The websites of several federal government agencies, including the National Weather Service (NWS), are unprotected from scammers looking to exploit a security weakness to fool potential victims. The sites in question allow what are known as “unvalidated redirects.” An unvalidated redirect is a link to an external website that appears to be sanctioned by the sending website, but in reality can be created by anyone, including scammers and identity thieves. In many cases, the redirects do not even require an additional click; users are taken to the external website automatically after a short pause as an exit message is displayed.
The website for the NWS, www.weather.gov, has been a favorite target for those seeking to exploit the unvalidated redirect vulnerability. A Google search shows an extensive list of hundreds of websites linked with an automatic redirect. Some are legitimate, such as one on lightning strikes, but more common are those hawking website hosting, insurance, and even herpes cures:
