US Airways 2
Published: 2012/04/08
観測日: 2012/4/6
通数: 600通/day
手法: 文中のリンクをクリックさせることで、マルウェアダウンロードサイトへ誘導
目的: マルウェア感染
特徴:
4/7の「US Airways」のバリエーション。
改竄ページに設置されるhtmlファイルのファイル名が統一的ではなく、7文字のランダムな文字列を利用するようになってます。
メール本文は前と同じ。
文中で指定されているリンク=改竄サイトに設置されるファイルのファイル名が統一的なものではなく、7文字のランダムな文字列に変更。
domain | path | |
---|---|---|
http://mandalayfreerider.com | /TreadImage/phmexhm.html | |
http://smansixbo.sch.id | /media/uvdpTTe.html | |
http://landscapedesign.org.ua | /wp-content/themes/slidette/PeEjVPe.html | |
http://arjomax.eu | /MmTixUF.html | |
http://clor.fr | /language/ru-RU/jfJPAcX.html | |
http://morostech.com | /images/OzlrphU.html | |
http://newfoundland-and-labrador.net | /wp-content/plugins/akismet/OfbDFnV.html | |
http://conchoursclassics.com | /auto/AgdaCKK.html | |
http://creativecrimes.nl | /mGfFEgX.html | |
http://lehrmanntraining.de | /oeffentlich/pix/pdf/iSZpaLk.html | |
http://sklep.okay-sklepy.pl | /images/NHmeZhz.html | |
http://audiomediatv.com | /inversiones/templates/rhuk_milkyway/fHeCENG.html | |
http://csportal-bg.info | /forum/xgPDYlA.html | |
http://hoveniersbedrijfrjansma.nl | /wp-content/themes/ecobiz/cache/OnUhaeZ.html | |
http://neboshop.ru | /yml/xvXidZp.html | |
http://crthailand.com | /upload/company/aOAbpzE.html | |
http://emailstudio.fr | /kDLuvJL.html | |
http://indianpalacefreising.de | /templates/ja_purity/zGbEBuh.html | |
http://nelsonpublicidade.com.br | /templates/system/nIZDs1z.html | |
http://pearl-pk.com | /pearl/images/txsoFaI.html | |
http://primfix-elite-arbitrage.com | /simogeo-Filemanager/userfiles/MDiYJSM.html | |
http://quranschoolinc.com | /gPvYBBD.html | |
http://amdac.co.uk | /templates/ja_purity/DSVCCSG.html | |
http://asteraplys.ru | /includes/yMdOuOB.html | |
http://galaxy-warez.com | /prezz-galaxy/VSybFnE.html | |
http://paforu.com | /codelibrary/inc/SMmestJ.html | |
http://208.53.168.5 | /~mythucom/EcLrZeX.html | |
http://abelabosede.com | /administrator/templates/khepri/ghNULXS.html | |
http://adamlgoldstein.com//wp-content | /themes/twentyeleven/XBGReAJ.html | |
http://alain-mace.com | /administrator/GZxBPVD.html | |
http://allgk.com | /XiHsdGo.html | |
http://cyborgchat.altervista.org | /cyborg/dokbsum.html | |
http://dailej.net | /scorp/mcazyAu.html | |
http://dialcmoviles.com | /scorp/mlxAox1.html | |
http://fashionbuddies.com | /wp-content/plugins/stats/zFDvnKI.html | |
http://my-movie-database.de | /templates/galeries/fTtihEj.html | |
http://rapnowogard.pl | /shit/IDLFusL.html | |
http://sepedahan.com | /file/igYiaOe.html | |
http://veliunlu.com | /wp-content/plugins/akismet/iUJdOxt.html | |
http://68.169.46.7 | /~tailieu2/forum/images/vXIeBfM.html | |
http://avtodor-ural.ru | /media/JN1pnMR.html | |
http://band2.com | /images/nJaVrNB.html | |
http://bandengmontok.com | /wp-content/themes/TheCorporation/UGREuRU.html | |
http://copperfieldhotel.co.uk | /pages/gRZlmnN.html | |
http://great-breads.com | /njtPzUk.html | |
http://hifi-leipzig.eu | /images/banner/H1ZlbJE.html | |
http://megagalactic.org.ua | /wp-content/themes/organic-theme/ppUuSoH.html | |
http://mib.edu.my | /tmp | /BbzL1fc.html |
http://mypassion4cars.com | /wp-content/plugins/akismet/gfauIEg.html | |
http://p30download.gozarweb.com | /Forum/xtDjbRn.html | |
http://qpay.com.vn | /wp-includes/js/jquery/ylZX1bK.html | |
http://templatesville.com | /wp-content/themes/twentyten/gZBiHSs.html | |
http://agadoodles.com | /VNFYSkJ.html | |
http://bbook.biz | /scorp/RedzAPh.html | |
http://breeze.pcollab.com | /dreamworks2/uploads/oaV1HSh.html | |
http://caycanhvietnam.net | /diendan/lMuLtxp.html | |
