極楽せきゅあブログ

ときどきセキュリティ

Googleのアドセンスフィッシング

GoogleAdWordsフィッシングのメールが来た。

Subject:Reactivate Your AdWords Google Account.
From:"Google-AdWords-Noreply" 
本文:
                                                                                                                                                • -
Dear Google AdWords Customer, We were unable to process your payment. Your ads will be suspended soon unless we can process your payment. To prevent your ads from being suspended, please update your payment information. Please sign in to your account at http://adwords.google.com/select/login, and update your payment information.
                                                                                                                                                                                • -
This message was sent from a notification-only email address that does not accept incoming email. Please do not reply to this message.
                                                                                                                                                                                • -
Thank you for chosing Google Adwords for your business

本文がHTMLメールになっていて、AdWordsログインのところの本当のリンク先が、

<a href=http://adwords.google.com.f0c0b0.cn/select/Login>http://adwords.google.com/select/login</a>,

になっていた。チャイナドメインですな。
ヘッダはこんな感じ。

Return-Path: 
(中略)
Received: from [217.67.188.242] (217.67.188.242 [217.67.188.242])
 by sbmx11 (SpamBlock.ps 3.4.100)
 with ESMTP id <024785277.24389707624099@hotmail.com> for <あっしのメアド>;
 Tue, 6 May 2008 21:49:15 +0900
Received: from [217.67.188.242]
 by mx4.hotmail.com;
 Tue, 6 May 2008 15:49:12 +0300
Date: Tue, 6 May 2008 15:49:12 +0300
From: "Google-AdWords-Noreply" 
X-Mailer: The Bat! (v3.60.07) Professional
Reply-To: fifimorris@hotmail.com
X-Priority: 3 (Normal)
Message-Id: <024785277.24389707624099@hotmail.com>
To: あっしのではないメアド
Subject: Reactivate Your AdWords Google Account.
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----------{nHEX}"
X-IP: 217.67.188.242
X-FROM-DOMAIN: hotmail.com
X-FROM-EMAIL: fifimorris@hotmail.com
Delivery-Agent: postfix/virtual 2.1.3+atson1mbox(RELEASE_2006041401) on mda02
X-Text-Classification: work

もうすでにGoogle(本物)のデータベースには登録されてるみたい&サーバーも消滅?してるみたい。

素早い対応、恐れ入ります。・・・っていうか、あっしのところに来たのが遅かったってことかなw。