Eva Pharmacy campaign

This is transferred to the new board at http://fraudreports.prophpbb.com
Spammers should not profit, so post information here that hits their pockets.

Re: Eva Pharmacy campaign

Postby Red Dwarf » Fri Mar 13, 2015 6:12 pm

How often is each Eva Pharmacy brand used? Sequenced by the number of live sites per fraud brand, we have

Code: Select all
  1771 RxExpressOnline
   537 Canadian Health&Care Mall
   409 RxMedications
   379 My Canadian Pharmacy
    45 Canadian Neighbor Pharmacy
    28 Canadian Family Pharmacy
    19 CanadianPharmacy
     3 Toronto Drugstore
     2 US Drugs
     1 Trusted Tabs
     1 International Legal RX


What registrars provide a domain name registration service to these fraud domains?

Code: Select all
 3133 R01-RU
   15 Key-Systems GmbH
   10 NAMESILO, LLC
   10 IP MIRROR PTE LTD
    6 PAKNIC (PRIVATE) LIMITED
    4 TODAYNIC.COM, INC.
    4 Registrar.eu
    4 NANJING IMPERIOSUS TECHNOLOGY CO. LTD.
    1 TRUNKOZ TECHNOLOGIES PVT LTD.
    1 REGRU-RU
    1 REGISTRAR OF DOMAIN NAMES REG.RU LLC
    1 NETLYNX, INC.
    1 NAUNET-REG-RIPN
    1 GUANGDONG NAISINIKE INFORMATION TECHNOLOGY CO LTD
    1 EURODNS S.A
    1 DOMAINSATCOST.CA CORP
    1 ADVANCED INTERNET TECHNOLOGIES, INC.
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Fri Oct 02, 2015 5:53 pm

A recent development in IP addresses for Eva pharmacy host. They have changed from putting many sites on the same IP address, to spreading some sites (10%) over a 254 range -
198.18.1.1 to 198.18.1.254

This range was previously reserved
IANA wrote:NetRange: 198.18.0.0 - 198.19.255.255
CIDR: 198.18.0.0/15
NetName: SPECIAL-IPV4-BENCHMARK-TESTING-IANA-RESERVED
NetHandle: NET-198-18-0-0-1
Parent: NET198 (NET-198-0-0-0-0)
NetType: IANA Special Use
Comment: Addresses starting with "198.18." or "198.19." are set aside for use in isolated laboratory networks used for benchmarking and performance testing.
They should never appear on the Internet and if you see Internet traffic using these addresses, they are being used without permission.
Comment:
Comment: This assignment was made by the IETF, the organization that develops Internet protocols, in RFC 2544, which can be found at:
Comment: http://datatracker.ietf.org/doc/rfc2544
Ref: http://whois.arin.net/rest/net/NET-198-18-0-0-1


Their preferred hosting addresses are currently

Count - IP Address - abuse complaint

377 91.210.106.11 abuse-mailbox: abuse@hostkey.com
104 80.243.189.35 abuse@redstation.com
102 198.144.158.53 peterk@yesup.com
89 91.200.12.88 abuse@vhoster.net
64 95.84.156.43 abuse@ncnet.ru
60 45.125.192.19 support@readyserver.sg
50 82.221.133.152 abuse@orangewebsite.com
50 81.21.193.70 abuse@kki-bci.pl
33 82.221.133.150
26 148.251.157.140
21 81.21.193.71
13 93.189.41.138
13 198.144.158.52
11 88.150.227.68
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Sat Oct 03, 2015 1:24 am

I have been thinking.

While the domains have their IP address set to one of those 198.18.1.*, they are out of action, because their IP addresses are not routable.

I assume that for some reason the sites are being temporarily taken offline, then put back online. I can't figure out why. If you are changing IP address you usually replace one good one with another. I saw 175 domains offline at once. Weird.
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Sat Oct 03, 2015 5:13 am

Further analysis shows that for these domains, one name server returns a routable IP address, and the other returns one that is not routable.

Here's an example. yourpillmart.be has two name servers, ns1 and ns2. The first is OK, the second seems to be malfunctioning.


