Decode Obfuscated URLs in SMTP Logs Instantly

For network admins, security analysts, and IT pros who monitor email traffic. Paste raw SMTP logs and instantly reveal decoded URLs hidden behind percent-encoding and obfuscation — no manual decoding, no scripts, no guesswork.

Results update live as you type — no button needed. The Example button fills a sample input.

Why use SMTP Log Analyzer?

Automatically detects and decodes percent-encoded and obfuscated URLs in SMTP logs

Works with raw mail server logs, SMTP transcripts, and configuration text

Highlights potential phishing or malicious links hidden in email traffic

No data leaves your browser — analysis runs entirely client-side

Clean, copy-ready output of decoded URLs for reporting and triage

FAQ

What kinds of obfuscation does this tool decode?

It decodes percent-encoding (e.g. %70%61%74%68), common URL-encoding variants, and other obfuscation patterns frequently used to hide phishing links in SMTP logs.

Is my SMTP log data sent to a server?

No. All analysis happens locally in your browser. Your log data never leaves your device.

Can I use this for real mail server logs?

Yes. It works with standard SMTP transcripts, Postfix, Exim, Exchange, and other mail server logs, as well as raw SMTP session captures.

Why would URLs be obfuscated in SMTP logs?

Attackers often obfuscate URLs to bypass security filters and evade detection. Decoding them reveals the true destination, helping you identify phishing or malware links.

Example input

Try it with this sample — paste it into the box above:

2025-03-15 10:23:45 SMTP connection from [192.168.1.100]:54321
2025-03-15 10:23:46 <-- 220 mail.example.com ESMTP
2025-03-15 10:23:47 --> EHLO client.example.org
2025-03-15 10:23:48 <-- 250-mail.example.com
2025-03-15 10:23:49 <-- 250 OK
2025-03-15 10:23:50 --> MAIL FROM:<sender@example.org>
2025-03-15 10:23:51 <-- 250 OK
2025-03-15 10:23:52 --> RCPT TO:<user@example.com>
2025-03-15 10:23:53 <-- 250 OK
2025-03-15 10:23:54 --> DATA
2025-03-15 10:23:55 <-- 354 Start mail input; end with <CRLF>.<CRLF>
2025-03-15 10:23:56 --> Subject: Test
2025-03-15 10:23:57 --> Click here: http://example.com/%70%61%74%68?q=%74%65%73%74
2025-03-15 10:23:58 --> .
2025-03-15 10:23:59 <-- 250 OK
2025-03-15 10:24:00 --> QUIT
2025-03-15 10:24:01 <-- 221 Bye

How to use SMTP Log Analyzer

  1. Enter or paste your data into the SMTP Log or Config Text box above.
  2. The result appears instantly in the Decoded URLs box — everything runs in your browser, nothing is uploaded.
  3. Use Copy or Download to keep the result, or Example to load a sample first.

More Security & Forensics tools

🔧

Base64 Strings Extractor - Decode Every Blob in Forensic Text Dumps

Extract and decode every Base64 blob hidden in Cellebrite UFED exports, hex dumps or logs.
🔧

Code Deobfuscator - Decode Obfuscated Code Online

Free online code deobfuscator. Instantly decode URL-encoded obfuscation to reveal readable
🔧

Comcast Bill Analyzer - Compare Bills & Spot Hidden Changes

Compare two Comcast bills, terms, or emails side by side. Instantly highlight differences

🔧

Cron Time Analyzer - Cron Expression to Human Readable

Convert cron expressions to human-readable schedules and get warned about the risky 2-3 AM

Related tools

🔧

EchoSpoofing Email Spoofing Analyzer | SMTP Log Parser

Paste SMTP logs to instantly detect EchoSpoofing and email spoofing red flags. Free analyz
🔧

SMTP Log Encryption Analyzer - TLS & Plaintext Check

Paste SMTP logs to instantly detect encrypted sessions, TLS versions, and risky plaintext

🔧

Email Guard MCP Converter - SMTP Log Analyzer

Convert raw SMTP and email guard logs into a clear security report. Instantly see blocked

🔧

LLM Proxy Log Inspector: Audit Logs & Headers for Leaks

Scan LLM proxy logs and request headers for leaked model names, prompts, and user metadata
🔧

Log Action Analyzer - SMTP Log Parser & Report

Paste raw SMTP or server logs and get a structured action report with anomalies, a key-eve
🔧

Salesforce Phishing Analyzer - SMTP Log & Email Threat Scanner

Analyze SMTP logs and email headers for Salesforce phishing. Extract malicious links, send

← All tools · Security & Forensics