The Super Long URL

Blue Coat's Security Lab's latest post is about what for most people should be an obviously bad URL:

online.citibank.com.us.jps.portal.index.do.signin.logon.citibank.online.secure.sessionid.udp pincyyadcjfwjkgporvazebpnejlinbnunptl.qtpycihnqzaepbbwdrgjysgkvvegkvrztfytnffb.cg gshinmxvtsmxeesikaeciwhyqscvtfbcxjklti.sid.afterthehunttaxidermy.com/

If you actually saw a URL that looked like the one above you should be immediately suspicious that it's part of an attempt at phishing.

But in actuality of course most people don't see the URL above, they see the HTML facade that's created for the email or webpage, and the above is just what's linked to the HTML display. But wait, you're thinking most browsers will show you where the HTML actually links to, and I'm smart enough to check that out (either in the bubble that shows up in the browser or the full link in the status bar at the bottom of the page).

But what's interesting about a URL like the one above is that it's so long that the entire URL won't display in most cases, so you only see the front part of the URL in your bubble or status bar. And that's the most likely explanation behind why the hacker created the URL. If you're not careful to check out the entire URL, you'll only see the front, and it may be enough to convince some people it's a legitimate link.

So be careful, and check the full URL of where you're going on the web, or at the very least make sure you're browsing through a Secure Web Gateway or proxy device that's configured to block phishing sites.