转载

诈骗网站利用LinkedIn和Baidu进行隐蔽跳转的分析

可疑链接

最近，我们监测到了一条在Skype上传播的URL链接，该URL以LinkedIn网站前缀为主体,并以Skype ID为参数结尾。

hxxps:// www.linkedin.com/slink?code=e2nsPHa#jpulusiv=victimskypeid

通常，大多数人对可疑链接会显得非常谨慎，但是，这条以LinkedIn网站开头，并以Skype ID结尾的URL链接非常具有迷惑性，让受害者根本不会引起怀疑，甚至有些接收者还会非常好奇，忙着去点击它！结果是什么呢？！事实是，一旦点击了这条链接，它将会重定向到另一条以baidu网站开头的链接：

hxxp:// www.baidu.com/link? url=6kdJhiuGhlv0r4EfUsqBKW9t86Werul6GdqAieiiPyC

之后，通过这条链接，会重定向到以下诈骗网站：

hxxp://easyfatloss-a.net/

hxxp://vpworldfor.com/

hxxp://hotvqqqhops.com/

最终，利用受害者Skype账户向其它通讯录联系人发送诈骗链接以后，就实现了大范围传播。

跳转分析

重定向路径：

诈骗网站利用LinkedIn和Baidu进行隐蔽跳转的分析

对其中涉及的两个跳转域名izatex(.)ru、adnanbostan(.)ru分析：

curl -v izatex(.)ru * Rebuilt URL to: izatex(.)ru/ * Hostname was NOT found in DNS cache * Trying 104.28.16.170… * Connected to izatex(.)ru (104.28.16.170) port 80 (#0) > GET / HTTP/1.1 > User-Agent: curl/7.35.0 > Host: izatex(.)ru > Accept: */* > < HTTP/1.1 302 Found < Date: Thu, 17 Nov 2016 21:54:59 GMT < Content-Type: text/html; charset=UTF-8 < Transfer-Encoding: chunked < Connection: keep-alive < Set-Cookie: __cfduid=d43aa46bb692c53416b4774b22908a0c21479419698; expires=Fri, 17-Nov-17 21:54:58 GMT; path=/; domain=.izatex(.)ru; HttpOnly < Location: hxxp://intellectvvv.com/?a=370961&c=brain&s=pahas&27352 * Server cloudflare-nginx is not blacklisted < Server: cloudflare-nginx < CF-RAY: 30366c9de40129cb-SEA < * Connection #0 to host izatex(.)ru left intact ping intellectvvv(.)com PING intellectvvv(.)com (5.149.248.236) 56(84) bytes of data. 64 bytes from marriageagency.in(.)ua (5.149.248.236): icmp_seq=1 ttl=54 time=133 ms

curl -v hxxp://adnanbostan.ru * About to connect() to adnanbostan(.)ru port 80 (#0) * Trying 178.208.80.103… * Connected to adnanbostan(.)ru (178.208.80.103) port 80 (#0) > GET / HTTP/1.1 > User-Agent: curl/7.29.0 > Host: adnanbostan(.)ru > Accept: */* > < HTTP/1.1 302 Found < Server: nginx < Date: Thu, 17 Nov 2016 17:57:15 GMT < Content-Type: text/html; charset=UTF-8 < Content-Length: 1 < Connection: keep-alive < Keep-Alive: timeout=60 < Location: hxxp://intellectzzz.com/?a=373727&c=brain&s=beget&9008 < * Connection #0 to host adnanbostan(.)ru left intact

经分析发现，共有30多个域名和IP涉及该诈骗链接：

178.208.78.89 185.112.157.139 192.99.182.95 46.166.128.136 5.149.248.236 adnanbostan(.)ru cobdurierni(.)com configinfofat(.)com diet-newest(.)info fatlossway(.)net fatLossway-b(.)net fatlossway-c(.)net fatlossway-d(.)net goodfastint(.)com hitdrretrast(.)com easyfatloss-a(.)net hotvqqqhops(.)com vpworldfor(.)com intellectvvv(.)com intellectzzz(.)com izatex(.)ru mindforbig(.)com mindvipshop(.)com safepaymentpage(.)net u2019(.)ru v-hd(.)ru weightuulossu(.)com witsswits(.)com witxxsmind(.)com womensenews(.)ru worldformind(.)com

以下是4个诈骗网站最近一段时期的点击访问流量，比较可疑：

诈骗网站利用LinkedIn和Baidu进行隐蔽跳转的分析