Interesting new phishing technique

I got an email with a link that starts out with the google.com address, then has a bunch of parameters that cause google to redirect to the other site. This seems to take advantage of how google handles referrals to web sites. This might lead some people to say, “Hey it’s Google, what can go wrong?”

Does Google know that it is being used like that? Not sure if there is anything they can do about it as long as they support this redirect for referrals.

Isn’t there something like goo.gl that’s something like TinyURL and other short-form redirectors? You’re right, it’s hard to keep something like that from being misused, which is why many users don’t trust the URL shorteners.

It’s been common for a long time to use URLs like “blah.blah.blah.google.fugwizaboom.[something]” that look legitimate at a glance.

Does this come with a login prompt? If so, it may be explained here.

I didn’t click on the link. But here is the URL (I keep unchecking “Automatically parse links” but it keeps getting displayed as a link so I broke it)

https : / / www . google . com/url?q=http%3A%2F%2F5d5dy.megahookup.in

followed by more arguments that are processed by the destination site, presumably to identify which email address led to the click.

Google process the argument q as a URL and redirects. I think this is how Google manages links from its searches that are paid ads, or some such mechanism