Spam Decoding
Spammers try to hide various aspects of how their operation is set up, using javascript, dns tricks, specially encoded characters and long streams of redirects - untangle their knots and deobfuscate their layers of misdirection with these tools and tips.
Listwashing Tokens
Spammer sometimes encode the email addresses of recipients into part of their spam, so that complaints with the “to” addresses stripped out can still be matched up to a recipient.
Email Addresses Encoded into URLs - howardknight.net/encemail.html
Untangling URLs
A URL is just so much gibberish?
URL Untangling Explained
How To Obscure Any URL - www.pc-help.org/obscure.htm
Link Based Tricks — URL obfuscation - www.contentverification.com/obfuscation-attacks/index.html
URL Untangling Tools
Feed scrambled URLs to one of these.
net.demon obfuscated URL Decoder - www.netdemon.net/decode.html
How To Obscure Any URL - www.pc-help.org/obscure.htm
Cloaked or spoofed HTML link checker - www.millersmiles.co.uk/Link-Checker.php
Deobfuscator for URL-Encoded Strings - spamwars.com/deobfuscator1.html
Sense of Scripting
If the source code of a webpage is hidden as chunks of unintelligible strings, try using one of these tools.
Decoding Scripting Explained
HTML/JS Obfuscation - securitylabs.websense.com/content/Blogs/2574.aspx
HTML/JS Obfuscation Part II - securitylabs.websense.com/content/Blogs/2625.aspx
Decoding Javascript - handlers.sans.org/dwesemann/decode/
Browser Decoders
View Rendered Source Firefox extension - jennifermadden.com/scripts/ViewRenderedSource.html
Drag either of these javascript links to your toolbar, or add them to your favourites. When you are viewing a page with source code that doesn't make sense, click on that link; the decoded source should appear in a new browser window, with luck.
view page code
view page code (2)
Online Script Decoder Pages
HayWyre Nullifyer - www.netdemon.net/haywyre/
Obfuscated-HTML De-obfuscation Tools - www.gooby.ca/decrypt/
spam-L toys - hesketh.com/schampeo/spam-l/
Windows Script Decoder - www.virtualconspiracy.com/?page=scrdec/intro
Online 'Windows Script Encoding' Decoder - www.greymagic.com/security/tools/decoder/
MIME Encodings
Get the plain text version of an email, undoing the MIME encoding the spammer used.
Downloadable MIME decoders
Decode Shell Extension - www.funduc.com/otsoft.htm#decodeshellextension - Win
MPack - ftp://ftp.andrew.cmu.edu/pub/mpack/ - Unix
Decoder - etresoft.com/decoder.html - Win/Mac
UUDeview - www.fpx.de/fp/Software/UUDeview/ - Unix/Win
ungoopspam - www.unicom.com/sw/ungoopspam/ - Perl
Web-based Base64 Decoders
Base64 is an encoding defined in RFC 2045. You don't need to know that to decode it.
base64 decrypt - www.robietherobot.com/calc.htm
Base64 and URL Encoding and Decoding - ostermiller.org/calc/encode.html
Decode BASE64 encoded text - www.toastedspam.com/decode64
Unpack base-64 - www.tipjar.com/nettoys/demimeulator.html
Base 64 Decoder - www.opinionatedgeek.com/dotnet/tools/Base64Decode/safedecode.aspx
base64 Decoder - spamwars.com/decoder.html
TRANSLATOR, BINARY - home2.paulschou.net/tools/xlate/
Quoted Printable
Decode quoted-printable - www.toastedspam.com/decodeqp
Decode Quoted-Printable - www.fourmilab.ch/webtools/qprint/
Other Decoding Tools
UPX Decompression - upx.sourceforge.net/ - common executable file compression scheme
Unpackers - www.exetools.com/unpackers.htm - unpack file packers
DataCompression.info - datacompression.info/
ASCII, ROT13, %HEX, ... - nospam-pl.net/koduj.php - misc tools
Deobfuscator for "&#n;" Character References (Entities) - spamwars.com/deobfuscator2.html
swfdump - www.quiss.org/swftools/swfdump.html - Unix, decode Shockwave Flash
Flare - www.nowrap.de/flare.html - dump Shockwave Flash ActionScript
TRANSLATOR, BINARY - home2.paulschou.net/tools/xlate/ - misc tools
This work is licensed under a Creative Commons License. SPAM is a trademark of Hormel Foods.
Page last updated: 13-Aug-2009