[Full-Disclosure] Phishing scam - Obfuscated url help please
nick at virus-l.demon.co.uk
Fri Jan 23 01:48:43 GMT 2004
"Zach Forsyth" <Zach.Forsyth at kiandra.com> wrote:
> Just wondering if someone could help me work out where this url actually
> Or just lead me in the right direction.
> Apologies if it has wrapped as it is quiet long.
Assuming the "=" chars are present because it was c'n'p'ed from a raw
MIME quoted-printable encoded message, you remove them (they mean "soft
line break" in QP -- see RFC 1521, section 5.1, "Rule #5") then you
need to undo the URL encoding, leaving the URL (will wrap):
The "real" URL in this is:
as the "@" is (incorrectly) interpreted by many browsers (most in terms
of absolute use) as indicating the username part of the "userinfo" part
of the generic URI scheme. Although userinfo is specifically not part
of the HTTP protocol, it is still commonly "understood" by many
browsers. Thus, the sub-string "www.netbank.commbank.com.aulloginl@",
or in its encoded form "www.netbank.commbank.com.au%6Clogin%6C@", will
be ignored by many browsers (at least it will unless the specified
server challenges the request for "/login/index.htm" with a "user
authentication required" or similar error.
> Just your average phishing spam email using IE address vulns - site is
> still live as well I believe
I couldn't get a connect from here a few minutes ago, but that could be
all sorts of things...
Full-Disclosure is hosted and sponsored by Secunia.