1

I'm receiving spam emails that, looking at the email headers, appear to be coming from a variety of computers around the planet. They're always the same type of email that contains invalid URLs inside of HTML IMG tags. I've set Thunderbird to never show images, so these URLs are (I assume) never passed to the network code for a GET request. How can I tell if these URLs are in fact exploits? I have no idea who to ask about this kind of thing i.e. who is the authority on diagnosing spam emails.

Incidentally these emails are typically meant to appear as though they are coming from markers.tk domain email addresses, such as branchiform-cohomologies-glue@brama.markers.tk.

Here is the complete set of HTTP URLs that I extracted (using grep, sed etc) from around 10 spam emails:

 http://0x1F.8847525?-zcNQec8Mqyay9MwQufAZyDUlLviGZxNBtAvdjUQniA4jIwSjugqP7PM_YDtdAdIonNBP230qbsCCEE3GCsYnT0ZOJKhVl0mQNAWqXOL45FVLPvLfDeD6C9Fu2vFD6QLKKWpg2t9fdpr_i0gSa25r1Sm4HcNXB2CXN8jpGywGHG
 http://0x1F.8847525?hYeUX_hOpKtco0KhofhYgO5idY1xpk71gWWaYhPNn-ich1rllpf-dxHOLkyvSfR0JvbB3-LANJSk-WYDWqYHnRhCKO45-koqC9pJ4dAKJwi8EO_SthO7CyBQ2s6QP3CTb9NcvcHeKOpb72mZa23a_b7k_kM6sj1NfnWUSp6mUF
 http://0x1F.8847525?oKLLiWGT7oFicUr-imJXIwVHRA_FcE2bglcWVCFO4jykerlKf-fyTNtAQZZNY9qADdEVOQ5IQICHqSpzJWIsyLN28KCWn4kPxaGpuSdgtcb18W9KZnHJR1X_QQnX1eTf97GGQIDQjHH45joCDY1y30KbrYoxysVVQNvCLJq44KG
 http://0x1F.8847525?4FfzWOPIrRj9oofD5SgyucrOVquKTsrFDU_2_wR5-Hk1uynXndCyzlIm-j3k_7_M_GQkLC1KK6Am0P1NBa6bwJBOToRlAFGoHvY-b24M_w9jPj-u-5ddMrZdyRPrOfTgHhjEA9blwHvQnRhUi0dIaSlDAXLda1aS_9iiAnzzE
 http://0x5B.15251803?b98Y15GsFo_xGIZbJ923WWJOLaBx-p7JEziR1AZR9fmhLDYMgtI0Jd3hIHIZX0c3bVtpSHehRhDizYfdpIPjY0QqEsaKmJ7_A_snqBbASkRt25jTWg2nne6q_KRmh4DApy3nQ6vdUO76ClhJe8nk6a5PaXrij28Gm9otM8cYlclEDZe1_lvFMyG98B7LV69buf4QgfugT8MfhivydF
 http://0x5B.15251803?KkLot73H22u7ukbbDIvetdwlABCGERMPjAphPEzzIre0DSEK1S-a9usnanWZbhjrWq-ISSOdWv4DD1i6xdqJBrl5hqnHX2lRrHRffeSAtdVW4wXJ8vcttIsbuYrOW1U_nrO0vHcr4ieuFjAMVZfPrXwWshxfP6vSPyxjEsdZ3qBatR0gWwlRJ0jURhBJNEyZ567M1qGjrK8c8aeD
 http://0x5B.15251803?YLd32UNkLvRBIvdDZpfyxORkWkMDBL5HPWGogdVLdQSP5olZ6S5usDtjH6e52MaPTtZPgU6T8jvyMJxw13_DFKTv3dbSap5UhU_e0API9fARW0-XmQg9TMyIiLzQsQijhlLQw1pC6F9uRwl8He3BmcrMpuqLdhBbVKm2x1WFFSXXqQ0v-ZdBY92PWI4RJAfmfxTZaCW2elxk9bd3E
 http://0x5B.15251803?3HYLxaVQI4UFjRIvxqImVwr8KTyBORzncMHLjSEmyqKQczSaIIXSOBX6bQ34ys0urKaZXz54Mb8TE1xFMEeWZT7I-WVNXORIjYesTBEcBv_zA_NBXb2rIUVLULAdLq5YvQOAH8sFkCnpj12vD14wpEZq8eqygtCNasbkL-QWoj_hS5fL5gvnCHfiZmclBmD7UO_icyYHFJQLfujkJaG
 http://0x5B.15251778?3BHHVK38ql7RnlHT4fJCQE70JbiAdaCJMUmpfpwpLW0IxlhDl3tSbNdeIxq23_Go5T9PZTWYjfyWr2nobxFCx-q8T8g1Xha6vxe0ehZETTmY8GZZIlbdjqHSiSa6aNceIw3GpLngSV168_NUpmy5njfF990NjtQ7JIJI8iVz4e-y9Lwgf9-wWp1PsKH_srpNuyDP4z91E
 http://0x5B.15251778?H21I_0l_l9if7EVt_AoTztLtJsyHabDXGWKAf35AzAnD8IXb4t3ERY3zTbjtWl1Guko3QMw9OeL3drlQfZxMmJNGquQLZ_Pke5zQnKxI65uA2uW3YAnfwlRPXAKRJgPXj6j02j_WX9p0xg7PFGJJOOrIN3vUjgP8jPAbV-kUW_31NZnZj8F2xRg_rHYmqz18XBUv7l3IrEG
 http://0x5B.15251778?tvd3O2L4NsBhh59sOCuNeuANfEmEtyE4bZyqcYFEPIOlG4r4SsarobR9kCWOAi9NDy9fKZGaNjyGDzURGbKl0hEC30gM4Ey8uM-iuY6BwVDzJxYQi6cGheCH-DBbn7KanHQnhDZvB7wj4zdyPXjVDCZg8YyyWJZjGc8QMCgR4x679mNw1KV9kMXowgDJqErC0egqaV4KV3G
 http://0x5B.15251778?jdsBmcYAYPncHd408oIXiIm4MszgfZ_6-vL2F-iXyGzLNqcj-uxVr3H5XJ5veQzsU8DmUchhZ3ku06mwvd7zKprOqTde9tpgUFZ3B7F75CGtATFkoibBiDnBsnOr-aVBsSK2x1FNbo7ZHhtA2sGHzGSNM_HGfRHICMZCMym2QpRTugdg16qheT5LWEY44ribWZfLviiD
 http://0x1F.8847641?zua4R3KVWSGCzSeEE8YKQKYIGo4LaYvPPwea-aqHV2SGV0V8hnHml8jNXGlvUKXtT-BMo3g0225rvheYbgPxALHuvj9j1_k0sf3EBjkcu3T9HYaAFffmt0tCVORNK5by7wgZVrtOPdxkoU5G-zNzezyfwNT4kv0xmG79-9G2j-ueG7a9qK2w5S-cQ2VvJlrMg1cG50VwxepUkwPrE
 http://0x1F.8847641?1jPOLsTs_ruXpt_yL8WwMzFeIPCMCJMn4t7A-naObBJFfUc9kUGr_3QyWbXMEC0BG_HFcHnH1DMHqHNh0n5GmMcHqPNA2Jw_f9I0pg-q-kQ75g-EroX-byT1aYvkkWr-fv03VdcNbutb4OjC77EtmBXLhA-G2Nl5oFg0SVgN40T5y5GvEY7XbGdG_I_PDlR6-HTZa8302MK85tpQBtG
 http://0x1F.8847641?gcj-lT9_OUmjDgzBpgFWgSNydBH8G5P0lk-oIEtlD_-jwKkeWU1Wqt712a0uXSBqQaES_mewlPRLS4AV-Tia5OyBS6PpTLQaKWYp4JzNE7DG622ugPkEIGE9q25zdQiINNPzcYTrGDInjSPXLV9klpbdI3vXLx1okc-gwl4_dpnTzukqAifsAX3dMsDr0HhOsWM4bGXdTPku4ojD
