What script is this

identifying cloaking script

[Mikey]

I run across cloaked pages quite often with code similar to this at the top. Any idea what script or software this is from? (I've changed the numbers for this example.)

<script language="JavaScript">
<!--
function decode(original){
var result="";
arrayofstring=original.split(',');
for (var i=0; i <arrayofstring.length; i++) {
result=result+String.fromCharCode(arrayofstring[i]-9);
}
return result;
}
var display="65,45,44,54,484,45,47,48,57,47,54,";
document.write(decode(display));
//-->
</script>

[johnhamman]

off the top of my head it looks like a simple encoder or decoder of characters.
john

[Mikey]

I did some research and the string is just an ascii encoding of

<script>window.location.replace("http://www.affiliateURL.com");</script>

I guess for this to be effective cloaking, it must only write the script if the agent is not a spider. I've seen this encoded redirect more than once on high rankinig cloaked pages, so I'm still wondering what package does this.

[wgrogers]

Mikey:

I have been asking the same question for months without an answer. I see a number of competitors with very high rankings use this redirecting script, but no one seems to know where to get it.

If anyone has any ideas, here's another one looking for the source.

BTW Mikey, how did you decode the string? Is there a tool or resource you might point me to?

[TheDave]

wgrogers, as far as I can see the string isn't decoded as such, it's just a series of numbers each one representing a character from the ascii set, ie String.fromCharCode(65) = "A", String.fromCharCode(66) = "B" etc.. so to get the set of numbers that create that string you would need to do the reverse, ie if String = "ABC", C = String.CharCodeAt(1), String.fromCharCode(C) = "A"

[littleman]

Just in case anyone is confused, the above code is not a cloaking script. You can not do true cloaking with client side javascript.

[Mikey]

Just in case anyone is confused, the above code is not a cloaking script. You can not do true cloaking with client side javascript.

=============================

I know, and that is why I am confused here. It is a simple javascript redirect with the URL ascii encoded. But why the encoding? To hide from users or spiders? The Cached pages on this site show classic, keyword spammed cloaking pages. Is the spider agent not able to decode this?