Pinaki 0xInfection

Been observing rampant phishing activity targeting people of Ukraine offering Visa as bait.

Links formatted particularly like this are being forwarded inside emails/chat:

https://evisa.mfa.gov.ua:login@%6D%61%6C%69%63%69%6F%75%73%2E%73%69%74%65

A quick glance will convince any user that the link will lead you to the login portal of https://evisa.mfa.gov.ua. But it won't. Clicking the link in the browser will lead you to the domain https://malicious.site.

Why? A root URL format looks like this (as defined in RFC 1808, Section 2.1):

Keybase proof

I hereby claim:

I am 0xinfection on github.
I am 0xinfection (https://keybase.io/0xinfection) on keybase.
I have a public key ASBkHvsMAdUMWiHWf1hEMUVSlakEgETmpUX8h0Rhj5Rj2Qo

To claim this, I am signing this object:

	#!/usr/bin/env python3
	# -- coding: utf-8 --

	import sys
	import ipaddress
	import socket
	import requests
	from const import HTTP_PORTS

	def determine_http(ip: str, port: str):

	-----BEGIN PGP PUBLIC KEY BLOCK-----

	mQGNBGEOixEBDACtAlQbrIotG59Ako+8+ZSwr1iqpReGGSY/kueXlB4cyyNzVdPw
	V7Tfub8rjqHjUDmz5T4xPlGPID/D5F5l3QIsfMIHiqszq4DgL46wFefH92uJRb0w
	8vhHMgaf1XiXxghR3i/ZNj5TxzsF5BwkgkbyA2lypbh/ks7/F/fLOIT93aGUOs65
	szIXnMd+xhUtzaU3WIlk84agxSnzN9vim3FIETUaF0+2/Hc3D0IyM1+dDXYAYW//
	E3K3JKnp0KvrKdOz8q6M0LI5niemBK7xPQqnxJ1jIGoCAEjSAYv8QiJlFeWdLlf9
	JVjmGTN2eXISq8uYMkcFy8orhPjfIWewgiIkMk4SYoS4sgC+PE+rf8GSwfbYe+lc
	iVsCeJKuKB9ybAdgp6wW6ZG7NNG4E1t9/B7+/3/9Lu9yWCi7Lp/DvGRvXwa0UtoL
	Q/0DAItNm+TpjNBrpCn+Ea2PoY1lUa7DosMx0gKnRyOYigOKPxwcPiK9U+ZcO0q6

	name: My Custom Automation Setup

	on:
	# Triggers the workflow when you push a commit to master branch
	push:
	branches: [ master ]
	# Allows you to run this workflow manually from the Actions tab
	workflow_dispatch:

	jobs:

	jd = {
	"left": {
	"left": {
	"type": "Literal",
	"value": "a"
	},
	"right": {
	"type": "Literal",
	"value": "b"
	}

	import "sync"

	func exampleFunc(str string) {
	// function to run concurrently
	}

	func main() {
	threadVal := 50 // number of threads to use
	allItems := []string{} // the slice containing whatever you want to pass to exampleFunc
	// creating a channel of strings, use whatever type the exampleFunc() takes in

	# Do reverse ip lookup via the yougetsignal.com API (illegally).
	# No license, do whatever you want to do with this script.

	import io
	import json
	import time
	import requests

	def request(webs: str):
	url = "https://domains.yougetsignal.com/domains.php"

	#!KAMAILIO
	#
	# Kamailio (OpenSER) SIP Server v5.1 - default configuration script
	# - web: https://www.kamailio.org
	# - git: https://github.com/kamailio/kamailio
	#
	# Direct your questions about this file to: <[email protected]>
	#
	# Refer to the Core CookBook at https://www.kamailio.org/wiki/
	# for an explanation of possible statements, functions and parameters.

	#!/usr/bin/env python3
	# -- coding: utf-8 --

	def linSearch(arr, x):
	for i in range(0, len(arr)):
	if arr[i] == x:
	print()
	return "Element found!"

	def binSearch(arr, x, upper, lower=0):