 http://0x1F.8847641?lPsLh1DYcoEgZZcvhFGcrwbX47fJYi8TVqRJuT3LxK5x8Rq4AxaGNMbd2m6F_NHKKB_AWePNpnVmdy8zZaxgg1cJUcZG2__zQh5RgGd11Q9h28L1AmVzGnBPYptlL_q4CR54BAGxBDOnVLqX_3h67KHvfq6mmgWqPh66tssona9BZoq0DaP8A4Sf5_KtEWk8pLYRMdGPfIgVWa3jx1G
 http://0x5B.15251809?432WAmVaZkFmc3C5V1aFaJ1kzSNrYMYgq4LA4J327eJE-ayite_pOYCg1fJv3BYYSIgDn6im3Iyj6WdobfNnv9Uh1s-FdjWPpgsMFOcb8AU74qDTiaa_qNbvoO7u4_zjr-zQDEQH-CsByanq4L5CghTXfcgaBgLW7ZkFpjIm5trIGU2-lgbjORyPRk6cHpNtxi8nq1DiYtsD
 http://0x5B.15251809?SL5wUpvucWZp1LFjp405OlJbwCRBbE-OByMJjPWUzZcQlloLkYywSzE2IwwsRddymL6XqUmtRtxt-Z38dIBeRZr1alvoMlYkJz-c-f-2nPEhwP5rfxUVWrMpvOl3tlEfdjBQ3RFdm9JR1oWG86-e_XFrZCWQlRZ62ePX8eQN9XDVDe1cuulncllBpyPSYjUT2AmKo1xKPO4ZCL5D
 http://0x5B.15251809?rjbEqJsLhNOPpENvvcipNBArj0-0nlc57ter36FDsTvi0TnigRBT_Jo500ggCyGgB-9sJRDozLIGKzA-Uv1-c6MYuRG_2KYMA-Ce14CPCXQTv9-PDgb0rHUu1EBehisdVyWuOkQ0P9fhGtg-eBVRi4GLwdvOL7kuAW66tR1BUYQ4TW4bqJxtvjaZIoefRbN1ItVCTW0ppWt6vF
 http://0x5B.15251809?Wa_0jvz9jakv6aLn49o3RNTLK-lQrUKVzf2hb1r-8pqIgdJ69qf4TcdcNTlmU_MWQknzxXQkVh0NhEg9H1GaT3kcy7dUl400NCEgNlCFtEWzdcBi8dXfNE6Xc71ILTvkReVaI9F7Hhx9dfflTxh80MvqXwfa37PK3vUAI6cprAE3WRPCyCnWbo1tJdUdu--sw01So7lZzSHg2a_D
 http://0x5B.15251742?8goapYhTToqYhg09OpzS_t6MrzMxMepCgqYKQs5d-wRx5bRfPUldwZb_MHYX7iBDNq_Grey8_sG3bECGBOHNMbrYbUVVh_AHTVprS19tbUq7U1KzGv0zsEtwmTM0sqW2NdnOqNV1NqMyIjk6eoefe9V5ozsXpj4Q_AFzV9DIhL4ryd_L-JJE3CEOU6mEWaV9IvHDZRnr64gD
 http://0x5B.15251742?dPoQ7YY1AycbNzoguenbSzOoMsZOGq1b1B1G14tSlj9kiVfUcNj1d0WMknDx8tMDsFIwpmuA5SVtY6Em_i_drAfXWOsAYpOx7mOmi5Vau2PvPHWWh_XsB2t4xErc7H6_Pcpwu78knkpjfNVp5Nf2iQRixfy4PYbc1AWbIXv8jAQs51j4vv2aP9T7U4_zQ0GrV3zvkL5YoicQE
 http://0x5B.15251742?GZicChkiSB1MyjSACxH2jbo0wfwVw-bMMXPkf7rNayLetUyrImgq_PT8lho_KLZe_ev7BRLjennJ8trV_ZidYzLG2v2XQMJYltWjufrK0HUNgLZCdLpLTMUdg612I5jJD70uH5zCYrLjDzEfzx-Y5HLaLuMxLtu-hUcifh3FJPHscotaMWWJEf8BBYz5UTxMWC57FcGV4CN0CZG
 http://0x5B.15251742?W4nNJ0BXys5sy9tWI4cIhtKUVtehM9DeM5aazThr3cpVzoeaRIUzMNuE0ulk3XFx8lSL0Vt-XJPQ027BRB0l9RP7lgAXKrTY-Q0t_D8ne5Hv7FPnhZ5FUL0O-McQVkw587j5He1qMxiKp6l6hy2ezOXh5hZggZW8iQY7UBAu5PHgDpv9g4w_gqV40NhCw-7WCFxhXuJh-D7NJF
