I got a phishing email from a supposed realtor that wanted me to click on the following link


which I decoded as:


I was curious about the URL query or command because I haven't seen one like this before. Can someone explain to me how this malicious link works? Is f#$%^)(*^%$%^amg*&^%$#$%^/ an encoding of some sort? Or is it something designed to attack this server? Is it a bash script or some other command?

PS. Of course, I haven't tried to open the page at all

  • 1
    Surprisingly enough that is almost a valid folder name, when I tested it f#$%^)(*^%$%^amg*&^%$#$%^ changed to f#$%^)(*^%$%^amg*&^%0$%^. Is it possible that this is a ReDoS attack designed to hit whatever framework they are using?
    – Aedazan
    Nov 10, 2016 at 1:06

1 Answer 1


The actual page requested would be http://wonderit.net/f, since anything after # would be interpreted by the DOM. That page returns HTTP status 406 with or without the hash mark and everything following. The site itself appears to be broken, so it's unlikely we can find out now what the intended result would've been.

  • 2
    No, the whole point of encoding is to be able to send special characters in the url to the server. In this case, because the hash mark is encoded as %23 it does get sent to server. But I agree: we will never find out the intended result.
    – Jeff
    Feb 24, 2017 at 19:12
  • That's a very good point Feb 24, 2017 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .