Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I don't know where to start in searching the forum for existing threads that might cover my issues.

I recently received a spoof email pretending to be from a client for whom I've just started to do some basic SEO and content work.

The email directed me to a problem URL on the site

http://clientdomainname.com/%E2%80%8E

I have changed the domain name, but the rest of the URL string is exactly what I received. There is no page corresponding to the URL on the site, so it triggered a 404.

The client did not send it, so I'm thinking that the URL may perhaps initiate some kind of script.

My questions are:

  1. Are my concerns plausible? The sector has hotted up recently and there are some unscrupulous large businesses trying to push small players out.

  2. How can I find out if that URL string triggers some kind of malicious script? Should I ask the host (hostgator) to scan, or is there a better way to scan?

  3. What steps can I take to remove and prevent it from happening in future?

share|improve this question
    
Hi and welcome to the security.stackexchage forum. I suspect some more information might be required to be able to answer your question. Did anything happen when you clicked on the link to make you suspect there was some sort of malicious activity happening? You can potentially get a lot more valuable information by running a wireshark trace and clicking on the link again (if you want to accept the potential risk it might pose). This trace should be able to show you if you are redirected somewhere else or if some script was downloaded that you weren't expecting. –  ilikebeets Aug 20 at 5:57

4 Answers 4

If you ever need to check a suspicious URL, you can use a service like urlquery to check if it has a malicious reputation, the HTTP transactions that take place, any java script that runs, etc etc. Very useful. They also provide a screenshot of what the visited page looks like.

http://urlquery.net/

share|improve this answer
1  
Terrific website, thank you! –  dotancohen Aug 20 at 10:42

%E2%80%8E is percent-encoded UTF-8 for the Unicode character "U+200E". It's used to make the text after it display in left-to-right reading order, such as when displaying an English-language quote in an Arabic text. Unless you've got some seriously broken software, it has no use as an attack.

My suspicion is that this was a prank that didn't work out: if they'd used the counterpart to that character, the right-to-left mark (%E2%80%8F), your 404 page likely would have looked broken because the RTL mark would have caused part or all of the page to display backwards.

share|improve this answer
    
This could still be part of a search for potentially exploitable vulnerabilities: The server response allows the attacker to see if the URL is echoed back by the server (which may not be too uncommon on 404 pages), in a way where the possibly most likely way (decoded and as UTF8) might be relatively hard to detect because it wouldn't change the visual appearance wherever this decoding did take place. –  pyramids Aug 20 at 8:39

It was probably an attempt to exploit the vulnerability outlined here:
https://www.online24.nl/blog/security-risks-associated-with-unicode/
The link would appear to be one thing, but actually be linking to a different domain, such as the reverse (eg., elpmaxe.com instead of example.com).

One way to avoid such exploits is to type domains yourself instead of clicking email links. You can also scan URLs before visiting them with sites like Virus Total.

share|improve this answer

To start analysing if any mail might contain an attack using HTML code, 1st rule is to read this exact same message in plain text. Plain text will never possibly fire anything.

To achieve this analysis, as an example, with Thunderbird (which is BTW a pretty good E_mail client to avoid a lot of attacks), just select your suspicious message, and select:

View > Message Body As > Plain Text

Here is a practical example:

Message displayed as Original HTML: enter image description here

Message displayed as Plain Text: enter image description here

This 2nd one is clearly exhibiting toward which web server this scam is trying to push the dummy to click.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.