cNotes 検索 一覧 カテゴリ

123Greetings.comを騙るスパム - postc.html

Published: 2012/08/12

観測日： 2012/8/8

通数： 100通/day

手法： 誘導URL型

目的： マルウェア感染

特徴：

サイトに設置されるスクリプトファイルのファイル名が「postc.html」

いわゆるgreeting card/ecard系のスパムです。

2,3年前にはZeuSやBredolabに利用されて大流行していたネタですが、

久しぶりに最近の攻撃用に利用されているのを観測しました。

最近数年前に流行したネタの再利用を多く観測していますが、その一つです。

文面。

誘導URLの例。「postc.html」が特徴。

 ｈttp://21soundtracks.com/postc.html
 ｈttp://3680999.com/postc.html
 ｈttp://76ol.net/postc.html
 ｈttp://98793282.p93.sqnet.cn/postc.html
 ｈttp://ankieta.kosmetykiaa.pl/postc.html
 ｈttp://ay-motor.com/postc.html
 ｈttp://bahaoshangcheng.com/postc.html
 ｈttp://beaconpost.com/mail.htm
 ｈttp://beaconpost.com/mail.htm
 ｈttp://beadsgalore.co.nz/postc.html
 ｈttp://bjflm.cn/postc.html
 ｈttp://bjhkby.com/postc.html
 ｈttp://bjlrpc.com/postc.html
 ｈttp://brightsuncoffee.com/postc.html
 ｈttp://carbcomposite.com/postc.html
 ｈttp://centralstudios.cn/postc.html
 ｈttp://chengdaepe.com/postc.html
 ｈttp://ciocolatapersonalizata.ro/postc.html
 ｈttp://ctrip163.com/postc.html
 ｈttp://dhjmsb.com/postc.html
 ｈttp://doleson.com/postc.html
 ｈttp://eletecsystems.ru/postc.html
 ｈttp://foreverbj.com/postc.html
 ｈttp://foryoubbs.com/postc.html
 ｈttp://greencook.net/postc.html
 ｈttp://hbgtbw.com/postc.html
 ｈttp://invest.m-industry.ru/postc.html
 ｈttp://iotsource.com/postc.html
 ｈttp://irecords.cn/postc.html
 ｈttp://itouzi.net/postc.html
 ｈttp://jinqiaouk.com/postc.html
 ｈttp://joanjoy.com/postc.html
 ｈttp://k2medya.com/postc.html
 ｈttp://keenchipled.com/postc.html
 ｈttp://kesaier.com/postc.html
 ｈttp://kushitong.com/postc.html
 ｈttp://labassee.bebe9.com/postc.html
 ｈttp://liquidarchaeology.com/postc.html
 ｈttp://lyzgs.com/postc.html
 ｈttp://mdshy.com/postc.html
 ｈttp://montmorot.bebe9.com/postc.html
 ｈttp://mulhouse-wittenheim.bebe9.com/postc.html
 ｈttp:nhughesp@holyapostlesnyc.org
 ｈttp://nmg8000.com/postc.html
 ｈttp://nopos.jaibanaips.com/postc.html
 ｈttp://novoferm.com.cn/postc.html
 ｈttp://ny.stjarnjul.se/postc.html
 ｈttp://ontarioaug.com/postc.html
 ｈttp://phototula.ru/postc.html
 ｈttp://plantykopernik.pl/postc.html
 ｈttp://pos.bg/postc.html
 ｈttp://postalspecfla.itsmyiq.com/mail.htm
 ｈttp://proje81.com/postc.html
 ｈttp://putlubvi.ru/postc.html
 ｈttp://rivesaltes.bebe9.com/postc.html
 ｈttp://rushangtz.com.cn/postc.html
 ｈttp://s49065.w25.21pages.com/postc.html
 ｈttp://s63475.w25.21pages.com/postc.html
 ｈttp://salonf.spb.ru/postc.html
 ｈttp://sampuesartesanias.com/postc.html
 ｈttp://shanxianzhengda.com/postc.html
 ｈttp://sigortabahcesi.com./postc.html
 ｈttp://speedtest.lbisat.com/postc.html
 ｈttp://sphere.com.my/postc.html
 ｈttp://steamcleanersinc.com/postc.html
 ｈttp://swadeshgifts.com/postc.html
 ｈttp://tangwo.cn/postc.html
 ｈttp://tczp168.com/postc.html
 ｈttp://tender.pl/postc.html
 ｈttp://ts-robot.com/postc.html
 ｈttp://votive.co.uk/postc.html
 ｈttp://whchivast.com/postc.html
 ｈttp://yanjingedu.org/postc.html
 ｈttp://yishiweb.com/postc.html
 ｈttp://ytmeishen.com/postc.html
 ｈttp://zhongmeisb.com/postc.html
 ｈttp://zhuangdian.cc/postc.html
 ｈttp://zuchezhaowo.com/postc.html

