Let"s first describe the reason. Today, I received a blackmail saying that my password was leaked while visiting an insecure website. The hacker had all my information and gave me a Trojan horse implanted in my computer. It is useless to change my email password. If I don"t pay more than $900 in Bitcoin within 48 hours, my information will be posted on the Internet!
I almost believed it at first glance, and then I thought that my mailbox was set up by myself, which was only used to receive mail. I had never logged in anywhere else. After careful analysis, I thought it was deception, but in fact, there was no relevant information about me. Later, Google did confirm that it belonged to random collision, and if I was careless, I would really transfer money to him!
later, I wanted to know if there were any Trojans hidden in this email. I found that there were no attachments, so I opened the source code of this email and found that there was such a js, in it. I formatted it and posted it
< script >
var w = 3Dwindow;
if (w.performance || w.mozPerformance || w.msPerformance || w.webki = tPerformance) {
var d = 3Ddocument;
AKSB = 3Dw.AKSB || {}, AKSB.q = 3DAKSB.q || [], AKSB.m = ark = 3DAKSB.mark ||
function(e, _) {
AKSB.q.push(["mark", e, _ || (new Date).getTime( = )])
}, AKSB.measure = 3DAKSB.measure ||
function(e, _, t) {
AKSB.q.push(["measure", e, = _, t || (new Date).getTime()])
}, AKSB.done = 3DAKSB.done ||
function(e) {
AKSB.q.push = (["done", e])
}, AKSB.mark("firstbyte", (new = 20
Date).getTime()), AKSB.prof = 3D {
custid: "641075",
ustr: "",
originlat: "0",
clientr = tt: "19",
ghostip: "217.212.224.166",
ipv6: false,
pct: "10",
clientip: "46.183.219.=
233",
requestid: "2120224a",
region: "27660",
protocol: "h2",
blver: 14,
akM: "x",
akN = : "ae",
akTT: "O",
akTX: "1",
akTI: "2120224a",
ai: "441803",
ra: "false",
pmgn: "",
pmgi = : "",
pmp: "",
qc: ""
}, function(e) {
var _ = 3Dd.createElement("script");
_.async = 3D "=
async", _.src = 3De;
var = 20
t = 3Dd.getElementsByTagName("script"),
t = 3Dt[t.length - 1];
t.parentNode.insertB = efore(_, t)
}(("https:" = 3D = 3D = 3Dd.location.protocol ? "https:" : "http:") + "//ds-a=
ksb-a.akamaihd.net/aksb.min.js")
} < /script>
what"s the use of looking at what you don"t understand for a long time? will you send something out? Google found that the domain name akamaihd.net should be a proxy server, and many websites will hang on it! Passing experts can help with the analysis, thank you first passing brothers!
add: when I opened my email for the first time, I immediately received a read prompt email, as shown in the figure below. How did you do this?