Domain > trey.sh

More information on this domain is in AlienVault OTX

DNS Resolutions

Date	IP Address
2020-10-08	13.35.82.49 (ClassC)
2020-12-07	13.32.192.103 (ClassC)
2024-03-14	204.246.191.13 (ClassC)
2024-07-04	204.246.191.122 (ClassC)
2024-11-12	204.246.191.22 (ClassC)
2024-11-22	3.165.160.103 (ClassC)
2025-03-20	204.246.191.24 (ClassC)
2025-03-31	99.86.38.114 (ClassC)

HTTP/1.1 200 OKContent-Type: text/htmlContent-Length: 11916Connection: keep-aliveDate: Thu, 14 Mar 2024 21:03:50 GMTLast-Modified: Wed, 12 Aug 2020 17:23:40 GMTETag: 4e6221cde418d66b809d864e1222875aAc

#!/usr/bin/env sh/*/../usr/bin/env true # !--: ###Howdy. This file is a webpage, a shell script, and a javascript file. They all output the same thing (more or less).Three (really, four) ways to run:  1. Webpage    a. Open in a browser without javascript (but with good CSS). My information is in a `noscript` tag, so I use some       CSS trickery to display only the information, and not the surrounding code.    b. Open in your favorite browser. The webpage will execute itself (literally, this content youre reading right now)       as javascript and put the result on the screen.  2. Shell script (you probably shouldnt follow this advice)    a. Download this page with `wget`, `chmod +x`, and run `./index.html`. Alternatively, just `curl trey.sh | sh`.  3. Javascript (this is really equally as dangerous as a shell script)    a. Download this page with `wget`, and run `node index.html`. Alternatively, view the page source and copy/paste       into the javascript console.I tried to share as much as possible between the three paths. The `echo` function code is shared by both javascript andthe shell script. Theres only one copy of my information - its what you see in the `noscript` tag below.This page has to render in quirks mode if I want the shebang. Even if I add a DOCTYPE after the shebang, it getsignored. The shebang has to be the very first thing in order to work, otherwise youll get an exec format error whenattempting to directly execute the shell script.Regarding the random-looking markup: when a browser encounters a page that has character data outside a `body` tag, itautomatically opens an `html` and `body` tag, then puts everything it sees inside. The `title` tag, though, works insidethe body, which is why you see it just thrown in down below.###: */z0;//usr/bin/env alias skip#function echo() {     -z ,  || /*/../usr/bin/env true #*/ true; console.log((typeof window  undefined) ? arguments1.replace(/^>+>/g, ) : arguments1);    //usr/bin/env true; if  $# -eq 0 ; then return; fi; command echo $1 | sed s/^,// | s

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > trey.sh

Is this malicious?

DNS Resolutions

Port 80

Port 443