イスラエルのガザ侵攻のニュースを利用したスパム

flashplayer系の新種です。時事ネタをベースにCNNのニュースだといつわって、flashplayerやコーデックのインストールを促し感染させるものです。

たとえば以前のエントリ。

こんかいはこんなメールです。

 Subject: Israel War on Hamas: A Dozen Thoughts
 
 Israel offers short respite from strikes.
 Israel will halt its bombardment of Gaza for three hours every day to allow  residents of the Hamas-ruled Palestinian territory to obtain much-needed  supplies, a military spokesman says.
 The images broadcast here were graphic and striking.
 The Al Jazeera English report below captures the extent of the devastation  caused by the initial strikes.
 
 Proceed to view details:
 
 http://edition.cnn.2009.forms.world-tq03lctm6.newsforusacnn.com/israel-gaza.htm?/asp/VIDEO=xxxxxxxxxxxxxxxx
 
 
 
 2009 Cable News Network. A Time Warner Company. All Rights Reserved.

以下のような長ったらしい、しかもストレートなドメインが利用されます。

今現在は使用できません。

 edition.cnn.2009.emberUIWeb.world-z540ydqd8.installflashadobeplaye10.com/israel-gaza.htm?/information/VIDEO=xxxxxxxx
 edition.cnn.2009.information.world-z7hmda5oa.installflashadobeplaye10.com/israel-gaza.htm?/based/VIDEO=xxxxxxxxx
 edition.cnn.2009.statement.world-wnx2yglu8.installflashadobeplaye10.com/israel-gaza.htm?/logon/VIDEO=xxxxxxxxxxx
 edition.cnn.2009.subject.world-deklcpiw3.downloadplayersnews.com/israel-gaza.htm?/BusinessLogin/VIDEO=xxxxxxxxx
 edition.cnn.2009.version.world-84i3vxenh.startinstalladobe.com/israel-gaza.htm?/multipart/VIDEO=xxxxxxxxx1
 edition.cnn.2009.forms.world-tq03lctm6.newsforusacnn.com/israel-gaza.htm?/asp/VIDEO=xxxxxxxxxxxx

   Domain Name: INSTALLFLASHADOBEPLAYE10.COM
   Registrar: BIZCN.COM, INC.
   Whois Server: whois.bizcn.com
   Referral URL: http://www.bizcn.com
   Name Server: NS1.SPACEINSTALLATIONS.COM
   Name Server: NS2.SPACEINSTALLATIONS.COM
   Status: clientDeleteProhibited
   Status: clientHold
   Status: clientTransferProhibited
   Updated Date: 08-jan-2009
   Creation Date: 08-jan-2009
   Expiration Date: 08-jan-2010

   Domain Name: DOWNLOADPLAYERSNEWS.COM
   Registrar: BIZCN.COM, INC.
   Whois Server: whois.bizcn.com
   Referral URL: http://www.bizcn.com
   Name Server: NS1.SPACEINSTALLATIONS.COM
   Name Server: NS2.SPACEINSTALLATIONS.COM
   Status: clientDeleteProhibited
   Status: clientHold
   Status: clientTransferProhibited
   Updated Date: 08-jan-2009
   Creation Date: 08-jan-2009
   Expiration Date: 08-jan-2010

[カテゴリ:spam観察日記]

by jyake