Code: Select all
50.0% of queries will be returned by 202.78.227.138 (ns1.yourpillmart.be)
yourpillmart.be.   600   IN   A   185.24.235.201
50.0% of queries will be returned by 212.154.209.10 (ns2.yourpillmart.be)
yourpillmart.be.   0   IN   A   198.18.1.150


A few seconds later
Code: Select all
50.0% of queries will be returned by 202.78.227.138 (ns1.yourpillmart.be)
yourpillmart.be.   600   IN   A   185.24.235.201
50.0% of queries will be returned by 212.154.209.10 (ns2.yourpillmart.be)
yourpillmart.be.   0   IN   A   198.18.1.43


The address returned on consecutive lookups by 212.154.209.10 (ns2.yourpillmart.be) is always non-routable.
That troubled name server resides in Kazakhstan. Its results are reducing the stability of the Eva pharmacy operation :-)

Note that the "time-to-live" on this faulty second name server is 0 seconds instead of 600 seconds for the good name server. The faulty one is set up as fast flux for the range 198.18.1.1 - 198.18.1.254.

Mind you, if I had a machine on the Internet, and I discovered that some Russian crooks had compromised it and were using it as a name server, I couldn't imagine a better plan to stuff up their bizness than to reconfigure it to give invalid results for the name resolutions it is performing.
:twisted:
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby AlphaCentauri » Sat Oct 03, 2015 6:30 pm

I recall a time when what was then Bulker.biz domains had three nameservers when you checked a passive domain name server: the two real ones, and a ns3._____ nameserver that listed IP addresses that were improbable, like the CIA or FBI. They seem to be recycling an old trick, whatever its purpose.
User avatar
AlphaCentauri
You are kiillllling-a my bizinisss!
 
Posts: 5989
Joined: Thu Mar 01, 2007 3:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Sat Oct 03, 2015 11:01 pm

I think that in this case, the resolution of the domain name to an IP address is giving a 50% failure rate or worse.

I can't prove it definitively, but I have found that when I load such a domain it sometimes times out, but if I try it again immediately it succeeds.
If this is right, then the 50% failure rate represents a disadvantage to the Eva gang.

Here are a few currently live samples

Code: Select all
securemedicaremall.be
securepharmeshop.xyz
sgnxecbp.in
thecuringgroup.xyz


When I test these using a DNS traversal, I see a report of a 50% error rate in resolving the name to an address, causing a browser to time out. Occasionally I will get a 75% error rate, such as sgnxecbp.in

Code: Select all
DNS check results for sgnxecbp.in:

Results

** 25.0% of queries will end in failure at 198.18.1.25 (ns1.deabwqlm.ru) - query timed out

** 25.0% of queries will end in failure at 198.18.1.42 (ns2.fajmtolz.xyz) - query timed out

25.0% of queries will be returned by 103.6.207.121 (ns1.deabwqlm.ru)
sgnxecbp.in.   600   IN   A   46.29.248.153

** 25.0% of queries will be returned by 212.154.209.10 (ns2.fajmtolz.xyz)
sgnxecbp.in.   0   IN   A   198.18.1.16


In this case, one of the name servers (ns1.deabwqlm.ru) is also being afflicted with the same bad resolution.

Another failing at 75% of the time: thecuringgroup.xyz
Code: Select all
DNS check results for thecuringgroup.xyz:

Results

25.0% of queries will end in failure at 198.18.1.96 (ns1.upceovvo.in) - query timed out

25.0% of queries will be returned by 103.13.228.186 (ns1.upceovvo.in)
thecuringgroup.xyz.   600   IN   A   46.29.248.153
50.0% of queries will be returned by 212.154.209.10 (ns2.fajmtolz.xyz)
thecuringgroup.xyz.   0   IN   A   198.18.1.197
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Wed Oct 07, 2015 3:19 pm

As of today, they have diagnosed the problem with the disabled name server at that address, (212.154.209.10 in Kazakstan) and reconfigured their network to avoid it. By my reckoning there were at lease 580 ns2.***** Eva name servers using it.

