147
What are these comments on lemmy posts?
(lemmy.sdf.org)
A loosely moderated place to ask open-ended questions
Search asklemmy ๐
If your post meets the following criteria, it's welcome here!
Looking for support?
Looking for a community?
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
Looks like it's issuing a GET to
https://zelensky.zip/save/{ENCODED_JWT_TOKEN_AND_NAV_FLAG}
. TheENCODED_JWT_TOKEN
is frombtoa(document.cookie+nav_flag)
wherenav_flag
is essentially'navAdmin'
if the account hit is an admin or''
if the user hit is not an admin (it checks if the admin button in the nav exists). Their server is likely logging all incoming requests and they just need to do a quick decoding to get jwt tokens and a flag telling them if it's an admin account.I'd be hesitant to visit Lemmy on a browser atm ๐
Sure enough, the
.zip
TLD is just being used for malicious activityLemmy.zip is cool!
Google Domains, creating new ways to exploit users right before being sold off to Squarespace.
Yo thanks for the obfuscation. Makes a lot of sense.