3

In this question someone received what was clearly a spam link. Sometimes I'm curious enough to take a peek, which I usually do with curl or other command line tools (less risk of drive-by malware, although I'm on linux so I'm not usually susceptible to most such attacks). I got this as the response from the website:

curl -v 'http://103.208.86.131/'
*   Trying 103.208.86.131...
* TCP_NODELAY set
* Connected to 103.208.86.131 (103.208.86.131) port 80 (#0)
> GET / HTTP/1.1
> Host: 103.208.86.131
> User-Agent: curl/7.56.0
> Accept: */*
> 
< HTTP/1.1 302 Found
< Date: Thu, 13 Sep 2018 18:27:16 GMT
< Server: Apache/2.4.7 (Ubuntu)
< X-Powered-By: PHP/5.5.9-1ubuntu4.25
< Location: https://www.google.com
< Content-Length: 0
< Content-Type: text/html
< 
* Connection #0 to host 103.208.86.131 left intact

It doesn't return an actual response, but rather just a 302 redirect to google.com. It doesn't even set a cookie. From what I can tell it literally just returns a simple redirect to google. This left me mildly confused as to what the actual purpose of this is. Obviously scammers have their own technical problems, so this could be a sign of a screw up (or perhaps they shut down their actual pages for whatever reason), but I can't help but wonder if perhaps:

  1. There is something else to this request/response that I'm missing?
  2. There is a reason (other than "oops") why a spam link might return nothing but an empty redirect?

Obviously my IP Address is potentially now in their server logs, but I can't imagine they were just trolling for IP addresses...

5

My first guess was the site was probably using your User Agent string to identify if you are vulnerable or not. As you are using curl and not changing the UserAgent, the exploit kit would redirect you to a harmless page.

I used curl with an IE11 UserAgent string, and got the same redirect. Probably my IP is not on the list of desired ones.

Next guess: IP address.

The IP address is usually matched against a list of desired targets, usually tied to a country. It is usually meant to keep the exploit kit secret and only expose it to the interesting targets, avoiding it to be readily flagged by security companies.

So I tried again using an UK proxy:

http_proxy=88.211.x.x:8080 curl -A 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko' -v 'http://103.208.86.131/'
*   Trying 88.211.x.x...
* Connected to 88.211.x.x (88.211.x.x) port 8080 (#0)
> GET http://103.208.86.131/ HTTP/1.1
> Host: 103.208.86.131
> User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
> Accept: */*
> Proxy-Connection: Keep-Alive
> 
< HTTP/1.1 302 Found
< Date: Thu, 13 Sep 2018 18:48:47 GMT
< Server: Apache/2.4.7 (Ubuntu)
< X-Powered-By: PHP/5.5.9-1ubuntu4.25
< Location: index2.php?&sessionid=08bcaee2029a8a766175c5c8cebc8bff&securessl=true
< Content-Length: 0
< Content-Type: text/html
< 
* Connection #0 to host 88.211.x.x left intact

And it connected, redirected me to another page.

  • Well that's not fun. I don't suppose you happen to have a VPN endpoint in the UK? – Conor Mancone Sep 13 '18 at 18:46
  • :) That was not actually a serious request – Conor Mancone Sep 13 '18 at 18:46
  • 1
    I don't have a VPN, but a search for "open UK proxy list" returned a couple ones. The site ends up redirecting to a Russian website after a couple hops. – ThoriumBR Sep 13 '18 at 18:56
  • 1
    Sneaky sneaky... index2.php doesn't do the fancy IP address check, so I get a curl response out of that one directly (contains an HTML redirect to Login.php) – Conor Mancone Sep 13 '18 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.