 http://0x5B.15251748?vP6NYqUyebZ6TTGAd4BsNbz0LJhIJZPZWBUcvdcS9DWmCQGHiE86kyEkPvug3HxpT_7WETbcsGb9x0_hYcZfeureqVYRKUtffuu1ADTUf5G_9ykGTqKAmxZOrdM-nK8lScyEHU-SQkMtTIYFKrOgirSMNUEtYmfmGPC6HbT6uhSHS1XGiF3GnLxtOGYXf4krqQryq2uGuH8dPP6D
 http://0x5B.15251748?ABhgyAeKRFVsELREyMRQdFr7YlX9nk2qPiJyEfwlVooW3KnoP5cWKVcoB5LuC-75fuNGkRypY9OORLdXG5jfp-X6pL6_k7SxqbaDHaYn8AQJ_0I4MjFG5NKvAnlgNNbi2DtxlTtyREcV3V1M461kFZowv77TFQu-JiSOUDX0JUMeJfhSQXb4ZHnDTUqjgwjUnojpfw4dd31dguIgyAG
 http://0x5B.15251748?tzBHVL8xs4Z3L35t_SWRSs38eZglrLmhDeHxRGJGlfJyqLUEGMDlGVwdMatVrfG6D53D4NRTzkBMmcl_9Ff1LI08azjSMLG3v6sjhFGbyTu4Vh7lqPc5UebDuetA3jWE9eRrOQsZ7HCf3b1n1xNONumombBZgydfLfgxv7hgROKw2bPf6CJh5ZHKSnw7O_wRQUUx4w6R8Aj9zF
 http://0x5B.15251748?sHJrKQ5QPzN1crJ39WFQl8z9nNBdnbAsX4J6zp8fgJyVm7QnJCVAIupEF1KoGIAahMYcswhnnJECiC6Oxl15FmHDj7mKDEc76JA8wqVudC23_Fy6AsrgOTPG8Ipfa8f3bdmzdg57d4gA4qsS8IOQODBh-9TJGz0wQisuRrS-VFgKNY2il_hxmqu_WpI7drwWuQ2bklF6vCpYT3JrE
 http://0x1F.8847697?a5Es4C0J9dw2adI4rHC-3VC838vVzB-MkwiuI6no6IkFqQUPRm5gqqcbrOZ9x4lIBcGtv8IQX_IqlRAtm3KoMRbDQ2YehrLtY4-u0Niu7fn6-ZN1PLxGK1PB-Nxv8KkXnuXx-kKXoWmZLzUGbwgAWtPAMzP62cjQqb2-Xpr6m_KupmFY9DT9yl3N3Z6xvC0hRemyJsBK1b3_E
 http://0x1F.8847697?ML1PqUlsv2hZMv5bdqx0Jpnh99HiCf0f-vtfu7Jk5wWmRRsTr-RCwZ9zDQodR-waM9Qf0zvTpkX-CCqPV0lezRKODRsCNc97G-ChlQgUkyr-XEWd1ZXXjvKiUUcks4t_eFZ36l6VuEVDZXEbCVxrjWrOmi5YH1WtYA5-u-g2T52b03g2NOTnYQHp3KhncFDWfVYvH7zeYtowE
 http://0x1F.8847697?AE0teNkKjvg3Ao45RjwS9im_x6ET2Yz9yos9i1ICLLGyZarxf3QgkS8R3Jn7F3u8N4mNVUo2fdVcy6htJtk8nKJs3GrgFV9Z62J_VRGStTKmwrEPRYAhF4quVMdEtMNGquDRhlcaUuFOKdUG-9Kw3jeIVtDNjqeLibdG1FbkAKQ_VXsUuQCxCfec2VVwo8J5qS3cD927LSAtE
 http://0x1F.8847697?3R0wSRVakN117bkUSdIvyCPsH1Yk23xi5kLlvh5gmml7UF7XyVip-qpf8VRYqv5jNc5DOAc5RVDcFIykZQb6ogiPVCWeXWYDIppTHjgf-c-vy86qqc5ieSgljb91oARRo7nFT_3CnrNcaRc6RdzJ8UuweLnfGxXWbvZYdJHWe_UFEZIw8lChD335p3REP2GXXy4i9J1BCBVDq1G
 http://0x1F.8847664?acM_E4l8knGQWvoaotMA_VHUQnAA16QpJBGB-cTZbHRq0TOW9yVI54TbBwj3AuF-PrdBoY66Xqz0D926feN-b7Yz5j9qIAkFQ7i6DSHH2QFeknyghLdAAvHsKPIl9C-kWdaZBk5BcRUKgku3Z2XwCjhjUDcHfZlzlb9kfgpd1k2XgHha4AK4DNk2K-Kk3bCLQoyyEnXqgT9-K5eBdF
