Search code examples
httpurlbasic-authenticationmalware

What is the meaning of '@' in the URL?

Let us try to access

http://yahoo.com@3627729518

with any browser. We get redirected to google.com.

3627729518 is the decimal representation of 11011000.00111010.11000010 .01101110 without dots. What's the reason of such behavior?

Note: I've changed the url so it's universal, but still, there is http://domain@ip. Originally it was local bank url and a scam-service's ip.

Solution

  • It's a malicious url, abusing the http://username:password@hostname support to make it LOOK like a yahoo url.

    But it's actually taking you to that IP address (yes, an IP address is just a number, and can be represented by an integer). So that url is effectively:

    http://[email protected]

    which reverse DNSs to

    http://[email protected]

    so probably a Google Fibre customer in Dallas/Fort Worth.