Groups > comp.mobile.android > #34619 > unrolled thread

How to check validity of suspicious looking SMS message text URL?

Started by	Horace Algiers <horace@horacealgiers.com>
First post	2016-09-23 01:22 +0000
Last post	2016-09-23 17:03 +0000
Articles	18 on this page of 38 — 14 participants

Back to article view | Back to comp.mobile.android

Page 2 of 2 — ← Prev page 1 [2]

#34645

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 11:44 +0000
Message-ID	<ns34iu$qh1$1@gioia.aioe.org>
In reply to	#34636

On Fri, 23 Sep 2016 00:42:21 -0400, tlvp wrote:

> You *do* know who Helmut Kohl is/was, don't you? (Forerunner to Angela
> Merkel.) Dead giveaway this site is *not* on the up-and-up!

There can be *many* Helmut Kohl's just as there are plenty of David
Thompsons, but you are probably correct since everything *else* about that
site was suspect already.

It's not obvious *what* the payload was, but from the URLs kindly provided,
it's obviously something that we should be suspicious of.

The main point though, was *where* to forward these payloads since the
exploits may time out in less than an hour - so we need to have the
forwarding addresses set up *ahead of time*.

Given that companies buy & sell iPhone zero-day exploits openly on the
market (e.g., Zerodium), the most recent set of three Apple zero-day
exploit SMS-link-sent attempts, for example, named "Trident", timed out
after only 1/2 hour, so, one would have to forward the SMishing message to
the "correct" authorities, within that time frame.
https://citizenlab.org/wp-content/uploads/2016/08/image16.png

Others exploits against that same phone expired after the first click, so
that security researchers themselves, had to be the first click - which is,
again, a reason to know, ahead of time, whom to send the links to, as
Mansoor did in the case of the three concurrent iOS zero-day exploits.

In that case, the person who received the message on his stock iPhone 6
running iOS 9.3.3., Mansoor, was prepared and sent it to a security
researcher at "Citizen Lab", who figured out the payload before it expired.
https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/

That payload, which included *3* zero-day exploits, would have allowed the
attackers to remotely "jailbreak Mansoor's iPhone 6 and install spyware to
track his movements, record his WhatsApp and Viber calls, log his messages
and access his microphone and camera."
https://citizenlab.org/wp-content/uploads/2016/08/image10.png

Luckily, within a short period (less than two weeks), Apple patched the
three zero-day exploits in iOS 9.3.5, but many as-yet-unknown zero-day
exploits undoubtably exist in all operating systems.

1. CVE-2016-4657: Visiting a maliciously crafted website may lead to
arbitrary code execution
2. CVE-2016-4655: An application may be able to disclose kernel memory
3. CVE-2016-4656: An application may be able to execute arbitrary code with
kernel privileges

[toc] | [prev] | [next] | [standalone]

#34638

From	Andreas Rutishauser <andreas@macandreas.ch>
Date	2016-09-23 06:56 +0200
Message-ID	<andreas-A1863B.06565223092016@news.individual.de>
In reply to	#34626

In article <ns270n$qk6$1@news.mixmin.net>,
 Horace Algiers <horace@horacealgiers.com> wrote:

> On Thu, 22 Sep 2016 19:38:50 -0700, Snit wrote:
> 
> >     How to preview shortened URLs?
> >     You can find out what is the destination address (expand a short
> >     link) and view to where the link will redirect without going to
> >     the final destination. Just add "/expand/" to the short link
> >     address. Example: http://bit.do/expand/shortlink
> >     -----
> >     
> > So in the case of yours go to http://bit.do/expand/cBuHr
> > 
> > That will tell you:
> >     -----
> >     Short link: http://bit.do/[REDACTED]
> >     Redirects to: http://www.rbusvv.com/
> >     -----
> >     
> > From there I went to: <http://whois.domaintools.com/rbusvv.com>
> > 
> > Gives you some info and a screen shot. There is also info on them online:
> > 
> > <http://www.scamadviser.com/is-rbusv.com-a-fake-site.html>
> >     -----
> >     Low Trust Rating. This Site May Not Be Safe to Use.
> >     -----
> > 
> > I think I would avoid it. :)
> 

> But looking at your scam advisor site, there is a ton of conflicting info:
> http://www.scamadviser.com/is-rbusv.com-a-fake-site.html

> Here is their analysis:
> Website: rbusv.com

there is a difference between rbusv and rbusvv ...

