Groups > comp.mobile.android > #34619 > unrolled thread

How to check validity of suspicious looking SMS message text URL?

Started by	Horace Algiers <horace@horacealgiers.com>
First post	2016-09-23 01:22 +0000
Last post	2016-09-23 17:03 +0000
Articles	20 on this page of 38 — 14 participants

Back to article view | Back to comp.mobile.android

Page 1 of 2 [1] 2 Next page →

#34619 — How to check validity of suspicious looking SMS message text URL?

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 01:22 +0000
Subject	How to check validity of suspicious looking SMS message text URL?
Message-ID	<ns2051$15hl$1@gioia.aioe.org>

Is there *anything* a user can do to check the URL without going to that
URL?

Just received this text on my cell phone:
http://i.cubeupload.com/k8CbNK.png

All I know is where it (says it) comes from:
http://i.cubeupload.com/QD1o9F.png

Of course, I could just delete it (and will); but my question here is how
can I find out *more information* about whether this is a phishing attempt
of some sort.

Of course, the text itself has to be ignored - and I'm pretty sure the
phone number itself can easily be spoofed (spoofcard, for example), so the
only real hint of the purpose is at the end of the URL.

The domain of the URL appears to be a redirector site (much like
tinyurl.com); so what matters most is the payload at the end of the URL.

Without actually going to that URL, is there a way to find out *more data*
about what this message is all about?

For example, is there a trusted aggregator where we can *forward* such
messages to?

Or is there a web site where we can paste in the URL to find out more data?

I googled the URL, but the result was "Your search - message
http://bit.do/cBuHr 681-207-8069 - did not match any documents".

Is there *anything* a user can do to check the URL without going to that
URL?

[toc] | [next] | [standalone]

#34620

From	Melzzzzz <Melzzzzz@zzzzz.com>
Date	2016-09-23 01:25 +0000
Message-ID	<ns20ai$ic3$1@news.albasani.net>
In reply to	#34619

On 2016-09-23, Horace Algiers <horace@horacealgiers.com> wrote:
> Is there *anything* a user can do to check the URL without going to that
> URL?
>
...
>
> For example, is there a trusted aggregator where we can *forward* such
> messages to?

Yes, firefox uses google servers for that.


-- 
press any key to continue or any other to quit

[toc] | [prev] | [next] | [standalone]

#34621

From	nospam <nospam@nospam.invalid>
Date	2016-09-22 21:39 -0400
Message-ID	<220920162139507952%nospam@nospam.invalid>
In reply to	#34619

In article <ns2051$15hl$1@gioia.aioe.org>, Horace Algiers
<horace@horacealgiers.com> wrote:

> 
> Just received this text on my cell phone:
> http://i.cubeupload.com/k8CbNK.png

tap it!

[toc] | [prev] | [next] | [standalone]

#34628

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 03:32 +0000
Message-ID	<ns27ov$1dj8$1@gioia.aioe.org>
In reply to	#34621

On Thu, 22 Sep 2016 21:39:50 -0400, nospam wrote:

>> Just received this text on my cell phone:
>> http://i.cubeupload.com/k8CbNK.png
> 
> tap it!

As always, you are an expert at being amazingly unhelpful.

[toc] | [prev] | [next] | [standalone]

#34622

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 01:48 +0000
Message-ID	<ns21lp$172c$1@gioia.aioe.org>
In reply to	#34619

On Fri, 23 Sep 2016 01:22:42 +0000 (UTC), Horace Algiers wrote:

> Is there *anything* a user can do to check the URL without going to that
> URL?
> 
> Just received this text on my cell phone:
> http://i.cubeupload.com/k8CbNK.png
> 
> All I know is where it (says it) comes from:
> http://i.cubeupload.com/QD1o9F.png

This does not answer the question, but I did forward the suspicious text to
T-mobile at "spam" (aka 7726) from my SMS client:
http://i.cubeupload.com/tkSPkz.jpg

While that does nothing to help me identify the reputed payload, it does
alert T-Mobile to the spam (and potential SMSishing attack, but I have no
way of knowing if they were phishing or spamming or doing anything else
maliciously as I didn't visit the URL).

I just want to know how to *investigate* the URL.

Meanwhile...

