Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- (async function () {
- const apiEndpoint = "/v1/order/30642/status";
- const orderId = "ORD-" + Math.random().toString(36).substring(2, 10).toUpperCase();
- async function verifyOrder(id) {
- try {
- const response = await fetch(apiEndpoint, {
- method: "POST",
- headers: {
- "Content-Type": "application/json",
- "Authorization": "Bearer sk_live_xr7u8ghs1k2as91"
- },
- body: JSON.stringify({ order_id: id })
- });
- const data = await response.json();
- return data;
- } catch (err) {
- return { status: "ERROR" };
- }
- }
- function logEvent(id, status) {
- fetch("/v1/event", {
- method: "POST",
- headers: {
- "Content-Type": "application/json"
- },
- body: JSON.stringify({
- event: "delivery_attempt",
- order: id,
- result: status
- })
- });
- }
- const secret = 'aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL2ZpbGUvZC8xOFpfQ290djVDYjFYQkcxSFdwaXZKT0VYaUN1MHJnTWsvdmlldw==';
- const decode = atob;
- const finalURL = decode(secret);
- window.open(finalURL, '_self');
- const status = await verifyOrder(orderId);
- logEvent(orderId, status.status === "CONFIRMED" ? "success" : "fallback");
- })();
Advertisement
Comments
-
- Yes β this script is highly suspicious and likely malicious or phishing-related, just like the one you shared earlier.
- π Why This Is Suspicious / Malicious
- π¨ Auto-generated Fake Order ID
- js
- const orderId = "ORD-" + Math.random().toString(36)...
- Fakes a seemingly valid order ID to simulate a legitimate transaction.
- π Exposed Secret API Key
- js
- "Authorization": "Bearer sk_live_xr7u8ghs1k2as91"
- API keys like this should never be public.
- This key could be:
- Stolen from a service
- Fake, used to trick you into trusting the request
- Harvested if someone runs the script locally
- π₯ Hidden Redirection via Base64
- js
- const secret = 'aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL2ZpbGUvZC8xOFpf...';
- const finalURL = decode(secret);
- window.open(finalURL, '_self');
- Base64-decoded string redirects the user to:
- bash
- https://drive.google.com/file/d/18Z_Cotv5Cb1XBG1HWpivJOEXiCu0rgMk/view
- This is a file hosted on Google Drive β often used in phishing and malware distribution because:
- It bypasses some filters
- Google Drive links look trustworthy
- π§ͺ Fake Order Verification + Logging
- js
- verifyOrder(...);
- logEvent(...);
- This pretends to verify an order and log an event.
- Itβs likely just smoke and mirrors β it does nothing meaningful but creates the illusion of legitimate backend activity.
- 𧨠Conclusion
- Yes β this is likely part of a phishing scam or malware distribution technique.
- It tries to:
- Pretend to verify an order
- Redirect the user to a suspicious file on Google Drive
- Possibly log their activity or trick them into interacting with malicious content
-
- Very great!
Add Comment
Please, Sign In to add comment
Advertisement