<http://www.scamadviser.com/check-website/rbusvv.com>

-- 
MacAndreas Rutishauser, <http://www.MacAndreas.ch> 
EDV-Dienstleistungen, Hard- und Software, Internet und Netzwerk
Beratung, Unterstuetzung und Schulung
<mailto:andreas@MacAndreas.ch>, Fon: 044 / 721 36 47

[toc] | [prev] | [next] | [standalone]

#34639

From	Snit <usenet@gallopinginsanity.com>
Date	2016-09-22 22:38 -0700
Message-ID	<D40A0DEF.7E1DB%usenet@gallopinginsanity.com>
In reply to	#34638

On 9/22/16, 9:56 PM, in article
andreas-A1863B.06565223092016@news.individual.de, "Andreas Rutishauser"
<andreas@macandreas.ch> wrote:

> In article <ns270n$qk6$1@news.mixmin.net>,
>  Horace Algiers <horace@horacealgiers.com> wrote:
> 
>> On Thu, 22 Sep 2016 19:38:50 -0700, Snit wrote:
>> 
>>>     How to preview shortened URLs?
>>>     You can find out what is the destination address (expand a short
>>>     link) and view to where the link will redirect without going to
>>>     the final destination. Just add "/expand/" to the short link
>>>     address. Example: http://bit.do/expand/shortlink
>>>     -----
>>>     
>>> So in the case of yours go to http://bit.do/expand/cBuHr
>>> 
>>> That will tell you:
>>>     -----
>>>     Short link: http://bit.do/[REDACTED]
>>>     Redirects to: http://www.rbusvv.com/
>>>     -----
>>>     
>>> From there I went to: <http://whois.domaintools.com/rbusvv.com>
>>> 
>>> Gives you some info and a screen shot. There is also info on them online:
>>> 
>>> <http://www.scamadviser.com/is-rbusv.com-a-fake-site.html>
>>>     -----
>>>     Low Trust Rating. This Site May Not Be Safe to Use.
>>>     -----
>>> 
>>> I think I would avoid it. :)
>> 
> 
>> But looking at your scam advisor site, there is a ton of conflicting info:
>> http://www.scamadviser.com/is-rbusv.com-a-fake-site.html
> 
>> Here is their analysis:
>> Website: rbusv.com
> 
> there is a difference between rbusv and rbusvv ...
> 
> <http://www.scamadviser.com/check-website/rbusvv.com>

Ah, thanks.... and sorry for the error.


-- 
* OS X / Linux: What is a file?     <http://youtu.be/_dMbXGLW9PI>
* Mint MATE Trash, Panel, Menu:     <http://youtu.be/C0y74FIf7uE>
* Mint KDE working with folders:    <http://youtu.be/7C9nvniOoE0>
* Mint KDE creating files:          <http://youtu.be/N7-fZJaJUv8>
* Mint KDE help:                    <http://youtu.be/3ikizUd3sa8>
* Mint KDE general navigation:      <http://youtu.be/t9y14yZtQuI>
* Mint KDE bugs or Easter eggs?     <http://youtu.be/CU-whJQvtfA>
* Easy on OS X / Hard on Linux:     <http://youtu.be/D3BPWANQoIk>
* OS / Word Processor Comparison:   <http://youtu.be/w6Qcl-w7s5c>

[toc] | [prev] | [next] | [standalone]

#34649

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 12:34 +0000
Message-ID	<ns37fr$1018$6@gioia.aioe.org>
In reply to	#34639

On Thu, 22 Sep 2016 22:38:39 -0700, Snit wrote:

>> there is a difference between rbusv and rbusvv ...
>> 
>> <http://www.scamadviser.com/check-website/rbusvv.com>
> 
> Ah, thanks.... and sorry for the error.

Looks like *both* sites are of suspicious nature (which is to be expected).