For those on T-Mobile, here's what they recommend for SMS spam:
http://www.t-mobile.com/company/privacy-resources/spam/sms-spam.html

And it's the same, essentially, for SMishing attacks:
http://www.t-mobile.com/company/privacy-resources/spam/phishing.html

We could also send email to privacy@T-Mobile.com if we think it's someone
impersonating T-Mobile themselves. 

The phone number of the sender can easily be spoofed, as explained here:
https://support.t-mobile.com/docs/DOC-2747

The FTC recommends we forward phishing messages to "spam@uce.gov" and to
"reportphishing@antiphishing.org", which is an Anti-Phishing Working Group
(whatever that means). 
https://www.consumer.ftc.gov/articles/0003-phishing

If you're on AT&T, they recommend forwarding it to "abuse@att.net":
http://www.att.com/gen/press-room?pid=22157&cdvn=news&newsarticleid=33564&mapcode=

Verizon suggests phishing@verizonwireless.com 
http://www.verizonwireless.com/support/phishing-faqs/

It seems that fraud.org is also interested in "your story":
http://www.fraud.org/homepage?splash=1

None of these above answer the question of how to *investigate* the URL
without actually clicking on the URL - so that's why I ask here...

[toc] | [prev] | [next] | [standalone]

#34623

From	Lewis <g.kreme@gmail.com.dontsendmecopies>
Date	2016-09-23 02:21 +0000
Message-ID	<slrnnu94du.56m.g.kreme@snow.local>
In reply to	#34619

In message <ns2051$15hl$1@gioia.aioe.org> 
  Horace Algiers <horace@horacealgiers.com> wrote:
> Is there *anything* a user can do to check the URL without going to that
> URL?

> Just received this text on my cell phone:
> http://i.cubeupload.com/k8CbNK.png

> All I know is where it (says it) comes from:
> http://i.cubeupload.com/QD1o9F.png

> Of course, I could just delete it (and will); but my question here is how
> can I find out *more information* about whether this is a phishing attempt
> of some sort.

`whois cubeupload.com` might be a start.

> The domain of the URL appears to be a redirector site (much like
> tinyurl.com); so what matters most is the payload at the end of the URL.

Which is a png.

> Without actually going to that URL, is there a way to find out *more data*
> about what this message is all about?

It is an image.

> For example, is there a trusted aggregator where we can *forward* such
> messages to?

No.


-- 
if you ever get that chimp off your back, if you ever find the thing
you lack, ah but you know you're only having a laugh. Oh, oh here we
go again -- until the end.

[toc] | [prev] | [next] | [standalone]

#34624

From	Snit <usenet@gallopinginsanity.com>
Date	2016-09-22 19:38 -0700
Message-ID	<D409E3CA.7E1AE%usenet@gallopinginsanity.com>
In reply to	#34619

On 9/22/16, 6:22 PM, in article ns2051$15hl$1@gioia.aioe.org, "Horace
Algiers" <horace@horacealgiers.com> wrote:

> Is there *anything* a user can do to check the URL without going to that
> URL?
> 
> Just received this text on my cell phone:
> http://i.cubeupload.com/k8CbNK.png
> 
> All I know is where it (says it) comes from:
> http://i.cubeupload.com/QD1o9F.png
> 
> Of course, I could just delete it (and will); but my question here is how
> can I find out *more information* about whether this is a phishing attempt
> of some sort.
> 
> Of course, the text itself has to be ignored - and I'm pretty sure the
> phone number itself can easily be spoofed (spoofcard, for example), so the
> only real hint of the purpose is at the end of the URL.
> 
> The domain of the URL appears to be a redirector site (much like
> tinyurl.com); so what matters most is the payload at the end of the URL.
> 
> Without actually going to that URL, is there a way to find out *more data*
> about what this message is all about?
> 
> For example, is there a trusted aggregator where we can *forward* such
> messages to?
> 
> Or is there a web site where we can paste in the URL to find out more data?
> 
> I googled the URL, but the result was "Your search - message
> http://bit.do/cBuHr 681-207-8069 - did not match any documents".
> 
> Is there *anything* a user can do to check the URL without going to that
> URL?

<http://bit.do/faq/#preview>
    -----
    How to preview shortened URLs?
    You can find out what is the destination address (expand a short
    link) and view to where the link will redirect without going to
    the final destination. Just add "/expand/" to the short link
    address. Example: http://bit.do/expand/shortlink
    -----
    
So in the case of yours go to http://bit.do/expand/cBuHr

That will tell you:
    -----
    Short link: http://bit.do/[REDACTED]
    Redirects to: http://www.rbusvv.com/
    -----
    
From there I went to: <http://whois.domaintools.com/rbusvv.com>

Gives you some info and a screen shot. There is also info on them online:

<http://www.scamadviser.com/is-rbusv.com-a-fake-site.html>
    -----
    Low Trust Rating. This Site May Not Be Safe to Use.
    -----

I think I would avoid it. :)


-- 
* OS X / Linux: What is a file?     <http://youtu.be/_dMbXGLW9PI>
* Mint MATE Trash, Panel, Menu:     <http://youtu.be/C0y74FIf7uE>
* Mint KDE working with folders:    <http://youtu.be/7C9nvniOoE0>
* Mint KDE creating files:          <http://youtu.be/N7-fZJaJUv8>
* Mint KDE help:                    <http://youtu.be/3ikizUd3sa8>
* Mint KDE general navigation:      <http://youtu.be/t9y14yZtQuI>
* Mint KDE bugs or Easter eggs?     <http://youtu.be/CU-whJQvtfA>
* Easy on OS X / Hard on Linux:     <http://youtu.be/D3BPWANQoIk>
* OS / Word Processor Comparison:   <http://youtu.be/w6Qcl-w7s5c>

[toc] | [prev] | [next] | [standalone]

#34625

From	Snit <usenet@gallopinginsanity.com>
Date	2016-09-22 19:58 -0700
Message-ID	<D409E87F.7E1BB%usenet@gallopinginsanity.com>
In reply to	#34624

On 9/22/16, 7:38 PM, in article D409E3CA.7E1AE%usenet@gallopinginsanity.com,
"Snit" <usenet@gallopinginsanity.com> wrote:

> On 9/22/16, 6:22 PM, in article ns2051$15hl$1@gioia.aioe.org, "Horace
> Algiers" <horace@horacealgiers.com> wrote:
> 
>> Is there *anything* a user can do to check the URL without going to that
>> URL?
>> 
>> Just received this text on my cell phone:
>> http://i.cubeupload.com/k8CbNK.png
>> 
>> All I know is where it (says it) comes from:
>> http://i.cubeupload.com/QD1o9F.png
>> 
>> Of course, I could just delete it (and will); but my question here is how
>> can I find out *more information* about whether this is a phishing attempt
>> of some sort.
>> 
>> Of course, the text itself has to be ignored - and I'm pretty sure the
>> phone number itself can easily be spoofed (spoofcard, for example), so the
>> only real hint of the purpose is at the end of the URL.
>> 
>> The domain of the URL appears to be a redirector site (much like
>> tinyurl.com); so what matters most is the payload at the end of the URL.
>> 
>> Without actually going to that URL, is there a way to find out *more data*
>> about what this message is all about?
>> 
>> For example, is there a trusted aggregator where we can *forward* such
>> messages to?
>> 
>> Or is there a web site where we can paste in the URL to find out more data?
>> 
>> I googled the URL, but the result was "Your search - message
>> http://bit.do/cBuHr 681-207-8069 - did not match any documents".
>> 
>> Is there *anything* a user can do to check the URL without going to that
>> URL?
> 
> <http://bit.do/faq/#preview>
>     -----
>     How to preview shortened URLs?
>     You can find out what is the destination address (expand a short
>     link) and view to where the link will redirect without going to
>     the final destination. Just add "/expand/" to the short link
>     address. Example: http://bit.do/expand/shortlink
>     -----
>     
> So in the case of yours go to http://bit.do/expand/cBuHr
> 
> That will tell you:
>     -----
>     Short link: http://bit.do/[REDACTED]
>     Redirects to: http://www.rbusvv.com/
>     -----

And I goofed. Do not click on the link right about this one. Redacted one
and then did not the other. Um, oops.

