How do I debug an emoticon-based URL?

dns phishing url unicode

8,857

Solution 1

In this case, the domain is "🍕💩.ws" (xn--vi8hiv.ws). This is a free link "shortener" that can turn any link into emojis. It's free and available at http://linkmoji.parseapp.com

In this case, the translation punycode as Steffen mentioned won't help you, because you just get the domain/ips of this free service.

You need to check the redirects using e.g. curl or your browser's developer tools.

In Chrome's developer tools, it could look like this:

Solution 2

This is a two-step process, which involved a bit of trial and error in finding the right URL un-shorteners.

First of all, I tried a bunch of URL-unshorteners on the emoji-URL, until I found one that worked.

Unshorten.me turned

http://🐒🍵🍱🍋🎩🍣🍕🍊.🍕💩.ws/

into

http://linkmoji.parseapp.com/xn--ki8hb4a5cudxa08a01a

Unfortunately, I wasn't able to feed that back to itself; it looped back to that same URL.

But Unshorten.it, which choked on the emoji, could handle this URL perfectly well and told me it pointed to

http://getlaid-xxxhoookupnow.com

The description it found for that site contains some words that are NSFW, so I won't repeat it here, but it's obviously spam to say the least, and possibly dodgy in other ways as well.

Solution 3

You need to convert it to punycode which is the ASCII representation of the name. This can be done for example online at punycoder.com and many programming languages have the necessary libraries if you want to convert it inside a program.

Solution 4

This is amazing! I had no idea you can use emojis in a URL, even though I'm a web developer! The other answer are great, but I found Unfurlr to work well. It allows you to see where something goes, without setting cookies in your browser, and without exposing you to a virus or drive-by-download as you would if you view it in your browser. It also shows you headers and scripts and contents if you need to safely inspect it more closely.

http://unfurlr.com/

Solution 5

Just past the URL in the address bar of Firefox browser, it will show you the ASCII form automatically:

I'd expect other modern browsers to have similar behaviour, but I didn't actually test those.

View more solutions

8,857

makerofthings7

Updated on September 18, 2022

Comments

makerofthings7 over 1 year

I came across this URL (NSFW) and need to convert this to puny code.

As an experiment, I'll paste this URL here, but not sure if this will save.

http://🐒🍵🍱🍋🎩🍣🍕🍊.🍕💩.ws/ (NSFW)

How can I convert this URL to a standard DNS name so I can whois the IP space?
- Hatted Rooster over 7 years
  
  Susan sounds like a nice girl though.
- Don't Root here plz... over 7 years
  
  This is the Short URL :- http://xn--ki8hb4a5cudxa08a01a.xn--vi8hiv.ws/ and this is the long URL :- http://trk.egtcashtrk.com/aff_c?offer_id=48&aff_id=4348&aff_‌sub=akash (The message you got was spam, because this links to a dating site.)
- SQB over 7 years
  
  @Don'tRoothereplz... I think you should post that as an answer.
- murgatroid99 over 7 years
  
  The link in the question currently redirects to an NSFW page without warning.
- user253751 over 7 years
  
  @Don'tRoothereplz... I think it was pretty obvious the message was spam, even without following the link, don't you?
- Don't Root here plz... over 7 years
  
  @user20574 Now that you say it like that, Yes, it is pretty obvious that it's spam.
- user253751 over 7 years
  
  @murgatroid99 The warning is that it's embedded in this sort of spam message.
- nispio over 7 years
  
  In an ironic twist, your SU question has probably driven more traffic to this "dating" site than the spammers could have hoped for. Or maybe you were in on the whole thing...
Don't Root here plz... over 7 years

Are you sure Unshorten.It! works? On trying, It just gave me a long Please Wait.
SQB over 7 years

Works for me, but on the second URL, the one returned by the first step.
thanby over 7 years

I'm absolutely blown away and horrified that such a service exists. When I read the title of this question I thought "Surely this is some xkcd-style humor" but no... it's a real thing. Next thing you know people are going to figure out how to encode their social media accounts into selfies or some other bizarre internet hack.
Tim over 7 years

@thanby already done, google.co.uk/…
Tim over 7 years

@thanby and also fb messenger does it with your profile picture: imgur.com/a/iJeLE
Amani Kilumanga over 7 years

@thanby the essence of xkcd-style humor (and the internet in general) is that someone is bound to make it reality (if it isn't already)
Gerald over 7 years

cURL gives me Failed to convert 🐒🍵🍱🍋🎩🍣🍕🍊.🍕💩.ws to ACE; String preparation failed.
Nic over 7 years

I don't think you need the description to tell what kind of site http://getlaid-xxxhoookupnow.com is.
Michael over 7 years

@QPaysTaxes Looks like it might have something to do with finding a place to put your RV(?) hookups?
Josef over 7 years

@TRiG if it doesn't work, you have to decode the punycode before. There is for example the idn tool. But if your shell doesn't handle unicode properly, better use a web tool like punycoder.com anyways, the output should be xn--ki8hb4a5cudxa08a01a.xn--vi8hiv.ws Then a curl -vv xn--ki8hb4a5cudxa08a01a.xn--vi8hiv.ws should have Location: http://linkmoji.parseapp.com/xn--ki8hb4a5cudxa08a01a somwhere. Put that in curl again and get <body onLoad="location.replace('http://trk.egtcashtrk.com/aff_c...
Gerald over 7 years

@Josef. In other words, this is definitely spam (as if we couldn't tell). But I'm puzzled that cURL can't handle it. My shell is GNU Bash 4.3.46 on Ubuntu 16.04 LTS, and I've never had any problems with Unicode.
Sebb over 7 years

Is there any technical reason to have 10 redirects?
Lilienthal over 7 years

@thanby At the risk of further derailing this post: Mastercard is looking to roll out "pay-by-selfie" by the end of the year. Let's face it, we're growing old.