 http://0x1F.8847664?om80oGvsZLUSGkMoyNTkNg3PEbqsmO6hnFcI3BkQynWjtdaXwFbySgLIHJtHbObSc8q6GZEnNqU3PZac5-FT1EDBVewhLY5SA1fWP8AI1XR3apn635MDwFOD4S-1MLBiUwV3GBSgOyGyyzPLzvyAJgECU_9AS7UHAch0qdOWWONZjXYMwwLdr_6fJyTTLT31dHQzBq0Wm17HRz8s0F
 http://0x1F.8847664?jI0_pBRkkMP0-vNjUFelICqliJbGY8snpHj1Q2vVtoc8rYgr3kfCoj13RiaP_Tr1XvHKj708g1SWWnzHmK_-WM1aFB2GyQJO8LpD1gZMcYXK99qFUYAzxGwFmSqHb1ZYUB8CHbd4V_rJBidYCTJJQMFQiEAyB02aO61EEz7PqLPC-G5Uylzp6CVERgfJubaKfrGDc5-chFYbW-o0_F
 http://0x1F.8847664?lNXwODWHVxJRhgylZoOM3KyDKYQpJhusM0TwR4IXn9tZPfBxs8WxiGpXd-sNgBedoPP25mTN7jsM_Fzst5kf8Ub3gJxsuCWrz1Pi53RTPaEsuiMK3Il3GAyGrSDC6ve0Evq4ghv5ytkYWhi_aniHBtJAgE68v2oPSQpFw__5a1D8TcmyPUxxNf6lqOsBK74IzC11o0sVcOWLXwjTwF
 http://0x5B.15251480?xkADPtwgUI0NhIAPCS-Vu_QnVgnSukKFRFcT2eIZexUtZFv0sQ4PKzGVtr2_8bwx0VhDElxManufWbuKVCK1A53KqaqdmVsLtv6AJxiUJqJV1U0IV3SNDQWP72foSJluF4XM6KTb9umaCYXY4ou15PM2iVYWNgbvc1cYk6wiJsQExXREuf4Pu96Nk7GhjMlXJepuFAPi4UVJ8AEDE
 http://0x5B.15251480?1wJzT55QYc191TN_GPFYvsDDi8_WxgX1VTFTAQZQ73dP8uq503oGFRha-_mlkfLMwTJz_h1FRnlrALlB9seYTj7CYtgYjdCzV2uxzRn8m56wUMFi73k3bxX8hQa6-4tfM7OTAVuFliToiiRKOFSfb8gvJ1PXG0GJI8uFXSA5PQv-iFBHK9ewVxN5S5gdPtkuJ2IImVAjyglkKCACE
 http://0x5B.15251480?at0OVB42kr4tG30xZNrMwzP9U9haLkWdCQ1kWN_vleWwKxYMC-zLLn-5IXHcQJ_FFvteWO6RQ2ihDdTnbRnIhLb4Qk0kKJA029sZJdUeSXGKLqTgFxV1U_eyjS2frSj4--t9fJg4nHrInl5ZGf-hwNycLufGjPHh_nzvbTanoiVaqblde4PkVt2OhH04t00SRXnkLrcsvMhsmaoeVBG
 http://0x5B.15251480?-ZIeDVci47m5yj4CDhPHGwAwO9UXR04pciEn65T-TCTj9zsb5d2XvuwnSj8krRfdkhRKqeol0i2xwyj9mlnzILXTCczXhU6T254hVE99cAPrb49dniuRM2fHHqtMFdHiOjNGZlRyw_UjbUYDQ7bmriqSo9N9otCqpfIutovxTxT0JGzB2gt8mlUqNVp-Rb2sm4CI6vsZ3cC4KOT7LVG
 http://0x1F.8847685?AP4eYodCj0ZIjTEh997BNweP59eSr0F2EncoUTUVSogOgIOa3ynp3MMSomT109X0HFGTZVSDLaQHt23QJL5K5orn8TTpd83sP-ypW8TQRxoOE4oWzvGbPcB96h2jn4gpqMDSuaQqUdRhu1bhSaNT1RThugjFUptR62b1-4SrTfaUP00VvzxwOL15G45N05KNV9VtN_3QzT3DTH4D
 http://0x1F.8847685?SKKwT6v9t2Y62KWTnMN4KNbxRPCNWuTe3XbeUKU2SsmSyViQ-dn-cYLoPLuJkHHLt2fTM8QfYf9A38AQAk-vI8xe4FZBl3cbRZ8OM2ReSJA5l7zgMaTP7sgA1w3roXmftbhDZgkSORjSNjzDzde6wsHLhf38Y-v-Ev3LOoX-k9yw7Zli-udNxKy2no-H-8H5RmCZqkRZIvKVm6KD