> From there I went to: <http://whois.domaintools.com/rbusvv.com>
> 
> Gives you some info and a screen shot. There is also info on them online:
> 
> <http://www.scamadviser.com/is-rbusv.com-a-fake-site.html>
>     -----
>     Low Trust Rating. This Site May Not Be Safe to Use.
>     -----
> 
> I think I would avoid it. :)
> 



-- 
* OS X / Linux: What is a file?     <http://youtu.be/_dMbXGLW9PI>
* Mint MATE Trash, Panel, Menu:     <http://youtu.be/C0y74FIf7uE>
* Mint KDE working with folders:    <http://youtu.be/7C9nvniOoE0>
* Mint KDE creating files:          <http://youtu.be/N7-fZJaJUv8>
* Mint KDE help:                    <http://youtu.be/3ikizUd3sa8>
* Mint KDE general navigation:      <http://youtu.be/t9y14yZtQuI>
* Mint KDE bugs or Easter eggs?     <http://youtu.be/CU-whJQvtfA>
* Easy on OS X / Hard on Linux:     <http://youtu.be/D3BPWANQoIk>
* OS / Word Processor Comparison:   <http://youtu.be/w6Qcl-w7s5c>

[toc] | [prev] | [next] | [standalone]

#34626

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 03:19 +0000
Message-ID	<ns270n$qk6$1@news.mixmin.net>
In reply to	#34624

On Thu, 22 Sep 2016 19:38:50 -0700, Snit wrote:

>     How to preview shortened URLs?
>     You can find out what is the destination address (expand a short
>     link) and view to where the link will redirect without going to
>     the final destination. Just add "/expand/" to the short link
>     address. Example: http://bit.do/expand/shortlink
>     -----
>     
> So in the case of yours go to http://bit.do/expand/cBuHr
> 
> That will tell you:
>     -----
>     Short link: http://bit.do/[REDACTED]
>     Redirects to: http://www.rbusvv.com/
>     -----
>     
> From there I went to: <http://whois.domaintools.com/rbusvv.com>
> 
> Gives you some info and a screen shot. There is also info on them online:
> 
> <http://www.scamadviser.com/is-rbusv.com-a-fake-site.html>
>     -----
>     Low Trust Rating. This Site May Not Be Safe to Use.
>     -----
> 
> I think I would avoid it. :)

Thank you for both *understanding* the question, and for being *helpful* in 
your response, especially since everyone can benefit from your advice.

I did not know about the *expand* option, so I just tried it on a tinyurl:
 http://tinyurl.com/alt-os-linux
 http://tinyurlcom/expand/alt-os-linux

Hmmm... it did not seem to work.
It reported nothing, when it should have reported:
https://groups.google.com/forum/#!forum/alt.os.linux

To test if the "expand" only works with "bit.do" URLs, I created this:
Short URL: http://bit.do/alt-os-linux	
Traffic stats: 	http://bit.do/alt-os-linux-
Which should point to that Google Groups URL for alt.os.linux.
http://i.cubeupload.com/loFJs7.jpg

Once created, I tried the *expand* option with bit.do to get:
http://bit.do/expand/alt-os-linux

Which did work by reporting:
  Short link: http://bit.do/alt-os-linux
  Redirects to: https://groups.google.com/forum/#!forum/alt.os.linux

So, thanks for the "expand" option for bit.do; now we need the same option 
for tinyurl.com.

Googling, I found this site: http://www.getlinkinfo.com/
And entering the tinyurl http://tinyurl.com/alt-os-linux, it reported a 
decent amount of good stuff about that shortened URL.

Looking at your whois link was interesting, but didn't show scamming:
http://whois.domaintools.com/rbusvv.com

But looking at your scam advisor site, there is a ton of conflicting info:
http://www.scamadviser.com/is-rbusv.com-a-fake-site.html

For example, the WHOIS implicates Las Vegas and CN but the *addresses* in 
China are oddly European:
 Admin Name: Helmut Kohl
 Admin Organization: Helmut Kohl
 Admin Street: 78 Messegel auml nde Neue Messe  
 Admin State/Province: Freistaat Bayern
 Admin Postal Code: 81477
 Admin Country: CN
 Admin Phone: +86.004908209145
 Admin Email: blucemall@gmail.com
So I suspect the *address* doesn't exist in China.

Conflictingly, the scam advisor web site tells us the site is in Turkey but 
most likely in China. 