ドメインに関して。

domainip逆引きASAS namecountry
kushitong.com58.215.64.137NONE4134CHINANET-BACKBONE_No.31Jin-rong_StreetChina
brightsuncoffee.com202.67.231.155dns4.hostingspeed.net.4645ASN-HKNET-AP_HKNet_Co._LtdHongKong
dhjmsb.com121.189.19.22NONE4766KIXS-AS-KR_Korea_TelecomKoreaRepublic
keenchipled.com121.189.19.24NONE4766KIXS-AS-KR_Korea_TelecomKoreaRepublic
shanxianzhengda.com121.189.19.21NONE4766KIXS-AS-KR_Korea_TelecomKoreaRepublic
ytmeishen.com121.189.19.13NONE4766KIXS-AS-KR_Korea_TelecomKoreaRepublic
21soundtracks.com218.83.160.69NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
ctrip163.com61.152.239.188NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
iotsource.com61.151.239.134NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
kesaier.com218.83.160.69NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
mdshy.com61.152.239.188NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
novoferm.com.cn61.152.91.38NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
rushangtz.com.cn61.152.239.188NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
s49065.w25.21pages.com218.83.160.69NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
s63475.w25.21pages.com218.83.160.69NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
tangwo.cn61.152.239.188NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
ts-robot.com218.83.160.69NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
zhuangdian.cc61.151.239.202NONE4812CHINANET-SH-AP_China_Telecom_(Group)China
irecords.cn121.101.217.125NONE4847CNIX-AP_China_Networks_Inter-ExchangeChina
liquidarchaeology.com63.250.48.134unix07.hsphere.cc.4906FDS-01_-_Frontline_Data_Services_IncUnitedStates
ontarioaug.com63.250.48.134unix07.hsphere.cc.4906FDS-01_-_Frontline_Data_Services_IncUnitedStates
ciocolatapersonalizata.ro193.226.163.129NONE5606KQRO_GTS_Telecom_SRLRomania
eletecsystems.ru195.131.162.2terraon.ru.6690WEBPLUS-AS_Web_Plus_ZAORussianFederation
invest.m-industry.ru194.8.181.65vh2.sp.ru.6690WEBPLUS-AS_Web_Plus_ZAORussianFederation
putlubvi.ru81.177.139.124NONE8342RTCOMM-AS_OJSC_RTComm.RURussianFederation
centralstudios.cn108.162.198.188NONE13335CLOUDFLARENET_-_CloudFlare_Inc.UnitedStates
centralstudios.cn108.162.198.88NONE13335CLOUDFLARENET_-_CloudFlare_Inc.UnitedStates
tender.pl188.165.217.98www.bajtkom.pl.16276OVH_OVH_SystemsFrance
nmg8000.com122.115.36.190NONE17429BGCTVNET_BEIJING_GEHUA_CATV_NETWORK_CO.LTDChina
chengdaepe.com58.64.187.60NONE17444NWT-AS-AP_AS_number_for_New_World_Telephone_Ltd.HongKong
itouzi.net113.10.178.78NONE17444NWT-AS-AP_AS_number_for_New_World_Telephone_Ltd.HongKong
3680999.com203.158.16.72NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
76ol.net203.158.16.72NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
98793282.p93.sqnet.cn203.158.16.75NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
ay-motor.com61.4.83.32NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
bjflm.cn61.4.83.39NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
bjhkby.com115.47.67.138NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
bjlrpc.com115.47.67.171NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
carbcomposite.com115.47.73.245NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
doleson.com115.47.134.247NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
foreverbj.com203.158.16.75NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
foryoubbs.com115.47.68.164NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
