2

We have a system that sends emails to people inviting them to visit our site to fill in a survey. Each person is sent a unique link so we can customise the survey for them. We also include some tracking codes in the link.

For example, we might send someone a link like this

https://www.example.com/view-survey/EkwXdq9Vsfg~?utm_source=Survey1088&utm_medium=Email&utm_campaign=Purchase

In this link, the "EkwXdq9Vsfg~" bit is the unique bit - it is actually an encryption of the integer ID of the person in our database.

What we are seeing in our logs are GET requests for links which we have not sent out.

For example, we might see in the log a GET request for

https://www.example.com/view-survey/FjeYas7Brlf~?utm_source=Survey1088&utm_medium=Email&utm_campaign=Purchase

In all cases, there is also a GET request very soon after such requests, from the same IP address. These are always something like;

https://www.example.com/view-survey/EkwXdq9Vsfg~?qrs_porfed=Chydge8473&ple_qjsyrb=Fredl&pkd_chdiongrh=Kedfhyde

In the first case, the bit of the URL that corresponds to the encrypted ID is FjeYas7Brlf~. When this is run through our decryption algorithm, it should return an integer which is the ID of the person who received the email. But, in this case, it does not decrypt to anything recognisable and certainly not an integer. On checking our mail logs, it is apparent that we did not send out any emails containing that string.

What it looks like is that something or someone is taking the link and then changing the characters in the link before requesting the resource at the URL in the link. What we see in the logs is that there is one request where every character before the ?, but after the final slash, in the link has been changed - lower case letters are replaced with a different lower case letter, upper case letters are replaced with a different upper case letter and numbers are replaced with other numbers. Then, there is another request straight after where the characters after the ? are replaced in the same fashion.

All I can think of is that something is fuzzing the URL so that the tracking codes are thwarted, but, this does not seem very likely.

Our logs show that this is only happening rarely. We send out on average tens of thousands of emails per day, and might see this happening maybe once or twice a day.

Does anyone know of an automated system that might be doing this fuzzing?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.