1

I have received this email from a scumbag today. It is a phishing telling me to download a file at this URL:

http://mes.org.my/home/tmp/comprovante/index1.php?Comprovante_Transferencia.pdf

This URL redirects to another site and downloads an exe, probably a server from some innocent guy, or not.

The browser flashes that other URL for a brief period of time, not enough to copy it. I want to know what URL is that, so I can denounce it to the hosting company and site owner.

Is there any terminal command I can type to capture the redirection URL?

I have tried wget without success.

thanks

5

It checks user agents, apparently:

$ curl -LI 'http://mes.org.my/home/tmp/comprovante/index1.php?Comprovante_Transferencia.pdf'
HTTP/1.1 406 Not Acceptable
Date: Mon, 12 Jan 2015 13:45:49 GMT
Server: Apache/2.2.23
Content-Type: text/html; charset=iso-8859-1
Connection: keep-alive

$ curl -I 'http://mes.org.my/home/tmp/comprovante/index1.php?Comprovante_Transferencia.pdf' -A 'Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/28.0.1500.52 Chrome/28.0.1500.52 Safari/537.36'
HTTP/1.1 302 Moved Temporarily
Date: Mon, 12 Jan 2015 13:46:56 GMT
Server: Apache/2.2.23
X-Powered-By: PHP/5.3.18
Location: index.htm?id=63E9CO8D8ZSBP6ORWWFQSD63K2UV1LAFCBKRDODLT4SFGKSMAHCBH6Y4XNCR8OZR4LOMDWM0IP6Y9E4IRVNS2KXOA27FDDBCGJES325Q42J61RNSPDL18OD9VHS0XXQRSCJ66L73688MGQWMJGU8UTUUSGLNM5SNAS81
Content-Type: text/html
Connection: keep-alive

$ curl -LI 'http://mes.org.my/home/tmp/comprovante/index1.php?Comprovante_Transferencia.pdf' -A 'Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/28.0.1500.52 Chrome/28.0.1500.52 Safari/537.36'
HTTP/1.1 302 Moved Temporarily
Date: Mon, 12 Jan 2015 13:47:32 GMT
Server: Apache/2.2.23
X-Powered-By: PHP/5.3.18
Location: index.htm?id=UT35116XRN6W7OR55AX3JP3Q3CHM02Y1ED1DITBJZPPB8ZCF7X4M2QPELG7WM76H0HV4UWFHD7COW8ANRNPMG5X7MGXQIHXPAWRAUFH3Y1G859EFV5UEVXA3KKKAAO7JWVS1OA7TJ0SL4IN4J08RIJREAL3KTTG9Y083
Content-Type: text/html
Connection: keep-alive

HTTP/1.1 200 OK
Date: Mon, 12 Jan 2015 13:47:33 GMT
Server: Apache/2.2.23
Last-Modified: Fri, 09 Jan 2015 21:14:52 GMT
ETag: "1728314-93-50c3ea5c1cb00"
Accept-Ranges: bytes
Content-Length: 147
Content-Type: text/html
Connection: keep-alive

$ curl -L 'http://mes.org.my/home/tmp/comprovante/index1.php?Comprovante_Transferencia.pdf' -A 'Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/28.0.1500.52 Chrome/28.0.1500.52 Safari/537.36'
<meta http-equiv="refresh" content="1; url=http://www.linabtechnologies.net/xmlrpc/I/comprovante/deposito/Comprovante_Transferencia_000053554.zip">%       

Looks like a zip file.

  • perfect!!!!! thanks. Yes it is a zip file containing a EXE. You are awesome! THANKS – SpaceDog Jan 12 '15 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.