 http://0x1F.8847685?82yyaa_iPNniAi98CzPb7yLjwJt2Oo7syFAsC1689IXD8042Hw95xV7L_ixf_rhps11cW8QJ32ioCruJfFU07rcEpTraitTZ4SPVXuXPYkDdNQwRF-qkuetcQu9E0f8Bgz-v6Rrk3CPzCQ_FeoL4lClRMYel7cbRIfbNqG8c-0ksw_NAzzHDlGc04xslm8mExvNcUzdW7w8yHPWyyF
 http://0x1F.8847685?qfhQMvIoRt_ampR0M7rOiH-Edq-MzUONNTp2zS9RM2rvNt2X11yn9mGX1c7uaAAVLpdjdqeze8LuvdGGQspltzOOGW5gcX8q_vyPahbE1sy6_V4lEjRoqS4ZLHboVNgx41vBykQUACSrEmOzZlFx0cwVL5vEaJPWEDG2uW0oSqLzr1hM49D8vjhCV5cdQudp-dY0qLsnwvTtOCskIvG
 http://0x5B.15251764?Yvh24R9SNE5h7ztpOd9pdS_KeV0L7bdGTadSkDB6dsQPldASftYDIkdh_dhPpsZ_dZI_uhTzmi-G6e19XrBbrjPvnP7i_EEifQ9xQBOUmYSv8DvZMmxupUISsFGgRGT3DN3yh5xH_1KRTe1W5wqwav23HtcuCV2xZNwHXxTY4HZI3hZlFaiQ5iW4V4lKEAGyrU8DVfxQOUOclLO6PhYD
 http://0x5B.15251764?2Q4UZobzb6a4aUEHu2IufPZEf2RPTkBjq3mQhW9u4ChIi-4wjHFZZ7YJXFJn2M0fBkC08fiBBpmFVolXLAl0t9UlFQdnTOr65TFTG1HDhhhvyu0mb6Zx6MyMUjYYcRYv0m4BakiK29Bl5oZK3aqjkBckUJg9YZBRaebiDcEF3ntPqsOouP0vWswm46kkfrlWpPiftiuSvvP_RYlcQ42D
 http://0x5B.15251764?TdxgAgxmhFjM_nxDEsk8tF6cNtammzGprlXSVLisUo1F5PKo7_wLtN0viuLJyov8DTwlNpkCsgJB_GS7laIph7ofPSAwS6W6P9hqPMtFeStIGKgxS4gGCwIT8i0BXxp8jvG8oiayEJxP7NSklvVr03fFdBhLLtD2JvixIq2NhBGJeNr1j5k334pgAzULTeZGfa3KX5oeQc_AT81i26G
 http://0x5B.15251764?HeOY4ln-9bzKYIcHqf30sYE9BTGK8viF-a0Zz8mZJKkZNRfjd3O6BguYPqDdjRu2W7OaeqQmj6S75hXVi_CJqm2NztF4wKv_lOyRAbfyNv-lVPl6T5YUDzgZNCmkbNAtTQDjyqNQjSDRTWy58RwbzC4vc6Zq4eCIb0EAxbHUuRsjtNgvPT8Tt2GYrKsuCtc8DVyTcjpl-OsUHOXWFe3eOF
 http://email.treditsoves.co.uk/UTcyD/slugrz/op00af/rgrlcmu/ssuhruarrl.kqz
 http://email.treditsoves.co.uk/o/slugrz/op00af/rgrlcmu/ssuhruarrl.kqz'/>
 http://email.treditsoves.co.uk/UTcyD/slugrz/op00af/rgrlcmu/ssuhruarrl.kqz
 http://email.treditsoves.co.uk/JkPnV3gp/BpV5q_hom/windlpim1.png
 http://email.treditsoves.co.uk/53zU/slugrz/op00af/rgrlcmu/ssuhruarrl.kqz
 http://email.treditsoves.co.uk/JkPnV3gp/BpV5q_hom/windupim3.png
 http://email.treditsoves.co.uk/67i/slugrz/op00af/rgrlcmu/ssuhruarrl.kqz
 http://email.treditsoves.co.uk/JkPnV3gp/BpV5q_uns/unsub.jpg

