0

I recently looked at a spam mail I received. Generally, I'd say it was a fairly standard phishing attempt, but one thing struck me as odd:

The link that victims are supposed to click looks very weird and (apart from the domain name) consists almost exclusively of special characters, to the point that it sort of looks like cartoon swearing. Most special characters were escaped, some were not.

Here's a portion of the link: %C2%A3!!%C2%A3%22%C2%A3%22%25%5E%25%25%26%5E*%26(%26(*)*(%5E

Why do attackers do this?

After all, the link would probably look much more convincing if it contained more words, maybe fake domain names etc.

Is this meant to make it harder to copy the link without damaging it? Or to confuse novice shell users attempting analysis (notice the !! which is somewhat hard to escape in Bash)?

Or is this just meant to look computer-y and difficult to inexperienced computer users to make it look more real?

1
  • My guess would be that this is a unique random value linked to the email address the message was sent to, in order to keep track of who actually clicked on the link.
    – Berend
    Aug 10, 2021 at 9:16

2 Answers 2

5

the link would probably look much more convincing

People tend to think that scammers/phishers need to be extra clever when composing a URL. But research shows that it's unnecessary for the general public.

In my own research, I registered a few very clever domain names and used all kinds of tricks. I then educated users of my system about what to look for and how to interpret URLs.

As part of the research, I used an example domain: phishy.com and used that as a control group of URLs in my research.

There was no statistical difference in whether users clicked the "clever" domains or the straight-up "phishy" domain. Users simply don't look at URLs, in general.

Mixing URL encoding with non-URL encoded characters does not make it difficult to copy and people who are using shells and analysing URLs would not be considered "novice" and if there was a problem, they would simply fix the problem by URL encoding everything for their own purposes.

So, no, the motivation is very likely not a 2nd layer of social engineering.

Since you provided few details and no context, it would be difficult to provide ideas on other motivations. It would require an analysis of the site it links to, and we cannot do site analysis here.

2

These two links store equivalent data:

http://domain.tld/wqMhIcKjIsKjIiVeJSUlMjZeKiUyNiglMjYoKikqKF4=
http://domain.tld/%C2%A3!!%C2%A3%22%C2%A3%22%25%5E%25%25%26%5E*%26(%26(*)*(%5E

That data decodes to £!!£"£"%^%%%26^*%26(%26(*)*(^, so it's probably a tracking identifier (or other binary data) rather than text. You tend not to see the percent-encoded variant because it's much uglier and much longer than the base64 encoding.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .