Menu ▾ ▴

#2 Support for latest spammer URLs

open
URLBody (2)
5
2006-08-15
2006-08-15
Anonymous
No

SpamPal v1.594
URLBody v0.06

URLBody is probably failing to parse certain URLs
containing |, >, [, ] etc.

These are apparently valid hostnames, as they resolve
in IE and even a tool such as nslookup. Spammers are
using them because they don't parse well with tools
that are designed to lookup the URLs. Here are a couple
of examples from recent spams:

www.ww|www<]upstairseddierecriminatekfourfoldo].attentivoffer.com
www.ww|www<]livesturnonmillionccumulatej].slideaffinity.com
www.ww|www<[mamanikolaiwantedfemigrateg[.anytimeclock.com

To see that they resolve, you can try it with a dos
command:

C:\> nslookup
"www.ww|www<]upstairseddierecriminatekfourfoldo].attentivoffer.com"

Output:

[...]

Non-authoritative answer:
Name:
www.ww|www<]upstairseddierecriminatekfourfoldo].attentivoffer.com
Address: 202.177.27.53

Discussion


Log in to post a comment.