In this question someone received what was clearly a spam link. Sometimes I'm curious enough to take a peek, which I usually do with curl or other command line tools (less risk of drive-by malware, although I'm on linux so I'm not usually susceptible to most such attacks). I got this as the response from the website:
curl -v 'http://22.214.171.124/' * Trying 126.96.36.199... * TCP_NODELAY set * Connected to 188.8.131.52 (184.108.40.206) port 80 (#0) > GET / HTTP/1.1 > Host: 220.127.116.11 > User-Agent: curl/7.56.0 > Accept: */* > < HTTP/1.1 302 Found < Date: Thu, 13 Sep 2018 18:27:16 GMT < Server: Apache/2.4.7 (Ubuntu) < X-Powered-By: PHP/5.5.9-1ubuntu4.25 < Location: https://www.google.com < Content-Length: 0 < Content-Type: text/html < * Connection #0 to host 18.104.22.168 left intact
It doesn't return an actual response, but rather just a 302 redirect to google.com. It doesn't even set a cookie. From what I can tell it literally just returns a simple redirect to google. This left me mildly confused as to what the actual purpose of this is. Obviously scammers have their own technical problems, so this could be a sign of a screw up (or perhaps they shut down their actual pages for whatever reason), but I can't help but wonder if perhaps:
- There is something else to this request/response that I'm missing?
- There is a reason (other than "oops") why a spam link might return nothing but an empty redirect?
Obviously my IP Address is potentially now in their server logs, but I can't imagine they were just trolling for IP addresses...