This whole episode shows what could be done to destroy their infrastructure if the owners of compromised machines which have been taken over to provide domain name server resolution are reconfigured to screw up their name resolution.
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Wed Oct 07, 2015 3:44 pm

Since March, the list of most frequent brands and most abused registrars have changed. Here are today's results. The counts include both live and suspended domains over the past 12 months.

END OF SEPTEMBER 2015
Most used brands
Code: Select all
 1218 Canadian Health&Care Mall
  822 RxExpressOnline
  396 CanadianPharmacy
  373 My Canadian Pharmacy
  262 Canadian Neighbor Pharmacy
  168 RxMedications
   81 Canadian Family Pharmacy
   53 Men's Health
   43 Toronto Drugstore
   14 US Drugs
    5 International Legal RX
    2 WikiPharmacy
    2 Trusted Tabs
    1 Unknown
    1 Online Drugstore


Most used registrars
Code: Select all
 1705 R01-RU
  348 TRUNKOZ TECHNOLOGIES PVT LTD.
  342 Key-Systems GmbH
  275 NAMESILO, LLC
  254 BIZCN.COM, INC.
  192 NETLYNX, INC.
  156 PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
   36 CV. JOGJACAMP
   26 Webiq Domains Solutions Pvt. Ltd. (R131-AFIN)
   26 KHEWEUL.COM SA
   17 LOGICBOXES NAMING SERVICES LTD
   16 InterNetworX Ltd. & Co. KG
    8 IP MIRROR PTE LTD
    9 PDR Ltd. d/b/a PublicDomainRegistry.com
    4 ACTIVE REGISTRAR, INC.
    3 TODAYNIC.COM, INC.
    3 ADVANCED INTERNET TECHNOLOGIES, INC.


Omitting the suspended domains, the registrars providing support for live domains today are:
Code: Select all
bait>grep -v [*] evaext|  cut -f 3  | sort | uniq -c | sort -r
 841 R01-RU
 247 BIZCN.COM, INC.
  10 NAMESILO, LLC
   5 Webiq Domains Solutions Pvt. Ltd.


END OF MARCH 2015
Red Dwarf wrote:How often is each Eva Pharmacy brand used? Sequenced by the number of live sites per fraud brand, we have

Code: Select all
  1771 RxExpressOnline
   537 Canadian Health&Care Mall
   409 RxMedications
   379 My Canadian Pharmacy
    45 Canadian Neighbor Pharmacy
    28 Canadian Family Pharmacy
    19 CanadianPharmacy
     3 Toronto Drugstore
     2 US Drugs
     1 Trusted Tabs
     1 International Legal RX


What registrars provide a domain name registration service to these fraud domains?

Code: Select all
 3133 R01-RU
   15 Key-Systems GmbH
   10 NAMESILO, LLC
   10 IP MIRROR PTE LTD
    6 PAKNIC (PRIVATE) LIMITED
    4 TODAYNIC.COM, INC.
    4 Registrar.eu
    4 NANJING IMPERIOSUS TECHNOLOGY CO. LTD.
    1 TRUNKOZ TECHNOLOGIES PVT LTD.
    1 REGRU-RU
    1 REGISTRAR OF DOMAIN NAMES REG.RU LLC
    1 NETLYNX, INC.
    1 NAUNET-REG-RIPN
    1 GUANGDONG NAISINIKE INFORMATION TECHNOLOGY CO LTD
    1 EURODNS S.A
    1 DOMAINSATCOST.CA CORP
    1 ADVANCED INTERNET TECHNOLOGIES, INC.
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Mon May 29, 2017 8:05 pm

IP Addresses of name servers.
Red means failing on May 31 2017


Over the past week, the most used IP addresses for hijacked name servers in order of frequency have been

14 221.207.50.84
14 103.205.96.112
13 185.65.206.111
13 115.124.94.106
7 185.23.116.223
6 194.67.200.64
5 95.215.63.114
5 84.200.211.128
4 107.161.80.234
3 140.115.80.23
3 125.212.224.130
3 103.53.231.3
2 42.112.27.111
1 150.129.3.239
1 103.216.188.54

ISPS RESPONSIBLE FOR THESE HIJACKED HOSTS
The abuse reporting addresses for the most used hijacked name servers are -

* 221.207.50.84 reported June 1
Abuse contact for '221.207.0.0 - 221.207.63.255' is 'zhouxm@chinaunicom.cn'

* 103.205.96.112 FAILING May 31 RECOVERED June 1 reported May 30 FAILING June 8
Abuse contact for '103.205.96.0 - 103.205.99.255' is hieu.huynh@tpcoms.vn, tan.ha@tpcoms.vn

* 185.65.206.111
Abuse contact for '185.65.206.0 - 185.65.206.255' is 'mtalaat@citynethost.com'

* 115.124.94.106
Abuse contact for '115.124.94.1 - 115.124.94.127' is 'abuse@idnic.net' and rianto@tachyon.net.id

* 185.23.116.223 FAILING May 31
Abuse contact for '185.23.116.0 - 185.23.119.255' is 'snr@simplexwebs.com' and harry@simplexwebs.com

194.67.200.64
Abuse contact for '194.67.200.0 - 194.67.207.255' is 'abuse@marosnet.ru'

* 95.215.63.114
Abuse contact for '95.215.60.0 - 95.215.63.255' is 'abuse@sologigabit.com'

* 84.200.211.128 FAILING May 31 RECOVERED June 1 reported June 1
Abuse contact for '84.200.211.0 - 84.200.211.255' is 'abuse@accelerated.de' and abuse@proplay.de

* 107.161.80.234 Reported June 1
contact:Abuse-Email: abuse@quadranet.com

* 140.115.80.23 FAILING June 1 RECOVERED June 3
Abuse contact for '140.115.0.0 - 140.115.255.255' is 'hostmaster@twnic.net.tw' and tanetadm@moe.edu.tw

125.212.224.130 FAILING May 31 RECOVERED June 3
remarks: send spam and abuse report to soc@viettel.com.vn

* 103.53.231.3
abuse reports to phuly@aohoaviet.com

* reported, May 29 - June 1, 2017
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Mon May 29, 2017 10:23 pm

These are the numbers of live Eva Pharmacy sites at the end of May 2017

375 Canadian Health&Care Mall
175 RxExpressOnline
138 My Canadian Pharmacy
107 CanadianPharmacy
49 Canadian Neighbor Pharmacy
39 RxMedications
21 Canadian Family Pharmacy
14 Toronto Drugstore
2 US Drugs

These are the registrars who are sponsoring these domains

543 R01-RU
169 R01-SU
70 R01-REG-FID
38 REGRU-SU
38 Key-Systems GmbH
20 PDR LTD.
13 ARDIS-SU
10 BIZCN.COM, INC.
8 REGRU-REG-FID
5 TUCOWS DOMAINS INC.
4 BIZCN.COM INC.
2 REG.RU
2 Gransy s.r.o.
2 GKG.NET, INC.
2 ADVANCED INTERNET TECHNOLOGIES, INC.
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Thu Jun 01, 2017 4:47 am

Highest used Name Server addresses for Eva Pharmacy fraud, and addresses for abuse complaints, discovered on June 1 2017:

77 107.161.80.234 abuse@quadranet.com
70 103.205.96.112 hieu.huynh@tpcoms.vn tan.ha@tpcoms.vn
58 194.67.200.64 abuse@marosnet.ru
22 185.65.206.111 mtalaat@citynethost.com
18 84.200.211.128 abuse@accelerated.de abuse@proplay.de
18 125.212.241.232 tiennd@viettel.com.vn soc@viettel.com.vn
17 218.2.22.96 abuse@jsinfo.net
16 103.53.231.3 phuly@aohoaviet.com
14 221.207.50.84 zhouxm@chinaunicom.cn abuse@cnc-noc.net
12 106.14.192.61 ipas@cnnic.cn
11 42.112.27.111 ftel.noc.net@fpt.com.vn haitt3@fpt.com.vn
10 140.115.80.23 tanetadm@moe.edu.tw
8 5.226.168.158 abuse@comforthost.net
7 95.143.198.186 peter@serverconnect.se abuse@serverconnect.se
6 95.215.63.114 abuse@sologigabit.com
6 78.46.249.202 abuse@hetzner.de mail@gurezkij.de
6 123.30.209.222 abuse@vnn.vn
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Thu Jun 01, 2017 6:20 am

abuse@accelerated.de [ABUSE-report] Your abuse report from 01.06.2017 was received [Hijacked name server on your IP address 84.200.211.128]


Hijacked server at your IP address 107.161.80.234
abuse-ticket@quadranet.com
Your abuse report has been submitted to our Abuse Department.
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Sat Jun 03, 2017 7:00 am

Current nameserver IP addresses, June 2, 2017. These are used solely to resolve domain names for the Eva Pharmacy fraud.
Each IP address has a hijacked name server, as described at
Fraud Reports - Hijacked_host

Count | IP ADDRESS | ABUSE REPORTING
153 140.115.80.23 tanetadm@moe.edu.tw
113 103.53.231.3 phuly@aohoaviet.com
92 103.205.96.112 hieu.huynh@tpcoms.vn tan.ha@tpcoms.vn
83 125.212.224.130 soc@viettel.com.vn tiennd@viettel.com.vn
73 84.200.211.128 abuse@proplay.de abuse@accelerated.de
70 194.67.200.64 abuse@marosnet.ru
47 125.212.241.232 soc@viettel.com.vn tiennd@viettel.com.vn
43 218.2.22.96 abuse@jsinfo.net
37 221.207.50.84 zhouxm@chinaunicom.cn abuse@cnc-noc.net
28 185.65.206.111 mtalaat@citynethost.com
24 42.112.27.111 haitt3@fpt.com.vn
19 5.226.168.158 abuse@comforthost.net
19 103.250.184.219 abuse@leapswitch.com (reported June 2, swapped out for 103.205.96.112 or 103.221.220.169 or 150.129.3.239 or 180.235.148.209)
17 123.30.209.222 abuse@vnn.vn
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Thu Jun 08, 2017 6:14 am

> 19 103.250.184.219 abuse@leapswitch.com (reported June 2, swapped out for 103.205.96.112 or 103.221.220.169 or 150.129.3.239 or 180.235.148.209)
Leapswitch wrote:date: Sun, Jun 4, 2017 at 5:28 PM
subject: Re: Hijacked machine at 103.250.184.219
mailed-by: leapswitch.com
Hello,

We have suspended the client server.

Regards,
Technical Support Engineer
LeapSwitch Networks Pvt. Ltd.


New addresses are now

As shown here
Code: Select all
> ns1.firstpillreward.ru had address 103.250.184.219
ns1.firstpillreward.ru has address 218.2.22.96
ns1.firstpillreward.ru has address 180.235.148.209

> ns1.genericmedsinc.ru had address 103.250.184.219
ns1.genericmedsinc.ru has address 218.2.22.96
ns1.genericmedsinc.ru has address 180.235.148.209

> ns1.globalaidvalue.ru had address 103.250.184.219
ns1.globalaidvalue.ru has address 218.2.22.96
ns1.globalaidvalue.ru has address 180.235.148.209

> ns1.globalcareoutlet.ru had address 103.250.184.219
ns1.GLOBALCAREOUTLET.ru  has  address 125.212.241.232
ns1.GLOBALCAREOUTLET.ru has address 180.235.148.209

> ns1.globaldrugvalue.ru had address 103.250.184.219
ns1.globaldrugvalue.ru has address 125.212.241.232
ns1.globaldrugvalue.ru has address 180.235.148.209

> ns1.globalmedssale.ru had address 103.250.184.219
ns1.globalmedssale.ru has address 218.2.22.96
ns1.globalmedssale.ru has address 180.235.148.209

> ns1.goodfastmarket.ru had address 103.250.184.219
ns1.goodfastmarket.ru has address 218.2.22.96
ns1.goodfastmarket.ru has address 180.235.148.209

> ns1.goodpharminc.ru had address 103.250.184.219
ns1.goodpharminc.ru has address 218.2.22.96
ns1.goodpharminc.ru has address 180.235.148.209

> ns1.goodprivateinc.ru had address 103.250.184.219
ns1.goodprivateinc.ru has address 218.2.22.96
ns1.goodprivateinc.ru has address 180.235.148.209

> ns1.goodsafeassist.ru had address 103.250.184.219
ns1.goodsafeassist.ru has address 218.2.22.96
ns1.goodsafeassist.ru has address 180.235.148.209

> ns1.goodtabsmart.ru had address 103.250.184.219
ns1.goodtabsmart.ru has address 125.212.241.232
ns1.goodtabsmart.ru has address 180.235.148.209

> ns1.homecarebargain.ru had address 103.250.184.219
ns1.homecarebargain.ru has address 125.212.241.232
ns1.homecarebargain.ru has address 180.235.148.209

> ns1.hotrxreward.ru had address 103.250.184.219
ns1.hotrxreward.ru has address 180.235.148.209

> ns1.hzcsioru.ru had address 103.250.184.219
ns1.hzcsioru.ru has address 218.2.22.96
ns1.hzcsioru.ru has address 180.235.148.209

> ns1.ikxxqjmc.ru had address 103.250.184.219
ns1.ikxxqjmc.ru has address 218.2.22.96
ns1.ikxxqjmc.ru has address 180.235.148.209

> ns1.iljsvqxo.ru had address 103.250.184.219
ns1.iljsvqxo.ru has address 218.2.22.96
ns1.iljsvqxo.ru has address 180.235.148.209

> ns1.ilypguxu.ru had address 103.250.184.219
ns1.ilypguxu.ru has address 218.2.22.96
ns1.ilypguxu.ru has address 180.235.148.209

> ns2.bestpilleshop.ru had address 103.250.184.219
ns2.bestpilleshop.ru has address 43.254.53.115
ns2.bestpilleshop.ru has address 125.212.224.130

> ns2.canadianhottrade.ru had address 103.250.184.219
ns2.canadianhottrade.ru has address 43.254.53.115
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Eva Pharmacy campaign

Postby Red Dwarf » Sun Jun 18, 2017 8:22 pm

The above name servers (or rather those still up) have reverted to an IP in Russia. 95.31.22.193 - CORBINA TELECOM in Moscow - abuse@beeline.ru

Code: Select all
   IP Address ns1.globalaidvalue.ru  did have  address 103.250.184.219
ns1.globalaidvalue.ru has address 95.31.22.193

   IP Address ns1.globalcareoutlet.ru  did have  address 103.250.184.219
ns1.globalcareoutlet.ru has address 95.31.22.193

   IP Address ns1.goodpharminc.ru  did have  address 103.250.184.219
ns1.goodpharminc.ru has address 95.31.22.193

   IP Address ns1.goodprivateinc.ru  did have  address 103.250.184.219
ns1.goodprivateinc.ru has address 95.31.22.193

   IP Address ns1.goodsafeassist.ru  did have  address 103.250.184.219
ns1.goodsafeassist.ru has address 95.31.22.193

   IP Address ns1.goodtabsmart.ru  did have  address 103.250.184.219
ns1.goodtabsmart.ru has address 95.31.22.193

   IP Address ns1.homecarebargain.ru  did have  address 103.250.184.219
ns1.homecarebargain.ru has address 95.31.22.193

   IP Address ns1.hotrxreward.ru  did have  address 103.250.184.219
ns1.hotrxreward.ru has address 95.31.22.193

   IP Address ns2.bestpilleshop.ru  did have  address 103.250.184.219
ns2.bestpilleshop.ru has address 95.31.22.193

   IP Address ns2.canadianhottrade.ru  did have  address 103.250.184.219
ns2.canadianhottrade.ru has address 95.31.22.193
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

PreviousNext

Return to Fight Spammers

Who is online

Users browsing this forum: Bing [Bot] and 2 guests

cron