Jump to content

3-card monty with URLs and anchor tags


rconner

Recommended Posts

I've seen this trick before, so it isn't new, but thought it might be worth posting (tracking link).

Spammer creates a link to his site that contains a lot of bogus fields in the <A> tag, all of which have long complicated URLs. Only one of these (the customary "HREF=") is any good. The spammer seems to be doing this to confuse investigators.

This guy has been pestering me for awhile, his messages contain no text at all save for an anchor to his link (he's selling pharms). I'd laugh at his stupidity in expecting that I'd click on such a link, but then again I suppose that too many other recipients do exactly that.

Interestingly, SpamCop found and reported to MSN on the good link, but was able to sidestep all the bad ones. So, hats off to the developers on this one.

-- rick

Link to comment
Share on other sites

Spammer creates a link to his site that contains a lot of bogus fields in the <A> tag, all of which have long complicated URLs. Only one of these (the customary "HREF=") is any good. The spammer seems to be doing this to confuse investigators.

Investigators would have to be rather poor/ignorant to be confused over these extra lines. As you note, hrvef, hlref, hcref, etc. are much distant from anything resembling valid HTML construction. Even the displayed URL is set to show up as garbage. I'm shooting at the other end of the scale, someone very ignorant buying some 'great software' to get rich quick doing the high-speed marketing thing.

Link to comment
Share on other sites

Investigators would have to be rather poor/ignorant to be confused over these extra lines.
Well, no doubt some of them are (we see some on these forums from time to time). I do however like your idea that it might be an Incredibly Powerful FeatureTM of some bulker app sold to the rubes. In any case, it certainly does add noise or camouflage.

-- rick

Link to comment
Share on other sites

...In any case, it certainly does add noise or camouflage.
Both in fact (in the technical sense where camouflage is 'concealment by disruptive pattern of the true form,' and noise is 'additional, random, non-functional content.') Thanks for the example - haven't seen one of those before. {sigh} I almost miss my daily spam.
Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...