[Jax.PM] Decode URL
WC -Sx- Jones
lists at insecurity.org
Fri Jun 6 16:49:59 CDT 2003
Hi Greg =)
I thought about all that too - but it calls a script off the referenced
domain's WWW server -- after I posted this I finally was able to
"capture" the remote server and get the javascript off of it. The
blasted thing does a "Thank You" and immediately sends you to msn.com
:/
Grrrrrr. Spammers are getting better :(
>> http://click.lycos.com/director.asp?id=&target=http://
>> k8u7sdfjghgdfguygh9ojdfghghdfgygjhdfgyghjdfgyughjdfguyghjdfguyghd9o8iu
>> 7f
>> gyugjhdfguygdjkhfguygdkfghdfgyhjdfgyugjhdfg at telmxrouleptycimuakbof.cc/
>> poiuytrewqlkjhgfdsa/
>> ?lksjdfpoiertkjhfdgiuhjdfgjhkdfguhkjdfguihrthbdfgbvkjhdfgugrehkdfguger
>> ty
>> gdfgiurthgdfgiugkhdfgy
>
> Lycos presumably does a redirect to the "target" parameter. Everything
> in the second URL before the "@" can be ignored, so the actual domain
> called is: "telmxrouleptycimuakbof.cc". The rest is just noise that
> is designed to confuse.
>
> Whois info:
>
> Registrant:
> Castro, Julia (CCWYCMWCXD)
> CAN Transversal 19 #45-12
> Santa Fe de Bogota, Boyaca 023564
> CO
>
> Domain Name: TELMXROULEPTYCIMUAKBOF.CC
>
> Administrative Contact, Technical Contact:
> Castro, Julia (GPJPJYMXRI) admin at keydist.com
> CAN Transversal 19 #45-12
> Santa Fe de Bogota, Boyaca 023564
> CO
> 57-1315-9000
More information about the Jacksonville-pm
mailing list