A lot of malicious links are just base64'ed to another redirect service; to another base64'ed address (continue as long as your head can keep up.)