Spammers use hexadecimal IP addresses to evade detection

guest · Sep 19, 2020

Spammers use hexadecimal IP addresses to evade detection
Links in spam emails looked like http://0xD83AC74E instead of "domain.com."
September 18, 2020
https://www.zdnet.com/article/spammers-use-hexadecimal-ip-addresses-to-evade-detection/

A spam group has picked up a pretty clever trick that has allowed it to bypass email filters and security systems and land in more inboxes than usual.

The trick relies on a quirk in RFC791 — a standard that describes the Internet Protocol (IP).
Among the various technical details, RFC791 is also the standard that describes how IP addresses look.
Click to expand...

According to a report published yesterday by Trustwave, a spam group has adopted hexadecimal IP addresses for their campaigns since mid-July earlier this year.

While web browsers are capable of interpreting hexadecimal IP addresses and load the website found on the server, it appears that the trick was enough to help the spam groups evade detection while spewing high volumes of pharma/pill spam messages.
This campaign also marks the second time hexadecimal IP addresses have been spotted being used in a malware campaign in recent years.
Click to expand...

Yet, besides the hexadecimal version, malware authors have also abused other IP addressing schemes. In 2011, Zscaler found malicious Word documents that used integer/DWORD IP addresses to hide the location of remotely-stored malicious resources that they'd download on infected hosts.

Just like in the Trustwave report, the previous operations used these strange IP addressing schemes as a way to bypass detection, as not all security software is fully RFC791-compliant.
Click to expand...

Trustwave: Evasive URLs in Spam

Spam messages were carefully crafted for each spam broadcast, where the email subject highlights the email body content and is mostly convincing-looking pharma product related messages.
This looks like ordinary spam, however what makes it unique is the use of hexadecimal IPs in the URL to access the pill spam web page.
Conclusion
Spammers are ever-evolving their methods to evade spam detection systems to deliver spam to victims. One spamming group recently started using URLs containing hexadecimal encoded IPs embedded in spam messages for their fake pharma spam campaigns in an event to evade spam detection systems and URL blocklists.
Click to expand...

Log in or Sign up

Spammers use hexadecimal IP addresses to evade detection

guest Guest

Log in or Sign up

Spammers use hexadecimal IP addresses to evade detection

guest Guest

Useful Searches