It's more important about what the cipher is. These are from a Russian banking phishing campaign that has been active recently and is making news. They encode the e-mail address in the url using some sort of cipher.
Here is what we have to work with:
That is the decrypted string. Here it is encrypted:
Here is a key that they provide in the URL, but I'm unsure if it's useful:
There was also another link with a different key, but same value
What we also know. Here are some of our findings that might point to what the cipher is:
- Numbers are always replaced with symbols
- Symbols are always replaced with numbers.
However, there are some weird things. Sometimes these rules aren't followed, but generally are. Sometimes the encrypted string isn't the same between messages.
We're leaning on some sort of base64 variation currently.
Here are some more that have the same sort of alphabet and base:
(row corresponds between decrypted and encrypted)
I wouldn't look too much into the keys, it's probably for their tracking.