Using Google redirect to hide the real link, Spamcop doesn't de-obfuscate
Bill <[email protected]> Tue, 28 Mar 2006 22:40:45 -0500
| Newsgroups | gmane.mail.spam.spamcop.help |
|---|---|
| Organization | None |
| Message-ID | <[email protected]> |
I've noticed that spammers are using site redirects to hide the real URL that they are going to. Here is an example from a recent Chase phish mail I received: Resolving link obfuscation http://www.google.com/url?sa=u&start=4&q=http://220.181.9.242/.chaseonlinesm.chase.com/ Host www.google.com (checking ip) = 64.233.179.104 host 64.233.179.104 (getting name) no name Tracking link: http://www.google.com/url?sa=u&start=4&q=http://220.181.9.242/.chaseonlinesm.chase.com/ No recent reports, no history available ISP does not wish to receive report regarding google.com You will notice that Spamcop did not try to report the 220.181.9.242 address, it never got past Google. I think there is a similar issue with something like rd.yahoo.com. Does Spamcop need to be made smarter so it can report the real site that these lowlifes are using?