Unfortunately, we still don't know whom to *forward* the SMishing messages
to, so that they're looked at by security researchers before they are
clicked on once, or before they time out in 30 minutes...

http://www.scamadviser.com/check-website/rbusv.com
Website: rbusv.com
Title: Fashion Sunglasses Online Sales, Fashion Sunglasses Online Sales
Description: Fashion Sunglasses Online Sales
Domain Age: 0 Days
Website Speed: Average
Organisation: huiru li
Owner: huiru li
Owner Address: an yang shi zheng da dong lu 9985 hao
Owner City: anyangshi
Owner Postcode: 351100
Phone Number: +86.18403310655  [China]
Phone Type: generic:
Email: 2926033044@qq.com  [China] Related to 14 sites
Owner Country : China  [China]
Website Location  : Turkey  [Turkey] 

http://www.scamadviser.com/check-website/rbusvv.com
Website: rbusvv.com
Title: 2016 Ray Ban Sunglasses Online Store
Description: Shop Ray-Ban cool sunglasses for men, women and kids from the
most popular fashion brands
Type: fashion,kids,sunglasses,sunglasses,Women
Domain Age: 22 Days
Website Speed: Average
Organisation: Helmut Kohl
Owner: Helmut Kohl
Owner Address: 78 Messegel auml nde Neue Messe
Owner City: M
Owner Postcode: 81477
Phone Number: +86.004908209145  [China]
Phone Type: generic:
Email: blucemall@gmail.com  [United States] Related to 53 sites
Owner Country : China  [China]
Website Location  : United States  [United States]

[toc] | [prev] | [next] | [standalone]

#34666

From	Snit <usenet@gallopinginsanity.com>
Date	2016-09-23 10:05 -0700
Message-ID	<D40AAF01.7E2DC%usenet@gallopinginsanity.com>
In reply to	#34649

On 9/23/16, 5:34 AM, in article ns37fr$1018$6@gioia.aioe.org, "Horace
Algiers" <horace@horacealgiers.com> wrote:

> On Thu, 22 Sep 2016 22:38:39 -0700, Snit wrote:
> 
>>> there is a difference between rbusv and rbusvv ...
>>> 
>>> <http://www.scamadviser.com/check-website/rbusvv.com>
>> 
>> Ah, thanks.... and sorry for the error.
> 
> Looks like *both* sites are of suspicious nature (which is to be expected).
> 
> Unfortunately, we still don't know whom to *forward* the SMishing messages
> to, so that they're looked at by security researchers before they are
> clicked on once, or before they time out in 30 minutes...
> 
> http://www.scamadviser.com/check-website/rbusv.com
> Website: rbusv.com
> Title: Fashion Sunglasses Online Sales, Fashion Sunglasses Online Sales
> Description: Fashion Sunglasses Online Sales
> Domain Age: 0 Days
> Website Speed: Average
> Organisation: huiru li
> Owner: huiru li
> Owner Address: an yang shi zheng da dong lu 9985 hao
> Owner City: anyangshi
> Owner Postcode: 351100
> Phone Number: +86.18403310655  [China]
> Phone Type: generic:
> Email: 2926033044@qq.com  [China] Related to 14 sites
> Owner Country : China  [China]
> Website Location  : Turkey  [Turkey]
> 
> http://www.scamadviser.com/check-website/rbusvv.com
> Website: rbusvv.com
> Title: 2016 Ray Ban Sunglasses Online Store
> Description: Shop Ray-Ban cool sunglasses for men, women and kids from the
> most popular fashion brands
> Type: fashion,kids,sunglasses,sunglasses,Women
> Domain Age: 22 Days
> Website Speed: Average
> Organisation: Helmut Kohl
> Owner: Helmut Kohl
> Owner Address: 78 Messegel auml nde Neue Messe
> Owner City: M
> Owner Postcode: 81477
> Phone Number: +86.004908209145  [China]
> Phone Type: generic:
> Email: blucemall@gmail.com  [United States] Related to 53 sites
> Owner Country : China  [China]
> Website Location  : United States  [United States]

I will be honest... I tend to just click what I want and then be careful
when I get there... but, yeah, seems there is a better way for me to deal
with it. :)


-- 
* OS X / Linux: What is a file?     <http://youtu.be/_dMbXGLW9PI>
* Mint MATE Trash, Panel, Menu:     <http://youtu.be/C0y74FIf7uE>
* Mint KDE working with folders:    <http://youtu.be/7C9nvniOoE0>
* Mint KDE creating files:          <http://youtu.be/N7-fZJaJUv8>
* Mint KDE help:                    <http://youtu.be/3ikizUd3sa8>
* Mint KDE general navigation:      <http://youtu.be/t9y14yZtQuI>
* Mint KDE bugs or Easter eggs?     <http://youtu.be/CU-whJQvtfA>
* Easy on OS X / Hard on Linux:     <http://youtu.be/D3BPWANQoIk>
* OS / Word Processor Comparison:   <http://youtu.be/w6Qcl-w7s5c>

[toc] | [prev] | [next] | [standalone]

#34629

From	"Rod Speed" <rod.speed.aaa@gmail.com>
Date	2016-09-23 13:32 +1000
Message-ID	<e4jmc8Feh64U1@mid.individual.net>
In reply to	#34619

Horace Algiers <horace@horacealgiers.com> wrote 

> Is there *anything* a user can do to check 
> the URL without going to that URL?

