Drug Spammers Start Using New Technique to Bypass Spam Filters

Actors behind a pill scam campaign are trying a new technique, betting on unconventional representation of URLs in spam messages to keep them undetected by email protection systems and URL blocklists.

In a massive campaign observed by security researchers, the operators put in some effort to ensure wider reach of their messages promoting dubious pharmaceutical products.

The spammers combined convincing messages with IP addresses encoded in the hexadecimal numeral system that lead to fake pharma sites after a few redirects.

There is no malware involved. The purpose of the operation is to convince recipients to buy fake drugs, sugar pills, snake oil products, and items of doubtful quality.

Researchers at Trustwave tracking this campaign noticed an increased volume of messages going out in mid-July. The peak recorded close to 25,000 emails going to inboxes across the world.

Also Read: Is it Illegal to Email Someone Without Their Permission?

The spammers are pushing anything from coronavirus face masks, anti-bacterial UV lamps, pills to improve concentration, for losing weight, for acid reflux, prostate, vertigo, vitiligo, or for correcting vision problems.

While using the hexadecimal system to encode IP addresses is not a new technique, it is uncommon in pharma spam campaigns. Web browsers accept and decode this format along with others (octal, integer or DWORD).

Researchers at Trustwave observed this specific technical detail in pharma spam and assume that the same group of actors is behind the campaigns they saw this year.

The chain of events after clicking the hex-encoded IP address goes through several intermediate HTTP 301 and HTTP 302 redirects before landing on the final page that integrates legitimate, third-party payment gateways to process transactions via credit card or PayPal.

Another interesting aspect is the spammers use the infrastructure of ClickBank, a legitimate retail and affiliate link service, to proxy to the final landing page.

Also Read: How to Send Mass Email Without Showing Addresses: 2 Great Workarounds

The researchers say that encoding the IP addresses in emails is an evolution in pharma related spam operations.

Relying on an infrastructure that includes legitimate services along with registering new domains for websites with convincing marketing materials (videos, testimonials) ensures the success of the operation to a higher degree.

Users should be wary of marketing messages popping in their inboxes out of the blue and promising miracle products for various problems of a medical nature.

Drugs that have not gone through a proper approval process may cause long term medical issues that may not be easily mended.