@OP what you got seems to be not the case right now.. either you saw something wrong or maybe you saw something and then they changed their entire method.. Seems to be former option..
So let's reverse-engineer this bich:
For the following page:
https://www1.123movies.la/movie/avengers-infinity-war-yvq9pm4/watching.html
It gave me following link in source code:
https://streamapi.xyz/connection?li...NHjiNXN~jDNtjA7.NUjkjbjnjP7l75NTNlNtNo&link2=
When you see source code of that page you get following retarded obfuscated JS:
(Please understand they are using tokens/cookies/whatever.. so you may or may not be able to click on above links. Most likely you wont be able to click.. so i am putting full text.. everything..code..etc here)
<script type="text/javascript" data-cfasync="false"> eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('9 w(a,b,d){B(d){5 e=X U;e.T(e.S()+R*(A*(A*(Q*d))));5 f="; P="+e.O()}N 5 f="";4.x=a+"="+b+f+"; K=/"}9 L(a){F(5 f,b=a+"=",d=4.x.J(";"),e=0;e<d.k;e++){F(f=d[e];" "==f.I(0)
f=f.z(1,f.k);B(0==f.H(b))y f.z(b.k,f.k)}y V}9 M(a){w(a,"",-1)}$(4).1g(9(){5 6=4.h("l");6.3("t-s","g");6.3("m","n/o");6.3("i","c://p.q/1f.1e");4.r.j(6);5 7=4.h("l");7.3("t-s","g");7.3("m","n/o");7.3("i","c://p.q/1c.C");4.r.j(7);1b(9(){5 8=4.h("l");8.3("t-s","g");8.3("m","n/o");8.3("i","c://p.q/14.C");4.r.j(8)},12);5 D="c://10.Z/v/W";5 2=4.h("2");2.11=0;2.13="E%";2.15="E%";2.16="2-17";2.18=g;2.3("Y",u);2.3("19",u);2.3("1a",u);2.3("i",D);4.1d("G").j(2)});',62,79,'||iframe|setAttribute|document|var|cpm|ada|cpme|function|||https||||false|createElement|src|appendChild|length|script|type|text|javascript|streamapi|xyz|head|cfasync|data|true||createCookie|cookie|return|substring|60|if|rp|link|100|for|container|indexOf|charAt|split|path|readCookie|eraseCookie|else|toGMTString|expires|24|1e3|getTime|setTime|Date|null|8xvpx607q97|new|allowfullscreen|io|bmoviesfree|frameBorder|900000|width|61823505|height|id|embed|seamless|webkitallowfullscreen|mozallowfullscreen|setTimeout|72699885|getElementById|pp|72396733|ready'.split('|'),0,{}))</script>
When you de-obfuscate the code on a simple online de-obfuscator like:
http://jsnice.org/ then you get the following code:
(Make sure you remove the JS start script and end script tags)
'use strict';
/**
*
@Param {string} name
*
@Param {string} value
*
@Param {number} days
* @return {undefined}
*/
function createCookie(name, value, days) {
if (days) {
/**
@Type {!Date} */
var e = new Date;
e.setTime(e.getTime() + 1e3 * (60 * (60 * (24 * days))));
/**
@Type {string} */
var urlAttr = "; expires=" + e.toGMTString();
} else {
/**
@Type {string} */
urlAttr = "";
}
/**
@Type {string} */
document.cookie = name + "=" + value + urlAttr + "; path=/";
}
/**
*
@Param {string} name
* @return {?}
*/
function readCookie(name) {
var message;
/**
@Type {string} */
var item = name + "=";
/**
@Type {!Array<string>} */
var d = document.cookie.split(";");
/**
@Type {number} */
var i = 0;
for (; i < d.length; i++) {
/**
@Type {string} */
message = d
;
for (; " " == message.charAt(0) {
/** @Type {string} */
message = message.substring(1, message.length);
}
if (0 == message.indexOf(item)) {
return message.substring(item.length, message.length);
}
}
return null;
}
/**
* @Param {string} name
* @return {undefined}
*/
function eraseCookie(name) {
createCookie(name, "", -1);
}
$(document).ready(function() {
/** @Type {!Element} */
var cordovaScript = document.createElement("script");
cordovaScript.setAttribute("data-cfasync", "false");
cordovaScript.setAttribute("type", "text/javascript");
cordovaScript.setAttribute("src", "https://streamapi.xyz/72396733.pp");
document.head.appendChild(cordovaScript);
/** @Type {!Element} */
var tScript = document.createElement("script");
