I've setup an application for my client, that sends lists of job vacancies to subscribers every Monday morning.
The emails use a custom link redirector service, to make the links email friendly, and to count clicks etc.
This redirector uses a hashed path parameter to uniquely identify the click.
Every week, after the emails are sent, I start receiving error alerts in the logs, for redirector links that can't be decoded.
At first I thought this must have been a bug in the coding, and that some end users were unable to click on the links. However I was able to verify that these links were bogus, and had not been created by our system.
What seems to be happening, is a bot of some kind must be trying to create random redirector links. What I can't understand is why?
The links have clearly been designed to try to mimic the format of the real links. At first glance they look legitimate. They could be identified initially because they included non-hexadecimal characters in the parameters, where the real parameters are always hex encoded. However now the bogus links are also hex encoded.
What would be the purpose of this link hacking? Would the attackers be hoping to figure out how the links are encoded, thinking they might be able to then create login links, or password reset links?
The other curious thing, is that that these attacks only seem to occur directly after the mail-out. If it was a regular intrusion attempt, I would expect it to just happen at various times throughout the week. Would this be intended to make it look less suspicious, and to make it appear more likely to be legitimate user activity?
In case it's helpful, the links that are sent in the emails look something like this...
Note: The .asp is completely arbitrary, it's not actually using classic ASP, I mostly just wanted to use an extension which wouldn't confuse email clients, but would also give hackers less clues about the back-end application environment.