Angler "April Fish"

(MonsterAV Logo - it was Reveton Affiliate name. and was the first big customer of Angler EK)

Yes in French Speaking areas (and in Italy too according to Wikipedia)  it's "April Fish" :) not April fool.

This morning @urlquery pointed to me a string in Angler EK landing.

oh... in Angler EK Landing 2014-04-01

hehe...ok.

So  :

After Some Cleaning

Looking fast I thought : "There is a redirect for IE >10  without Java, Silverlight, Flash"
But coming with IE11 I noticed the UserAgent / app.version does not contains MSIE :

User Agent :  Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko

Impossible path... but let's craft a specific App Version :

And let's try.

Yeah !! Got the Redirect. Bummer.... "Connection : close"

Was expecting a base64 encoded file or something..but anyway, that was fun.
Thanks guys. Reminded me when Sakura coder was leaving messages in the landing code.


<edit 2014-04-02> Looking in my previous Angler traces....It seems this as old as 2014-03-24...less fun<edit>