greencook.net61.4.83.39NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
hbgtbw.com203.158.16.75NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
jinqiaouk.com203.158.16.66NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
lyzgs.com203.158.16.75NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
tczp168.com203.158.16.75NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
whchivast.com203.158.16.66NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
yanjingedu.org61.4.83.32NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
yishiweb.com203.158.16.72NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
zhongmeisb.com115.47.170.99NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
zuchezhaowo.com203.158.16.72NONE17964DXTNET_Beijing_Dian-Xin-Tong_Network_Technologies_Co._Ltd.China
beaconpost.com209.188.15.35lonestar.hosted-servers.net.19181CWIE_-_CWIE_LLCUnitedStates
beaconpost.com209.188.15.35lonestar.hosted-servers.net.19181CWIE_-_CWIE_LLCUnitedStates
nopos.jaibanaips.com64.90.42.13ps110979.dreamhost.com.26347DREAMHOST-AS_-_New_Dream_Network_LLCUnitedStates
postalspecfla.itsmyiq.com75.119.194.105ps24764.dreamhost.com.26347DREAMHOST-AS_-_New_Dream_Network_LLCUnitedStates
steamcleanersinc.com184.168.179.1p3nlhg220c1220.shr.prod.phx3.secureserver.net.26496AS-26496-GO-DADDY-COM-LLC_-_GoDaddy.com_LLCUnitedStates
votive.co.uk109.75.171.200wokingham.webhosting.uk.com.29550SIMPLYTRANSIT_Simply_Transit_LtdUnitedKingdom
swadeshgifts.com108.178.28.74hosttrue.dnsracks.com.32475SINGLEHOP-INC_-_SingleHopUnitedStates
sampuesartesanias.com66.7.221.226gold.nseasy.com.33182DIMENOC_-_HostDime.com_Inc.UnitedStates
pos.bg78.90.170.137NONE35141MEGALAN_Megalan_-_Autonomous_System_of_Megalan_Network_Ltd.Bulgaria
labassee.bebe9.com193.169.65.138xe-bb9-web-prod.systonic.net.38926SYSTONIC-AS_AS_for_BDL-SYSTEME_SA_(aka_Systonic)France
montmorot.bebe9.com193.169.65.138xe-bb9-web-prod.systonic.net.38926SYSTONIC-AS_AS_for_BDL-SYSTEME_SA_(aka_Systonic)France
mulhouse-wittenheim.bebe9.com193.169.65.138xe-bb9-web-prod.systonic.net.38926SYSTONIC-AS_AS_for_BDL-SYSTEME_SA_(aka_Systonic)France
rivesaltes.bebe9.com193.169.65.138xe-bb9-web-prod.systonic.net.38926SYSTONIC-AS_AS_for_BDL-SYSTEME_SA_(aka_Systonic)France
ny.stjarnjul.se217.70.32.136www1-php5.fordon.levonline.com.41175INTERNETBORDER_Internet_Border_Technolgies_ABSweden
ankieta.kosmetykiaa.pl94.124.1.3host3.polserwer.net.42927S-NET-AS_S-NET_Sp._z_o.o.Poland
plantykopernik.pl94.124.1.3host3.polserwer.net.42927S-NET-AS_S-NET_Sp._z_o.o.Poland
k2medya.com77.245.149.33srv75626s1.trdns.com.43391NETDIREKT-TR_Netdirekt_A.S.Turkey
proje81.com77.245.149.55host55.b6.nw.com.tr.43391NETDIREKT-TR_Netdirekt_A.S.Turkey
sigortabahcesi.com.77.245.149.14linmail.mail.trdns.com.43391NETDIREKT-TR_Netdirekt_A.S.Turkey
beadsgalore.co.nz119.47.118.75linuxplesk13.openhost.net.nz.45459WEB-DRIVE-NZ-AS-AP_Web_Drive_LimitedNewZealand
sphere.com.my103.6.196.12triton.mschosting.com.46015EXABYTES-AS-AP_Exa_Bytes_Network_Sdn.Bhd.Malaysia
joanjoy.com69.89.29.6629-66.bluehost.com.46606BLUEHOST-AS-2_-_Bluehost_Inc.UnitedStates
phototula.ru91.218.228.19h9.ihc.ru.48172OVERSUN-MERCURY_Oversun-Mercury_LtdRussianFederation

アジア圏が少し多め？cloudflareを利用しているサイトが改竄されてるのが気持ち悪いですね。

[カテゴリ:spam観察日記]

by jyake

Powered by FreeStyleWikiLite X

TOP

Contents

About cNotes

What's New

2014/10/04 2014/08/22 2014/08/21 2014/08/15 2014/07/22 2014/07/01 2014/06/29 2014/06/28 2014/04/29 2014/04/28

2012年08月12日 10時40分09秒