[SpamCop-List] Re: Question regarding "\x[hexnumber]" code.

Thu Dec 8 23:35:22 EST 2005

"Redstone" wrote:

> I'm curious to know exactly what kind of code "\x" is.
>
> The spammer who hides behind Geocities sites appear to be using this type
> of code as means to hide the final site.
>
> It is coded in this manner: "\x[hex number]"
>
> Sort of like this: "....\x76\x61\x72\x25\x32\x30\x74\..."
>
> I've tried digging around but Gargle doesn't give me much of anything
> meaningful I can use for decrapting this.

Create an html document as shown below, paste the encoded text into the
form window, and press "Decode" as many times as needed to get clear text.
Will unscramble hex values coded with "\x" or "%".
(thanks to Spamless for the idea)

<html>
<form name="decoder">
<textarea cols="100" rows="30" name="str"></textarea>
<input type="submit" value="Decode" onclick='{dehex();return false}'>
</form>
<script language="JavaScript">
function dehex() {
  document.decoder.str.value=unescape(document.decoder.str.value.replace(/\\x/gi,"%"))
}
</script>
</html>