In April 2013, Symantec was alerted to a series of sophisticated social-engineering attacks targeting a limited set of organizations in Europe. The most distinguishing feature of these attacks is that the victim will receive a phone call from the attac…
The 58th season of the UEFA Champions League is coming to an end with the final being played on May 25 at Wembley Stadium in London. Nowadays, cybercriminals are gaining a lot of interest in football, at least inasmuch as how to exploit interest in foo…
Like all doting daughters, I adore my mother. However, I have to confess – I haven’t yet purchased her well-deserved Mother’s Day gift. But I am not short of gift suggestions, no way. In fact, I have an inbox full of emails offering me fabulous gift options from knives to nighties. So all is well, Read more…
Contributor: Binny Kuriakose
People dream big when buying expensive items like a car or a property. When those dreams are seen with very affordable price tags it certainly attracts everybody’s interest. There are lots of websites available …
Mother’s Day is celebrated in many countries on May 12 and it’s a day for children, regardless of age, to express their love to their mother by giving her a gift. Spam messages related to Mother’s Day have begun flowing into the Symantec Probe Network. Clicking the URL contained in the spam message automatically redirects the recipient to a website containing a bogus Mother’s Day offer upon completion of a fake survey.
Figure 1: Survey spam targeting Mother’s Day
Once the survey is completed, a page is then displayed asking the user to enter their personal information in order to receive the bogus offer.
Figure 2: Fake survey
Figure 3: Bogus Web page asking for personal information
We recently blogged about the persistence of spam with .pw URLs and not surprisingly a lot of the Mother’s Day spam messages contain .pw top-level domain (TLD) URLs. The following are some examples of the From header using .pw URLs that we have identified to date:
From: Mother’s Day Gifts <Check@[REMOVED].pw>
From: “Early Bird Mother’s Day Flowers” <postmaster@[REMOVED].pw>
From: “Early Bird Mother’s Day Bouquets” <noreply@[REMOVED].pw>
From: “Mother’s Day Bouquets” <MothersDayBouquets@[REMOVED].pw>
From: “Mom” <Mom@[REMOVED].pw>
Figure4:Another dodgy website related to Mother’s Day
Symantec is observing an increase in spam volume related to Mother’s Day, which can be seen in the following graph.
Figure5:Volume of Mother’s Day spam
The following are some of the Subject lines observed for these spam attacks:
Subject: Don’t Forget Mother’s Day – $19.99 Chocolate, Dipped Strawberries
Subject: Stunning Personalized Gifts for Mother’s Day
Subject: Top Personalized Mother’s Day Gifts
Subject: Make Mother’s Day Special With A Personalized Gift
Subject: Mother’s Day Car Deal (Half Off Every Make And Model)
Subject: Regarding Mothers Day
Subject: Celebrate Mom with a $19.99 bouquet.
Subject: Mother’s Day Replica’s Women’s Accessories
Subject: Mother’s Day Secret Formula.
Symantec advises our readers to use caution when receiving unsolicited or unexpected emails. We are closely monitoring Mother’s Day spam attacks to ensure that readers are kept up to date with information on the latest threats.
Last week, Symantec posted a blog on an increase in spam messages with .pw URLs. Since then, spam messages with .pw URLs have begun showing up even more.
Figure 1. .pw TLD spam message increase
Symantec conducted some analysis into where these attacks are coming from in terms of IP spaces. As expected, Symantec observed a large quantity of mail being sent from an IP range and then moving to another IP range. While this is an expected behavior, there was an interesting twist. There were multiple companies (with different names) hosting .pw spammers using the same physical address in Nevada.
Examining messages found in the Global Intelligence Network, Symantec researchers have found that the vast majority of spam messages containing .pw URLs are hit-and-run (also known as snowshoe) spam. The top 25 subject lines from .pw URL spam from May 1, 2013 were:
Subject: For all the moms in your life on Mother’s Day.
Subject: Tax Relief Notification
Subject: Remove IRS Tax Penalties
Subject: Save on the most beautiful bouquets for Mom
Subject: Reusable K Cup for Keurig or single-brew coffee maker
Subject: Garden Today says, “By far the easiest hose to use”
Subject: HOME: Amazingly Strong water hose you can fit anywhere.
Subject: The LAST water hose you’ll ever need
Subject: No Hassle Pricing on Ford Vehicles
Subject: Own a NEW Ford for the Summer
Subject: May 1st Ford Clearance Event
Subject: Lasik- Safe, Easy, and Affordable
Subject: Safe, Easy, and Affordable Lasik
Subject: We work with the Biggest and Best Brands in Fashion
Subject: Whos the hottest? Post . Vote . Win
Subject: Are You and Your Business seen at a global scale?
Subject: Power your entire House, Pool and more with Solar Energy
Subject: Most EFFECTIVE way to treat Hypertension
Subject: Solar power slashes your electric bill in half
Subject: Global Business Registry for Networking Professionals
Subject: Finally, an EFFECTIVE fat shredding solution
Subject: Register with other professionals
Subject: Easiest Way To Lower Blood Pressure
Subject: Secret To Lowering Blood Pressure Naturally
Subject: Refinance Today, Save Tomorrow
In addition to creating anti-spam filters as needed, Symantec has been in contact with Directi and working with the registrar to report and take down the .pw domains associated with spam. Symantec believes that collaborating with the registrar is a more progressive and holistic approach to solving this problem.
For that past several days, Symantec has observed an increase in spam messages containing hexadecimal obfuscated URLs. Hexadecimal character codes are simply the hexadecimal number to letter representation for the ASCII character set. To a computer, he…
フィッシング詐欺の世界では最近も変わらず、サッカーが大人気のようです。2012 年にも、サッカーを利用したさまざまなフィッシング攻撃が確認されましたが、フィッシング詐欺師は早くも 2014 年の FIFA ワールドカップに熱い視線を注ぎ、有名選手やサッカークラブを狙っています。リオネル・メッシ選手のファンを狙った詐欺や、FC バルセロナを利用した詐欺は、そういったフィッシングの一例です。たくさんのファンが付いている有名選手を利用すれば、標的も膨大な数にのぼり、結果的に個人情報を収集できるチャンスも大きくなることを詐欺師は知っています。2013 年 4 月にもこの傾向は続き、同じようなフィッシング詐欺の手口が横行しています。今回のフィッシングサイトは、フランスにある無料の Web ホスティングサイトを利用していました。
このフィッシングサイトでは Facebook のログイン情報を入力するよう要求します。ページにはリオネル・メッシ選手、FC バルセロナ、あるいはクリスティアーノ・ロナウド選手が目立つようにデザインされています。フィッシングページには彼らの画像が掲載され、いずれかの正規の Facebook ページであるかのような印象を与えます。なかには、「first social networking site in the world（世界で最初のソーシャルネットワークサイト）」というタイトルの偽サイトまでありました。ユーザーは、Facebook ページにアクセスするために Facebook のログイン情報を入力するよう求められます。ログイン情報を入力すると、ログインが有効であると思い込ませるようにリオネル・メッシ選手、FC バルセロナ、またはクリスティアーノ・ロナウド選手の正規のコミュニティページにリダイレクトされます。この手口に乗ってログイン情報を入力したユーザーは、個人情報を盗まれ、なりすまし犯罪に使われてしまいます。
