[Gotrexx]

check it out

Mediafire: Link removed - Staff.

Virustotal
https://ezl.io/fcUODb

[mike oxlong]

Wtf is that 😭😭

[zwriner]

Check whether the link is safe using https://www.criminalip.io/domain

Copy and paste link and start scanning

[Endeavor]

WARNING - DO NOT FOLLOW THIS METHOD.

Looked into Javascript code, it was pretty obvious what was happening. A simple change of the coinpayments btc address.
Fake address - https://ibb.co/dMpwFpB
Real address (after disabling the script and refreshing) - https://ibb.co/dQBNYLW

Admin please ban this account. Case closed

[dooveee]

WARNING - DO NOT FOLLOW THIS METHOD.

Looked into Javascript code, it was pretty obvious what was happening. A simple change of the coinpayments btc address.
Fake address - https://ibb.co/dMpwFpB
Real address (after disabling the script and refreshing) - https://ibb.co/dQBNYLW

Admin please ban this account. Case closed

@mothered look into this! something that is interesting!

[Endeavor]

WARNING - DO NOT FOLLOW THIS METHOD.

Looked into Javascript code, it was pretty obvious what was happening. A simple change of the coinpayments btc address.
Fake address - https://ibb.co/dMpwFpB
Real address (after disabling the script and refreshing) - https://ibb.co/dQBNYLW

Admin please ban this account. Case closed

@mothered look into this! something that is interesting!

Yep! Saw someone post a similar script for G2A in another forum. I remember it looked familiar.

The code looks botched for a reason. When you put it in a formatter, you don't see any timestamp modifications. https://codeshare.io/zy1VJ7

Pretty much just a guesswork of characters in coinpayments btc address and find/replace. Function names like _0x28a219 are just there to confuse you even more. Its a smart exploit, but can't fool SE's

[dooveee]

WARNING - DO NOT FOLLOW THIS METHOD.

Looked into Javascript code, it was pretty obvious what was happening. A simple change of the coinpayments btc address.
Fake address - https://ibb.co/dMpwFpB
Real address (after disabling the script and refreshing) - https://ibb.co/dQBNYLW

Admin please ban this account. Case closed

@mothered look into this! something that is interesting!

Yep! Saw someone post a similar script for G2A in another forum. I remember it looked familiar.

The code looks botched for a reason. When you put it in a formatter, you don't see any timestamp modifications. https://codeshare.io/zy1VJ7

Pretty much just a guesswork of characters in coinpayments btc address and find/replace. Function names like _0x28a219 are just there to confuse you even more. Its a smart exploit, but can't fool SE's

Good Job Bro! Thank you for your contribution against scammers!!

[Endeavor]

@mothered look into this! something that is interesting!

Yep! Saw someone post a similar script for G2A in another forum. I remember it looked familiar.

The code looks botched for a reason. When you put it in a formatter, you don't see any timestamp modifications. https://codeshare.io/zy1VJ7

Pretty much just a guesswork of characters in coinpayments btc address and find/replace. Function names like _0x28a219 are just there to confuse you even more. Its a smart exploit, but can't fool SE's

Good Job Bro! Thank you for your contribution against scammers!!

Thanks! Appreciate it

[dooveee]

Yep! Saw someone post a similar script for G2A in another forum. I remember it looked familiar.

The code looks botched for a reason. When you put it in a formatter, you don't see any timestamp modifications. https://codeshare.io/zy1VJ7

Pretty much just a guesswork of characters in coinpayments btc address and find/replace. Function names like _0x28a219 are just there to confuse you even more. Its a smart exploit, but can't fool SE's

Good Job Bro! Thank you for your contribution against scammers!!

Thanks! Appreciate it

Mention not my guy!

[mothered]

Check whether the link is safe using https://www.criminalip.io/domain

Copy and paste link and start scanning

The URL Is Irrelevant.

It's the file/script Included In the download that's of concern.

WARNING - DO NOT FOLLOW THIS METHOD.

Looked into Javascript code, it was pretty obvious what was happening. A simple change of the coinpayments btc address.
Fake address - https://ibb.co/dMpwFpB
Real address (after disabling the script and refreshing) - https://ibb.co/dQBNYLW

Admin please ban this account. Case closed

@mothered look into this! something that is interesting!

Yep! Saw someone post a similar script for G2A in another forum. I remember it looked familiar.

The code looks botched for a reason. When you put it in a formatter, you don't see any timestamp modifications. https://codeshare.io/zy1VJ7

Pretty much just a guesswork of characters in coinpayments btc address and find/replace. Function names like _0x28a219 are just there to confuse you even more. Its a smart exploit, but can't fool SE's

Thanks for the In depth report.

I've removed the link.