No.15212 投稿時間:2004年03月16日(Tue) 08:51 投稿者名:鷹の巣@松阪 URL:http://sakaguch.com/
The Sakaguch.com teamのstaff@sakaguch.comより面白いメールが来ましたので、全文引用します。
転載許可は取っていません。しかし、色々と手の込んだウィルスメールを作るものですね。
メールのヘッダ部分は、以下の通りです。
Received: by j.asahi-net.or.jp (ATSON-1) ; 16 Mar 2004 00:23:11 +0900
Return-Path: <webmaster@*****> ← 自宅サーバーで有名なサイトのメールアドレスが書かれていました。
Received: from [203.212.55.105] by sakaguchiextif
(ArGoSoft Mail Server Freeware, Version 1.8 (1.8.5.2)); Tue, 16 Mar 2004 00:23:09
Received: from [195.110.121.210] by sakaguchiextif ← 良く出来てます。
(ArGoSoft Mail Server Freeware, Version 1.8 (1.8.5.2)); Tue, 16 Mar 2004 00:23:09 ← 良く出来てます。
Date: Mon, 15 Mar 2004 16:22:54 +0100
To: webmaster@sakaguch.com
Subject: Warning about your e-mail account.
From: staff@sakaguch.com
Message-ID: <jbyaljothapsmenuxnn@sakaguch.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------mcoudjdcskluuwmqgsle"
Delivery-Agent: @(#)$Id: local.c,v 1.76 2003/02/17 01:38:14 atson1 Exp $ on belta
----------mcoudjdcskluuwmqgsle
メールの本文は、以下の通りです。
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Dear user of e-mail server "Sakaguch.com",
Your e-mail account has been temporary disabled because of unauthorized access.
For details see the attached file.
The Management,
The Sakaguch.com team http://www.sakaguch.com
----------mcoudjdcskluuwmqgsle
メールの添付ファイルは、以下の通りです。
Content-Type: application/octet-stream; name="Message.pif"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Message.pif"
TVoAAAEAAAACAAAA//8AAEAAAAAAAAAAQAAAAAAAAAC0TM0hAAAAAAAAAAAAAAAAAAAAAAAA
...中略...
AABJbnRlcm5ldE9wZW5BAAAAYmluZAAAAAAAAAAA
----------mcoudjdcskluuwmqgsle--
アクセスログを見ていませんので間違っているかもしれませんが、
送信元(接続元)?の195.110.121.210の所有者は、以下の通りです。
==================================================
195.110.121.210
whois.ripe.net
=========================== 2004/03/16 08:36:40 ==
% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html
inetnum: 195.110.96.0 - 195.110.127.255
netname: IT-DADA-970904
descr: Provider Local Registry
country: IT
admin-c: PB29-RIPE
tech-c: FC269-RIPE
status: ALLOCATED PA
remarks: [optional] [multiple] [ ]
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: DADA-NOC
changed: hostmaster@ripe.net 19980129
source: RIPE
route: 195.110.96.0/19
descr: DADANET
descr: Internet Service Provider
origin: AS12363
notify: registry@dada.it
mnt-by: DADA-NOC
changed: registry@dada.it 19990601
source: RIPE
person: Paolo Barberis
address: DADA S.p.A.
address: Borgo degli Albizi, 12
address: I-50122 Firenze
address: ITALY
phone: +39 055 203941
fax-no: +39 055 2466304
nic-hdl: PB29-RIPE
changed: registry@dada.net 20030212
source: RIPE
person: Felice Carraro
address: DADA S.p.a.
address: Via de' Pandolfini 34/R
address: Firenze 50122 Italy
phone: +39 55 2345113
fax-no: +39 55 2478143
e-mail: network@dada.it
nic-hdl: FC269-RIPE
changed: registrar@ns.il 20000315
source: RIPE