14 DAY TRIAL // Hexadecimal URL obfuscation has been used by spammers for quite some time now because it’s a good way to bypass anti-spam filters. However, Symantec experts have recently spotted a spike in the volume of spam campaigns that use this technique.
One spam message identified by the security firm attempts to lure users to rogue pharmacy websites.
The email is simple. It’s entitled “Male pills lowest prices” and it contains the following message: “Viagra is rpeal onluy herwe (sic).”
The user can see the link to the site normally, but the source code reveals that the sender has utilized hexadecimal URL obfuscation to evade spam filters.
“The technique is used to evade anti-spam filters because anti-spam engines are sensitive to every single character in a message body,” Symantec experts noted in a blog post.