Is this an attack and how can I fix it?

Question

I don't know where to start in searching the forum for existing threads that might cover my issues.

I recently received a spoof email pretending to be from a client for whom I've just started to do some basic SEO and content work.

The email directed me to a problem URL on the site:

http://clientdomainname.com/%E2%80%8E

I have changed the domain name, but the rest of the URL string is exactly what I received. There is no page corresponding to the URL on the site, so it triggered a 404.

The client did not send it, so I'm thinking that the URL may perhaps initiate some kind of script.

My questions are:

1. Are my concerns plausible? The sector has hotted up recently and there are some unscrupulous large businesses trying to push small players out.

2. How can I find out if that URL string triggers some kind of malicious script? Should I ask the host (hostgator) to scan, or is there a better way to scan?

3. What steps can I take to remove and prevent it from happening in future?

Answer 1

If you ever need to check a suspicious URL, you can use a service like urlquery to check if it has a malicious reputation, the HTTP transactions that take place, any java script that runs, etc etc. Very useful. They also provide a screenshot of what the visited page looks like.

http://urlquery.net/

Answer 2

%E2%80%8E is percent-encoded UTF-8 for the Unicode character "U+200E". It's used to make the text after it display in left-to-right reading order, such as when displaying an English-language quote in an Arabic text. Unless you've got some seriously broken software, it has no use as an attack.

My suspicion is that this was a prank that didn't work out: if they'd used the counterpart to that character, the right-to-left mark (%E2%80%8F), your 404 page likely would have looked broken because the RTL mark would have caused part or all of the page to display backwards.

Answer 3

It was probably an attempt to exploit the vulnerability outlined here:
https://www.online24.nl/blog/security-risks-associated-with-unicode/
The link would appear to be one thing, but actually be linking to a different domain, such as the reverse (eg., elpmaxe.com instead of example.com).

One way to avoid such exploits is to type domains yourself instead of clicking email links. You can also scan URLs before visiting them with sites like Virus Total.

Answer 4

To start analysing if any mail might contain an attack using HTML code, 1st rule is to read this exact same message in plain text. Plain text will never possibly fire anything.

To achieve this analysis, as an example, with Thunderbird (which is BTW a pretty good E_mail client to avoid a lot of attacks), just select your suspicious message, and select:

View > Message Body As > Plain Text

Here is a practical example:

Message displayed as Original HTML:

Message displayed as Plain Text:

This 2nd one is clearly exhibiting toward which web server this scam is trying to push the dummy to click.