There's a new (to me), overly clever campaign combining Google
Translate with a URL shortener. It's fairly low volume, but most
are sailing thru SA. It's such a goofy pattern it feels like it's
worthy of an Extinction level score. :)
These started yesterday (Dec 9) at around 2am Eastern US time, and
ALL the shorteners are still active. :(
They're all coming from Yahoo, with an unusual nation of origin.
In general, MANY of the interesting new campaigns are coming from
one or more of the big Freemailers.
All the URLs have the shortener domain encoded and look like:
http://google.com.ag/translate?u=%79%2e%61%68%6f%6f%2e%69%74/[REDACTED]?&hl=en
which translates to:
http://google.com.ag/translate?u=y.ahoo.it/[REDACTED]?&hl=en
The REDACTED element is _NOT_ encoded (and does not contain
brackets, it's just a regular five character shortener parameter).
All are hitting SA's "HTTP_EXCESSIVE_ESCAPES". :)
In all cases, the shortener goes to some variation of:
http://1427762013/[REDACTED]/[REDACTED].html
ALL of my samples go to the pure numerical domain "1427762013".
Could someone sanity check that that translates to "85.25.235.93"?
That's in German light snowshoe territory. :)
I've seen that form before, and am surprised that any URL shortener
is still allowing those.
So far, there's always two subdirs, and they look like either
year month, or month day (always numbers).
The filename is long (15 to 19 chars), and looks random, with all
mixed-case alphanumerical characters.
So far, they're all using unusual Google domains (including my old
favorite "google.co.ck"). Google tricks campaigns often have
started with rare TLDs, and often move to Google's default domain,
so it's probably best to write rules for all Google variations.
Suggestions:
Add metas for each of:
* Google Translate
* semi-legit but often exploited URL shorteners
* any Google URL with "HTTP_EXCESSIVE_ESCAPES"
* combinations of the above, and/or from Freemailers
Personally, I've jacked up the score of "HTTP_EXCESSIVE_ESCAPES",
however I do see enough legit-but-thick senders who hit it, that I
understand why it's somewhat low.
John H:
I'll send you a couple of raw corpses so you can wave your
RE magic wand. :)
- "Chip"
