2

I received a phishing email with the following format:

hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+/

but I can't make out what ~!@%23$%25%5e&*() is - is it an obfuscated js function? I see traces of this string on google, but nothing concrete as to what it does.

It translates to this:

"/~!@#$%^&()_+~!@#$%^&()+~!@#$%^&*()+~!@#$%^&()_+~!@#$%^&()+~!@#$%^&*()+~!@#$%^&()_+~!@#$%^&()+~!@#$%^&*()+~!@#$%^&()_+~!@#$%^&()+~!@#$%^&*()+~!@#$%^&()_+~!@#$%^&()+~!@#$%^&*()+~!@#$%^&()_+~!@#$%^&()+~!@#$%^&*()+~!@#$%^&*()_+/"

Would that be just a path to a index.php file to a malicious file download?

A similar thread online:

GET /%21@%23$%25%5E&%2A%28%29%29%28%2A&%5E%25$%23@%21/Review%20/ApproveDocument/Office%20365_files/shellg2coremincss_ba45585d.css HTTP/1.1

1
  • 1
    That's the result of typing the top row of a standard US keyboard with shift on (although the asterisk at shift 8 isn't easily visible because Stack treats it as markdown for italic), and almost certainly just convenient dummy/filler text. Your similar thread is typing most of the top row then going back. Jan 12, 2018 at 6:03

1 Answer 1

1

About the codification in your URL :"/~!@#$%^&()+~!@#$%^&()+~!@#$%^&*()+~!@#$%^&()+~!@#$%^&()+~!@#$%^&()+~!@#$%^&()_+~!@#$%^&()+~!@#$%^&()+~!@#$%^&()+~!@#$%^&()+~!@#$%^&*()+~!@#$%^&()+~!@#$%^&()+~!@#$%^&()+~!@#$%^&()_+~!@#$%^&()+~!@#$%^&()+~!@#$%^&*()_+/" I think that it is formed part of the path of the file suspected.

I think that this maybe is Phishing, I shearch the URL and finded this site:

https://urlquery.net/report/284aaf9f-1419-462f-86b3-392532e12237

It say that was report for a firewall because find a suspected trafic data.

You can test the host in virustotal for read the reports and have a major know of what happen and assurance if is malicious URL (the more probability is yes).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .