MjYwMjcyMjcyMjY4MjE0MjAzMjAzMjYwMjc3MjcyMjA4MjU2MjEwMjAyMjc0MjYzMjU1MjUzMjU1MjYwMjU3MjAyMjU1MjY3MjY1
Curious to know what they hide i found:
1- first, is a base64 encoded string
260272272268214203203260277272208256210202274263255253255260257202255267265
2- is a modified unicoded string. To decode it, split it in 3
260 272 272 268 214 203 203 260 277 272 208 256 210 202 274 263 255 253 255 260 257 202 255 267 265
and read it as unicode adding \u0 to each item
\u0260\u0272\u0272\u0268\u0214\u0203\u0203\u0260\u0277\u0272\u0208\u0256\u0210\u0202\u0274\u0263\u0255\u0253\u0255\u0260\u0257\u0202\u0255\u0267\u0265
and maybe convert it to Decimal NCRs
ɠɲɲɨȔȃȃɠɷɲȈɖȐȂɴɣɕɓɕɠɗȂɕɧɥ
which equals as html to
ɠɲɲɨȔȃȃɠɷɲȈɖȐȂɴɣɕɓɕɠɗȂɕɧɥ
which is nonsense. Then?
3- If we know that the encoded string hides a url, then we can think that it must begin with "http". Making reverse encoding, we found the unicoded expression of
"http" is \u0068\u0074\u0074\u0070 in hex
but \u0104\u0116\u0116\u0112 in dec
Comparing to \u0260\u0272\u0272\u0268 there is a constant gap of 156, so apply it to the entire original items and convert them to hex
\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0068\u0079\u0074\u0034\u0064\u0036\u002e\u0076\u006b\u0063\u0061\u0063\u0068\u0065\u002e\u0063\u006f\u006d
or Decimal NCRs
http://hyt4d6.vkcache.com