I used Curl+Tor to fetch one of the "kqz" files, which was a 302 redirect to here:

 http://46.16.168.80/ilayer.php?slugrz/op00af/rgrlcmu/ssuhruarrl/53zU

That URL in turn did not return anything at all.

How can I efficiently diagnose a spam email and obtain a timely, conclusive report?

Is there anyone in this forum who has a hobby of testing out potential exploits who'd like to copy one of these URLs into a browser running in a VM and run What Changed?

  • 3
    Well, the part before the ? is an obfuscated IP address. If I shift 0x5B left 24 bits, than add decimal 15,251,809, I get (in hex) 5b E8 B9 61, which in dotted quad decimal is 91.232.185.97. A whois lookup puts that in Romania. The query part appears to be some kind of hash code. So these URLs aren't really invalid, just strange. I don't have the wherewithal to try one of them at the moment. As you say, that would take a VM and I am away from where I could set one up. – Bob Brown Feb 20 '15 at 16:45
  • 1
    SE sort-of frowns on requests for product recommendations. Can you re-cast your question from "free service" to "how can I?" – Bob Brown Feb 20 '15 at 16:49
  • I find it bizarre that such a format would even be supported. I guess the Romanians are really doing their research... I discovered an article that compares anti-spam companies' products, so perhaps I'll contact some of them to help them improve their anti-spam scores; virusbtn.com/pdf/magazine/2015/201501-vbspam-comparative.pdf – Icann Feb 20 '15 at 17:01
  • I used curl through Tor to get the 1st one. It's a gif. virustotal claims it is safe. Curl is able to process the strange IP format. The 2nd one is a very large JPEG (250kB) and is supposedly safe too. The 3rd one doesn't fetch at all. – Icann Feb 20 '15 at 17:11
  • I checked one of them.. it was an unsubscribe page for AIG Direct which is some kind of insurance company according to google, code was normal, no exploit. I used this website to view the source code of the url without actually loading it on my browser: source.domania.net – Kotzu Feb 20 '15 at 17:59
3

No, they are not invalid URLs and the URL themselves are not exploits. If they point to exploit files it's hard to tell.

They are obfuscated URLs intended to avoid spam filters. If you try to ping, for example, 0x5B.15251742, you will see that the address is translated to 91.232.185.30. The rest of the URL is a hash, and probably there are a few files with a lot of aliases, one for each of the hashes you are seeing.

If you want to know if those are exploits or not, load a VM, install a sandbox software on it (Sandboxie is a good one), load the URLs and check the sandbox folder for created files.

You could create a script to use curl/wget to download the files on a directory and run an antivirus on them. Downloading the files using a command line tool is a very safe way to get suspected files without risking infecting yourself.

You could get the MD5 or SHA hashes of them and search Virus Total. If someone has already sent the file, they will send you to the report page. If nobody has sent the file, they will tell you too. You could them use forensics tools (IDA, Volatility, GDB, WinDBG) to determine what kind of exploit you got (if any).

If you don't want to download the files, you can even just post the URL on VirusTotal and see what they say.

2

The problem is that not all spam is meant to exploit anything. Spam can simply advertise or be a part of a phishing attempt (which isn't an exploit).

The thing to see here is that the URLs attempt to hide where they go and what they do. THAT is the thing that determines the fact they they are trouble. If you wanted an automated way to deal with these URLs, you could parse them to determine if they use the standard URL format, which these don't.

