Redirectors in Compromised Sites Used in Spam Mails

[Peaches]

Jul27

Redirectors in Compromised Sites Used in Spam Mails

We’re currently seeing a wave of fake pharma spam emails which do not directly advertise the URL of the fake pharma website in the spam email. Instead, the spam emails advertise URLs which points to HTML pages that are hosted in compromised sites.

Obfuscation Layer for Spam

These HTML pages are uploaded to the web root of the compromised sites while the HTML redirectors provide an obfuscation layer to hide the final landing page – in this case, the real fake pharma site – the infamous Canadian Pharmacy or Pharmacy Express.

These HTML pages are very simple redirectors. From what I’ve seen so far, they’re either a META refresh redirect, or a Javascript redirect.

Read more here plus screenshots: http://blog.trendmicro.com/