It has become noticeable that 2003 is the year SCAMs have replaced SPAM as the most annoying thing you are likely to see in your mailbox and may soon replace viruses as the most lethal. In our Spam and Scam busters forum we've seen a new scam that is particularly nasty in the way it hides its true nature.

In brief, these particular scammers have discovered that broadband ISP EarthLink offers a URL (encrypted as well) that would do a simple browser redirection to any other website on the net without checking if this redirection was authorized or valid. The destination URL is encoded in the parameters to the secure URL. This redirection utility URL was probably useful to some part of the earthlink website.

This "hole" meant the scammers were able to write a semi-official looking email that asked users to click on a secure (https) earthlink url, in order to "verify your data", and then they spammed this email to possibly millions of addresses.

At first blush, even well seasoned earthlink customers may be fooled by this link and email, and may continue, only to fill out a form containing enough information to allow the bad guys (hosted offshore) to steal their identity or worse. It is more than likely the operators of this particular scam, within hours, collected and now have hundreds, possibly thousands, of customers information. (Image of their collection form, thanks to RadioDoc for this: they ask for everything). At this point, it matters little what EarthLink do to disable this redirector, or what the web-hosting company does to the throw-away hosting account.

Previous to this particularly nasty URL redirection trick, the worst scam email s have been html messages that contained a GIF that looked like a regular email (example), but the gif was entirely clickable. The GIF would contain an EBAY link in blue in the text, even though the actual destination was somewhere else entirely. Such a trick may fool people who read their email with all HTML type viewing options turned on, but not those who read their email in text only. This redirection trick may fool text-based link clickers as well.

We have contacted EarthLink about this open redirection vulnerability, but since similar redirector URLs are very common in many e-commerce web-sites, it is clear this spam+spam trick could be re-used against a number of high-profile domain names in order to trick customers into revealing, well, anything really.