http://crossbonesguild.com//images | /stories/KkTh1Lc.html | |
http://djurs.kernelglobal.dk | /wordpress/cvmTuJn.html | |
http://dkmarket.co.kr | /images/RZNmRfa.html | |
http://dricaza.com | /pILLdPc.html | |
http://energycommercialization.com | /AxJavgh.html | |
http://fixacar.org.ua | /wp-includes/images/smilies/lvzVsFJ.html | |
http://gabriels-pizzeria-wiesbaden.de | /images/UhroAcg.html | |
http://gx-hosting.com | /arena/IlZiVBS.html | |
http://langpra.com | /vtBaHhY.html | |
http://lekiuh.10h.us | /RxfTStM.html | |
http://lightship-pos.com | /yKafOLv.html | |
http://mirabab.fr | /eiYLxDS.html | |
http://rt.kh.ua | /wp-includes/images/smilies/MBADoyo.html | |
http://whiteandcare.com | /upimg/JHYiNai.html | |
http://a1bizlinks.com | /foCOSmu.html | |
http://blackr00t.netne.net | /bNoOoPs.html | |
http://bulletup.com | /wp-content/themes/twentyten/hKExVDV.html | |
http://camassatouch.com | /scorp/1ZMRvTJ.html | |
http://citycontractcleaners.co.uk | /templates/beez/GBMBIeP.html | |
http://ez123webhost.com | /members/templates/XxOOyoh.html | |
http://pescapesca.cl | /BuHKIsC.html | |
http://pierre-lafoucriere.com | /wp-admin/ytjVBay.html | |
http://sjinfra.co.kr | /board/data/eng_board_store/hAgumCg.html | |
http://smkn1jamblang.sch.id | /modul/BUIPCHs.html | |
http://solidusscale.com | /upimg/yjP1IhM.html | |
http://soyminero.com.ar | /wp-content/backups/jzzprSz.html | |
http://verify-paypal.net | /IuLJXEu.html | |
http://acnstudios.com | /bizdirect/files/upload/BzrMbdg.html | |
http://baby2day.co.za | /images/HmFgJng.html | |
http://bedeckedandbeadazzled.com | /images/shop/storefronts/1/categories/nublor/uCDvHCx.html | |
http://beogame-online.net | /lapac/plugins/buttons/A1xhZvu.html | |
http://bodyandsenses.dk | /joomla/templates/atomic/UugvzzI.html | |
http://candlecottage.com | /IxhMGfz.html | |
http://childrenlearningtools.com | /wp-content/themes/twentyten/HHMFnMk.html | |
http://clubhippiquedegrasse.com | /bwgest/planning1/uOFEInH.html | |
http://compagnie-bagamoyo.org | /images/background/ae1bTAc.html | |
http://copcochemtech.co.th | /images/FRVPouf.html | |
http://del-irk.ru | /templates/delirk/ueeJIDf.html | |
http://delta-holod.ru | /assets/site/jZGpGKT.html | |
http://doktorlarkulubu.biz | /forum/tp-images/File/eVsDGtI.html | |
http://eda2a.com | /FtsfvSS.html | |
http://europe-banks.com | /eporue/upload/sYbppvZ.html | |
http://evraire.ca | /nDsMYDH.html | |
http://guiasolidaria.com | /templates/beez/xjaxrFH.html | |
http://love-youpeng.net | /bbshop451/images/kdmzmGo.html | |
http://mebolaget.se | /wordpress/ssntgEi.html | |
http://mining.org.ua | /wp-includes/images/smilies/rEubdsT.html | |
http://mnhcamp.com | /wp-includes/images/ZtuHGsR.html | |
http://old.bip.miastko.pl | /download/zalaczniki/ZG1FFvg.html | |
http://parsianinc.com | /KAZRF1l.html | |
http://perfectbody.in | /vjgUtXU.html | |
http://qrz.ge | /qrz.ge/includes/vrKRBRL.html | |
http://saigonlink.vn | /wp-content/plugins/akismet/MHchvHL.html | |
http://soft-guide.dk | /joomla15/templates/ja_purity/XpbrRiD.html | |
http://tamarackarmory.com | /wp-content/themes/irrigation/VDUSrJp.html | |
http://vgelendjike.ru | /yNSUiOd.html | |
http://y-cult.net | /rikHifG.html |
これらのサイトの存在する国はこんな感じでアメリカが多いです。
UnitedStates | 45 |
---|---|
Germany | 15 |
Denmark | 5 |
France | 5 |
RussianFederation | 5 |
Thailand | 5 |
Ukraine | 5 |
Korea | 3 |
Poland | 3 |
Vietnam | 3 |
Canada | 2 |
Indonesia | 2 |
Malaysia | 2 |
Netherlands | 2 |
Georgia | 1 |
Singapore | 1 |
Turkey | 1 |
UnitedKingdom | 1 |
? | 8 |
次のジャンプ先が早期にNXDOMAIN化され対策済みです。
by jyake