Here is their analysis:
Website: rbusv.com
Title: Fashion Sunglasses Online Sales, Fashion Sunglasses Online Sales
Description: Fashion Sunglasses Online Sales

Domain Age: 0 Days
Website Speed: Average

Organisation: huiru li
Owner: huiru li
Owner Address: an yang shi zheng da dong lu 9985 hao
Owner City: anyangshi
Owner Postcode: 351100
Phone Number: +86.18403310655  [China]
Phone Type: generic:
Email: 2926033044@qq.com  [China] Related to 14 sites

Owner Country : China  [China]
Website Location  : Turkey  [Turkey]

Probable website origin :-
 80%;   [China]  China
 14%;   [United States]  United States
 6%;   [Turkey]  Turkey

Notes:-
[Alert Result] Registered contact email address is a free one
[Alert Result] Technical contact email address is a free one
[Alert Result] Administrative contact email address is a free one
[Alert Result] This registrar is used by a high % of spammers and fraud 
sites
[Alert Result] This website may be related to a number of high risk sites
[Alert Result] This website may be related to a number of high risk sites
[Alert Result] This website is 0 Days old
[Alert Result] The website expected life (364 days) is relatively short.
[Alert Result] This website setup involves countries known to be high risk
[Alert Result] This website is likely to be operating from a high risk 
country

Analysis Details:-

This site has a high risk country associated with it. This may be as you 
expect but care should be taken if purchasing an item from a site that you 
didn't expect to be associated with the countries listed above. Certain 
countries are listed as being high risk because of the high percentage of 
online fraud or tendency to send fake/replica items.

Free email addresses have been used in the setup of this website. This is 
not necesarily worrying, depending on the site. For online shops, this can 
be a sign that the site has some risk

[toc] | [prev] | [next] | [standalone]

#34627

From	JF Mezei <jfmezei.spamnot@vaxination.ca>
Date	2016-09-22 23:27 -0400
Message-ID	<57e4a122$0$17653$b1db1813$19ace300@news.astraweb.com>
In reply to	#34626

Note: the payload may end in .jpg or .png in the URL, but it does not
mean that the server will serve that. It could have Content-type:
application/octed-stream or somethint else and feed something that will
cause a buffer overflow.

More importantly, clicking on that URL sends the spammer plenty of
information about you because your mobile phone will send chockful of
info in the HTTP request.

These URLs are often specific to your telephone number so they can then
link your HTTP requyest to your phone number by using the request as a
key to their database.

[toc] | [prev] | [next] | [standalone]

#34631

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 03:47 +0000
Message-ID	<ns28jl$1eg5$1@gioia.aioe.org>
In reply to	#34627

On Thu, 22 Sep 2016 23:27:28 -0400, JF Mezei wrote:

> Note: the payload may end in .jpg or .png in the URL, but it does not
> mean that the server will serve that. It could have Content-type:
> application/octed-stream or somethint else and feed something that will
> cause a buffer overflow.

Just to be clear, the URL was *not* an image URL.
The "PNG" URL was merely the URL of the screenshot that I uploaded.

1. This is a screenshot I uploaded of the original message:
   http://i.cubeupload.com/k8CbNK.png

2. This is a screenshot when I clicked for more details:
   http://i.cubeupload.com/QD1o9F.png

3. And this is a screenshot of what T-Mobile said about it:
   http://i.cubeupload.com/tkSPkz.jpg

There should be no danger in viewing those screenshots.

> More importantly, clicking on that URL sends the spammer plenty of
> information about you because your mobile phone will send chockful of
> info in the HTTP request.
> 
> These URLs are often specific to your telephone number so they can then
> link your HTTP requyest to your phone number by using the request as a
> key to their database.

This is a good point in that nobody should click on the actual URL.
And that the actual URL may be specific to my particular phone number.
In which case, it gives the sender precise information about my phone.
(Although you may note I'm *always* on TOR and VPN concurrently on my phone
- so while the phone number is correct, the IP address will always be
incorrect.)

If others want to run TOR/VPN 100% of the time on the phone, it's easy. 
Just install "Orbot" 
https://play.google.com/store/apps/details?id=org.torproject.android

Note that Orbot has superceded Orfox:
https://play.google.com/store/apps/details?id=info.guardianproject.orfox

What Orfox gives you is TOR-on-Firefox (similar to the tor-browser-bundle
on computers); but what Orbot gives you is that, plus VPN (which is
basically Tor on everything).

