Re: strange domain name in phishing email

[Brian Dessent <brian () dessent net>]

Jianqiang Xin wrote:

> I received several phishing emails. One interesting thing is the link
> to phishing website has the link:
> http://1406379699/dbweb/ws/ebay/index.htm

This is a very old technique.  Most people think that dotted-quad
decimal is the only way to express an IP address but they can in fact be
written in a variety of formats - octal, hexadecimal, and/or combined as
a single 32 bit word.  Read <http://www.pc-help.org/obscure.htm> for
more.

Brian
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/