# How does this URL work? **URL:** \ **Category:** Factual Questions\ **Created:** [May 30, 2006, 5:25am UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708 "2006-05-30T05:25:54Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [May 30, 2006, 5:25am UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708/1 "2006-05-30T05:25:54Z")
Rumming through my spam e-mails tonight, I saw a PayPal phishing scam. It was obvious enough but I often look at the URL they present because, if it’s a Geocities or similiar account I try to report it. Anyway, the fake URL they gave was: h++p://0xdb91827a/.w-w-w.paypal.com/cgi-bin/webscrcmd\_login.php It actually read “http” and “www” but I wanted to break the URL in case it leads to some site that’ll install nastyware. The part that had me curious though was the **0xdb91827a**. How does that get resolved by my browser? ---
**Author:** ![xash](https://avatars.discourse-cdn.com/v4/letter/x/c6cbf5/32.png) [@xash](https://boards.straightdope.com/u/xash)\ **Post date:** [May 30, 2006, 5:39am UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708/2 "2006-05-30T05:39:08Z")
It’s done using some form of URL encoding. See this page for an explanation and some examples: [http://www.pc-help.org/obscure.htm](http://www.pc-help.org/obscure.htm) ---
**Author:** ![Bag\_of\_Mostly\_Water](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bag_of_mostly_water/32/1029_2.png) [@Bag\_of\_Mostly\_Water](https://boards.straightdope.com/u/Bag_of_Mostly_Water)\ **Post date:** [May 30, 2006, 6:22am UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708/3 "2006-05-30T06:22:34Z")
This is a IP address address in numeric form. The “0x” indicates the number is hex. Each pair of symbols corresponds to one of the numbers between the dots (as IP addresses are normally written). So, hex db = dec 219 hex 91 = dec 145 hex 82 = dec 130 hex 7a = dec 122 The IP address is 219.145.130.122 which is owned by China Telecom. For obvious reasons, I won’t list the complete URL. This encoding will not work in all browsers. I tried it in Safari and it didin’t work. Interestingly, Firefox (Mac) automatically went to a page on DSL reports and told we this was a URL used for phishing. I didn’t know Firefox did this. Well done Firefox! ---
**Author:** ![Bag\_of\_Mostly\_Water](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bag_of_mostly_water/32/1029_2.png) [@Bag\_of\_Mostly\_Water](https://boards.straightdope.com/u/Bag_of_Mostly_Water)\ **Post date:** [May 30, 2006, 6:40am UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708/4 "2006-05-30T06:40:37Z")
Let me correct serveral errors in my last paragraph: This encoding will not work in all browsers. I tried it in Safari and I got a message that Safari “can’t find the server ‘0xdb91827a’”. Interestingly, Firefox (Mac) automatically redirected to a page on DSL reports which indicated that this was a URL used for phishing. I didn’t know Firefox did this. Well done Firefox! ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [May 30, 2006, 9:14am UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708/5 "2006-05-30T09:14:24Z")
> [@Ex\_Chemist](#): > > This is a IP address address in numeric form. The “0x” indicates the number is hex. Each pair of symbols corresponds to one of the numbers between the dots (as IP addresses are normally written). > > So, > hex db = dec 219 > hex 91 = dec 145 > hex 82 = dec 130 > hex 7a = dec 122 That’s so cool! Learn something new every day 🙂 > [@](#): > > Firefox (Mac) automatically went to a page on DSL reports and told we this was a URL used for phishing. I didn’t know Firefox did this. Well done Firefox! Not to say Firefox doesn’t deserve praise, but are you sure this specific behavior isn’t due to Google? Firefox by default performs a Google “I’m feeling lucky” search whenever it encounters a URL it can’t handle, and 0xdb91827a on Google leads right to the dslreports page. So maybe Google, as the Omniscient Overlord of All Human Knowledge, is to thank here? ---
**Author:** ![Bag\_of\_Mostly\_Water](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bag_of_mostly_water/32/1029_2.png) [@Bag\_of\_Mostly\_Water](https://boards.straightdope.com/u/Bag_of_Mostly_Water)\ **Post date:** [May 30, 2006, 1:52pm UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708/6 "2006-05-30T13:52:53Z")
> [@Reply](#): > > Not to say Firefox doesn’t deserve praise, but are you sure this specific behavior isn’t due to Google? Firefox by default performs a Google “I’m feeling lucky” search whenever it encounters a URL it can’t handle, and 0xdb91827a on Google leads right to the dslreports page. So maybe Google, as the Omniscient Overlord of All Human Knowledge, is to thank here? I was wondering how this could work. You’re probably correct. ---
**Author:** ![total\_blank](https://avatars.discourse-cdn.com/v4/letter/t/b487fb/32.png) [@total\_blank](https://boards.straightdope.com/u/total_blank)\ **Post date:** [May 30, 2006, 3:06pm UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708/7 "2006-05-30T15:06:47Z")
Funny, when I try it in Firefox (version 1.5.0.3) I get a 404 Error. When I go to h++p://0xdb91827a I just get the standard “Test Page for Apache” message that says: > [@](#): > > If you can see this, it means that the installation of the Apache web server software on this system was successful. You may now add content to this directory and replace this page. > Seeing this instead of the website you expected? > > This page is here because the site administrator has changed the configuration of this web server. Please contact the person responsible for maintaining this server with questions. The Apache Software Foundation, which wrote the web server software this site administrator is using, has nothing to do with maintaining this site and cannot help resolve configuration issues. > > The Apache documentation has been included with this distribution. > > You are free to use the image below on an Apache-powered web server. Thanks for using Apache! ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [May 30, 2006, 3:25pm UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708/8 "2006-05-30T15:25:13Z")
> [@total blank](#): > > Funny, when I try it in Firefox (version 1.5.0.3) I get a 404 Error. When I go to h++p://0xdb91827a I just get the standard “Test Page for Apache” message that says: Most likely the phishers sent the email, had the fake site up, caught some phishees and moved on so as to not get caught. If you go to [http://219.145.130.122](http://219.145.130.122) (the de-coded URL) in any browser (I did it in IE) you’ll see the Apache test message, meaning whoever was there before ain’t there no more. ---
**Author:** ![simster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/simster/32/1047_2.png) [@simster](https://boards.straightdope.com/u/simster)\ **Post date:** [May 30, 2006, 4:26pm UTC](https://boards.straightdope.com/t/how-does-this-url-work/358708/9 "2006-05-30T16:26:13Z")
> [@ZipperJJ](#): > > Most likely the phishers sent the email, had the fake site up, caught some phishees and moved on so as to not get caught. If you go to [http://219.145.130.122](http://219.145.130.122) (the de-coded URL) in any browser (I did it in IE) you’ll see the Apache test message, meaning whoever was there before ain’t there no more. Well, strictly speaking it does not mean that… it does mean that they havent changed the default index.htm(l) file… Has nothing to do with wether or not the rest of the path is still existent.