full-disclosure - strange domain name in phishing email

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4412A0C5.7B448466@dessent.net>
Date: Sat Mar 11 10:05:42 2006
From: brian at dessent.net (Brian Dessent)
Subject: strange domain name in phishing email

Jianqiang Xin wrote:

> I received several phishing emails. One interesting thing is the link
> to phishing website has the link:
> http://1406379699/dbweb/ws/ebay/index.htm

This is a very old technique.  Most people think that dotted-quad
decimal is the only way to express an IP address but they can in fact be
written in a variety of formats - octal, hexadecimal, and/or combined as
a single 32 bit word.  Read <http://www.pc-help.org/obscure.htm> for
more.

Brian