security/piyokangoについて、ここに記述してください。

https://piyolog.hatenadiary.jp/entry/2020/07/08/025056

1. CNAME orphan

国内でも発生している。

https://twitter.com/piyokango/status/1280256470257332224?s=20 

クラウドサービスにCNAME定義されたドメインを狙い、当選詐欺サイトへ誘導するWebサイトの改ざん被害が発生しています。
（大手企業のサブドメインでも被害を確認）

何だか 知ら ん が とにかく よし | 何だか知らんが とにかくよし！ swmazrdev2.jti.co.jp › temedocad56158

なんだかしらんがとにかくよし とは【ピクシブ百科事典】

検索結果 ウェブ検索結果

【プロモパックPR】《発展+発破/Expansion+Explosion》【R】 swmazrdev2.jti.co.jp › kuqogubeb33498 

swmazrdev2.jti.co.jp.   3600    IN      CNAME   swmazrdevjpe2.cloudapp.net.
swmazrdevjpe2.cloudapp.net. 9   IN      A       13.94.131.121

2. msc.com

https://twitter.com/tiketiketikeke/status/1280312848485236738?s=20 

$ dig -t a nwddev.msc.com

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> -t a nwddev.msc.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33261
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;nwddev.msc.com.                        IN      A

;; ANSWER SECTION:
nwddev.msc.com.         3600    IN      CNAME   nwddevmsccom.trafficmanager.net.
nwddevmsccom.trafficmanager.net. 29 IN  CNAME   nwddevmsccom.funblog2019.ru.
nwddevmsccom.funblog2019.ru. 3599 IN    A       94.23.211.10

;; Query time: 431 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Jul 07 11:29:11 JST 2020
;; MSG SIZE  rcvd: 145

3. msc.com

$ dig -t a nwddev.msc.com @a.gtld-servers.net

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> -t a nwddev.msc.com @a.gtld-servers.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3367
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 3, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;nwddev.msc.com.                        IN      A

;; AUTHORITY SECTION:
msc.com.                172800  IN      NS      ns02.mscgva.ch.
msc.com.                172800  IN      NS      ns03.mscgva.ch.
msc.com.                172800  IN      NS      ns04.mscgva.ch.

;; Query time: 49 msec
;; SERVER: 192.5.6.30#53(192.5.6.30)
;; WHEN: Tue Jul 07 11:36:25 JST 2020
;; MSG SIZE  rcvd: 109

$ dig -t a nwddev.msc.com @ns02.mscgva.ch.

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> -t a nwddev.msc.com @ns02.mscgva.ch.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32849
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;nwddev.msc.com.                        IN      A

;; ANSWER SECTION:
nwddev.msc.com.         3600    IN      CNAME   nwddevmsccom.trafficmanager.net.

;; Query time: 271 msec
;; SERVER: 193.138.73.100#53(193.138.73.100)
;; WHEN: Tue Jul 07 11:37:28 JST 2020
;; MSG SIZE  rcvd: 88

4. trafficmanamer.net 下

$ dig -t a nwddevmsccom.trafficmanager.net @a.gtld-servers.net

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> -t a nwddevmsccom.trafficmanager.net @a.gtld-servers.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59797
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;nwddevmsccom.trafficmanager.net. IN    A

;; AUTHORITY SECTION:
trafficmanager.net.     172800  IN      NS      tm1.msft.net.
trafficmanager.net.     172800  IN      NS      tm2.msft.net.
trafficmanager.net.     172800  IN      NS      tm1.edgedns-tm.info.
trafficmanager.net.     172800  IN      NS      tm2.edgedns-tm.info.

;; ADDITIONAL SECTION:
tm1.msft.net.           172800  IN      A       204.79.195.41
tm2.msft.net.           172800  IN      A       65.55.117.41

;; Query time: 49 msec
;; SERVER: 192.5.6.30#53(192.5.6.30)
;; WHEN: Tue Jul 07 11:40:14 JST 2020
;; MSG SIZE  rcvd: 184

$ dig -t ns nwddevmsccom.trafficmanager.net @tm1.msft.net.

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> -t ns nwddevmsccom.trafficmanager.net @tm1.msft.net.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10397
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
; COOKIE: afa4bca00d23ca09 (echoed)
;; QUESTION SECTION:
;nwddevmsccom.trafficmanager.net. IN    NS

;; ANSWER SECTION:
nwddevmsccom.trafficmanager.net. 30 IN  CNAME   nwddevmsccom.funblog2019.ru.

;; Query time: 144 msec
;; SERVER: 204.79.195.41#53(204.79.195.41)
;; WHEN: Tue Jul 07 15:51:29 JST 2020
;; MSG SIZE  rcvd: 113