For a long time I've rec'd phishing scam e-mails claiming to be from ebay - nothing new there. They say "click here" on a link and use lots of methods to hide the real URL desitnation. For some months I've noticed that the phishers are using real URLs at legit companies that redirect to the phishers' sites. I figured this hole would be closed quickly, but not so far. One hole is at ebayobjects.com, which actually is registered to Doubleclick. Example (mucked/cleaned up): h_ttp://us.ebayobjects.com/6k;h=h_ttp://**PHISHER_IP_ADDRESS**/eBayISAPI.dll-SignIn/index.php
Doubleclick must know about this but must be unwilling to fix it. Does anyone know the legit reason DClick allows/needs this redirect functionality to be available to its customers? In any event, I do wonder how they get away with this w/o having a major PR problem?
2007-05-31
10:49:36
·
2 answers
·
asked by
Igorok2
2
in
Computers & Internet
➔ Security
Maybe I need to clarify some things. The link in the spam e-mail takes me to ebayobjects.com and then redirects me to an IP address in China. I understand that one can make a page that looks like someone else's page. Here, though, the phishers are using a process on the ebayobjects.com server to cause an actual redirect. BTW, the URL segment that I posted is from the start of the actual URL code, not simply what appears as text in the spam e-mail. So, it really does send my browser to ebayobjects.com - and then redirects it..
(Also, I don't know who runs the servers at the ebayobjects.com domain, but according to the whois database ebayobjects.com is registered to Doubleclick.)
I can understand why ebay, doubleclick. google, etc., want to allow their customers to do all sorts of things when someone clicks on their ad, but redirecting should not be allowed. What I'd like to know is an example or two of legit functions for which someone needs this redirect function.
2007-05-31
12:12:46 ·
update #1