# Interesting new phishing technique

**URL:** <https://boards.straightdope.com/t/interesting-new-phishing-technique/764504>\
**Category:** Miscellaneous and Personal Stuff I Must Share\
**Created:** [August 30, 2016, 8:04pm UTC](https://boards.straightdope.com/t/interesting-new-phishing-technique/764504 "2016-08-30T20:04:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\
**Post date:** [August 30, 2016, 8:04pm UTC](https://boards.straightdope.com/t/interesting-new-phishing-technique/764504/1 "2016-08-30T20:04:35Z")

</div>

I got an email with a link that starts out with the [google.com](http://google.com) address, then has a bunch of parameters that cause google to redirect to the other site. This seems to take advantage of how google handles referrals to web sites. This might lead some people to say, “Hey it’s Google, what can go wrong?”

Does Google know that it is being used like that? Not sure if there is anything they can do about it as long as they support this redirect for referrals.

---

<div class="post-metadata">

**Author:** ![Amateur\_Barbarian](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@Amateur\_Barbarian](https://boards.straightdope.com/u/Amateur_Barbarian)\
**Post date:** [August 30, 2016, 8:11pm UTC](https://boards.straightdope.com/t/interesting-new-phishing-technique/764504/2 "2016-08-30T20:11:13Z")

</div>

Isn’t there something like goo.gl that’s something like TinyURL and other short-form redirectors? You’re right, it’s hard to keep something like that from being misused, which is why many users don’t trust the URL shorteners.

It’s been common for a long time to use URLs like “blah.blah.blah.google.fugwizaboom.[something]” that look legitimate at a glance.

---

<div class="post-metadata">

**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\
**Post date:** [August 30, 2016, 9:19pm UTC](https://boards.straightdope.com/t/interesting-new-phishing-technique/764504/3 "2016-08-30T21:19:12Z")

</div>

Does this come with a login prompt? If so, it may be explained [here](https://www.aidanwoods.com/blog/faulty-login-pages).

---

<div class="post-metadata">

**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\
**Post date:** [August 30, 2016, 10:39pm UTC](https://boards.straightdope.com/t/interesting-new-phishing-technique/764504/4 "2016-08-30T22:39:27Z")

</div>

I didn’t click on the link. But here is the URL (I keep unchecking “Automatically parse links” but it keeps getting displayed as a link so I broke it)

https : / / www . google . com/url?q=http%3A%2F%2F5d5dy.megahookup.in

followed by more arguments that are processed by the destination site, presumably to identify which email address led to the click.

Google process the argument q as a URL and redirects. I think this is how Google manages links from its searches that are paid ads, or some such mechanism