[toc] | [prev] | [next] | [standalone]

#34630

From	Snit <usenet@gallopinginsanity.com>
Date	2016-09-22 20:46 -0700
Message-ID	<D409F3C2.7E1CA%usenet@gallopinginsanity.com>
In reply to	#34626

On 9/22/16, 8:19 PM, in article ns270n$qk6$1@news.mixmin.net, "Horace
Algiers" <horace@horacealgiers.com> wrote:

> On Thu, 22 Sep 2016 19:38:50 -0700, Snit wrote:
> 
>>     How to preview shortened URLs?
>>     You can find out what is the destination address (expand a short
>>     link) and view to where the link will redirect without going to
>>     the final destination. Just add "/expand/" to the short link
>>     address. Example: http://bit.do/expand/shortlink
>>     -----
>>     
>> So in the case of yours go to http://bit.do/expand/cBuHr
>> 
>> That will tell you:
>>     -----
>>     Short link: http://bit.do/[REDACTED]
>>     Redirects to: http://www.[redacted].com/
>>     -----
>>     
>> From there I went to: <http://whois.domaintools.com/rbusvv.com>
>> 
>> Gives you some info and a screen shot. There is also info on them online:
>> 
>> <http://www.scamadviser.com/is-rbusv.com-a-fake-site.html>
>>     -----
>>     Low Trust Rating. This Site May Not Be Safe to Use.
>>     -----
>> 
>> I think I would avoid it. :)
> 
> Thank you for both *understanding* the question, and for being *helpful* in
> your response, especially since everyone can benefit from your advice.

Most URL shortners have this ability. Not all though.

> I did not know about the *expand* option, so I just tried it on a tinyurl:
>  http://tinyurl.com/alt-os-linux
>  http://tinyurlcom/expand/alt-os-linux
> 
> Hmmm... it did not seem to work.
> It reported nothing, when it should have reported:
> https://groups.google.com/forum/#!forum/alt.os.linux

You can enable previews for ALL tinyurl links:

<http://tinyurl.com/preview.php>
    -----
    Don't want to be instantly redirected to a TinyURL and instead
    want to see where it's going before going to the site? Not a
    problem with our preview feature.
    -----

But as I looked for that I found this:

<http://www.getlinkinfo.com>

Works great... I will have to remember that. And below I see you found it,
too.

> To test if the "expand" only works with "bit.do" URLs, I created this:
> Short URL: http://bit.do/alt-os-linux 
> Traffic stats:  http://bit.do/alt-os-linux-
> Which should point to that Google Groups URL for alt.os.linux.
> http://i.cubeupload.com/loFJs7.jpg
> 
> Once created, I tried the *expand* option with bit.do to get:
> http://bit.do/expand/alt-os-linux
> 
> Which did work by reporting:
>   Short link: http://bit.do/alt-os-linux
>   Redirects to: https://groups.google.com/forum/#!forum/alt.os.linux
> 
> So, thanks for the "expand" option for bit.do; now we need the same option
> for tinyurl.com.

They have one as well.

> Googling, I found this site: http://www.getlinkinfo.com/
> And entering the tinyurl http://tinyurl.com/alt-os-linux, it reported a
> decent amount of good stuff about that shortened URL.
> 
> Looking at your whois link was interesting, but didn't show scamming:
> http://whois.domaintools.com/rbusvv.com
> 
> But looking at your scam advisor site, there is a ton of conflicting info:
> http://www.scamadviser.com/is-rbusv.com-a-fake-site.html
> 
> For example, the WHOIS implicates Las Vegas and CN but the *addresses* in
> China are oddly European:
>  Admin Name: Helmut Kohl
>  Admin Organization: Helmut Kohl
>  Admin Street: 78 Messegel auml nde Neue Messe
>  Admin State/Province: Freistaat Bayern
>  Admin Postal Code: 81477
>  Admin Country: CN
>  Admin Phone: +86.004908209145
>  Admin Email: blucemall@gmail.com
> So I suspect the *address* doesn't exist in China.
> 
> Conflictingly, the scam advisor web site tells us the site is in Turkey but
> most likely in China.
> 
> Here is their analysis:
> Website: rbusv.com
> Title: Fashion Sunglasses Online Sales, Fashion Sunglasses Online Sales
> Description: Fashion Sunglasses Online Sales
> 
> Domain Age: 0 Days
> Website Speed: Average
> 
> Organisation: huiru li
> Owner: huiru li
> Owner Address: an yang shi zheng da dong lu 9985 hao
> Owner City: anyangshi
> Owner Postcode: 351100
> Phone Number: +86.18403310655  [China]
> Phone Type: generic:
> Email: 2926033044@qq.com  [China] Related to 14 sites
> 
> Owner Country : China  [China]
> Website Location  : Turkey  [Turkey]
> 
> Probable website origin :-
>  80%;   [China]  China
>  14%;   [United States]  United States
>  6%;   [Turkey]  Turkey
> 
> Notes:-
> [Alert Result] Registered contact email address is a free one
> [Alert Result] Technical contact email address is a free one
> [Alert Result] Administrative contact email address is a free one
> [Alert Result] This registrar is used by a high % of spammers and fraud
> sites
> [Alert Result] This website may be related to a number of high risk sites
> [Alert Result] This website may be related to a number of high risk sites
> [Alert Result] This website is 0 Days old
> [Alert Result] The website expected life (364 days) is relatively short.
> [Alert Result] This website setup involves countries known to be high risk
> [Alert Result] This website is likely to be operating from a high risk
> country
> 
> Analysis Details:-
> 
> This site has a high risk country associated with it. This may be as you
> expect but care should be taken if purchasing an item from a site that you
> didn't expect to be associated with the countries listed above. Certain
> countries are listed as being high risk because of the high percentage of
> online fraud or tendency to send fake/replica items.
> 
> Free email addresses have been used in the setup of this website. This is
> not necesarily worrying, depending on the site. For online shops, this can
> be a sign that the site has some risk
> 
> 



