Latest posts of: RobertZen

Quote from: vv181 on October 10, 2021, 12:52:29 PM

Quote from: ETFbitcoin on October 10, 2021, 09:42:03 AM

~What i find suspicious is each time you reload the page, the request has different parameter value.~

Inspecting the index page, it shows

Code:

<script type="text/javascript"><!--
document.write("<img src='//counter*yadro*ru/hit?t45.11;r"+
escape(document.referrer)+((typeof(screen)=="undefined")?"":
";s"+screen.width+"*"+screen.height+"*"+(screen.colorDepth?
screen.colorDepth:screen.pixelDepth))+";u"+escape(document.URL)+
";"+Math.random()+
"' alt='' title='LiveInternet' "+
"border='0' width='1' height='1'>")
//--></script>

The parameter is a random value, but who knows what it actually does. Searching the domain also gave me a reference that it is indeed a suspicious site[1]. I look further to the site code, they partially use coinb.in code and adding up some code by themselves.

[1] https://answers.microsoft.com/en-us/protect/forum/all/what-is-counter-yadro/3b7a3384-6eba-4225-ac6f-54f58e837bdd

During the inspection, did you find anything suspicious in the code of the https://bitcoin-wallet.org ?

This code that you provided is just the counter code.