Hackers orchestrating a scam campaign selling medicines are trying a new technique, betting on unconventional representation of URL addresses in spam messages so that they are not detected by email protection systems and URL blocklists.
In a massive campaign observed by some security researchers, operators made an effort to ensure the widest reach of messages promoting pharmaceutical products of dubious origin.
Spammers combined convincing messages with IP addresses encoded in the hexadecimal number system that lead to fake pharmacy websites after a few redirects.
No malware is included. The purpose of the business is to convince recipients to purchase fake medicines, dietary supplements, snake oil products, and items of questionable quality.
Trustwave researchers monitoring this campaign noticed that the highest volume of messages was released in mid-July.
Spammers are really trying to sell anything from COVID-19, antibacterial UV lamps, pills to improve concentration, for weight loss, for reflux, prostate, vertigo or even to correct vision problems.
While using hexadecimal to encode IP addresses is not a new technique, it is uncommon in pharmaceutical spam campaigns. Web browsers accept and decode this format along with others (octal, integer, or DWORD).
Trustwave researchers noticed this specific technical detail in this scam campaign and assume that the same group of attackers is behind the campaigns released this year.
The campaign is very convincing as its final page (after going through various other redirects) also has legitimate payment gateways via credit card or PayPal.
Another interesting aspect is that spammers use the infrastructure of ClickBank, a legitimate retail and affiliate link service, as a proxy for the final landing page.
Researchers say that encoding IP addresses in emails is a development in pharmaceutical-related spam.
An infrastructure that includes legal services, as well as convincing marketing material (videos and photos) ensures the success of the operation.
Users should be cautious about marketing messages that appear in their inboxes. Drugs that have not gone through a proper approval process can cause long-term medical problems that may not be easily corrected.