-- 
* OS X / Linux: What is a file?     <http://youtu.be/_dMbXGLW9PI>
* Mint MATE Trash, Panel, Menu:     <http://youtu.be/C0y74FIf7uE>
* Mint KDE working with folders:    <http://youtu.be/7C9nvniOoE0>
* Mint KDE creating files:          <http://youtu.be/N7-fZJaJUv8>
* Mint KDE help:                    <http://youtu.be/3ikizUd3sa8>
* Mint KDE general navigation:      <http://youtu.be/t9y14yZtQuI>
* Mint KDE bugs or Easter eggs?     <http://youtu.be/CU-whJQvtfA>
* Easy on OS X / Hard on Linux:     <http://youtu.be/D3BPWANQoIk>
* OS / Word Processor Comparison:   <http://youtu.be/w6Qcl-w7s5c>

[toc] | [prev] | [next] | [standalone]

#34632

From	Eef Hartman <E.J.M.Hartman@gmail.com>
Date	2016-09-23 04:05 +0000
Message-ID	<57e4a9f9$0$871$e4fe514c@news.xs4all.nl>
In reply to	#34626

In alt.os.linux Horace Algiers <horace@horacealgiers.com> wrote:
> China are oddly European:
> Admin Name: Helmut Kohl
> Admin Organization: Helmut Kohl
> Admin Street: 78 Messegel auml nde Neue Messe  
> Admin State/Province: Freistaat Bayern

Helmut Kohl is the ex-BundesKansler (Prime Minister) of Germany,
the one that accomplished the re-unification of both Germanies.
He's 86 now and retired, so this info is most certainly fake.

[toc] | [prev] | [next] | [standalone]

#34646

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 11:45 +0000
Message-ID	<ns34lj$qlf$1@gioia.aioe.org>
In reply to	#34632

On 23 Sep 2016 04:05:13 GMT, Eef Hartman wrote:

> Helmut Kohl is the ex-BundesKansler (Prime Minister) of Germany,
> the one that accomplished the re-unification of both Germanies.
> He's 86 now and retired, so this info is most certainly fake.

Just curious, did he live at "78 Messegel auml nde Neue Messe", in  
"Freistaat Bayern", or is that also a wholly made-up address?

[toc] | [prev] | [next] | [standalone]

#34653

From	Eef Hartman <E.J.M.Hartman@gmail.com>
Date	2016-09-23 13:11 +0000
Message-ID	<57e52a10$0$15994$e4fe514c@news.xs4all.nl>
In reply to	#34646

In alt.os.linux Horace Algiers <horace@horacealgiers.com> wrote:
> Just curious, did he live at "78 Messegel auml nde Neue Messe", in  
> "Freistaat Bayern", or is that also a wholly made-up address?

I don't know his current address, no, but "Freistaat Bayern" is the
old name for the federal state of Bavaria (in the south-east of
Germany) and I don't believe that's where he's currently living.

[toc] | [prev] | [next] | [standalone]

#34658

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 16:08 +0000
Message-ID	<ns3k16$1n3c$2@gioia.aioe.org>
In reply to	#34653

On 23 Sep 2016 13:11:44 GMT, Eef Hartman wrote:

> I don't know his current address, no, but "Freistaat Bayern" is the
> old name for the federal state of Bavaria (in the south-east of
> Germany) and I don't believe that's where he's currently living.

