Saturday, February 18, 2017

Phishing Site with Search Engine Detection

Continuing discussing @Techhelplistcom's post a dhl/stripe phish site

hxxp://bitadze[.]ge/wp-includes/

The http.zip file also contained X-x-X.php which appears to be search engine/bot/crawler detection ... in theory returns 404 not found for search engines trying to index the site and 200 success for the victims. The idea probably being that they don't want their pages to show up in search engines, they want them hidden from the internet except for when they send out their links in phishing emails. Probably extends the lifetime and thus success rate of their phishing campaign.

Full code here





More about neonprimetime


Top Blogs of all-time
  1. pagerank botnet sql injection walk-thru
  2. DOM XSS 101 Walk-Through
  3. An Invoice email and a Hot mess of Java


Top Github Contributions
  1. Qualys Scantronitor 2.0


Copyright © 2017, this post cannot be reproduced or retransmitted in any form without reference to the original post.

No comments:

Post a Comment