OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: [Full-disclosure] Suspicious URL in IDS

From: Andrew Farmer (andfarmgmail.com)
Date: Sat Nov 03 2007 - 18:59:12 CDT

On 03 Nov 07, at 16:24, Kelly Robinson wrote:
> Is the following URL valid? http://www.address.comwww.sitenameremoved.ru

Technically, yes. (It specifies that the client is to authenticate to www.sitenameremoved.ru
  with the username "www.address.com".) It's often used in phishing
attempts, though, as a sufficiently long username can be used to
obscure the actual hostname and path.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/