• Categories
• Company News
• Industry
• Seattle Internet Events
• Security
• Technology
• Uncategorized
• Web development
• Archives
• February 2010
• January 2010
• December 2009
• November 2009
• October 2009
• September 2009
• August 2009
• July 2009
• June 2009
• May 2009
• April 2009
• February 2009
• January 2009
• December 2008
• November 2008
• October 2008
• September 2008
• August 2008
• July 2008
• June 2008
• May 2008
• March 2008
• February 2008
• January 2008
• December 2007
• November 2007
• October 2007
• September 2007
• Subscribe via RSS
• 
• 
• 

Adhost Blog

Spammers using Google to hotlink to phishing sites

The Internet Storm Center recently reported on how spammers are now using Google’s “I’m Feeling Lucky” feature to redirect phishing links, in an effort to mask their trails.

Systems administrators at Adhost actually reported the first uses of this technique nearly two months before ISC’s report, which was reported to them through their submission forms and also was passed around to other administrators.

This might be interesting – we’ve gotten spam that is using Google’s “I’m Getting Lucky” feature to essentially do a referral bounce using Google!

Here’s the link from the spam, a typical “mortgage refinancing” spam otherwise:

http://www.google.com/search?hl=en&q=earthmortgage123+As+
direct+lender+Earth+Mortgage+eliminated+high-commissioned+
Employment+Opportunities&btnI=gndo1

The key is the “&btnI=gndo1″ at the end – what this does is trigger the “I’m Getting Lucky” button from their front page, which automatically sends you to the first hit on the search. Therefore, if you go to that link, you go to Google, which does the search that only gets one hit – the spammer’s page – and then via I’m Getting Lucky, you unluckily get sent right to their site.

This is just one example of how Adhost systems administrators and engineers are constantly working to detect, diagnose and protect systems against several attack vectors online, from phishing attacks, to spam, to denial of service attacks, and more!