index3.html - ref_img Returned mail: see transcript for details

このようなリターンメール風なメールに

htmlファイルが添付されてきます。

 Returned mail see transcript for details.html

index3.html - Delivery Status Notification (Failure)と同じ内容です。

その他SUBJECT、添付ファイルに以下のバリエーションがあります。

 The results of your email commands

htmlファイル内の難読化を解くと、このようなURLが現れます。

 ｈttp：//yasetai.com／index3.html

yasetai？

痩せたい？

レジストラント情報が東京でした。

   Domain Name: YASETAI.COM
   Registrar: GODADDY.COM, INC.
   Whois Server: whois.godaddy.com
   Referral URL: http://registrar.godaddy.com
   Name Server: NS1.PEER1.NET
   Name Server: NS1.SHAPEOFYOURLIFE.COM
   Name Server: NS2.PEER1.NET
   Status: clientDeleteProhibited
   Status: clientRenewProhibited
   Status: clientTransferProhibited
   Status: clientUpdateProhibited
   Updated Date: 17-may-2010
   Creation Date: 20-dec-1999
   Expiration Date: 03-may-2011

 Registrant:
   Janne Banan
   Meguro 5-5
   Meguro-ku, Tokyo 152-0067
   Japan

   Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
   Domain Name: YASETAI.COM
      Created on: 20-Dec-99
      Expires on: 03-May-11
      Last Updated on: 17-May-10
 
   Administrative Contact:
      Banan, Janne  info@yasetai.com
      Meguro 5-5
      Meguro-ku, Tokyo 152-0067
      Japan
      +81.337246282      Fax -- 
 
   Technical Contact:
      Banan, Janne  info@yasetai.com
      Meguro 5-5
      Meguro-ku, Tokyo 152-0067
      Japan
      +81.337246282      Fax -- 
 
   Domain servers in listed order:
      NS1.SHAPEOFYOURLIFE.COM
      NS1.PEER1.NET
      NS2.PEER1.NET

 yasetai.com has address 76.74.238.172
 
 CustName:   Brian French
 Address:    110 Sea Ave. N.
 City:       Burnaby
 StateProv:  BC
 PostalCode: V5B1K5
 Country:    IN
 NetRange:   76.74.238.0 - 76.74.238.255 
 CIDR:       76.74.238.0/24 
 NetName:    APTHOST-COMMUNICATIONS-INC
 NetHandle:  NET-76-74-238-0-1
 Parent:     NET-76-74-236-0-1
 NetType:    Reassigned
 Comment:    
 RegDate:    2008-10-08
 Updated:    2008-10-08

index3.htmlにアクセスするとこのようなものをダウンロードさせられます。日本はブロック？

 ｈttp：//inc.kleenterprises.biz:8080／index.php?pid=10
 ｈttp：//inc.kleenterprises.biz:8080／jquery.jxx?v=5.3.4
 ｈttp：//inc.kleenterprises.biz:8080／Notes10.pdf

 Domain Name:                                 KLEENTERPRISES.BIZ
 Domain ID:                                   D13989544-BIZ
 Sponsoring Registrar:                        GODADDY.COM, INC.
 Sponsoring Registrar IANA ID:                146
 Domain Status:                               clientDeleteProhibited
 Domain Status:                               clientRenewProhibited
 Domain Status:                               clientTransferProhibited
 Domain Status:                               clientUpdateProhibited
 Registrant ID:                               CR19262527
 Registrant Country:                          United States
 Registrant Country Code:                     US

 inc.kleenterprises.biz has address 209.135.157.64
 
 OrgName:    Rose Web Services LLC 
 OrgID:      RWSL-1
 Address:    2977 Hwy K
 Address:    STE 252
 City:       Ofallon
 StateProv:  MO
 PostalCode: 63368
 Country:    US
 
 NetRange:   209.135.157.0 - 209.135.157.255 
 CIDR:       209.135.157.0/24 
 NetName:    ROSEHOSTING-209-135-157
 NetHandle:  NET-209-135-157-0-1
 Parent:     NET-209-135-128-0-1
 NetType:    Reassigned
 Comment:    
 RegDate:    2005-10-31
 Updated:    2005-10-31

[カテゴリ:spam観察日記]

by jyake