1

I received a suspicious email from a friend of mine with stange name of the form first.last@zs3.szczecin.pl, where first and last are his/her first and last names. But the domain is totally awkward. Then he/she didn't used my real name, apparently not knowing it, and greeted me by my email username. Then it was written in English, whereas we both are from a non-english speaking country. The link was not masked:

hxxp://fox-logger.com/Aunt.php?therefore=p1g8t0mux6defstb8

When googling the site, Google reports something like "This website may be changed by hackers." below the URL. Scanning the link, however, shows no threats.

Upon using view-source: I get the following one-line, which I divided in multiple line for readibility:

<script>location.href = "/tut.php?c=1&key=08j67nnw86627tzh7270prli&
    id=6f7b72ba&gid=&pin=&pid=18068&sid=http://com-d77f0s.com&
    cid=185.25.117.213&
    tid=mc42erz1&dal=http://com-d77f0s.com
/?affID=18068*aff_name=TDsSD*clickID=7226147247891*funnel=google*token=BKahRDesaD*timeID=mc42erz1";
</script>

giving that some script is being run on click.

My question(s):
Is the site malicious and how could I actually know that?
Should I report it somewhere and tell the affected person that his/her personal information has been stolen?

  • 2
    You can assume it is malicious due to how you got it. – schroeder Oct 14 '16 at 21:02
  • @schroeder OP can assume that the person who sent them the email has malicious intents but that doesn't mean the website sharing their email addresses domain is malicious. Looks like the website of a polish school to me. – UTF-8 Oct 14 '16 at 21:08
  • @UTF-8 So, someone with assumed malicious intent performs one act (direct someone to a site), but that act (the site) is not malicious? I think we can transfer maliciousness to the site. – schroeder Oct 15 '16 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.