URLs with hexcode-obscured IPs still work?

[niclas <lists () datenritter de>]

Today I received a phishing mail containing a link which obscures the
IP-address as a hexadecimal number. The URL looks like this:

http:// 0x ded 6d8a1/www.paypal.com/int ... /index.htm

(Spaces added to circumvent phishing filters.)

Obviously the IP-address is disguised as an hexcode, to distract
unexperienced users from the fact that they are not actually visiting
PayPal.

This seems to be an old problem, and links like that - IMHO - just
shouldn't work. They don't do when using proxy servers, but they do in
some Firefox-versions, in Konqueror and in Microsoft's Internet Explorer.

While the IE presents the IP-addresses in dotted-decimal format., KDE's
Konqueror simply shows the hexcode-URL in the address bar.

Some Info here (german):
http://blog.datenritter.de/archives/421-Phisher-tarnen-IP-Adressen-als-Hexcode.html

Why does this still work?

n.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/