Spammers add random text to shortened links to evade detection

guest · Oct 1, 2020

Spammers add random text to shortened links to evade detection
October 1, 2020
https://www.bleepingcomputer.com/ne...m-text-to-shortened-links-to-evade-detection/

Spammers are using a new technique of generating URLs to evade detection by humans and spam filters alike.

This technique comprises adding random, unused text bits to shortened links, to disguise them as full-sized URLs and bypass the scrutiny of email gateways.
A URL or URI consists of multiple parts, with some being optional. This is specified by an industry-standard called RFC3986.
Click to expand...

In the case of this particular spam campaign, the destinations it connects to are all known websites, such as the j.mp URL shortener service, Pastebin.com, etc.
But, the structure of the hardcoded URLs includes a gibberish "userinfo" part right before the domain name, to give off the impression these are different URLs.

Therefore, for example, if an enterprise security product was previously blocking the malicious link https://j[.]mp/kassaasdskdd it isn't clear if the product would also interpret something like https://nonsensical-text@j[.]mp/kassaasdskdd in the same manner and block it too.
Click to expand...

Trustwave: Evasive URLs in Spam: Part 2

A URL can be completely valid, yet still misleading. In this blog, we will present another technique with URLs that we observed in a recent malicious spam campaign. This is the continuation of an earlier blog that discussed how valid URL formats can be used in evading detection.
Click to expand...

Log in or Sign up

Spammers add random text to shortened links to evade detection

guest Guest

Log in or Sign up

Spammers add random text to shortened links to evade detection

guest Guest

Useful Searches