2014-04-01 - Landing

Angler "April Fish"

(MonsterAV Logo - it was Reveton Affiliate name.
and was the first big customer of Angler EK)

Yes in French Speaking areas (and in Italy too according to Wikipedia) it's "April Fish" :) not April fool.

This morning @urlquery pointed to me a string in Angler EK landing.

oh... in Angler EK Landing
2014-04-01

hehe...ok.

So :

After Some Cleaning

Looking fast I thought : "There is a redirect for IE >10 without Java, Silverlight, Flash"
But coming with IE11 I noticed the UserAgent / app.version does not contains MSIE :

User Agent : Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko

Impossible path... but let's craft a specific App Version :

And let's try.

Yeah !! Got the Redirect.
Bummer.... "Connection : close"

Was expecting a base64 encoded file or something..but anyway, that was fun.
Thanks guys. Reminded me when Sakura coder was leaving messages in the landing code.

<edit 2014-04-02> Looking in my previous Angler traces....It seems this as old as 2014-03-24...less fun<edit>