|
Sick of spam? Get mad and get even
Blog
|
|
Mon, 19 Feb 2007
|
 Pharmacy Express sites (almost) removed
After receiving many complaints, a registrar in
the People's Republic of China tried to take
action to remove one of the highest
spammed suites of web sites - Leo Kuvayev's
Pharmacy Express.
Heavily spammed sites removed today included
- lodrx.com
- zodrx.com
- tetrx.com
- vedrx.com
- zonrx.com
- tedrx.com
- 22rx.com
- 33rx.com
- 44rx.com
- rx555.com
Unfortunately, the removal of these sites did not
last. The two rogue name servers registered by
the
criminal Leo Kuvayev operation were restored, and
those sites came back again.
Action required
Beijing Innovative Linkage Technology must
permanently remove two name servers:
- ns0.kerunhandgunfandesikuntun.com
[60.12.193.14]
- ns0.adesuikintandefunhandesun.com
[60.12.193.14]
Posted 17:35
|
3 comments
|
Bejing Innovative
Bejing Innovative Linkage Technology is the
biggest spam supporter there is! Especial
[201.71.0.6] with hundereds of sites wit bloan
forms, like superrate027.com, superrate026.com;
superrate025.com, superrate024.com etc.
afc27d.com; I get around 20 spam messages
promoted by the URL's hosted at [201.76.0.1] per
day! This is an Identity theft spam! I guess,
Bejing Innovative just did not want to get
involved with illigasl drug Promotions! But they
are as criminal as criminal as can be! So please
be careful, whom you thank! 
|
Beijing Innovative
Last Christmas they removed these Kuvayev name
servers in one swoop, and I thank them for it:
ns0.qeruikipoikinfandes.com
ns0.caseruikertungendas.com
ns0.caseruijandesunkinxs.com
ns1.leoforever.com
ns2.jakkahrakka.com
ns.kertuijingenfunhadesun.com
ns.badesruikinherungans.com
ns0.vckionldesunjas.com
ns0.avuihdesunhawio.com
ns0.sadewunmkedefuna.com
ns.vaserunkiontunhdetunhas.com
ns.baserunkintunhdefunhas.com
ns0.quijindeshkinmas.com
ns0.kilonherunhasedun.com
. . . It also pays to notify the China Internet
Society of IP addresses being abused, as they are
quick to identify and blackhole them.
|
URL & server Roadmap of "Canadian Pharmacy"
As many as you, I get up to 40 different messages
with a Lin to Canadian Pharmacy!
They are criminals allreight, they wrongfully
claim to be a memeber of "CIPA" and "Pharmacy
Checker" produce a faked Pharmacy license for
the "State of Ontario", which they host on google
or if they get kicked of there on an :80 port.
Lately they got into .hk doamian names! I have
notified them, but they seem to help the spammer
Here is the roadmap of "Canadian Pharmacy" URL's
and Server IP's since December 2006:
http://juaa.hk [200.255.33.2] http://seeu.hk;
[200.255.33.2] http://zujol.hk [200.255.33.2]
http://jujuk.hk; [200.255.33.2] http://mumrq.hk
[200.255.33.2] http://miyol.hk [200.255.33.2]
http://masqr.hk [200.255.33.2] http://niaqo.hk,
[200.255.33.2] http://sloik.hk/; [200.255.33.2]
http://lostned.hk/; [200.255.33.2]
http://dafroos.hk/; [200.255.33.2]
http://telsiber.com; [63.122.61.15]
http://ourselfp.com [200.255.33.2];
http://wwaerq.hk; [60.2.225.106]
http://potglassy.com; [60.2.225.106]
http://wallettugboat.com; [60.2.225.106]
http://potwalloppersos.com [60.2.225.106]
http://depridatiom.net; http://wwaerq.hk
(http://syspony.com or http://meaterilo.com or
http://repulsemi.com; ; http://blowsback.com;
http://quitefull.com http://trevormuss.com;
http://withfulls.com; http://ekagreem.info
http://overworkscrape.com/p/?&pid=1359; (was
haycockjam.com; rexito.com),
http://lettersmate.com/p/?&pid=1430;
http://www.theclaspoff.com/p/?&pid=1359) at
[200.255.33.2] or [60.2.225.106] or
[63.122.61.15] was [60.8.233.18] &
[61.158.228.139] & was [87.105.62.30] was
[200.255.33.2] was [59.120.127.38] was
[220.189.231.22] was [218.92.3.161] was
[64.53.62.160]; [219.156.206.171] [87.105.62.30]
was [64.53.62.160] was [60.2.225.106] was
[219.156.206.171] [60.2.39.58] [87.105.62.30]
[213.85.227.50] [60.2.225.106] & [60.8.233.18]
was [220.134.150.81] [60.2.39.58]
[200.170.112.252] [60.2.39.58] or
[222.134.78.66] [200.160.91.198] or [60.2.39.58]
was [87.118.160.9] & [221.215.89.210] was
[24.171.143.242] was [87.105.62.30] was
[24.171.143.242] was [85.136.20.235] or
[213.85.227.50] was [83.229.85.132] or
[200.160.91.198] was [24.171.143.242] was
[124.106.168.5] was [24.171.143.242] was
[87.118.160.9] & [87.105.62.30] to
[213.85.227.50] & [200.160.91.198] was
[85.136.20.235] was [213.85.227.50] was
[134.169.97.173] [210.77.30.253] was
[24.232.38.38] was [67.161.52.133] was
[59.120.123.19] was [203.226.0.150] was
[203.231.90.90] was [67.161.52.133] or
[203.97.99.153] was [125.215.149.201] or
[203.215.232.130] was [217.218.235.6] was
[24.232.169.19] was [60.2.225.106] was
[221.215.89.210] or [60.213.15.242] or
[60.213.10.2] or [218.21.90.7] from
[219.156.206.171] from [61.158.228.139] from
[60.213.10.2] from [61.191.21.18] from
[60.2.225.106] from [60.213.10.2] from
[218.21.90.7] from [216.220.40.248] from
[61.191.21.18] from [59.120.127.38] from
[60.2.225.106] from [61.163.118.72] etc.
"Canadian Pharmacy" is returning over and over
to the same servers like now to [200.255.33.2]
or [60.2.225.106]
|
Post a Comment:
|
|
|
|