You can obviously see if anyone else 
has reported that url using google etc. 

And you can obviously use a completely secure 
system like a linux live cd to go to the url too. 
 
> Just received this text on my cell phone:
> http://i.cubeupload.com/k8CbNK.png
 
> All I know is where it (says it) comes from:
> http://i.cubeupload.com/QD1o9F.png

> Of course, I could just delete it (and will); but my 
> question here is how can I find out *more information* 
> about whether this is a phishing attempt of some sort.
 
> Of course, the text itself has to be ignored - and I'm pretty sure the
> phone number itself can easily be spoofed (spoofcard, for example), 
> so the only real hint of the purpose is at the end of the URL.
 
> The domain of the URL appears to be a redirector site (much like
> tinyurl.com); so what matters most is the payload at the end of the URL.

> Without actually going to that URL, is there a way to find 
> out *more data* about what this message is all about?
 
> For example, is there a trusted aggregator 
> where we can *forward* such messages to?

Likely. 
 
> Or is there a web site where we can paste 
> in the URL to find out more data?

> I googled the URL, but the result was "Your search - message
> http://bit.do/cBuHr 681-207-8069 - did not match any documents".

You should obviously be trying just the bit.do part, stupid. 
 
> Is there *anything* a user can do to check 
> the URL without going to that URL?

Why do you ask the same question 3 fucking times ?

[toc] | [prev] | [next] | [standalone]

#34637

From	tlvp <mPiOsUcB.EtLlLvEp@att.net>
Date	2016-09-23 00:48 -0400
Message-ID	<1krw0pt9qjr6d.si19e8vwtopj$.dlg@40tude.net>
In reply to	#34629

On Fri, 23 Sep 2016 13:32:35 +1000, Rod Speed inquired:

> Why do you ask the same question 3 fucking times ?

Trying to improve the signal-to-noise ratio, I guess :-) . Cheers, -- tlvp
-- 
Avant de repondre, jeter la poubelle, SVP.

[toc] | [prev] | [next] | [standalone]

#34635

From	tlvp <mPiOsUcB.EtLlLvEp@att.net>
Date	2016-09-23 00:34 -0400
Message-ID	<v7fkkfls5t2t$.1xxx5ix6qahs7$.dlg@40tude.net>
In reply to	#34619

On Fri, 23 Sep 2016 01:22:42 +0000 (UTC), Horace Algiers wrote:

> Is there *anything* a user can do to check the URL without going to that
> URL?

Submit the URL to virustotal.com -- they'll analyze it, and let you know. 

While you wait :-) . HTH.  Cheers, -- tlvp
-- 
Avant de repondre, jeter la poubelle, SVP.

[toc] | [prev] | [next] | [standalone]

#34651

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 12:42 +0000
Message-ID	<ns37ud$po9$1@news.mixmin.net>
In reply to	#34635

On Fri, 23 Sep 2016 00:34:29 -0400, tlvp wrote:

> Submit the URL to virustotal.com -- they'll analyze it, and let you know.

Thank you tlvp for that *helpful* response!
http://virustotal.com

As we know from the latest series of four iOS zero-day exploits (three of 
which were concurrent), the URL must be submitted within a short time frame 
(as little as one half hour) of receipt, and, before it's ever clicked 
upon.

Therefore, this virustotal.com URL has to be saved, ahead of time, to be of 
any use, which I have done in an executable text-file shortcut on my 
desktop (which is trivial to create on Android).

