Register Of Known Spam Operations (ROKSO) Spam Operation: Canadian Pharmacy 193.27.246.0/23 is listed on the SBL as being assigned to, being under the control of, or being otherwise connected with a known spam operation listed on the ROKSO database as: Canadian Pharmacy Dankon Ltd. - cybercrime hosting network http://www.google.com///group/rosehadley2e10e/?skirtwerzrspillpewttore; ENTER SITE HERE -> http://takenbluesong.diggby29292.com/ -> http://takenbluesong.diggby29292.com/rspill/ -> http://drugsdirecthot.com/ (SBL70820 & ROK8138) *.diggby29292.com has address 193.27.246.83 Do to continued hosting of Canadian Pharmacy on this network, escalating to 193.27.246.0/23 --8<----------------------------------------------------- Request: 193.27.246.83 connected to whois.ripe.net [193.0.0.135:43] ... % This is the RIPE Whois query server #3. % The objects are in RPSL format. % % Rights restricted by copyright. % See http://www.ripe.net/db/copyright.html % Note: This output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '193.27.246.0 - 193.27.247.255' inetnum: 193.27.246.0 - 193.27.247.255 netname: DANKON-NET remarks: Routing issues: ipadm@dankon-ltd.com remarks: Abuse issues (ONLY TO): abuse@dankon-ltd.com remarks: Customer support: support@dankon-ltd.com remarks: General information: info@dankon-ltd.com descr: Dankon Ltd. country: RU org: ORG-DL60-RIPE admin-c: DVE48-RIPE tech-c: DVE48-RIPE status: ASSIGNED PI mnt-by: RIPE-NCC-HM-PI-MNT mnt-by: MNT-DANKON mnt-lower: RIPE-NCC-HM-PI-MNT mnt-routes: MNT-DANKON mnt-domains: MNT-DANKON source: RIPE # Filtered organisation: ORG-DL60-RIPE org-name: Dankon Ltd. org-type: OTHER address: Russia, Moscow, Arbat, h.13/3 e-mail: dankon-ltd@mail.ru mnt-ref: MNT-DANKON mnt-by: MNT-DANKON source: RIPE # Filtered person: Denis Vladimirovich Evmenov address: Russia, Moscow, Arbat, h.13/3 phone: +7 906 7022673 nic-hdl: DVE48-RIPE source: RIPE # Filtered % Information related to '193.27.246.0/23AS43689' route: 193.27.246.0/23 descr: Dankon Ltd. origin: AS43689 mnt-by: MNT-DANKON source: RIPE # Filtered ______________________________________ Domain Name: DANKON-LTD.COM Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU Whois Server: whois.nic.ru Referral URL: http://www.nic.ru Name Server: NS.DANKON-LTD.COM Name Server: NS2.DANKON-LTD.COM Status: clientTransferProhibited Updated Date: 02-jun-2008 Creation Date: 28-apr-2008 Expiration Date: 28-apr-2009 Domain name: DANKON-LTD.COM Name Server: ns.dankon-ltd.com 193.27.246.1 Name Server: ns2.dankon-ltd.com 193.27.247.1 Creation Date: 2008.04.28 Updated Date: 2008.06.02 Expiration Date: 2009.04.28 Status: DELEGATED Registrant ID: GIXEBEJ-RU Registrant Name: "Dankon" Ltd. Registrant Organization: "Dankon" Ltd. Registrant Street1: Arbat st. 13/3 Registrant City: Moscow Registrant Postal Code: 119021 Registrant Country: RU Administrative, Technical Contact Contact ID: 92D9ANC-RU Contact Name: Evmenov Denis Contact Organization: Dankon Ltd. Contact Street1: Arbat 13/3 Contact City: Moscow Contact Postal Code: 119021 Contact Country: RU Contact Phone: +79067022673 Contact E-mail: dankon-ltd@mail.ru --8<----------------------------------------------------- Domain Name : diggby29292.com PunnyCode : diggby29292.com Registrant: Organization : WUQINGYIN Name : WUQINGYIN Address : YUNSHANLU20 City : huainanshi Province/State : anhuisheng Country : china Postal Code : 232067 Administrative Contact: Name : WUQINGYIN Organization : WUQINGYIN Address : YUNSHANLU20 City : huainanshi Province/State : anhuisheng Country : china Postal Code : 232067 Phone Number : 86-0554-69501475 Fax : 86-0554-69501475 Email : WUQINGYIN@GMAIL.COM Technical Contact: Name : WUQINGYIN Organization : WUQINGYIN Address : YUNSHANLU20 City : huainanshi Province/State : anhuisheng Country : china Postal Code : 232067 Phone Number : 86-0554-69501475 Fax : 86-0554-69501475 Email : WUQINGYIN@GMAIL.COM Billing Contact: Name : WUQINGYIN Organization : WUQINGYIN Address : YUNSHANLU20 City : huainanshi Province/State : anhuisheng Country : china Postal Code : 232067 Phone Number : 86-0554-69501475 Fax : 86-0554-69501475 Email : WUQINGYIN@GMAIL.COM --8<----------------------------------------------------- Return-Path: <frederickpaneulogism6977542@yahoo.com> Received: from n8a.bullet.mail.re3.yahoo.com (n8a.bullet.mail.re3.yahoo.com [68.142.236.46]) by {deleted} (Postfix) with SMTP id E484E44CC7 for <{deleted}>; Sat, 27 Dec 2008 00:xx:xx -0800 (PST) Received: from [68.142.237.90] by n8.bullet.re3.yahoo.com with NNFMP; 27 Dec 2008 08:xx:xx -0000 Received: from [66.196.97.136] by t6.bullet.re3.yahoo.com with NNFMP; 27 Dec 2008 08:xx:xx -0000 Received: from [127.0.0.1] by omp109.mail.re3.yahoo.com with NNFMP; 27 Dec 2008 08:xx:xx -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 192472.62183.bm@omp109.mail.re3.yahoo.com Received: (qmail 75382 invoked by uid 60001); 27 Dec 2008 08:xx:xx -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Received:X-Mailer:Date:From:Reply-To:Subject:To:Cc:MIME-Version:Content-Type:Message-ID; b=3upjpsT+ox6MxFQ/YpuluiqcYsjSlBYfZ0ygd9hVJBK6dDWdJYEbz0x0wyxU3SKc1VTU/AMTa9Un180/6Bn1CoWb/2yfBE7QqFDHSLGssL0qGiCukmHimNhGH85pgSijugdVQJNFKKc37P/Z3+fxkH6PlNo7oV69jTAl432dj7Q=; Received: from [83.221.171.8] by web59312.mail.re1.yahoo.com via HTTP; Sat, 27 Dec 2008 00:xx:xx PST X-Mailer: YahooMailWebService/0.7.260.1 Date: Sat, 27 Dec 2008 00:xx:xx -0800 (PST) From: Frederick Paneulogism <frederickpaneulogism6977542@yahoo.com> Reply-To: frederickpaneulogism6977542@yahoo.com Subject: Block the pain down rhurts court To: {deleted} Cc: {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted}, {deleted} MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Message-ID: <{deleted}@web59312.mail.re1.yahoo.com> sense hope keep amuse isnt. http://www.google.com///group/rosehadley2e10e/?skirtwerzrspillpewttore _________________________________________________________ Related listings: 193.27.246.115/32 Live dankon-ltd.com SR02 2009-02-12 03:42:29 SBL72471 favorite-serials.ru, etc. 91.209.184.0/24 Live lira-s.ru SR14 2009-02-01 20:45:29 SBL71669 Canadian Pharmacy mayspirituality.com etc, cybercriminal spammers 193.27.246.248/29 Removed dankon-ltd.com SR15 2008-11-12 02:10:39 SBL69298 Canadian Pharmacy Canadian Pharmacy sites 193.27.246.245/32 Removed dankon-ltd.com SR04 2008-09-08 21:07:04 SBL67686 Pinch bot C&C - ddl.padonaque.info 193.27.246.220/32 Removed dankon-ltd.com SR04 2008-07-27 22:57:20 SBL66399 koromanskipart1.ru / lethaliananapopart2.ru malware C&C 193.27.246.246/32 Removed dankon-ltd.com SR20 2008-07-26 19:53:10 SBL65606 Malware loader and host 72.52.249.216/32 Removed liquidweb.com SR20 2008-07-19 03:21:45 SBL65605 Malware redirector (infected site) 216.185.128.200/32 Removed affinity.com SR20 2008-07-02 19:42:22 SBL65539 Malware redirector and host __________________________________________

Notes for RIPE Abuse/Security

A listing in the ROKSO database means that this entity has already been terminated by a minimum of 3 Internet networks for serious AUP violations. ROKSO spammers are professional spammers who will use every trick to try to stop you from terminating them. You can not issue "warnings" to ROKSO spammers, they treat warnings as simply opportunities to get even more spam out before the account is gone. To protect your network it is important that you read the ROKSO records of your customer now. See: ROKSO records for Canadian Pharmacy

Removal Procedure

As this listing is of part of a known ROKSO spam operation, Spamhaus can not remove this SBL listing if there is any functioning web site, mail server or DNS server still serving the spam operation in 193.27.246.0/23.

To have record SBL70826 (193.27.246.0/23) removed from the SBL, the Abuse/Security representative of RIPE (or the Internet Service Provider responsible for supplying connectivity to 193.27.246.0/23) needs to contact the SBL Team by email (use this link) to explain how the spam problem has been terminated (we need to know exactly how you have terminated the problem). If the spam problem that caused this listing has been verifiably terminated we will normally remove the listing from the SBL without delay.

It is essential that emails to the SBL Team about this SBL listing include this exact ticket information in the Subject: