disclude.io

crates.io / foldhash / 0.2.0

foldhash 0.2.0

Source
https://github.com/orlp/foldhash
Tag scanned
v0.2.0
Compared with
v0.1.5 (0 signals introduced since)
Files
14 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 104 info
Scan time
62.1 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 82 of 82 warn and critical signals; 82 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-14 21:24

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review encoding-base64 benches/urls-10000.txt:42:298

    base64-like blob (123 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    jaG5SLOdvGZSgqs8C9_17-rFak37UGOdNSEmYKDgi4-rKPARD_v8rzhKMCEgMI9g4aHQobCIECmonx2wQSCAESDlJlYWQgbWUgYSBwb2VtIjAKLmh0dHBzOi8vYXNzaXN0YW50Lmdvb2dsZS5jb20vcGxhdGZvcm1zL3Bob25lcy8&amv=300727608&utm_campaign=1910
    likely benign LLM, confidence 0.92 A tracking/query-string segment in a benchmark URL list flagged as a base64-like blob.
    Reasoning

    Raw-pass base64 match on a URL list used as benchmark input. The blob is a long query string with tracking parameters, and its alphanumeric run is what triggers the match. Raw findings have a high false-positive rate, and nothing here executes or decodes anything.

  2. info warn → info by review encoding-base64 benches/urls-10000.txt:392:44

    base64-like blob (122 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    https://ulta.ztk5.net/c/249354/164999/3037?subId1=PEORihannaDisheson10oftheBestFentyBeautyProductsIncludingtheOneSheCallsHerSecretWeapontgubbiotLifAff13792964202212I&u=https%3A%2F%2Fwww.ulta.com%2Fp%2Fcheeks-out-freestyle-cream-blush-pimprod2031376
http://tocaboca.com/privacy/
    likely benign LLM, confidence 0.92 An affiliate tracking URL parameter in a benchmark URL list, flagged for its long alphanumeric run.
    Reasoning

    The flagged run is an affiliate-style subId1 value concatenated into a URL query string inside a plain-text URL fixture. It is not an encoded payload, and the file is a list of URLs for benchmarking.

  3. info warn → info by review encoding-base64 benches/urls-10000.txt:438:55

    base64-like blob (87 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

    https://true-botanicals.sjv.io/c/249354/1113696/14123?subId1=PEOTheBestBeautyProductsthePEOPLETeamTriedThisMonthfspatolaLifAff13750048202211I&u=https%3A%2F%2Ftruebotanicals.com%2Fproducts%2Fnourishing-shampoo-fresh
https://people.com/health/artist-michelle-browder-is-reclaiming-history-for-the-mothers-of-gynecology/
    likely benign LLM, confidence 0.92 An affiliate redirect URL in a benchmark fixture, flagged as base64-like.
    Reasoning

    The matched text is a subId1 tracking value inside an affiliate redirect URL. It is ordinary marketing-link data in a text fixture, with no decoding or execution path.

  4. info warn → info by review encoding-base64 benches/urls-10000.txt:685:47

    base64-like blob (102 bytes, compression ratio 1.05) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOThe40BestDealsYouCanShopatWalmartsPresidentsDaySaleRightNowmsapozhnikovLifAff13940302202302I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FVIZIO-OLED-65-Class-4K-HDR-SmartCast-Smart-TV-OLED65-H1%2F232867283
https://www.gub.uy/atencion-ciudadania
    likely benign LLM, confidence 0.92 A retailer affiliate link's tracking parameter in a benchmark URL list.
    Reasoning

    A tracking subId1 value in a Walmart affiliate link inside a plain-text URL list. The long mixed-case string is a campaign identifier, not an encoded blob.

  5. info long-line benches/urls-10000.txt:788:1

    line length 636 characters (raw pass, confidence 0.50)

    https://vkontakte.ru/share.php?url=https%3A%2F%2Fwww.un.org%2Fsustainabledevelopment%2Fbiodiversity%2F&title=Forests%2C%20desertification%20and%20biodiversity&description=Goal%2015%20is%20about%20conserving%20life%20on%20land.%20It%20is%20to%20protect%20and%20restore%20terrestrial%20ecosystems%2C%20sustainably%20manage
  6. info warn → info by review encoding-base64 benches/urls-10000.txt:862:163

    base64-like blob (92 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

    searchbox&al=googleapp%3A%2F%2Fdeeplink%2F%3Fdata%3DCk0BDb3mGzBGAiEA5rH7ycXA0W8ZcHHSuqyVJgr6fXaNsNfH5BgrocBaOSkCIQDDXLaOCOF56xeDdGaUkaVE2JO3gF-YMIt3Gk096Oo5ExJYCg4IuPqyjwEQ_7_K84SjAhIAGh0KGwiBApqJ8dsEEggBEg5TZXQgYSByZW1pbmRlciIlCiNodHRwczovL2Fzc2lzdGFudC5nb29nbGUuY29tL2xlYXJuLw%26utm_source%3DUS_20191119_EXP05&amv=3007
    likely benign LLM, confidence 0.92 A URL-encoded deeplink parameter in a benchmark URL list.
    Reasoning

    The segment is a URL-encoded deeplink parameter in a Google search URL within a text fixture. It is data for URL parsing benchmarks, and the match reflects its length and character set rather than any decoding step.

  7. info warn → info by review encoding-base64 benches/urls-10000.txt:862:288

    base64-like blob (103 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

    xeDdGaUkaVE2JO3gF-YMIt3Gk096Oo5ExJYCg4IuPqyjwEQ_7_K84SjAhIAGh0KGwiBApqJ8dsEEggBEg5TZXQgYSByZW1pbmRlciIlCiNodHRwczovL2Fzc2lzdGFudC5nb29nbGUuY29tL2xlYXJuLw%26utm_source%3DUS_20191119_EXP05&amv=300727608
    likely benign LLM, confidence 0.90 A continuation of a Google deeplink query string in a benchmark URL list.
    Reasoning

    Another segment of the same Google deeplink query string in the URL fixture. It is a URL parameter value, not a payload, and nothing in the file consumes it as code.

  8. info warn → info by review encoding-base64 benches/urls-10000.txt:867:47

    base64-like blob (85 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

    https://marine-conservation.org/on-the-tide/tag/united-states/
https://www.pntrs.com/t/8-10989-131940-141079?sid=PEOThe5BestTintedMoisturizersof2022TestedandReviewedtgubbiotBeaAff13470807202207I&url=https%3A%2F%2Fwww.narscosmetics.com%2FUSA%2Ftinted-moisturizer
https://letsoftware.com
    likely benign LLM, confidence 0.92 An affiliate tracking parameter in a benchmark URL list.
    Reasoning

    A tracking parameter in a pntrs affiliate URL, inside a plain-text list of URLs. The blob is a campaign identifier that happens to be long and alphanumeric.

  9. info warn → info by review encoding-base64 benches/urls-10000.txt:1208:47

    base64-like blob (109 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOWalmartsHugeAfterChristmasSaleHasAlreadyBegunandPricesAreUpto73OffmsapozhnikovLifAff13828603202212I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FPaw-Patrol-Skye-Sidewalk-Bike-12-In-Wheels-Ages-2-to-4-Pink%2F959708625
    likely benign LLM, confidence 0.92 A retailer affiliate tracking value in a benchmark URL list.
    Reasoning

    A subId1 tracking value in a Walmart affiliate URL within a text fixture. No decoding, execution, or obfuscation is involved.

  10. info long-line benches/urls-10000.txt:1280:1

    line length 609 characters (raw pass, confidence 0.50)

    https://pt-br.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Fimportant-question-world-child-crying%252F%26t%3D%25E2%2580%259CThe%2Bmost%2Bimportant%2Bquestion%2Bin
  11. info warn → info by review encoding-base64 benches/urls-10000.txt:1282:47

    base64-like blob (109 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOWalmartsHugeAfterChristmasSaleHasAlreadyBegunandPricesAreUpto73OffmsapozhnikovLifAff13828603202212I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FORORO-Women-s-Lightweight-Heated-Vest-with-Battery-Pack-Black-M%2F319995446
    likely benign LLM, confidence 0.92 A retailer affiliate tracking value in a benchmark URL list.
    Reasoning

    Same Walmart affiliate subId1 pattern as the adjacent finding, in a URL fixture file. It is a long tracking string in data, not a payload.

  12. info warn → info by review encoding-base64 benches/urls-10000.txt:1416:320

    base64-like blob (127 bytes, compression ratio 0.95) (raw pass, confidence 0.60)

    size%3D1.08%2520fl%2520oz%2520%252F%252032%2520ml&u1=PEOIDitchedtheFoundationIWasUsingforaDecadeforThisLightweightSkinTintThatDoublesasSunscreenmsapozhnikovBeaAff13977238202303I
    likely benign LLM, confidence 0.92 A tracking query parameter in a benchmark URL list, flagged as base64-like.
    Reasoning

    A URL-encoded query parameter with a long tracking identifier in a text list of URLs. It is data that a URL benchmark would parse, and the raw base64 heuristic matched only on its character run.

