
dns1.wheelfinish.com
dns1.whiteaware.com
dns1.winnertrue.com
dns1.wishlate.com
dns2.aftermulti.com
dns2.agreecrop.com
dns2.boughtcreate.com
dns2.carryfit.com
dns2.createwere.com
dns2.dadfour.com
dns2.deepworthy.com
dns2.dreamylot.com
dns2.drivefabled.com
dns2.fireideal.com
dns2.greatyule.com
dns2.hasfeet.com
dns2.headraise.com
dns2.huntbring.com
dns2.leadspitch.com
dns2.littletrue.com
dns2.nationdimple.com
dns2.nationreap.com
dns2.noseaglow.com
dns2.orclock.com
dns2.pleaseself.com
dns2.replyvoice.com
dns2.ropebird.com
dns2.saidplan.com
dns2.shallcoat.com
dns2.spotseason.com
dns2.tangyprime.com
dns2.towardhardy.com
dns2.trendysit.com
dns2.varystart.com
dns2.vippast.com
dns2.weekplease.com
dns3.agreecrop.com
dns3.deepworthy.com
dns3.drivefabled.com
dns3.fireideal.com
dns3.fullrail.com
dns3.headraise.com
dns3.leadspitch.com
dns3.littletrue.com
dns3.nationdimple.com
dns3.nationreap.com
dns3.noseaglow.com
dns3.noticematch.com
dns3.nounstudy.com
dns3.personsuffix.com
dns3.pleaseself.com
dns3.relaxrange.com
dns3.renownstreet.com
dns3.replyvoice.com
dns3.ropebird.com
dns3.saidplan.com
dns3.shallcoat.com
dns3.tangyprime.com
dns3.towardhardy.com
dns3.trendylost.com
dns3.trendysit.com
dns3.varystart.com
dns3.vippast.com
dns3.weekplease.com
dns4.agreecrop.com
dns4.buyvalued.com
dns4.camediffer.com
dns4.coursethey.com
dns4.createwere.com
dns4.dadfour.com
dns4.decidesmile.com
dns4.deepworthy.com

Canadian Pharmacy Spam – homevaried.com

June 18, 2009Leave a comment

Header Analysis

The following IP addresses were extracted from your headers:

IP Address	Probable Country	Additional Info
66.18.238.145	Canada (Calgary)*	Whois	Google	DNSStuff	Urgentmessage.org
207.115.36.154	United States (Richardson)*	Whois	Google	DNSStuff	Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Todd Hinkle Sat Jun 13 16:47:50 2009 Return-Path: todd.hinklexs@netron.cz
Authentication-Results: mta167.sbc.mail.mud.yahoo.com from=netron.cz; domainkeys=neutral (no sig); from=netron.cz; dkim=neutral (no sig) Received: from 66.18.238.145 (EHLO nlpi140.prodigy.net) (207.115.36.154) by mta167.sbc.mail.mud.yahoo.com with SMTP;
Sat, 13 Jun 2009 16:47:48 -0700 Received: from zjl05r3 (dsl-vlan458-66-18-238-145.nucleus.com [66.18.238.145]) by nlpi140.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n5DNlSlm031067; Sat, 13 Jun 2009 18:47:47 -0500 Message-ID: <000701c9ec81$5c956240$4a37416a@netron.cz>
Reply-To: “Todd Hinkle” todd.hinklexs@netron.cz
From: “Todd Hinkle” todd.hinklexs@netron.cz
To: ScamFraudAlert
Subject: Get anti anxiety medications online!!
Date: Sat, 13 Jun 2009 18:47:50 -0500 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=”windows-1250″ reply-type=original Content-Transfer-Encoding: 7bit Content-Length: 136
An Incredible CanadianPharmacy is available at your Fingertips!
No Doctor Needed! Browse our SiteToday! -> http://homevaried.com

Address lookup

canonical name	homevaried.com.
aliases
addresses	60.191.221.123 60.191.239.166 61.191.191.241 203.93.208.86 58.17.3.41

Domain Whois record

Queried whois.internic.net with “dom homevaried.com“…

   Domain Name: HOMEVARIED.COM
   Registrar: CHINA SPRINGBOARD INC.
   Whois Server: whois.namerich.cn
   Referral URL: http://www.namerich.cn
   Name Server: NS1.BEDPLAIN.COM
   Name Server: NS2.BEDPLAIN.COM
   Name Server: NS3.AGAINTAIL.COM
   Name Server: NS4.AGAINTAIL.COM
   Name Server: NS5.OUTMILK.IM
   Name Server: NS6.OUTMILK.IM
   Status: ok
   Updated Date: 10-jun-2009
   Creation Date: 10-jun-2009
   Expiration Date: 10-jun-2010

Last update of whois database: Thu, 18 Jun 2009 07:58:28 UTC <<<

Queried whois.namerich.cn with “homevaried.com“…

 DomainName : homevaried.com

RSP: China Springboard Inc.
URL: http://www.namerich.cn      

Name Server......................NS5.OUTMILK.IM
Name Server......................NS3.AGAINTAIL.COM
Name Server......................NS1.BEDPLAIN.COM
Name Server......................NS6.OUTMILK.IM
Name Server......................NS4.AGAINTAIL.COM
Name Server......................NS2.BEDPLAIN.COM
Status...........................ok
Creation  Date ..................2009-06-10
Expiration Date .................2010-06-10
Last Update  Date ...............2009-06-10

Registrant ID ...................V-X-57187-12492
Registrant Name .................JIANG HUA
Registrant Organization .........JIANG HUA
Registrant Address ..............LONGSHABEILU12
Registrant City..................TianJin
Registrant Province/State .......TianJin
Registrant Country Code .........CN
Registrant Postal Code ..........300009
Registrant Phone Number .........+86.02251251685
Registrant Fax ..................+86.02251251685
Registrant Email ................xianeldb@126.com

Administrative ID ...............V-X-57187-12492
Administrative Name .............JIANG HUA
Administrative Organization .....JIANG HUA
Administrative Address ..........LONGSHABEILU12
Administrative City..............TianJin
Administrative Province/State ...TianJin
Administrative Country Code .....CN
Administrative Postal Code ......300009
Administrative Phone Number .....+86.02251251685
Administrative Fax ..............+86.02251251685
Administrative Email ............xianeldb@126.com

Billing ID ......................V-X-57187-12492
Billing Name ....................JIANG HUA
Billing Organization ............JIANG HUA
Billing Address .................LONGSHABEILU12
Billing City.....................TianJin
Billing Province/State ..........TianJin
Billing Country Code ............CN
Billing Postal Code .............300009
Billing Phone Number ............+86.02251251685
Billing Fax .....................+86.02251251685
Billing Email ...................xianeldb@126.com

Technical ID ....................V-X-57187-12492
Technical Name ..................JIANG HUA
Technical Organization...........JIANG HUA
Technical Address ...............LONGSHABEILU12
Technical City...................TianJin
Technical Province/State.........TianJin
Technical Country Code ..........CN
Technical Postal Code ...........300009
Technical Phone Number ..........+86.02251251685
Technical Fax ...................+86.02251251685
Technical Email .................xianeldb@126.com

; Please register your domains at
; http://www.namerich.cn

Network Whois record

Queried whois.apnic.net with “60.191.221.123“…

inetnum:      60.191.221.0 - 60.191.221.255
netname:      JINHUA-TELECOM-LTD
country:      CN
descr:        Jinhua Telecom Co.,ltd IDC Center
descr:
admin-c:      LW1143-AP
tech-c:       CJ54-AP
status:       ASSIGNED NON-PORTABLE
changed:      auto-dbm@dcb.hz.zj.cn 20070618
mnt-by:       MAINT-CN-CHINANET-ZJ-JH
source:       APNIC

role:         CHINANET-ZJ Jinhua
address:      No.155 Xishi street,Jinhua,Zhejiang.321000
country:      CN
phone:        +86-579-2300779
fax-no:       +86-579-2330035
e-mail:       anti_spam@mail.jhptt.zj.cn
trouble:      send spam reports to anti_spam@mail.jhptt.zj.cn
trouble:      and abuse reports to anti_spam@mail.jhptt.zj.cn
trouble:      Please include detailed information and times in UTC
admin-c:      CH55-AP
tech-c:       CH55-AP
nic-hdl:      CJ54-AP
mnt-by:       MAINT-CHINANET-ZJ
changed:      master@dcb.hz.zj.cn 20031204
source:       APNIC

person:       Lujiang Wang
nic-hdl:      LW1143-AP
e-mail:       anti_spam@mail.jhptt.zj.cn
address:      NO.155 Xishi Street,Jinhua,Zhejiang.Postcode:321000
phone:        +86-579-83285460
country:      CN
changed:      auto-dbm@dcb.hz.zj.cn 20070618
mnt-by:       MAINT-CN-CHINANET-ZJ-JH
source:       APNIC

DNS records

DNS query for 123.221.191.60.in-addr.arpa returned an error from the server: NameError

name	class	type	data	time to live
homevaried.com	IN	A	58.17.3.41	3600s	(01:00:00)
homevaried.com	IN	A	60.191.239.166	3600s	(01:00:00)
homevaried.com	IN	A	60.191.221.123	3600s	(01:00:00)
homevaried.com	IN	A	61.191.191.241	3600s	(01:00:00)
homevaried.com	IN	A	203.93.208.86	3600s	(01:00:00)

— end —

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Address lookup

Domain Whois record

Network Whois record

DNS records

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Address lookup

Domain Whois record

Network Whois record

DNS records

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Address lookup

Domain Whois record

Network Whois record

DNS records

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Address lookup

Domain Whois record

Network Whois record

DNS records

Consumer & Business Alert – Stolen Identity!!!! This Is A Fraudulent Website Phishing or Identity Theft Do Not Conduct or Transact Business With Them

Address lookup

Domain Whois record

Network Whois record

DNS records

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Header Analysis

Address lookup

Domain Whois record

Network Whois record

DNS records

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Header Analysis

Address lookup

Domain Whois record

Network Whois record

DNS records

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Address lookup

Domain Whois record

Network Whois record

DNS records

Domain Whois record

Network Whois record

DNS records

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Address lookup

Domain Whois record

Network Whois record

DNS records

Header Analysis

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Header Analysis

Address lookup

Domain Whois record

Network Whois record

DNS records

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Warning

Address lookup

Domain Whois record

Network Whois record

DNS records

Address lookup

Domain Whois record

Network Whois record

DNS records

Buying Precription Drugs Online May Be Dangerous – Consumer Alert – Drug Enforcement Administration Says

Address lookup

Domain Whois record

Network Whois record

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Consumer & Business Alert – Stolen Identity!!!!
This Is A Fraudulent Website
Phishing or Identity Theft
Do Not Conduct or Transact Business With Them

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says

Buying Precription Drugs Online May Be Dangerous
– Consumer Alert –
Drug Enforcement Administration Says