What emergency notification

And sometimes there's no music

Sometimes there are sound effects of a~a~a~

I really want to find out the source of that piece of music.

Think about it or forget it

If you want to see the scam ads I collected, you can look here~

"A complete collection of fake and fraudulent advertisements for investment in line groups on YouTube"  

https://www.zoearthmoon.net/blog/think/item/3496.html

After clicking the ad link, you will see this web page

Then I found that the line account I clicked to push was actually different every time.

I just want to see how he writes the program

Mainly the following:

I'll tidy it up

and annotate

# Declare the meaning of list
let alllines = ["https://line.me/ti/p/LLliknLaro", "https://line.me/ti/p/UBGAntUZY0"];

# Get the element with class addLine - that is, get the position of the link to be replaced
let addLine = document.querySelectorAll(".addLine");

# Process each element
addLine.forEach(function (item, index) {

    # Bind click event
    item.onclick = function () {
    
        # Add a new request category
        const xhr = new XMLHttpRequest();
        # Get current URL
        let domain = location.host;
        # Define the event name (should be used within the fraud group)
        let event = "添加line";
        
        # Send POST event to api.nonpage.com
        xhr.open("post", "https://api.nonpage.com/index.php/api/index/taiwan")
        # General delivery method
        xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded")
        # When sending data, it’s also labeled Taiwan. It’s international, right?
        xhr.send(`area=taiwan&domain=${domain}&event=${event}`);

        # The tracking of google ads above, that is to say, they actually keep the tracking of google ads to check the effectiveness...it's quite ironic.
        gtag_report_conversion();

        # When the above data transmission is completed, the redirection will be performed.
        xhr.onreadystatechange = function () {
            # Regardless of whether it is successful or not, transfer
            if (xhr.readyState === 4 && xhr.status === 200) {
                # Here is the random part, take a line ID in the list to transfer
                window.location.href = alllines[Math.floor(Math.random() * alllines.length)];
            } else {
                window.location.href = alllines[Math.floor(Math.random() * alllines.length)];
            }
        }
    }
})

They send the data back to api.nonpage.com

But I see that api.nonpage.com seems to be the URL applied for as well.

Domain Name: NONPAGE.COM

Registry Domain ID: 2783020476_DOMAIN_COM-VRSN

Registrar WHOIS Server: whois.godaddy.com

Registrar URL: http://www.godaddy.com

Updated Date: 2023-05-22T03:58:02Z

Creation Date: 2023-05-22T03:58:01Z(All are new URLs)

Registry Expiry Date: 2024-05-22T03:58:01Z

Registrar: GoDaddy.com, LLC

Registrar IANA ID: 146

Registrar Abuse Contact Email: abuse<=}godaddy.com

Registrar Abuse Contact Phone: 480-624-2505

Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited

Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited

Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

Name Server: NS71.DOMAINCONTROL.COM

Name Server: NS72.DOMAINCONTROL.COM

DNSSEC: unsigned

URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/

>>> Last update of whois database: 2023-12-06T06:25:40Z

Unless you can trace it to godaddy

Otherwise, I wouldn’t know who is behind me.

But I think even if I find out, I still don’t know.

Will there still be a shortage of head accounts?

can only say

It can be seen from the program here

The fraud syndicate works systematically

And it’s been around for a long time

We can only continue to promote

Join a line account Talking about investment is a scam

For your reference