Most of the score of site tests showed up clean when I pasted the URL just 
now into XXX but these two came up as "malicious":
AutoShun Malicious site
Dr.Web 	Malicious site

Web site category
Dr.Web
known infection source
Websense ThreatSeeker
information technology
Final URL after redirects
http://www.rbusvv.com/
IP address resolution
54.83.52.76

[toc] | [prev] | [next] | [standalone]

#34642

From	Arno Welzel <usenet@arnowelzel.de>
Date	2016-09-23 08:26 +0200
Message-ID	<506c1de1-556a-dd83-775d-9623254cf67c@arnowelzel.de>
In reply to	#34619

Horace Algiers schrieb am 2016-09-23 um 03:22:

> Is there *anything* a user can do to check the URL without going to that
> URL?
> 
> Just received this text on my cell phone:
> http://i.cubeupload.com/k8CbNK.png
> 
> All I know is where it (says it) comes from:
> http://i.cubeupload.com/QD1o9F.png

The number from which the message comes, can be faked.

> Of course, I could just delete it (and will); but my question here is how
> can I find out *more information* about whether this is a phishing attempt
> of some sort.

You can't.

> Is there *anything* a user can do to check the URL without going to that
> URL?

No.


-- 
Arno Welzel
https://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#34648

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 12:33 +0000
Message-ID	<ns37eg$1018$3@gioia.aioe.org>
In reply to	#34642

On Fri, 23 Sep 2016 08:26:51 +0200, Arno Welzel wrote:

>> All I know is where it (says it) comes from:
>> http://i.cubeupload.com/QD1o9F.png
> 
> The number from which the message comes, can be faked.

Yes, I know. I've used those faked numbers myself.

One example is Spoofcard:
https://www.spoofcard.com/

Another example of a different way to fake it is, especially while on VPN:
Sideline – 2nd Phone Number by Pinger, Inc. 
https://play.google.com/store/apps/details?id=com.sideline.phone.number

Both are trivial to use by *anyone*, but I'm sure the SMishers have
*better* ways to hide the caller's real location than these two obvious and
free methods which I've personally tested out myself.

NOTE: SPoofcard offered a free test - I didn't check if they still offer
that, but I have done it in the past, and it *does* work - and is perfectly
legal in the USA (as long as the call purpose itself, isn't illegal).

[toc] | [prev] | [next] | [standalone]

#34667

From	JF Mezei <jfmezei.spamnot@vaxination.ca>
Date	2016-09-23 14:39 -0400
Message-ID	<57e576c7$0$1536$c3e8da3$12bcf670@news.astraweb.com>
In reply to	#34648

BTW, if the URL in the suspicious SMS is from a known link shornener
company:

from command line:

curl -I <url>

This gives you just the headers which should have a 300 code and a
Location: header and you can then do whois etc on the actual location's
domain.

Up to this point, you have sent 0 info to the spammers since your only
transaction was to the URL shortening service.

[toc] | [prev] | [next] | [standalone]

#34643

From	Whiskers <catwheezel@operamail.com>
Date	2016-09-23 10:07 +0100
Message-ID	<slrnnu9s5v.4vg.catwheezel@ID-107770.user.individual.net>
In reply to	#34619

On 2016-09-23, Horace Algiers <horace@horacealgiers.com> wrote:
> Is there *anything* a user can do to check the URL without going to that
> URL?
>
> Just received this text on my cell phone:
> http://i.cubeupload.com/k8CbNK.png
>
> All I know is where it (says it) comes from:
> http://i.cubeupload.com/QD1o9F.png
>
> Of course, I could just delete it (and will); but my question here is how
> can I find out *more information* about whether this is a phishing attempt
> of some sort.
>
> Of course, the text itself has to be ignored - and I'm pretty sure the
> phone number itself can easily be spoofed (spoofcard, for example), so the
> only real hint of the purpose is at the end of the URL.
>
> The domain of the URL appears to be a redirector site (much like
> tinyurl.com); so what matters most is the payload at the end of the URL.
>
> Without actually going to that URL, is there a way to find out *more data*
> about what this message is all about?
>
> For example, is there a trusted aggregator where we can *forward* such
> messages to?
>
> Or is there a web site where we can paste in the URL to find out more data?
>
> I googled the URL, but the result was "Your search - message
> http://bit.do/cBuHr 681-207-8069 - did not match any documents".
>
> Is there *anything* a user can do to check the URL without going to that
> URL?

There are services that expand shortened URLs.  <http://expandurl.net/>
and <http://urlex.org/> and <http://checkshorturl.com/> for example.

