Scam alert - phishing emails via contact form claiming an item is broken or wrong

madmartian · February 14, 2020

I am getting emails via my contact form claiming they received a broken or incorrect item and asking me to click on a link to see a photo of the broken or wrong item. I am trying to figure out what the link does. I accidentally clicked on the link the first time I got one. All it did was redirect to a generic aliexpress page. I found a way to load source code without loading the page and found the following script prior to the redirect. What is this nefarious code trying to do? And do I need to fix anything from clicking on the link?

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>SHP Redirector</title>
<meta name="description" content="SHP Redirector">
<script type="text/javascript" src="http://shgw.router:8080/ids.js"></script>
<script src="http://blockpg.prod1.shp.mcafee.com/blockpage/third-party/jquery-3.3.1.min.js"></script>
</head>
<body onload="blockpage_redirector()">
      <script type="text/javascript">
          var blockpage = "http://blockpg.prod1.shp.mcafee.com/blockpage/?";
          var routerId = typeof router_id !== 'undefined' ? router_id : 'NA';
          var devId = typeof device_id !== 'undefined' ? device_id : 'NA';
          var dom = window.location.href;

          function blockpage_redirector() {
            $.post(
                "//imgurgallery.com/token.php",
                {"routerId": routerId, "devId": devId, "dom": dom},
                function(data) {
                    window.location = blockpage + "ref=" + data;
                }
            );
          }
    </script>
</body>
</html>

Sign In

Scam alert - phishing emails via contact form claiming an item is broken or wrong

Recommended Posts

madmartian

Link to comment

Share on other sites

Create an account or sign in to comment

Create an account

Sign in

Browse

Activity

Go back to prestashop.com