Jump to content

3-card monty with URLs and anchor tags


rconner
 Share

Recommended Posts

I've seen this trick before, so it isn't new, but thought it might be worth posting (tracking link).

Spammer creates a link to his site that contains a lot of bogus fields in the <A> tag, all of which have long complicated URLs. Only one of these (the customary "HREF=") is any good. The spammer seems to be doing this to confuse investigators.

This guy has been pestering me for awhile, his messages contain no text at all save for an anchor to his link (he's selling pharms). I'd laugh at his stupidity in expecting that I'd click on such a link, but then again I suppose that too many other recipients do exactly that.

Interestingly, SpamCop found and reported to MSN on the good link, but was able to sidestep all the bad ones. So, hats off to the developers on this one.

-- rick

Link to comment
Share on other sites

Spammer creates a link to his site that contains a lot of bogus fields in the <A> tag, all of which have long complicated URLs. Only one of these (the customary "HREF=") is any good. The spammer seems to be doing this to confuse investigators.

Investigators would have to be rather poor/ignorant to be confused over these extra lines. As you note, hrvef, hlref, hcref, etc. are much distant from anything resembling valid HTML construction. Even the displayed URL is set to show up as garbage. I'm shooting at the other end of the scale, someone very ignorant buying some 'great software' to get rich quick doing the high-speed marketing thing.

Link to comment
Share on other sites

Investigators would have to be rather poor/ignorant to be confused over these extra lines.
Well, no doubt some of them are (we see some on these forums from time to time). I do however like your idea that it might be an Incredibly Powerful FeatureTM of some bulker app sold to the rubes. In any case, it certainly does add noise or camouflage.

-- rick

Link to comment
Share on other sites

...In any case, it certainly does add noise or camouflage.
Both in fact (in the technical sense where camouflage is 'concealment by disruptive pattern of the true form,' and noise is 'additional, random, non-functional content.') Thanks for the example - haven't seen one of those before. {sigh} I almost miss my daily spam.
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...