  13. info long-line benches/urls-10000.txt:1441:1

    line length 803 characters (raw pass, confidence 0.50)

    https://ko-kr.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Flook-science-something-elite-people-can-learn-thats-just-not-true-just-start-early-give-kids-foundatio
  14. info warn → info by review encoding-base64 benches/urls-10000.txt:1497:285

    base64-like blob (106 bytes, compression ratio 1.03) (raw pass, confidence 0.60)

    nRF4Kl3GMxFkLKKpyD4HDMkDGpankoFTwSWgoOCLj6so8BEP-_yvOEowISABofCh0IgQKaifHbBBQIARIQUGxheSBtZSB0aGUgbmV3cyIlCiNodHRwczovL2Fzc2lzdGFudC5nb29nbGUuY29tL2xlYXJuLw%26utm_source%3DUS_2019010720_NL7&amv=300727608
    likely benign LLM, confidence 0.97 Base64-looking fragment inside a tracking URL in a benchmark URL list.
    Reasoning

    Raw-pass base64-like match in a benchmark corpus of URLs; the blob sits inside a tracking URL query string (Google Assistant/utm parameters) and is not executed or decoded by any code. Low-entropy text blob with normal compression ratio.

  15. info long-line benches/urls-10000.txt:1529:1

    line length 579 characters (raw pass, confidence 0.50)

    https://hi-in.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php%3Fu%3Dhttps%253A%252F%252Fglobalfishingwatch.org%252Fdata%252Ftracking-illegal-fishing-in-the-pacific%252F%26t%3DRecent%2BStudy%2BShows%2BHow%2BSatellite%2BTechnology%2BC
  16. info warn → info by review encoding-base64 benches/urls-10000.txt:1557:45

    base64-like blob (85 bytes, compression ratio 1.05) (raw pass, confidence 0.60)

    https://goto.target.com/c/249354/81938/2092?subId1=PEOThe50BestDealsHidingatTargetThisMonthUpto63OffsomalleyLifAff13884631202301I&u=https%3A%2F%2Fwww.target.com%2Fc%2Ftop-deals%2F-%2FN-4xw74
https://sesamestreetincommunities.org/activities/raising-an-upstander/
    likely benign LLM, confidence 0.97 Encoded affiliate tracking parameter inside a URL list.
    Reasoning

    Raw match on a URL-encoded tracking parameter in a benchmark data file of affiliate URLs. No decoding or execution context; it is plain data.

  17. info long-line benches/urls-10000.txt:1709:1

    line length 938 characters (raw pass, confidence 0.50)

    https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Flink.mediaoutreach.meltwater.com%2Fls%2Fclick%3Fupn%3Duds9FRvUT-2BYQTVntkkHBIRsAanNsdQwVwv9dAh8RGkxjMz7x-2Fh5XjsegSmYoM381bDhi_4NcAjL2EEx7I-2FoTcLtQd1K3vlMY3wRHimH3twh6qCVBBk2WEZpW-2BJuIodmKXuTImg5TFQo6rWvQSwD47FeBvAmRR9n0s3uNGKFeXxK5lEnli1OCEYWfgEnQHpoK4
  18. info warn → info by review encoding-base64 benches/urls-10000.txt:1709:247

    base64-like blob (139 bytes, compression ratio 0.96) (raw pass, confidence 0.60)

    jL2EEx7I-2FoTcLtQd1K3vlMY3wRHimH3twh6qCVBBk2WEZpW-2BJuIodmKXuTImg5TFQo6rWvQSwD47FeBvAmRR9n0s3uNGKFeXxK5lEnli1OCEYWfgEnQHpoK4fedia4V0Zta3HobW96fiLv4SldcECpDT7A5IbONTtLeCWWYGBXUHSN1W3s4cvyy3v-2BXOIZqaUmord5HmmLbiEUrXDKme-2BOl-2FO8uuMCJW1o9-2FbJRo-2B29zyuZpY1wyfVJXTS-2FEaLm-2BDKYQA0YUikSBXvbJPy8p1DKPaK9kD0t8pLI7Wtijwa8vlh
    likely benign LLM, confidence 0.97 Opaque tracking token inside a URL in a benchmark corpus.
    Reasoning

    Long token in a URL-list benchmark file, typical of tracking/session IDs from ad redirect links. Raw pass has high false-positive rate and nothing executes it.

  19. info warn → info by review encoding-base64 benches/urls-10000.txt:1709:786

    base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

    a86ec55e29%7C0%7C0%7C637613735763209747%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=THWHws9NurZ7KxPaO749zzPda%2F2p4qTf2aIOXOyGKy8%3D&reserved=0
    likely benign LLM, confidence 0.97 Safelinks/email tracking base64 parameter inside a URL list.
    Reasoning

    Contains a Microsoft SafeLinks-style base64 segment (TWFpbGZsb3d...) and an sdata token, both normal email-link tracking parameters within a URL list in a benchmark file.

  20. info long-line benches/urls-10000.txt:1719:1

    line length 609 characters (raw pass, confidence 0.50)

    https://it-it.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Fimportant-question-world-child-crying%252F%26t%3D%25E2%2580%259CThe%2Bmost%2Bimportant%2Bquestion%2Bin
  21. info warn → info by review encoding-base64 benches/urls-10000.txt:1782:47

    base64-like blob (102 bytes, compression ratio 1.05) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOThe40BestDealsYouCanShopatWalmartsPresidentsDaySaleRightNowmsapozhnikovLifAff13940302202302I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2Fppyoung-Women-s-Summer-Casual-T-shirt-Dresses-Short-Sleeve-Boho-Beach-Dress%2F847757367
    likely benign LLM, confidence 0.96 Affiliate redirect link with URL-encoded destination in a test corpus.
    Reasoning

    Affiliate redirect URL with an encoded target URL in a benchmark URL corpus; no executable context.

  22. info warn → info by review encoding-base64 benches/urls-10000.txt:1970:44

    base64-like blob (122 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    https://ulta.ztk5.net/c/249354/164999/3037?subId1=PEORihannaDisheson10oftheBestFentyBeautyProductsIncludingtheOneSheCallsHerSecretWeapontgubbiotLifAff13792964202212I&u=https%3A%2F%2Fwww.ulta.com%2Fp%2Fmatch-stix-contour-skinstick-pimprod2031436
http://acestoohigh.com
    likely benign LLM, confidence 0.96 Tracking URL containing a base64-like parameter in a benchmark corpus.
    Reasoning

    Affiliate tracking URL with encoded parameters in a benchmark data file; plain data, not code.

  23. info warn → info by review encoding-base64 benches/urls-10000.txt:2130:45

    base64-like blob (123 bytes, compression ratio 0.96) (raw pass, confidence 0.60)

    https://goto.target.com/c/249354/81938/2092?subId1=PEOThe19BestDealsatTargetsAfterChristmasSaleIncludingaKitchenAidStandMixerandAppleAirPodsssavoyLifAff13828917202212I&u=https%3A%2F%2Fwww.target.com%2F
https://people.com/royals/prince-harry-meghan-markle-at-home/
    likely benign LLM, confidence 0.96 Affiliate tracking link inside a benchmark URL corpus.
    Reasoning

    Affiliate tracking URL with encoded parameter values in a benchmark URL list; no decoding or execution.

  24. info warn → info by review encoding-base64 benches/urls-10000.txt:2232:44

    base64-like blob (88 bytes, compression ratio 1.05) (raw pass, confidence 0.60)

    https://sesamestreetincommunities.org/topics/asthma/
https://ulta.ztk5.net/c/249354/164999/3037?subId1=PEOThe5BestTintedMoisturizersof2022TestedandReviewedtgubbiotBeaAff13470807202207I&u=https%3A%2F%2Fwww.ulta.com%2Fp%2Fpure-radiant-tinted-moisturizer-spf-30-xlsImpprod15251329
https://www.infosysbpm.com/
    likely benign LLM, confidence 0.96 Affiliate tracking URL in a benchmark URL list.
    Reasoning

    Tracking URL with encoded target in a benchmark text file of URLs; benign data.

  25. info long-line benches/urls-10000.txt:2626:1

    line length 523 characters (raw pass, confidence 0.50)

    https://de-de.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php%3Fu%3Dhttps%253A%252F%252Fglobalfishingwatch.org%252Fnews-views%252Ftransshipment-monitoring%252F%26t%3DTransshipment%2BMonitoring%2BPortal%2BBrings%2BTransparency%2Bto%2
  26. info warn → info by review encoding-base64 benches/urls-10000.txt:2660:47

    base64-like blob (120 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    https://www.pntrs.com/t/8-11514-131940-155614?sid=PEOKateHudsonsOversizedBeltBagIsaSmartChoiceforMomsOntheGoandTheseLookalikesStartat14lstansburyFasAff13976767202303I&url=http%3A%2F%2Fawaytravel.com%2Ftravel-bags%2Fpackable-sling-bag%3Fcolor%3Dblack
https://www.vera.org/media-center
    likely benign LLM, confidence 0.96 Affiliate redirect link with encoded destination in a test corpus.
    Reasoning

    Affiliate redirect link with encoded URL parameter inside a benchmark URL list; not executable.

  27. info warn → info by review encoding-base64 benches/urls-10000.txt:2774:47

    base64-like blob (109 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOWalmartsHugeAfterChristmasSaleHasAlreadyBegunandPricesAreUpto73OffmsapozhnikovLifAff13828603202212I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FDissect-It-Mega-Lab-Interactive-Simulation-Stem-Children-s-Toy%2F484954291
    likely benign LLM, confidence 0.96 Affiliate tracking URL in a benchmark URL corpus.
    Reasoning

    Affiliate tracking URL with encoded destination in a benchmark data file; plain text URL list.

  28. info warn → info by review encoding-base64 benches/urls-10000.txt:3005:298

    base64-like blob (135 bytes, compression ratio 0.99) (raw pass, confidence 0.60)

    ckfukrl0065HdwRZdSbx69V80rCZbipkpsEm8KDgi4-rKPARD_v8rzhKMCEgMI6Q4aJgokCIECmonx2wQbCAESF1RlbGwgbWUgdGhlIGxhdGVzdCBuZXdzIjAKLmh0dHBzOi8vYXNzaXN0YW50Lmdvb2dsZS5jb20vcGxhdGZvcm1zL3Bob25lcy8&amv=300727608&utm_campaign=1897
    likely benign LLM, confidence 0.93 A tracking URL with a long query string flagged as a base64-like blob in a benchmark URL list.
    Reasoning

    Raw-pass base64 match inside a URL list used as benchmark input. The blob is a tracking-URL query string with affiliate parameters, not an encoded payload, and the file is plain URL data.

  29. info long-line benches/urls-10000.txt:3020:1

    line length 601 characters (raw pass, confidence 0.50)

    https://de-de.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Feducation-is-not-preparation-for-life-education-is-life-itself-john-dewey%252F%26t%3D%25E2%2580%259CEd
  30. info warn → info by review encoding-base64 benches/urls-10000.txt:3125:184

    base64-like blob (66 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

    https://apps.apple.com/us/app/sleep-stories-for-adults/id1575734220
https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=2417&murl=https%3A%2F%2Fwww.sephora.com%2Fproduct%2Frare-beauty-by-selena-gomez-liquid-touch-brightening-concealer-P64546856&u1=PEOThe9BestUnderEyeConcealersof2023pleskinBeaAff13248894202204I
    likely benign LLM, confidence 0.93 An affiliate deeplink with an encoded destination URL flagged in a benchmark URL list.
    Reasoning

    The matched span is a LinkSynergy deeplink with percent-encoded URL parameters and affiliate IDs. This is ordinary URL text in a benchmark fixture, not an obfuscated blob.

  31. info warn → info by review encoding-base64 benches/urls-10000.txt:3161:169

    base64-like blob (90 bytes, compression ratio 1.02) (raw pass, confidence 0.60)

    https://vpn.mozilla.org
https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=42608&murl=https%3A%2F%2Fwww.katespade.com%2Fproducts%2Fcucumber-floral-tie-bandeau-bikini-top%2FSS58237.html&u1=PEOAtKateSpadesMassivePresidentsDaySalePricesStartatJust20somalleyFasAff13944013202302I
    likely benign LLM, confidence 0.93 An affiliate deeplink with percent-encoded parameters flagged in a benchmark URL list.
    Reasoning

    The span is a LinkSynergy affiliate deeplink with URL-encoded parameters, sitting among ordinary URLs in a benchmark fixture. Nothing indicates a payload or dropper.

  32. info warn → info by review encoding-base64 benches/urls-10000.txt:3465:150

    base64-like blob (66 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

    https://l.facebook.com/l.php?u=https%3A%2F%2Fwww.instagram.com%2F&h=AT2hZQ9CdK276biMcLmA9VJisoKHHOCQz1pxy4E_ECqGSd6aLkUW2dOBXX8O0zC2xp4ROAyMFzvxusJQ-2UO1ZRG8ObeQviPqJBfklRfw1kIhZPGPFOx586aYjHcDcMJIsiHTJ8GhxTI5aIsUeI-hbVC4sapkkGS
https://people.com/health/fran-drescher-talks-honoring-her-body-health-as-she-gets-older/
    likely benign LLM, confidence 0.93 A Facebook redirect URL with an opaque tracking token flagged in a benchmark URL list.
    Reasoning

    The matched span is a Facebook link-redirect URL with an encoded destination and a long opaque token in the h parameter. This is typical of link-shim URLs in a crawl-style URL corpus, not malicious encoding.

  33. info long-line benches/urls-10000.txt:3488:1

    line length 567 characters (raw pass, confidence 0.50)

    https://it-it.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Fno-thing-perfect-parent-just-real-one%252F%26t%3D%25E2%2580%259CThere%2Bis%2Bno%2Bsuch%2Bthing%2Bas%2B
  34. info warn → info by review encoding-base64 benches/urls-10000.txt:3503:45

    base64-like blob (123 bytes, compression ratio 0.96) (raw pass, confidence 0.60)

    https://goto.target.com/c/249354/81938/2092?subId1=PEOThe19BestDealsatTargetsAfterChristmasSaleIncludingaKitchenAidStandMixerandAppleAirPodsssavoyLifAff13828917202212I&u=https%3A%2F%2Fwww.target.com%2Fp%2Fgourmia-9-slice-digital-air-fryer-oven-with-14-one-touch-cooking-functions-and-auto-french-doors%2F-%2FA-82780907%2
    likely benign LLM, confidence 0.93 An affiliate tracking URL with a long campaign subId flagged in a benchmark URL list.
    Reasoning

    Affiliate tracking URL with a long subId campaign string and an encoded target URL. This is ordinary marketing-link text in a benchmark fixture, and the raw base64 heuristic is firing on alphanumeric query text.

  35. info warn → info by review encoding-base64 benches/urls-10000.txt:3574:49

    base64-like blob (129 bytes, compression ratio 0.96) (raw pass, confidence 0.60)

    https://bistravel.pxf.io/c/249354/1148735/14511?subId1=PEOHaileyBieberSaysSheOnlyTravelswithThisChicandFunctionalCarryOnThatSoManyReviewersLoveToolstansburyTraAff13867544202301I&u=https%3A%2F%2Fbeistravel.com%2Fproducts%2Fthe-check-in-roller-in-beige
https://people.com/celebrity/star-tracks-monday-january-31-2022/
    likely benign LLM, confidence 0.93 An affiliate tracking URL with a long subId flagged in a benchmark URL list.
    Reasoning

    Affiliate tracking URL with a long subId campaign string and encoded destination. It is plain URL text in a benchmark corpus, so the base64-like flag is a false positive.

  36. info warn → info by review encoding-base64 benches/urls-10000.txt:3766:22

    base64-like blob (100 bytes, compression ratio 1.05) (raw pass, confidence 0.60)

    https://www.microsoft.com/edge
https://www.facebook.com/OfficialLondonEye/posts/pfbid02m2Yfuda1A66dXJQav37CKSDZRo1VHcgcYgkNqtMERdjJ1xeM7HB1KR2vn8WNtQPAl
https://www.7eleven.ca/7rewards
https://vision.esa.int/cm22
    likely benign LLM, confidence 0.93 A group of ordinary https URLs with long path IDs flagged in a benchmark URL list.
    Reasoning

    The span is a group of plain https URLs, including a Facebook post path with an alphanumeric ID. This is a list of ordinary links in a benchmark file, not encoded content.

  37. info warn → info by review encoding-base64 benches/urls-10000.txt:3931:47

    base64-like blob (111 bytes, compression ratio 1.02) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOPEOPLEsPostSAGAwardsGalaWasDeckedOutwithThisChicFurniturefromWalmartmsapozhnikovHomAff13965998202302I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FBetter-Homes-Gardens-Braxton-4-Piece-Wood-Conversation-Set-with-Off-White-Cushions%2F478796207
    likely benign LLM, confidence 0.93 An affiliate tracking URL with a long subId flagged in a benchmark URL list.
    Reasoning

    Affiliate tracking URL with a long subId campaign string and an encoded product URL. The raw base64 heuristic is matching URL query text in a benchmark corpus.

  38. info long-line benches/urls-10000.txt:4004:1

    line length 516 characters (raw pass, confidence 0.50)

    https://hi-in.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Ftakes-village-raise-child%252F%26t%3D%25E2%2580%259CIt%2Btakes%2Ba%2Bvillage%2Bto%2Braise%2Ba%2Bchild%
  39. info warn → info by review encoding-base64 benches/urls-10000.txt:4034:47

    base64-like blob (88 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

    https://www.pjatr.com/t/8-12847-131940-280099?sid=PEOTheBestChristmasSalestoShopfromOurFavoriteStoresmsapozhnikovLifAff13830521202212I&url=https%3A%2F%2Fgravityblankets.com%2Fcollections%2Fsale%2Fproducts%2Fcooling-weighted-blanket-gen-3
    likely benign LLM, confidence 0.93 An affiliate redirect URL with a long sid parameter flagged in a benchmark URL list.
    Reasoning

    Affiliate redirect URL with a long sid campaign string and an encoded destination. This is ordinary URL data in a benchmark fixture, not an encoded payload.

  40. info warn → info by review encoding-base64 benches/urls-10000.txt:4104:180

    base64-like blob (102 bytes, compression ratio 1.01) (raw pass, confidence 0.60)

    https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=1237&murl=https%3A%2F%2Fwww.nordstrom.com%2Fs%2Fallbirds-tree-breezer-ballet-flat-women%2F6979837%3Fcolor%3Dcream%2Bhush&u1=PEONordstromsWinterSaleHasThousandsofMarkdownsandWeFoundthe31BestDealssomalleyLifAff13941100202302I
    likely benign LLM, confidence 0.93 An affiliate deeplink with an encoded destination flagged in a benchmark URL list.
    Reasoning

    LinkSynergy deeplink with an encoded destination URL and affiliate parameters, inside a benchmark URL list. The raw base64 match is a false positive on URL query text.

  41. info warn → info by review encoding-base64 benches/urls-10000.txt:4113:121

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

    eca-Park-Zoo-Announces-Death-of-Masai-Giraffe.pdf?fbclid=IwAR1A3iFbhtBfWV96qihzsw5hjgq92WdGfPgYXUarfeVlLSPTF0eQI6iW_BQhttps://senecaparkzoo.org/wp-content/uploads/2023/02/PRESS-RELEASE-Seneca-Park-Zoo-Announces-Death-of-Masai-Giraffe.pdf?fbclid=IwAR1A3iFbhtBfWV96qihzsw5hjgq92WdGfPgYXUarfeVlLSPTF0eQI6iW_BQ
    dismissed LLM, confidence 0.96 A news URL with a Facebook click-ID query parameter inside a URL benchmark list.
    Reasoning

    Raw-pass match on a long URL with an fbclid tracking query string in a benchmark corpus file of plain URLs. The 'base64-like' run is ordinary URL path and tracking-parameter text, not an encoded payload.

  42. info warn → info by review encoding-base64 benches/urls-10000.txt:4113:309

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

    eca-Park-Zoo-Announces-Death-of-Masai-Giraffe.pdf?fbclid=IwAR1A3iFbhtBfWV96qihzsw5hjgq92WdGfPgYXUarfeVlLSPTF0eQI6iW_BQ
    dismissed LLM, confidence 0.96 Repeated fbclid tracking fragment within the same URL benchmark line.
    Reasoning

    Same line as the previous finding, a second offset with the same fbclid-style tracking string. Plain URL text in a benchmark fixture, not code or a dropper.

  43. info warn → info by review encoding-base64 benches/urls-10000.txt:4166:47

    base64-like blob (93 bytes, compression ratio 1.03) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOTheBestPresidentsDayTVDealsHappeningNowUpto1000OffmsapozhnikovLifAff13939225202302I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FLG-55-Class-4K-UHD-NanoCell-Web-OS-Smart-TV-with-Active-HDR-75-Series-55NANO75UQA%2F900155842
https://people.com/tag/vanderpump-rules/
    dismissed LLM, confidence 0.96 An affiliate redirect URL with percent-encoded walmart.com destination.
    Reasoning

    Raw-pass hit on an affiliate-tracking redirect URL with an encoded destination. These are common marketing links in a benchmark URL corpus, not obfuscated code.

  44. info long-line benches/urls-10000.txt:4402:1

    line length 622 characters (raw pass, confidence 0.50)

    https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.un.org%2Fsustainabledevelopment%2Fglobalpartnerships%2F&title=Global%20Partnerships&summary=Goal%2017%20is%20about%20revitalizing%20the%20global%20partnership%20for%20sustainable%20development.%20The%202030%20Agenda%20is%20universal%20and%20calls%20f
  45. info warn → info by review encoding-base64 benches/urls-10000.txt:4506:162

    base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)

    https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=40538&murl=https%3A%2F%2Fwww.kerastase-usa.com%2Fcollections%2Fnutritive%2Fbain-magistral-shampoo.html&u1=PEOTheBestBeautyProductsthePEOPLETeamTriedThisMonthfspatolaLifAff13750048202211I
https://twitter.com/MarvelStudios/status/1621191718379950082
    dismissed LLM, confidence 0.96 A linksynergy affiliate deeplink carrying an encoded product URL.
    Reasoning

    Affiliate deeplink with URL-encoded merchant target and campaign text in a benchmark URL list. Ordinary tracking-parameter content.

  46. info warn → info by review encoding-base64 benches/urls-10000.txt:4978:44

    base64-like blob (70 bytes, compression ratio 1.16) (raw pass, confidence 0.60)

    https://ulta.ztk5.net/c/249354/164999/3037?subId1=PEOThe9BestUnderEyeConcealersof2023pleskinBeaAff13248894202204I&u=https%3A%2F%2Fwww.ulta.com%2Fp%2Finstabake-3-in-1-concealer-pimprod2009083
https://lnkd.in/g2dtxMin?trk=organization_guest_main-feed-card_reshare-text
    dismissed LLM, confidence 0.96 An affiliate tracking URL pointing to an ulta.com product page.
    Reasoning

    Tracking redirect with subId and encoded ulta.com target in a benchmark URL corpus. Mundane link text, not an encoded blob with execution context.

  47. info warn → info by review encoding-base64 benches/urls-10000.txt:5116:167

    base64-like blob (110 bytes, compression ratio 1.00) (raw pass, confidence 0.60)

    https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=45581&murl=https%3A%2F%2Ftnuck.com%2F%2Fproducts%2Fchambray-callahan-shirt-dress%3Fvariant%3D43477426569438&u1=PEOSarahJessicaParkerWoreThisEverydayLayeringPieceWhileontheSetofAndJustLikeThatssavoyFasAff13960716202302I
    dismissed LLM, confidence 0.96 A linksynergy deeplink to a clothing retailer product page.
    Reasoning

    Affiliate deeplink with an encoded merchant URL and campaign label in a benchmark list. The high-entropy-looking run is just a query parameter value.

  48. info long-line benches/urls-10000.txt:5161:1

    line length 523 characters (raw pass, confidence 0.50)

    https://es-la.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php%3Fu%3Dhttps%253A%252F%252Fglobalfishingwatch.org%252Fnews-views%252Ftransshipment-monitoring%252F%26t%3DTransshipment%2BMonitoring%2BPortal%2BBrings%2BTransparency%2Bto%2
  49. info long-line benches/urls-10000.txt:5260:1

    line length 516 characters (raw pass, confidence 0.50)

    https://ko-kr.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Ftakes-village-raise-child%252F%26t%3D%25E2%2580%259CIt%2Btakes%2Ba%2Bvillage%2Bto%2Braise%2Ba%2Bchild%
  50. info long-line benches/urls-10000.txt:5320:1

    line length 579 characters (raw pass, confidence 0.50)

    https://de-de.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php%3Fu%3Dhttps%253A%252F%252Fglobalfishingwatch.org%252Fdata%252Ftracking-illegal-fishing-in-the-pacific%252F%26t%3DRecent%2BStudy%2BShows%2BHow%2BSatellite%2BTechnology%2BC
  51. info warn → info by review encoding-base64 benches/urls-10000.txt:5328:124

    base64-like blob (128 bytes, compression ratio 0.97) (raw pass, confidence 0.60)

    https://shareasale.com/r.cfm?b=1697964&u=1772040&m=105577&urllink=https%3A%2F%2Fjonesroadbeauty.com%2Fproducts%2Feye-cream&afftrack=PEOJonesRoadBeautyJustBroughtBackItsBelovedNewYearSameYouSetThatCreatesaFreshFacedLookmsapozhnikovBeaAff13858220202301I
    dismissed LLM, confidence 0.96 A shareasale affiliate redirect to a beauty product page.
    Reasoning

    ShareASale affiliate URL with encoded target and tracking label in a benchmark URL fixture. No code execution or decoding context.

  52. info warn → info by review encoding-base64 benches/urls-10000.txt:5732:241

    base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

    a86ec55e29%7C0%7C0%7C637541829074521246%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=OsuBl0jQubvphPWHr%2F25rEBYxcMgYin1Px9kwcsz1IA%3D&reserved=0
    dismissed LLM, confidence 0.95 A SafeLinks-wrapped URL whose query contains base64-encoded tokens.
    Reasoning

    Outlook SafeLinks-style URL with a base64-encoded 'Mailflow' token and sdata signature inside query parameters. Standard email-link wrapper text in a URL corpus, not a payload.

  53. info warn → info by review encoding-base64 benches/urls-10000.txt:5746:46

    base64-like blob (116 bytes, compression ratio 0.94) (raw pass, confidence 0.60)

    https://prf.hn/click/camref:1100lrphZ/pubref:PEOMoreThan200TheNorthFaceJacketsCoatsandFleecesAreDeeplyDiscountedRightNowsomalleyFasAff13936572202302I/destination:https%3A%2F%2Fwww.ruelala.com%2Fboutique%2Fproduct%2F215366%2F186632359%2F
https://documentation.spire.com
    dismissed LLM, confidence 0.96 A prf.hn affiliate click link to a ruelala.com product page.
    Reasoning

    Affiliate tracking URL with encoded destination in a benchmark list, paired with a plain domain line. Ordinary web link content.

  54. info warn → info by review encoding-base64 benches/urls-10000.txt:5914:133

    base64-like blob (68 bytes, compression ratio 1.16) (raw pass, confidence 0.60)

    es%2F21646220-it-depends-what-you-study-not-where&t=NGRhNGJlMzUyNWE0MGU1YTdkZTFkNDFkN2I4MzkwNTNkYWMwNDlmYyxkalNpRmg2Mw%3D%3D&b=t%3Ab649Kh6uXhlKEbRfMhDZ7Q&p=https%3A%2F%2Fblog.code.org%2Fpost%2F143085018748%2F16-of-all-new-wages-in-the-us-are-in-computer&m=1&ts=1677772282
    dismissed LLM, confidence 0.96 A tracking redirect URL to a blog.code.org post with an encoded parameter.
    Reasoning

    Redirect URL with a base64-looking tracking token and encoded blog destination in a benchmark URL file. Typical link-tracking parameter, no decode-and-execute behaviour.

  55. info warn → info by review encoding-base64 benches/urls-10000.txt:5927:47

    base64-like blob (114 bytes, compression ratio 1.01) (raw pass, confidence 0.60)

    https://www.pntra.com/t/8-12786-131940-269792?sid=PEOPSATheDePuffingFaceWandThatCelebsandEditorsCantStopUsingIsSecretlyonSaleRightNowssavoyBeaAff13879143202301I&url=https%3A%2F%2Fsolawave.co%2Fproducts%2Fmicrocurrent-red-light-therapy-facial-wand-kit-with-conductive-serum
https://www.instagram.com/p/CWRvmbClnCf/?hl=en
    dismissed LLM, confidence 0.93 Affiliate tracking URL with a long alphanumeric subId parameter in a benchmark URL list.
    Reasoning

    Raw-pass base64 heuristic firing on a tracking-affiliate URL query parameter inside a benchmark URL corpus. The blob is a human-readable campaign label followed by an affiliate ID, not an encoded payload, and nothing executes it.

  56. info long-line benches/urls-10000.txt:5929:1

    line length 601 characters (raw pass, confidence 0.50)

    https://hi-in.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Feducation-is-not-preparation-for-life-education-is-life-itself-john-dewey%252F%26t%3D%25E2%2580%259CEd
  57. info warn → info by review encoding-base64 benches/urls-10000.txt:5995:44

    base64-like blob (73 bytes, compression ratio 1.15) (raw pass, confidence 0.60)

    https://ulta.ztk5.net/c/249354/164999/3037?subId1=PEOTheseArethe10BestKylieSkinProductsfspatolaBeaAff13954288202302I&u=https%3A%2F%2Fwww.ulta.com%2Fp%2Fvitamin-c-serum-pimprod2009648
https://people.com/style/best-dressed-baftas-2023-red-carpet/
    dismissed LLM, confidence 0.93 Affiliate redirect URL with a readable subId tracking parameter in a URL benchmark file.
    Reasoning

    The flagged span is a subId1 tracking parameter whose value is readable marketing text plus an affiliate code. This is a raw-pass false positive on a benchmark data file of URLs.

  58. info warn → info by review encoding-base64 benches/urls-10000.txt:6012:51

    base64-like blob (91 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

    https://backcountry.tnu8.net/c/249354/358742/5311?subId1=PEOTheBestChristmasSalestoShopfromOurFavoriteStoresmsapozhnikovLifAff13830521202212I&u=https%3A%2F%2Fwww.backcountry.com%2Fpatagonia-nano-puff-insulated-jacket-womens
https://people.com/tag/lily-rose-depp/
https://corporate.walmart.com/hello-bello
    dismissed LLM, confidence 0.93 Affiliate tracking link with a readable subId parameter in a URL list.
    Reasoning

    Same pattern: an affiliate tracking subId containing readable text, inside a plain list of URLs. No decoding or execution is involved.

  59. info warn → info by review encoding-base64 benches/urls-10000.txt:6028:197

    base64-like blob (81 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

    HtUHwRxjZDcAePT4357_KluG0YT1HICdRPQTvmKjY0iU92kl5-JNKXf3yGcn9o0cT0qlEcuRTx2TPulSxz5kZLkXZJuZPCTuzIVoWuPMy4F63qaLZLLTmT0PXrfvP8WnUCA&sig=AOD64_11PMI7g48zQ_UfIuYcUHzo42cvsg&q&adurl&ved=2ahUKEwiv1NS65Yb9AhVKN0QIHa2PCK0Q0Qx6BAgIEAE&nis=2&dct=1
    dismissed LLM, confidence 0.92 Google redirect URL with opaque tracking and signature query parameters.
    Reasoning

    A long opaque token in a Google search-result redirect query string (sig, ved, adurl). Those parameters are ordinary Google tracking and signature values, and the file is a plain URL list.

  60. info warn → info by review encoding-base64 benches/urls-10000.txt:6099:149

    base64-like blob (96 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

    https://www.eonline.com/shows/the_bradshaw_bunch
https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=1237&murl=https%3A%2F%2Fwww.nordstrom.com%2Fs%2Fbp-rib-long-sleeve-polo-sweater%2F6576318&u1=PEO9CuteandCozySweatersonSaleforUnder35toGrabatNordstromRightNowsomalleyFasAff13922545202302I
    dismissed LLM, confidence 0.93 Affiliate deeplink with a readable u1 tracking parameter in a URL list.
    Reasoning

    A linksynergy deeplink whose u1 parameter holds readable promotional text plus an affiliate code. This is standard affiliate tracking in a benchmark URL corpus, not obfuscation.

  61. info long-line benches/urls-10000.txt:6171:1

    line length 1126 characters (raw pass, confidence 0.50)

    https://m.vk.com/settings?act=change_regional&from=oauth&to=YXV0aG9yaXplP2NsaWVudF9pZD0tMSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZtLnZrLmNvbSUyRm1haW4ucGhwJTNGc3ViZGlyJTNEc2hhcmUucGhwJTI2dXJsJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZ3d3cudW4ub3JnJTI1MkZzdXN0YWluYWJsZWRldmVsb3BtZW50JTI1MkZvY2VhbnMlMjUyRiUyNnRpdGxlJTNET2NlYW5zJTI2ZGVz
  62. info warn → info by review encoding-base64 benches/urls-10000.txt:6226:298

    base64-like blob (138 bytes, compression ratio 0.96) (raw pass, confidence 0.60)

    JsYuso8MFM3CGQKZ_25EeB_NWTrISI6-gScgoOCLj6so8BEP-_yvOEowISAwjjDhopCicIgQKaifHbBB4IARIaV2hhdCB0aW1lIGlzIGl0IGluIExvbmRvbj8iMAouaHR0cHM6Ly9hc3Npc3RhbnQuZ29vZ2xlLmNvbS9wbGF0Zm9ybXMvcGhvbmVzLw&amv=300727608&utm_campaign=1891
    dismissed LLM, confidence 0.90 Google URL with a long encoded query parameter that decodes to ordinary text.
    Reasoning

    A long token in a Google Assistant-related URL parameter. It decodes to ordinary text and URL fragments, which is typical of search and tracking query strings. The raw base64 heuristic has a high false-positive rate here.

  63. info warn → info by review encoding-base64 benches/urls-10000.txt:6248:47

    base64-like blob (109 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOWalmartsHugeAfterChristmasSaleHasAlreadyBegunandPricesAreUpto73OffmsapozhnikovLifAff13828603202212I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FBarbie-6-Doll-Sports-Career-Collection-Related-Clothes-Accessories-3-Up%2F405422763
    dismissed LLM, confidence 0.93 Affiliate redirect URL with a readable subId parameter.
    Reasoning

    Affiliate tracking subId with readable campaign text in a Walmart redirect URL inside a benchmark list.

  64. info warn → info by review encoding-base64 benches/urls-10000.txt:6288:45

    base64-like blob (85 bytes, compression ratio 1.05) (raw pass, confidence 0.60)

    https://sesamestreetincommunities.org/activities/adaptarse-dos-hogares/
https://goto.target.com/c/249354/81938/2092?subId1=PEOThe50BestDealsHidingatTargetThisMonthUpto63OffsomalleyLifAff13884631202301I&u=https%3A%2F%2Fwww.target.com%2Fp%2Fjbl-flip-6-portable-waterproof-bluetooth-speaker%2F-%2FA-86464757
    dismissed LLM, confidence 0.93 Affiliate redirect URL with a readable subId tracking parameter.
    Reasoning

    Affiliate tracking subId with readable text in a Target redirect URL. The file is a benchmark URL corpus, so this is a raw-pass false positive.

  65. info long-line benches/urls-10000.txt:6377:1

    line length 548 characters (raw pass, confidence 0.50)

    https://es-la.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php%3Fu%3Dhttps%253A%252F%252Fglobalfishingwatch.org%252Fdata%252Ftracking-illegal-fishing-in-the-pacific%252F%26t%3DRecent%2BStudy%2BShows%2BHow%2BSatellite%2BTechnology%2BC
  66. info warn → info by review encoding-base64 benches/urls-10000.txt:6500:45

    base64-like blob (123 bytes, compression ratio 0.96) (raw pass, confidence 0.60)

    https://goto.target.com/c/249354/81938/2092?subId1=PEOThe19BestDealsatTargetsAfterChristmasSaleIncludingaKitchenAidStandMixerandAppleAirPodsssavoyLifAff13828917202212I&u=https%3A%2F%2Fwww.target.com%2Fp%2Fkitchenaid-artisan-10-speed-stand-mixer-hearth-38-hand-8482-with-magnolia%2F-%2FA-80272482%23lnk%3Dsametab
    dismissed LLM, confidence 0.93 Affiliate redirect URL with a readable subId tracking parameter.
    Reasoning

    Affiliate tracking subId with readable promotional text in a Target redirect URL inside a plain URL list.

  67. info warn → info by review encoding-base64 benches/urls-10000.txt:6505:62

    base64-like blob (320 bytes, compression ratio 0.81) (raw pass, confidence 0.60)

    drillapp.com/track/click/30976981/oceanexpert.org?p=eyJzIjoiVXVXd1dWek5XdlVES0NRV3QtRGlFVjlxSjRJIiwidiI6MSwicCI6IntcInVcIjozMDk3Njk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL29jZWFuZXhwZXJ0Lm9yZ1xcXC9kb2N1bWVudFxcXC8zMTQ0MFwiLFwiaWRcIjpcImE4Y2NiM2RkY2VmZTQ2MTk4ZjMwMjc0ZWZhZDViM2FmXCIsXCJ1cmxfaWRzXCI6W1wiMzk0NjhiMmQ0
    likely benign LLM, confidence 0.90 Email click-tracking URL with a base64-encoded JSON tracking parameter.
    Reasoning

    A base64-encoded JSON tracking blob in the p= parameter of an email click-tracking URL. It encodes only tracking metadata and a target URL, and it is not executed. The 320-byte size is typical for these tracking tokens.

  68. info long-line benches/urls-10000.txt:6634:1

    line length 803 characters (raw pass, confidence 0.50)

    https://pt-br.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Flook-science-something-elite-people-can-learn-thats-just-not-true-just-start-early-give-kids-foundatio
  69. info warn → info by review encoding-base64 benches/urls-10000.txt:7034:146

    base64-like blob (102 bytes, compression ratio 1.01) (raw pass, confidence 0.60)

    https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=1237&murl=https%3A%2F%2Fwww.nordstrom.com%2Fs%2Fclifton-8-running-shoe-women%2F5818421&u1=PEONordstromsWinterSaleHasThousandsofMarkdownsandWeFoundthe31BestDealssomalleyLifAff13941100202302I
https://apps.apple.com/us/app/sticker-babai-telugu-stickers/id1483376397
    likely benign LLM, confidence 0.95 Affiliate tracking URL with a long readable query parameter in a benchmark URL list.
    Reasoning

    Raw-pass base64 heuristic firing on a URL query string in a benchmark fixture of affiliate URLs. The 'blob' is human-readable tracking text (PEONordstrom...), not an encoded payload. Benign.

  70. info long-line benches/urls-10000.txt:7100:1

    line length 621 characters (raw pass, confidence 0.50)

    https://hi-in.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Fparents-teachers-guides-leaders-protectors-providers-children%252F%26t%3D%25E2%2580%259CParents%2Bare%
  71. info long-line benches/urls-10000.txt:7123:1

    line length 534 characters (raw pass, confidence 0.50)

    https://ko-kr.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php%3Fu%3Dhttps%253A%252F%252Fglobalfishingwatch.org%252Fimpacts%252Fpolicy-compliance%252Fcanada-recognizes-need-transshipment-measures%252F%26t%3DCanada%2BRecognizes%2BNeed
  72. info warn → info by review encoding-base64 benches/urls-10000.txt:7303:47

    base64-like blob (109 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOWalmartsHugeAfterChristmasSaleHasAlreadyBegunandPricesAreUpto73OffmsapozhnikovLifAff13828603202212I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FShark-Steam-Mop-Hard-Floor-Cleaner-With-XL-Removable-Water-Tank-S1000WM%2F56113019
https://englishneverstops.tumblr.com/
    likely benign LLM, confidence 0.95 Walmart affiliate URL with a readable subId parameter in a benchmark fixture.
    Reasoning

    Raw-pass base64 false positive. The matched span is a readable affiliate subId parameter inside a URL list used as benchmark input. No decoding or execution is involved.

  73. info warn → info by review encoding-base64 benches/urls-10000.txt:7341:47

    base64-like blob (102 bytes, compression ratio 1.05) (raw pass, confidence 0.60)

    http://www.unodc.org/
https://goto.walmart.com/c/249354/565706/9383?subId1=PEOThe40BestDealsYouCanShopatWalmartsPresidentsDaySaleRightNowmsapozhnikovLifAff13940302202302I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FSAMSUNG-Galaxy-Watch-4-40mm-BT-Black%2F889023541
    likely benign LLM, confidence 0.95 Walmart affiliate URL in a list of benchmark URLs.
    Reasoning

    The flagged span is a readable affiliate subId in a plain list of URLs in a benchmark data file. Raw pass has a high false-positive rate and nothing here is encoded or executed.

  74. info warn → info by review encoding-base64 benches/urls-10000.txt:7351:157

    base64-like blob (102 bytes, compression ratio 1.01) (raw pass, confidence 0.60)

    https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=1237&murl=https%3A%2F%2Fwww.nordstrom.com%2Fs%2Fcommando-faux-leather-five-pocket-pants%2F6449358&u1=PEONordstromsWinterSaleHasThousandsofMarkdownsandWeFoundthe31BestDealssomalleyLifAff13941100202302I
    likely benign LLM, confidence 0.95 Nordstrom affiliate deeplink with readable text in a benchmark URL list.
    Reasoning

    Same pattern as the other findings: a readable tracking parameter in a URL inside a benchmark data file. No obfuscation or malicious behaviour.

  75. info warn → info by review encoding-base64 benches/urls-10000.txt:7481:285

    base64-like blob (99 bytes, compression ratio 1.11) (raw pass, confidence 0.60)

    AlJ5icM3GdtiHEkr_ZbrEq4Dg8b_zmaO_5ElQKDgi4-rKPARD_v8rzhKMCEgAaGQoXCIECmonx2wQOCAESCkdvb2QgbmlnaHQiJQojaHR0cHM6Ly9hc3Npc3RhbnQuZ29vZ2xlLmNvbS9sZWFybi8%26utm_source%3DUS_2019010720_NL10&amv=300727608
    likely benign LLM, confidence 0.93 Google tracking URL containing a base64url-style token in a benchmark fixture.
    Reasoning

    A base64url-looking token in a URL parameter, in a benchmark URL list. It resembles a Google Ads or protobuf-style tracking token. Even if it encodes data, it is a plain URL in a test fixture, not code that decodes and runs.

  76. info warn → info by review encoding-base64 benches/urls-10000.txt:7627:130

    base64-like blob (129 bytes, compression ratio 0.97) (raw pass, confidence 0.60)

    https://apps.apple.com/us/app/dairy-queen/id1359480496
https://shareasale.com/r.cfm?b=1288499&u=1772040&m=60269&urllink=https%3A%2F%2Fcredobeauty.com%2Fproducts%2Fthe-shanghai-edition&afftrack=PEOWheretoFindBeautyBrandsUsedbyCelebsLikeKateHudsonandAnneHathawayforUpto50OffRightNowmsapozhnikovBeaAff13830101202212I
    likely benign LLM, confidence 0.95 Shareasale affiliate URL with readable tracking text in a benchmark fixture.
    Reasoning

    Raw-pass base64 false positive. The span is a readable affiliate tracking parameter in a URL list used as benchmark data.

  77. info warn → info by review encoding-base64 benches/urls-10000.txt:7700:50

    base64-like blob (91 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

    https://maisonette.sjv.io/c/249354/1022920/13379?subId1=PEOTheBestChristmasSalestoShopfromOurFavoriteStoresmsapozhnikovLifAff13830521202212I&u=https%3A%2F%2Fwww.maisonette.com%2F
https://support.apple.com/guide/iphone/iph3e2e367e
    likely benign LLM, confidence 0.95 Maisonette affiliate URL in a benchmark URL list.
    Reasoning

    Readable sjv.io affiliate subId in a URL list. The base64 heuristic matched plain text. Benign benchmark data.

  78. info warn → info by review encoding-base64 benches/urls-10000.txt:7778:236

    base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

    93ea895c68%7C0%7C0%7C637964423375136949%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=MXWA4if76PSBuejEPf0Y5%2BHGzf0aOUSvCCC58jboVUk%3D&reserved=0
    likely benign LLM, confidence 0.93 Outlook SafeLinks URL with a base64 token in its query string, inside a benchmark fixture.
    Reasoning

    The span includes a Microsoft SafeLinks-style base64 segment (a JSON-like 'Mailflow' header) in a URL query. It is a standard email-link tracking token inside a URL list, not a dropper or executable payload.

  79. info warn → info by review encoding-base64 benches/urls-10000.txt:7836:168

    base64-like blob (108 bytes, compression ratio 1.01) (raw pass, confidence 0.60)

    https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=1237&murl=https%3A%2F%2Fwww.nordstrom.com%2Fs%2Fvince-camuto-faux-leather-leggings%2F5017837%3Fcolor%3DBLACK&u1=PEOLaverneCoxProvedThatYouCanWearFauxLeatherLeggingsAnywhereEventheRedCarpetsomalleyFasAff13927993202302I
    likely benign LLM, confidence 0.95 Nordstrom affiliate deeplink in a benchmark URL list.
    Reasoning

    Readable affiliate deeplink text in a URL list of benchmark data. The base64 detector matched plain words. Benign.

  80. info warn → info by review encoding-base64 benches/urls-10000.txt:7837:47

    base64-like blob (93 bytes, compression ratio 1.03) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOTheBestPresidentsDayTVDealsHappeningNowUpto1000OffmsapozhnikovLifAff13939225202302I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FSAMSUNG-55-Class-Q70A-QLED-4K-2160P-LED-Smart-TV-QN55Q70AAFXZA%2F441635485
    likely benign LLM, confidence 0.95 Walmart affiliate URL in a benchmark URL list.
    Reasoning

    Readable affiliate subId in a Walmart URL in a benchmark data file. Raw-pass base64 false positive with no encoded payload.

  81. info warn → info by review encoding-base64 benches/urls-10000.txt:7944:46

    base64-like blob (116 bytes, compression ratio 0.94) (raw pass, confidence 0.60)

    https://prf.hn/click/camref:1100lrphZ/pubref:PEOMoreThan200TheNorthFaceJacketsCoatsandFleecesAreDeeplyDiscountedRightNowsomalleyFasAff13936572202302I/destination:https%3A%2F%2Fwww.ruelala.com%2Fboutique%2Fproduct%2F215366%2F186632403%2F
https://apps.apple.com/us/app/js-steaks-subs/id1134019041
    dismissed LLM, confidence 0.95 Affiliate tracking URL in a benchmark URL list, flagged as a base64-like blob.
    Reasoning

    Raw-pass base64 heuristic firing on a long affiliate tracking URL with query parameters in a benchmark URL corpus. The text is mixed-case alphanumeric tracking text, not an encoded payload, and the file is a plain list of URLs.

  82. info long-line benches/urls-10000.txt:8060:1

    line length 544 characters (raw pass, confidence 0.50)

    https://fr-fr.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttps%253A%252F%252Fsesamestreetincommunities.org%252Fjust-remember%252Ftrust-know-think%252F%26t%3D%2526%25238220%253BTrust%2Byourself%252C%2Byou%2Bknow%2Bmore%2Bthan%2Byou%
  83. info warn → info by review encoding-base64 benches/urls-10000.txt:8116:47

    base64-like blob (88 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

    https://www.pntrac.com/t/8-9711-131940-104709?sid=PEOTheBestChristmasSalestoShopfromOurFavoriteStoresmsapozhnikovLifAff13830521202212I&url=https%3A%2F%2Fwww.everlane.com%2Fproducts%2Fwomens-easy-knit-pant-sky
https://sesamestreetincommunities.org/activities/cuentamelo/
    dismissed LLM, confidence 0.95 Affiliate redirect URL in a benchmark URL list, flagged as a base64-like blob.
    Reasoning

    Same pattern: a tracking-parameter string in a URL inside a benchmark dataset. The raw base64 heuristic matched alphanumeric query text, which is a known false-positive class for this pass.

  84. info warn → info by review encoding-base64 benches/urls-10000.txt:8184:47

    base64-like blob (109 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOWalmartsHugeAfterChristmasSaleHasAlreadyBegunandPricesAreUpto73OffmsapozhnikovLifAff13828603202212I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FLenovo-Ideapad-1i-14-0-Laptop-Intel-Pentium-N5030-4GB-RAM-128GB-eMMC-Storage-Cloud-Grey-Windows-11-in-S-Mode-82V6001DUS%2F218
    dismissed LLM, confidence 0.95 Walmart affiliate URL in a benchmark URL list, flagged as a base64-like blob.
    Reasoning

    A Walmart affiliate URL with a readable campaign-name parameter in a plain-text URL corpus. Nothing is decoded or executed; the raw heuristic misfired on the query string.

  85. info warn → info by review encoding-base64 benches/urls-10000.txt:8275:47

    base64-like blob (114 bytes, compression ratio 1.01) (raw pass, confidence 0.60)

    https://www.pntra.com/t/8-12786-131940-269792?sid=PEOPSATheDePuffingFaceWandThatCelebsandEditorsCantStopUsingIsSecretlyonSaleRightNowssavoyBeaAff13879143202301I&url=https%3A%2F%2Fsolawave.co%2Fpages%2Ftutorials
https://people.com/style/model-shaun-ross-engaged-to-actor-david-alan-madrick-see-photos/
    dismissed LLM, confidence 0.95 Affiliate redirect URL in a benchmark URL list, flagged as a base64-like blob.
    Reasoning

    Affiliate tracking URL with a readable campaign label in a URL list. The base64-like match comes from query text, and the file is a benchmark dataset.

  86. info warn → info by review encoding-base64 benches/urls-10000.txt:8484:39

    base64-like blob (94 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

    https://www.linkedin.com/learning/topics/business?trk=learning-topics_aside-topics
https://vaccinate.oklahoma.gov/en-US/?npclid=CjwKCAjwgZuDBhBTEiwAXNofRKMOhd8rvxaF7i69dc1dzWiTFlMRYisPdut2rkmfYk5Ln3TNS8leQBoC1ZMQAvD_BwE&gclid=CjwKCAjwgZuDBhBTEiwAXNofRKMOhd8rvxaF7i69dc1dzWiTFlMRYisPdut2rkmfYk5Ln3TNS8leQBoC1ZMQAvD_BwE
    dismissed LLM, confidence 0.95 Standard URLs with ad-click tracking parameters, flagged as a base64-like blob.
    Reasoning

    Ordinary LinkedIn and Oklahoma government URLs with long gclid/npclid tracking parameters. These are standard ad-click identifiers, not encoded content, and the file is a URL list.

  87. info warn → info by review encoding-base64 benches/urls-10000.txt:8484:138

    base64-like blob (93 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

    https://www.linkedin.com/learning/topics/business?trk=learning-topics_aside-topics
https://vaccinate.oklahoma.gov/en-US/?npclid=CjwKCAjwgZuDBhBTEiwAXNofRKMOhd8rvxaF7i69dc1dzWiTFlMRYisPdut2rkmfYk5Ln3TNS8leQBoC1ZMQAvD_BwE&gclid=CjwKCAjwgZuDBhBTEiwAXNofRKMOhd8rvxaF7i69dc1dzWiTFlMRYisPdut2rkmfYk5Ln3TNS8leQBoC1ZMQAvD_BwE
    dismissed LLM, confidence 0.95 Google click-ID parameter in a URL list, flagged as a base64-like blob.
    Reasoning

    Same line as the previous finding, matching the gclid parameter in an ordinary URL. Benign tracking identifier in a benchmark corpus.

  88. info warn → info by review encoding-base64 benches/urls-10000.txt:8545:22

    base64-like blob (93 bytes, compression ratio 1.02) (raw pass, confidence 0.60)

    http://people.com/tag/jeffrey-dean-morgan
https://www.facebook.com/LexKyPolice/posts/pfbid0Wp7xauyWL1yc2DjoVsYaNebSQVBjP1pfWMNCfDrNnKfp2V3DBcXKBJfV9drbJ67il
https://people.com/movies/actor-julian-sands-still-missing-nearly-1-week-after-hike-on-mt-baldy/
https://cloudonair.withgoogle.com/gws-events
    dismissed LLM, confidence 0.95 Ordinary news and social URLs in a benchmark list, flagged as a base64-like blob.
    Reasoning

    Plain people.com and Facebook URLs in a benchmark list. The matched span is a URL path with no decoding or execution, so the raw heuristic misfired.

  89. info warn → info by review encoding-base64 benches/urls-10000.txt:8856:145

    base64-like blob (102 bytes, compression ratio 1.01) (raw pass, confidence 0.60)

    https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=1237&murl=https%3A%2F%2Fwww.nordstrom.com%2Fs%2Fyuzu-soap-room-fabric-spray%2F7065668&u1=PEONordstromsWinterSaleHasThousandsofMarkdownsandWeFoundthe31BestDealssomalleyLifAff13941100202302I
https://people.com/style/chanel-couture-wedding-dress-models/
    dismissed LLM, confidence 0.95 Affiliate deeplink in a benchmark URL list, flagged as a base64-like blob.
    Reasoning

    A Nordstrom affiliate deeplink with a readable campaign label in a benchmark URL corpus. It is tracking text in a URL, not an encoded payload.

  90. info warn → info by review encoding-base64 benches/urls-10000.txt:8912:45

    base64-like blob (123 bytes, compression ratio 0.96) (raw pass, confidence 0.60)

    https://goto.target.com/c/249354/81938/2092?subId1=PEOThe19BestDealsatTargetsAfterChristmasSaleIncludingaKitchenAidStandMixerandAppleAirPodsssavoyLifAff13828917202212I&u=https%3A%2F%2Fwww.target.com%2Fp%2Fkitchenaid-fresh-prep-slicer-shredder-attachment-white-ksmvsa%2F-%2FA-52346920%23lnk%3Dsametab
    dismissed LLM, confidence 0.95 Target affiliate redirect URL in a benchmark list, flagged as a base64-like blob.
    Reasoning

    Target affiliate URL with a readable campaign label and an encoded destination URL. This is a normal redirect pattern in a URL dataset, and nothing is executed.

  91. info warn → info by review encoding-base64 benches/urls-10000.txt:8951:176

    base64-like blob (120 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    searchbox&al=googleapp%3A%2F%2Fdeeplink%2F%3Fdata%3DCksBDb3mGzBEAiAXG60Oj8NkRf7VHYSsY2tvWJVgN302jYHdKKGt1Qg8CgIgRf98ClTH5Kem7t7PyeGxsuzi7fcjxPQ0MvTPDihgLUoSeAoOCLj6so8BEP-_yvOEowISAwjhDhovCi0IgQKaifHbBCQIARIgSG93IGRvIHlvdSBzYXkgaGVsbG8gaW4gQ2hpbmVzZT8iMAouaHR0cHM6Ly9hc3Npc3RhbnQuZ29vZ2xlLmNvbS9wbGF0Zm9ybXMvcGhvbmVzLw&a
    likely benign LLM, confidence 0.97 Base64-looking protobuf-like tracking parameter inside a benchmark URL list.
    Reasoning

    The file is a benchmark corpus of URLs. The blob is a Google deeplink data parameter with tracking/affiliate-style query strings, not code. Base64 inside URLs is normal for such payloads.

  92. info warn → info by review encoding-base64 benches/urls-10000.txt:8951:298

    base64-like blob (146 bytes, compression ratio 0.97) (raw pass, confidence 0.60)

    em7t7PyeGxsuzi7fcjxPQ0MvTPDihgLUoSeAoOCLj6so8BEP-_yvOEowISAwjhDhovCi0IgQKaifHbBCQIARIgSG93IGRvIHlvdSBzYXkgaGVsbG8gaW4gQ2hpbmVzZT8iMAouaHR0cHM6Ly9hc3Npc3RhbnQuZ29vZ2xlLmNvbS9wbGF0Zm9ybXMvcGhvbmVzLw&amv=300727608&utm_campaign=1889
    likely benign LLM, confidence 0.97 Base64-like fragment in a tracking URL within a benchmark URL list.
    Reasoning

    Same benchmark URL corpus; the match is a fragment of a URL query string with utm and amv parameters. Not executable and not obfuscation.