  • What I'd really like is if Thunderbird would tell me "Hey there are URLs pointing to Romania in this email... we think it's junk". The percentage of the English speaking population who has contacts of any kind in Romania is very small. Also the obfuscated IP address should be a giveaway of trouble. – Icann Feb 20 '15 at 18:09
  • 1
    Romanians have good websites, too. You can't suspect a whole country. – schroeder Feb 20 '15 at 18:10
  • No but it's like credit card charges that occur overseas when a person is not overseas. Such a thing is unusual and should be flagged. Similarly I never have any dealings with Romanians. They're not on my nation whitelist. – Icann Feb 20 '15 at 19:05
2
http://0x1F.8847525?-zcNQec8Mqyay9MwQufAZyDUlLviGZxNBtAvdjUQniA4jIwSjug…

Components of URI schemes (with hierarchical part expanded):

<scheme name> : [ <userinfo> @ ] <host> [ : <port> ] [ / <path> ] [ ? <query> ] [ # <fragment> ]

All these URIs have is a scheme name, host, and query. While it is quite rare to have a query but not a path, it is perfectly valid. It's also valid to use various combinations of octal, decimal, and hexadecimal for an IP address as the host.

IP obfuscation is quite old (and rare). It is mostly used to bypass IP-detecting regular expressions.

There are six ways to represent an IPv4 address (examples are all the same IP). These may be mixed, though the non-dotted versions must represent the lowest quad(s). This allows you to use 127.1 for 127.0.0.1 for instance. It also allows ugly things like the sample combinations to the right of the dotted line below. All IPs in the block below are the same (your local IP). Try them in ping to see them map to 127.8.16.1

REPRESENTATION      EXAMPLE            ┊  SAMPLE COMBINATIONS (in no particular order)
dotted decimal      127.8.16.1         ┊  127.010.0x10.1    127.010.010001
dotted hexadecimal  0x7f.0x8.0x10.0x1  ┊  0x7f.010.0x1001   0x7f.8.0x10.1
dotted octal        0177.010.020.01    ┊  0177.010.010001   0177.0x8.16.01
decimal             2131234817         ┊  127.528385        127.8.4097
hexadecimal         0x7f081001         ┊  0x7f.0x81001      0x7f.010.0x1001
octal               017702010001       ┊  0177.02010001     0177.8.010001

On top of that, you can zero-pad octal like 000177.000010.010001 and hexadecimal (after the 0x) like 0x0007f.0x81001.

Dotted decimal IPs (rather than host names) in the public IP space are extremely rare in URLs in non-spam. If you are writing a filter, it should be safe to penalize them (block at your own risk).

In SpamAssassin, you can write a rule like this:

uri  URI_OBFUSCATED_IP  m"^http://(?:[^\@]{0,99}\@)?(?!(?:[1-9][0-9]{0,2}|2(?:[0-9]{2}|5[0-5]))(?:\.(?:[1-9][0-9]{0,2}|2(?:[0-9]{2}|5[0-5]))){3}(?:[:/?\#]|$))(?:0x0{0,256}[0-9a-f]{1,8}|0{1,256}[0-9]{1,11}|[1-9][0-9]{0,9})(?:\.(?:0x0{0,99}[0-9a-f]{1,8}|0{1,99}[0-9]{1,11}|[1-9][0-9]{0,9})){0,3}(?:[:/?\#]|$)"i
  • This is great info, but I'm not sure that the OP was confused about what the URLs were (used curl on them). – schroeder Mar 31 '15 at 3:16
  • 1
    @schroeder, the OP used curl on one of the unobfuscated links. My answer shows a way to filter messages with obfuscated IPs in their links, which is a direct answer to "How can I efficiently diagnose a spam email and obtain a timely, conclusive report?" Perhaps I'll edit my answer to make that more clear. – Adam Katz Mar 31 '15 at 4:23
0

I haven't worked with spam filtering scripting but this is something that I had known for a while, hoping this helps!

One of the Apache Projects, named SpamAssassin could come in handy. It is a Spam filter for mail servers but I am guessing you will be able to work with it to some how suite your use-case on the client side. One thing particularly of interest in your case could be spamc which is the client of SpamAssassin specifically for scripts. Quoting the link,

Spamc is the client half of the spamc/spamd pair. It should be used in place of spamassassin in scripts to process mail. It will read the mail from STDIN, and spool it to its connection to spamd, then read the result back and print it to STDOUT.

The home page claims,

SpamAssassin uses a wide variety of local and network tests to identify spam signatures. This makes it harder for spammers to identify one aspect which they can craft their messages to work around.

So hopefully it will take care of the cryptic URLs and more.

0

The query string after the domain name of the uri scheme are probably some kind of tracking id as well. There's probably a large cross domain database that correlates the clicks with whatever that could be installed on your computer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.