But that doesn't tell you what the actual site will try to do to you, so
if in doubt don't go there.

-- 
-- ^^^^^^^^^^
--  Whiskers 
-- ~~~~~~~~~~

[toc] | [prev] | [next] | [standalone]

#34647

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 12:33 +0000
Message-ID	<ns37e1$1018$2@gioia.aioe.org>
In reply to	#34643

On Fri, 23 Sep 2016 10:07:10 +0100, Whiskers wrote:

> There are services that expand shortened URLs.  <http://expandurl.net/>
> and <http://urlex.org/> and <http://checkshorturl.com/> for example.
> 
> But that doesn't tell you what the actual site will try to do to you, so
> if in doubt don't go there.

Thanks for providing those URLs which I have placed in a clickable text
file symbolic link on my desktop in my "communications" folder. 

The goal is to be *prepared* for the *next* similarly suspicious text,
which I get, perhaps once a month or so (sometimes a few times a week).

Normally I simply *delete* these texts, but I happened to have been on the
computer at the time I received that, so I figured I would just upload the
screenshot by bluetooth and post it while I was online.

I think there are three sets of actions that we can prepare ahead of time:

1. Forward immediately to an authority who can check it out further before
it times out. 
2. Expand the shortened URL to the actual link that it redirects to
3. Look up the provenance of the final link in a safe way (e.g., on a
pre-prepared Tails VM)

I think we've made headway on one of the three goals, but there's sill a
very long way to go for the other two.

[toc] | [prev] | [next] | [standalone]

#34650

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 12:36 +0000
Message-ID	<ns37jp$10b5$1@gioia.aioe.org>
In reply to	#34643

On Fri, 23 Sep 2016 10:07:10 +0100, Whiskers wrote:

> if in doubt don't go there.

On *that* topic, of "going there", it has to be pre-prepared.

The reason it has to be set up ahead of time is that the payload often
expires in a short time period (e.g., the latest simultaneous triplet of
iOS zero-day exploits were delivered by a link whose payload expired within
a half hour, and a previous iOS zero-day exploit expired after the first
click).

What do the OS people suggest as the best pre-preparation for visiting a
potential harmful link?

Would "Tails on a VM" be the best bet?

[toc] | [prev] | [next] | [standalone]

#34654

From	"Mark W." <markawillson@gmail.com>
Date	2016-09-23 06:24 -0700
Message-ID	<6412dbf3-d1dd-498b-bdc7-1e20fdb176b4@googlegroups.com>
In reply to	#34619

On Thursday, September 22, 2016 at 9:22:45 PM UTC-4, Horace Algiers wrote:
> Is there *anything* a user can do to check the URL without going to that
> URL?
> 
> Just received this text on my cell phone:
...
> http://bit.do/cBuHr
> 
> Is there *anything* a user can do to check the URL without going to that
> URL?

This site will expand the URL and show a snippet of text from the
destination page:

http://mopages.com/texis/browserinfo/longurl.html

[toc] | [prev] | [next] | [standalone]

#34657

From	Horace Algiers <horace@horacealgiers.com>
Date	2016-09-23 16:08 +0000
Message-ID	<ns3k13$1n3c$1@gioia.aioe.org>
In reply to	#34654

On Fri, 23 Sep 2016 06:24:56 -0700 (PDT), Mark W. wrote:

> This site will expand the URL and show a snippet of text from the
> destination page:
> 
> http://mopages.com/texis/browserinfo/longurl.html

Nice find!

That site not only expands teh URL redirect, but it also gives, as you
said, a text-only verson of the web page (which, we can presume, is "safe"
to read). 

That's almost perfect for figuring out *what* the suspect web page
ostensibly purports to do.

Thanks,

[toc] | [prev] | [next] | [standalone]

#34662

From	Chris <ithinkiam@gmail.com>
Date	2016-09-23 17:03 +0000
Message-ID	<ns3n98$r0r$1@dont-email.me>
In reply to	#34619

Horace Algiers <horace@horacealgiers.com> wrote:
> 

Looks like you've forgotten how to spell your name 'Horace''...
*re-plonk*

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

csiph-web

How to check validity of suspicious looking SMS message text URL?

Contents

#34645

#34638

#34639

#34649

#34666

#34629

#34637

#34635

#34651

#34642

#34648

#34667

#34643

#34647

#34650

#34654

#34657

#34662