{"id":1535,"date":"2005-05-12T09:06:07","date_gmt":"2005-05-12T13:06:07","guid":{"rendered":"http:\/\/www.thewormbook.com\/hlog\/?p=1535"},"modified":"2005-05-12T09:06:07","modified_gmt":"2005-05-12T13:06:07","slug":"a-new-scam","status":"publish","type":"post","link":"http:\/\/www.thewormbook.com\/hlog\/?p=1535","title":{"rendered":"A new scam"},"content":{"rendered":"<p>This phishing technique is new to me. Nowadays you get lots of scams in which they appear to have printed the <span class=\"caps\">URL <\/span>in plain text, but hovering the mouse over it shows that it goes to a completely different <span class=\"caps\">URL.<\/span> However, when I hovered the mouse over this one, nothing appeared at all; and when I looked at the code, it turns out that the text of the <span class=\"caps\">URL <\/span>was actually the input button for a form which sent you off to the crooks&#8217; site. This is clever, or at least ingenious. But I can&#8217;t work out what the repeated &#8220;3D&#8221;s do in the code below. Does anyone know?<\/p>\n\n\n<pre class=\"loony\">\n&lt;A href=3D&quot;https:\/\/secure.ebay.com\/eBayISAPI.dll?\naction=3Dverify&amp;id=3D0062665=4&amp;user=3D&quot;&gt;\n&lt;FORM action=\n3Dhttp:\/\/0040246.netsolhost.com\/SAW-CGI\/saw-cgi\/login.html&gt;\n&lt;INPUT\nstyle=3D&quot;BORDER-RIGHT: 0pt;\nBORDER-TOP: 0pt;\nFONT-SIZE: 10pt;\nBORDER-LEFT: 0pt;\nCURSOR: hand;\nCOLOR:blue;\nBORDER-BOTTOM: 0pt;\nBACKGROUND-COLOR: transparent;\nTEXT-DECORATION: underline&quot;\ntype=3Dsubmit\nvalue=3Dhttps:\/\/secure.ebay.com\/eBayISAPI.dll?\naction=3Dverify&amp;id=3D0062665=4&amp;user=3D&gt;\n&lt;\/A&gt;\n<\/pre>","protected":false},"excerpt":{"rendered":"<p>This phishing technique is new to me. Nowadays you get lots of scams in which they appear to have printed the <span class=\"caps\">URL <\/span>in plain text, but hovering the mouse over it shows that it goes to a completely different <span class=\"caps\">URL. <\/span>&hellip; <a href=\"http:\/\/www.thewormbook.com\/hlog\/?p=1535\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a> <a href=\"http:\/\/www.thewormbook.com\/hlog\/?p=1535\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"_links":{"self":[{"href":"http:\/\/www.thewormbook.com\/hlog\/index.php?rest_route=\/wp\/v2\/posts\/1535"}],"collection":[{"href":"http:\/\/www.thewormbook.com\/hlog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.thewormbook.com\/hlog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.thewormbook.com\/hlog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.thewormbook.com\/hlog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1535"}],"version-history":[{"count":0,"href":"http:\/\/www.thewormbook.com\/hlog\/index.php?rest_route=\/wp\/v2\/posts\/1535\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.thewormbook.com\/hlog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.thewormbook.com\/hlog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1535"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.thewormbook.com\/hlog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}