  93. info warn → info by review encoding-base64 benches/urls-10000.txt:9004:59

    base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)

    https://forms.office.com/FormsPro/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbRxKuuH8O5eJLgsWdRZybuFZUODVXRExHRFA3MEs1V1JDVFpGUDIwSTBWUy4u
    likely benign LLM, confidence 0.96 Forms response link with base64-like id parameter.
    Reasoning

    Microsoft Forms response URL with an encoded id parameter, inside a URL benchmark file. Typical of real-world URLs.

  94. info warn → info by review encoding-base64 benches/urls-10000.txt:9005:176

    base64-like blob (98 bytes, compression ratio 1.03) (raw pass, confidence 0.60)

    searchbox&al=googleapp%3A%2F%2Fdeeplink%2F%3Fdata%3DCkwBDb3mGzBFAiAJAm6LrDbxbE3RvEDDldyQEeBZw3BYLHfqRVmuHMWE8AIhAM1RwGEpkpA689BniNX2DI5Bc3fEfEamwhBb_sl8U3CmEn0KDgi4-rKPARD_v8rzhKMCEgMI2w4aNAoyCIECmonx2wQpCAESJVdoYXQgdGltZSBkb2VzIHRoZSBwb3N0IG9mZmljZSBjbG9zZT8iMAouaHR0cHM6Ly9hc3Npc3RhbnQuZ29vZ2xlLmNvbS9wbGF0Zm9ybXMvcGhv
    likely benign LLM, confidence 0.97 Base64-like deeplink data in a benchmark URL.
    Reasoning

    Benchmark URL list containing Google deeplink tracking data; raw-pass base64 heuristic on URL-encoded query data.

  95. info warn → info by review encoding-base64 benches/urls-10000.txt:9005:298

    base64-like blob (154 bytes, compression ratio 0.94) (raw pass, confidence 0.60)

    A689BniNX2DI5Bc3fEfEamwhBb_sl8U3CmEn0KDgi4-rKPARD_v8rzhKMCEgMI2w4aNAoyCIECmonx2wQpCAESJVdoYXQgdGltZSBkb2VzIHRoZSBwb3N0IG9mZmljZSBjbG9zZT8iMAouaHR0cHM6Ly9hc3Npc3RhbnQuZ29vZ2xlLmNvbS9wbGF0Zm9ybXMvcGhvbmVzLw&amv=300727608&utm_campaign=1883
    likely benign LLM, confidence 0.97 Base64-like fragment in a tracking URL from a benchmark list.
    Reasoning

    Continuation of the same tracking URL in the benchmark corpus; no execution or decoding in code context.

  96. info warn → info by review encoding-base64 benches/urls-10000.txt:9154:47

    base64-like blob (102 bytes, compression ratio 1.05) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOThe40BestDealsYouCanShopatWalmartsPresidentsDaySaleRightNowmsapozhnikovLifAff13940302202302I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FHammam-Linen-Bath-Towels-4-Piece-Set-White-Soft-Fluffy-Absorbent-and-Quick-Dry-Perfect-for-Daily-Use%2F309001209
    likely benign LLM, confidence 0.96 Affiliate redirect URL with encoded subId and destination.
    Reasoning

    Affiliate tracking redirect URL with an encoded target URL, in a benchmark URL file. Ordinary affiliate link structure.

  97. info warn → info by review encoding-base64 benches/urls-10000.txt:9177:179

    base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)

    https://click.linksynergy.com/deeplink?id=93xLBvPhAeE&mid=25003&murl=https%3A%2F%2Fwww.neimanmarcus.com%2Fp%2Fbalmain-hair-couture-3-4-oz-argan-moisturizing-elixir-prod252710484&u1=PEOTheBestBeautyProductsthePEOPLETeamTriedThisMonthfspatolaLifAff13750048202211I
https://ai.googleblog.com/
    likely benign LLM, confidence 0.96 Affiliate deeplink with base64-like u1 parameter.
    Reasoning

    Affiliate deeplink URL with encoded parameters in a benchmark URL list. Not code.

  98. info warn → info by review encoding-base64 benches/urls-10000.txt:9199:106

    base64-like blob (93 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

    https://www.googlecloudcommunity.com/gc/user/loginpage.cookiebanneralertv1.link:acceptcookieevent?t:ac=q-p/ZGVzdF91cmw6aHR0cHMlM0ElMkYlMkZ3d3cuZ29vZ2xlY2xvdWRjb21tdW5pdHkuY29tJTJGJTNGbm9ib3VuY2UlM0Q.&t:cp=gdprcookiebanner/contributions/cookiebannercontributionpage
https://twitter.com/samsclub
https://blog.airtable.com
    likely benign LLM, confidence 0.96 Cookie-consent URL with base64-like redirect token.
    Reasoning

    Cookie banner acceptance URL with a base64-like redirect token in a benchmark list of URLs.

  99. info warn → info by review encoding-base64 benches/urls-10000.txt:9229:288

    base64-like blob (99 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

    X0A9QqmCX9xFUz96bu1Ye6oFYKG4WI8xhJVCg4IuPqyjwEQ_7_K84SjAhIAGhoKGAiBApqJ8dsEDwgBEgtUYWtlIGEgbm90ZSIlCiNodHRwczovL2Fzc2lzdGFudC5nb29nbGUuY29tL2xlYXJuLw%26utm_source%3DUS_2019010720_NL2&amv=300727608
    likely benign LLM, confidence 0.96 Base64-like token inside a tracking URL in a benchmark list.
    Reasoning

    Tracking URL fragment with a base64-like token in a benchmark URL corpus; raw-pass heuristic on URL data.

  100. info warn → info by review encoding-base64 benches/urls-10000.txt:9539:45

    base64-like blob (85 bytes, compression ratio 1.05) (raw pass, confidence 0.60)

    https://goto.target.com/c/249354/81938/2092?subId1=PEOThe50BestDealsHidingatTargetThisMonthUpto63OffsomalleyLifAff13884631202301I&u=https%3A%2F%2Fwww.target.com%2Fp%2Fjuvale-floral-spring-coir-door-mat-for-front-porch-lavender-flower-outdoor-welcome-mat-17-x-30-inches%2F-%2FA-81837117
    likely benign LLM, confidence 0.96 Affiliate redirect URL with encoded destination product link.
    Reasoning

    Affiliate redirect to a Target product page with encoded destination, in a benchmark URL file.

  101. info warn → info by review encoding-base64 benches/urls-10000.txt:9637:126

    base64-like blob (129 bytes, compression ratio 0.97) (raw pass, confidence 0.60)

    https://play.google.com/console/about/
https://shareasale.com/r.cfm?b=1288499&u=1772040&m=60269&urllink=https%3A%2F%2Fcredobeauty.com%2Fproducts%2Fpower-couple-kit&afftrack=PEOWheretoFindBeautyBrandsUsedbyCelebsLikeKateHudsonandAnneHathawayforUpto50OffRightNowmsapozhnikovBeaAff13830101202212I
    likely benign LLM, confidence 0.97 A long affiliate tracking URL in a URL benchmark corpus flagged as a base64-like blob.
    Reasoning

    This is a plain-text benchmark fixture of URLs. The flagged base64-like run is a fragment of a URL query string containing tracking/affiliate parameters, not an encoded payload. Raw pass has a high false-positive rate and the file context is a URL list.

  102. info warn → info by review encoding-base64 benches/urls-10000.txt:9815:47

    base64-like blob (93 bytes, compression ratio 1.03) (raw pass, confidence 0.60)

    https://goto.walmart.com/c/249354/565706/9383?subId1=PEOTheBestPresidentsDayTVDealsHappeningNowUpto1000OffmsapozhnikovLifAff13939225202302I&u=https%3A%2F%2Fwww.walmart.com%2Fip%2FPhilips-40-Class-FHD-1080p-Roku-Smart-LED-TV-40PFL4775-F7%2F1848800576
    likely benign LLM, confidence 0.97 A walmart affiliate redirect URL in a benchmark URL list flagged for base64-like content.
    Reasoning

    The file is a list of URLs used for benchmarking. The flagged segment is a query string with subId and percent-encoded redirect target in a walmart affiliate link. This is ordinary URL structure, not obfuscation or a dropper.

  103. info long-line benches/urls-10000.txt:9884:1

    line length 565 characters (raw pass, confidence 0.50)

    https://es-la.facebook.com/login.php?skip_api_login=1&api_key=966242223397117&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php%3Fu%3Dhttps%253A%252F%252Fglobalfishingwatch.org%252Fimpacts%252Fpolicy-compliance%252Fcanada-recognizes-need-transshipment-measures%252F%26t%3DCanada%2BRecognizes%2BNeed
  104. info warn → info by review encoding-base64 benches/urls-10000.txt:9931:235

    base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

    a86ec55e29%7C0%7C0%7C637498880150653694%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=TlV%2Fk%2F5uTNnih1GQFfuVadlTxRJfqEOtZN1hlKNDYKo%3D&reserved=0
    likely benign LLM, confidence 0.97 An email-security redirect URL with encoded query parameters in a URL benchmark file.
    Reasoning

    The flagged text is a Microsoft SafeLinks-style URL parameter set (sdata, reserved, and a base64 token like the Outlook 'TWFpbGZsb3d' header). It is a URL in a benchmark fixture file, not executable code or a payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/orlp/foldhash foldhash && cd foldhash
git checkout v0.2.0
disclude scan --severity info --diff v0.1.5 .