8

Last time I have got suspicious link from some of my Skype contacts. The link looks like:

h**ps://www.google.com/url?sa=t&url=%68%74%74%70%3A%2F%2F%63%32%36%34%2E%72%75&usg=AFQjCNFczxOu-pqCubz7HJppKMWrNYbi5Q&id=[my-skype-account]

I have changed protocol part to * and remove my Skype account from link.

How does it works? And what do I need to do if I click on this link in my iPhone? I suspect that opening this link will infect me, but not sure that iOS is the target platform.

Update:

As I see this URL

  • redirect to option4life3.com site
  • use ip-api.com to get current location using my current IP
  • working with history API of the browser - I don't understand what it does exactly (here is a script: h**p://option4life3.com/media/bbo.js
0

2 Answers 2

3

Could be anything from referral stuff to password steal. %68%74%74%70%3A%2F%2F%63%32%36%34%2E%72%75" translate from hex as http://c264.ru .

From there, anything can run further (scripts, etc).

0

I've found some interesting things:

  • Anchor tag with href: h**p://option4life3.com/unsub.aspx
  • More files: h**ps://urlscan.io/result/fef5934c-2b1e-4a82-8236-a9c0cbfc3e55#transactions

Nothing seems to be an exploit, it seems to be an AD url.

3
  • 2
    What is an AD URL ? Advertisement ?
    – ceth
    Apr 17, 2017 at 14:52
  • 1
    I meant: an URL that redirects/shows an Advertisement, but it seems to be offline or not working
    – Crabax
    Apr 17, 2017 at 17:08
  • 1
    The capitalization of the D made me think active directory for a split second
    – J.A.K.
    Apr 20, 2017 at 7:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .