You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Martin Gregorie <ma...@gregorie.org> on 2012/06/12 17:36:44 UTC
Is this a new typoe of URI obfuscation?
Today I got a piece of spam carrying the URL chasovik.it.gg as its
payload. I was intrigued because I didn't think .gg was a valid tld and
looked it up with 'whois'. Sure enough, no match was found. However,
'host' resolved it as 80.190.202.40 and a 'host' lookup on the IP
resolved to homepage-baukasten.de, which is known to 'whois'.
This is the first time I've seen this type of obfuscation. Has anybody
else seen it? If so is it at all common, and how can it be set up apart
from using some form of DNS poisoning exploit?
Martin
RE: Is this a new type of URI obfuscation?
Posted by Martin Gregorie <ma...@gregorie.org>.
On Tue, 2012-06-12 at 17:24 +0100, si@yacc.co.uk wrote:
> .gg is Guernsey ... it's definitely there ... I can see it out the
> window :)
>
Thanks for that clarification. I wasn't as clear as I could have been.
The URL in the spam body was unknown to 'whois' but was resolved by
'host'. I've previously seen URLs with no publicly available contact
details on whois but never one that host can resolve but that is unknown
to whois.
So, my questions remain: how much spam carries URLs that resolve but at
the same time are unknown to 'whois' and how would they be set up?
Martin
RE: Is this a new typoe of URI obfuscation?
Posted by si...@yacc.co.uk.
> From: Martin Gregorie [mailto:martin@gregorie.org]
> Sent: 12 June 2012 16:37
> To: Spamassassin users list
> Subject: Is this a new typoe of URI obfuscation?
>
> Today I got a piece of spam carrying the URL chasovik.it.gg as its
> payload. I was intrigued because I didn't think .gg was a valid tld
and
> looked it up with 'whois'. Sure enough, no match was found. However,
> 'host' resolved it as 80.190.202.40 and a 'host' lookup on the IP
> resolved to homepage-baukasten.de, which is known to 'whois'.
>
> This is the first time I've seen this type of obfuscation. Has anybody
> else seen it? If so is it at all common, and how can it be set up
apart
> from using some form of DNS poisoning exploit?
> Martin
-------------------------------------------------------------
.gg is Guernsey ... it's definitely there ... I can see it out the
window :)
Re: Is this a new typoe of URI obfuscation?
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Tue, 12 Jun 2012 16:36:44 +0100
Martin Gregorie <ma...@gregorie.org> wrote:
> Today I got a piece of spam carrying the URL chasovik.it.gg as its
> payload. I was intrigued because I didn't think .gg was a valid tld
> and looked it up with 'whois'. Sure enough, no match was found.
.gg is a valid TLD: http://en.wikipedia.org/wiki/.gg
$ host -t ns gg
gg name server f.ci-servers.gg.
gg name server a.ci-servers.net.
gg name server c.ci-servers.org.
gg name server d.ci-servers.je.
gg name server ns99.dns.net.nz.
gg name server b.ci-servers.org.
gg name server ns0.ja.net.
Regards,
David.
Re: Is this a new typoe of URI obfuscation?
Posted by Michael Scheidell <mi...@secnap.com>.
On 6/12/12 11:36 AM, Martin Gregorie wrote:
> Today I got a piece of spam carrying the URL chasovik.it.gg as its
> payload. I was intrigued because I didn't think .gg was a valid tld and
> looked it up with 'whois'.
that just means that the tld provider is violating RFC's, no that the
tld is invalid:
;; QUESTION SECTION:
;chasovik.it.gg. IN A
;; ANSWER SECTION:
chasovik.it.gg. 86387 IN A 80.190.202.40
;; AUTHORITY SECTION:
it.gg. 86386 IN NS ns2.webme.com.
it.gg. 86386 IN NS ns1.webme.com.
;; ADDITIONAL SECTION:
ns1.webme.com. 287 IN A 62.116.130.62
ns2.webme.com. 287 IN A 62.116.162.62
and it is a valid tld:
<http://en.wikipedia.org/wiki/.gg>
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
>*| *SECNAP Network Security Corporation
* Best Mobile Solutions Product of 2011
* Best Intrusion Prevention Product
* Hot Company Finalist 2011
* Best Email Security Product
* Certified SNORT Integrator
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.spammertrap.com/
______________________________________________________________________
Re: Is this a new typoe of URI obfuscation?
Posted by Martin Gregorie <ma...@gregorie.org>.
On Wed, 2012-06-13 at 03:04 +0200, Wolfgang Zeikat wrote:
> On 2012-06-12 20:52, Martin Gregorie wrote:
>
> > so its probably worth treating .gg
> > the same way as .cn and .ru, though for slightly different reasons.
>
> Unless you're in .cn, .ru or vicinity or have correspondence partners
> there, you may be right.
>
I have about three correspondents in Russia, so a meta-rule along the
lines of
header __MG_RU1 From /\.(ru|su|cn)/
header __MG_RU2 From /(name1@isp1.ru || name2@isp2.ru || ...)/
meta MG_RUSSPAM (__MG_RU1 && !__MG_RU2)
score MG_RUSSPAM 5.0
works just fine for me. I don't need any exceptions for .su or .cn, but
as you say, ymmv.
Martin
Re: Is this a new typoe of URI obfuscation?
Posted by Wolfgang Zeikat <wo...@desy.de>.
On 2012-06-12 20:52, Martin Gregorie wrote:
> so its probably worth treating .gg
> the same way as .cn and .ru, though for slightly different reasons.
Unless you're in .cn, .ru or vicinity or have correspondence partners
there, you may be right.
wolfgang
Re: Is this a new typoe of URI obfuscation?
Posted by Martin Gregorie <ma...@gregorie.org>.
On Tue, 2012-06-12 at 18:47 +0100, Stephane Chazelas wrote:
> 2012-06-12 16:36:44 +0100, Martin Gregorie:
> > Today I got a piece of spam carrying the URL chasovik.it.gg as its
> > payload. I was intrigued because I didn't think .gg was a valid tld and
> > looked it up with 'whois'. Sure enough, no match was found. However,
> > 'host' resolved it as 80.190.202.40 and a 'host' lookup on the IP
> > resolved to homepage-baukasten.de, which is known to 'whois'.
> [...]
>
> You're not querying the right whois server
>
> Try
>
> whois -h whois.gg it.gg
>
OK, and I see from the TLD list that .gg is another tart's TLD: unlike
many national TLDs, the registrants don't need any connection to Gurnsey
to own a URL under it, so its probably worth treating .gg the same way
as .cn and .ru, though for slightly different reasons.
Martin
Re: Is this a new typoe of URI obfuscation?
Posted by Stephane Chazelas <st...@gmail.com>.
2012-06-12 16:36:44 +0100, Martin Gregorie:
> Today I got a piece of spam carrying the URL chasovik.it.gg as its
> payload. I was intrigued because I didn't think .gg was a valid tld and
> looked it up with 'whois'. Sure enough, no match was found. However,
> 'host' resolved it as 80.190.202.40 and a 'host' lookup on the IP
> resolved to homepage-baukasten.de, which is known to 'whois'.
[...]
You're not querying the right whois server
Try
whois -h whois.gg it.gg
--
Stephane