Thanks. The *entire* set of registered information appeared, from the
start, to be bogus, which is just one sign of "something" being fishy.

Still, it would be nice if we could forward the SMishing texts in a timely
manner to a security researcher who knew what to do with them to track down
the specific payload.

[toc] | [prev] | [next] | [standalone]

#34707

From	tlvp <mPiOsUcB.EtLlLvEp@att.net>
Date	2016-09-24 01:35 -0400
Message-ID	<16biuct5x3snd$.1bgemgutc2v1u$.dlg@40tude.net>
In reply to	#34646

On Fri, 23 Sep 2016 11:45:59 +0000 (UTC), Horace Algiers wrote:

> On 23 Sep 2016 04:05:13 GMT, Eef Hartman wrote:
> 
>> Helmut Kohl ... 
> 
> Just curious, did he live at "78 Messegel auml nde Neue Messe" ... ?

No idea. But "Messegel auml nde" is almost certainly a typographically
garbled form of "78 Messegelände" (the "auml" being the HTML entity-name
for the character " ä "). HTH. Cheers, -- tlvp
-- 
Avant de repondre, jeter la poubelle, SVP.

[toc] | [prev] | [next] | [standalone]

#34723

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-24 15:34 +0000
Message-ID	<ns66e1$1ann$1@gioia.aioe.org>
In reply to	#34707

On Sat, 24 Sep 2016 01:35:03 -0400, tlvp wrote:

> No idea. But "Messegel auml nde" is almost certainly a typographically
> garbled form of "78 Messegelände" (the "auml" being the HTML entity-name
> for the character " ä "). HTH. Cheers, -- tlvp

Thanks. I think we've mostly agreed that the SMS was up to no good, and
that there are places to forward such SMS texts, and that there are places
which will unravel and reveal the URL without compromising our security.

Thanks.

[toc] | [prev] | [next] | [standalone]

#34751

From	tlvp <mPiOsUcB.EtLlLvEp@att.net>
Date	2016-09-24 18:19 -0400
Message-ID	<148ibyxvclt9$.af4bxg9674ow$.dlg@40tude.net>
In reply to	#34723

On Sat, 24 Sep 2016 15:34:25 +0000 (UTC), Horace Algiers wrote:

> On Sat, 24 Sep 2016 01:35:03 -0400, tlvp wrote:
> 
>> No idea. But "Messegel auml nde" is almost certainly a typographically
>> garbled form of "78 Messegel㭤e" (the "auml" being the HTML entity-name
>> for the character " ➢). HTH. Cheers, -- tlvp
> 
> Thanks. I think we've mostly agreed that the SMS was up to no good, and
> that there are places to forward such SMS texts, and that there are places
> which will unravel and reveal the URL without compromising our security.
> 
> Thanks.

Oops ... you don't do Unicode very well, do you :-) ? Cheers, -- tlvp
-- 
Avant de repondre, jeter la poubelle, SVP.

[toc] | [prev] | [next] | [standalone]

#34636

From	tlvp <mPiOsUcB.EtLlLvEp@att.net>
Date	2016-09-23 00:42 -0400
Message-ID	<1exxvxx0v4py2$.1vaegndrzrt6a$.dlg@40tude.net>
In reply to	#34626

On Fri, 23 Sep 2016 03:19:51 -0000 (UTC), Horace Algiers wrote:

> ...
> But looking at your scam advisor site, there is a ton of conflicting info:
> http://www.scamadviser.com/is-rbusv.com-a-fake-site.html
> 
> For example, the WHOIS implicates Las Vegas and CN but the *addresses* in 
> China are oddly European:
>  Admin Name: Helmut Kohl
>  Admin Organization: Helmut Kohl

You *do* know who Helmut Kohl is/was, don't you? (Forerunner to Angela
Merkel.) Dead giveaway this site is *not* on the up-and-up! Cheers, -- tlvp
-- 
Avant de repondre, jeter la poubelle, SVP.

[toc] | [prev] | [next] | [standalone]

Page 1 of 2 [1] 2 Next page →

csiph-web

How to check validity of suspicious looking SMS message text URL?

Contents

#34619 — How to check validity of suspicious looking SMS message text URL?

#34620

#34621

#34628

#34622

#34623

#34624

#34625

#34626

#34627

#34631

#34630

#34632

#34646

#34653

#34658

#34707

#34723

#34751

#34636