Josh Tolley to "Steven": [re-organized to sensible quoting order] > > The page actually appears to link to eBay and it does, the link below is > > the one I received in my inbox recently. > > > > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&DomainUrl=http%3A%2F%2F%32%31%31%2E%31%37%32%2E%39%36%2E%37%2FUpdateCenter%2FLogin%2F%3FMfcISAPISession%3DAAJbaQqzeHAAeMWZlHhlWXS2AlBXVShqAhQRfhgTDrferHCURstpAisNRqAhQRfhgTDrferHCURstpAisNRpAisNRqAhQRfhgTDrferHCUQRfqzeHAAeMWZlHhlWXh > > > > > > Simply: > > > > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&DomainUrl=www.website.com > > > I just tried this with my own URL, and eBay didn't forward me to some > other site. Perhaps they've plugged this already? That's odd, because the original URL in the spam Steven reported (and as seen here earlier) still works, as does the redirector with a handful of arbitrary URLs I just plucked from memory. At least, the redirector works if you put "http://"; (or variously encoded forms of the same) at the head of the URL. URLs of the form "www.website.com" as suggested by Steven do not work. In short, it does work so it's not fixed. Site designers wanting to implement universal redirector URLs such as this (to simplify logging of their own offsite referrals??) should limit the redirector to _only_ accept redirects from their own servers. And no, using http's "Referer:" [sic] header is not, in general, good enough for this, but would help eBay in the short-term against tricks such as this phishing scam. Of course, the modern world of content served by third-parties from arbitrarily many or few machines on quasi- random IPs all round the globe, depending on load and so on, makes this _much_ harder to do properly, but that's part of the price you pay for using cheap ugly hacks such distributed content serving depends on... Regards, Nick FitzGerald