tScript.setAttribute("data-cfasync", "false");
tScript.setAttribute("type", "text/javascript");
tScript.setAttribute("src", "https://streamapi.xyz/72699885.rp");
document.head.appendChild(tScript);
setTimeout(function() {
/** @Type {!Element} */
var tScript = document.createElement("script");
tScript.setAttribute("data-cfasync", "false");
tScript.setAttribute("type", "text/javascript");
tScript.setAttribute("src", "https://streamapi.xyz/61823505.rp");
document.head.appendChild(tScript);
}, 900000);
/** @Type {string} */
var iOSurl = "https://bmoviesfree.io/v/8xvpx607q97";
/** @Type {!Element} */
var iframe = document.createElement("iframe");
/** @Type {number} */
iframe.frameBorder = 0;
/** @Type {string} */
iframe.width = "100%";
/** @Type {string} */
iframe.height = "100%";
/** @Type {string} */
iframe.id = "iframe-embed";
/** @Type {boolean} */
iframe.seamless = false;
iframe.setAttribute("allowfullscreen", true);
iframe.setAttribute("webkitallowfullscreen", true);
iframe.setAttribute("mozallowfullscreen", true);
iframe.setAttribute("src", iOSurl);
document.getElementById("container").appendChild(iframe);
});
In there you see: https://bmoviesfree.io/v/8xvpx607q97
There video is playing..
Following is source:
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/html">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Watching video tt4154756.mp4</title>
<link rel="icon" type="image/png" href="/asset/default/img/favicon.png?v=1503026993" />
<style>
body{
font-family: Arial,Helvetica,sans-serif;
width:100%;
height:100%;
background-color:#000;
overflow:hidden;
position:fixed;
border:0;
margin:0;
padding:0;
}
#vstr {
position:absolute;
min-width:100%;
min-height:100%;
z-index: 10;
}
#loading, #resume {
width: 100%;
height: 100%;
position: absolute;
}
#loading {
z-index: 11;
}
#resume {
z-index: 12;
}
.pop-wrap {
display: table;
position: absolute;
height: 100%;
width: 100%;
}
.pop-main {
display: table-cell;
vertical-align: middle;
}
.pop-html {
margin-left: auto;
margin-right: auto;
text-align: center;
}
.pop-block {
display: inline-block;
position: relative;
}
.myConfirm {
max-width: 260px;
max-height: 160px;
padding: 3px;
padding-bottom: 0px;
border-radius: 3px;
font-size: 14px;
line-height: 1.3em;
background-color: #333333;
color: #f2f2f2;
}
.button {
border-width: 0;
padding: 5px 15px;
line-height: 1.5;
border-radius: 20px;
text-transform: uppercase;
font-size: 80%;
font-weight: 700;
margin: 5px 5px 5px 0;
cursor: pointer;
outline: none;
background-color: #565656;
color: #ffffff;
}
@-moz-keyframes rotate-loading {
0% {
transform: rotate(0);
-ms-transform: rotate(0);
-webkit-transform: rotate(0);
-o-transform: rotate(0);
-moz-transform: rotate(0)
}
100% {
transform: rotate(360deg);
-ms-transform: rotate(360deg);
-webkit-transform: rotate(360deg);
-o-transform: rotate(360deg);
-moz-transform: rotate(360deg)
}
}
@-o-keyframes rotate-loading {
0% {
transform: rotate(0);
-ms-transform: rotate(0);
-webkit-transform: rotate(0);
-o-transform: rotate(0);
-moz-transform: rotate(0)
}
100% {
transform: rotate(360deg);
-ms-transform: rotate(360deg);
-webkit-transform: rotate(360deg);
-o-transform: rotate(360deg);
-moz-transform: rotate(360deg)
}
}
@-webkit-keyframes rotate-loading {
0% {
transform: rotate(0);
-ms-transform: rotate(0);
-webkit-transform: rotate(0);
-o-transform: rotate(0);
-moz-transform: rotate(0)
}
100% {
transform: rotate(360deg);
-ms-transform: rotate(360deg);
-webkit-transform: rotate(360deg);
-o-transform: rotate(360deg);
-moz-transform: rotate(360deg)
}
}
@keyframes rotate-loading {
0% {
transform: rotate(0);
-ms-transform: rotate(0);
-webkit-transform: rotate(0);
-o-transform: rotate(0);
-moz-transform: rotate(0)
}
100% {
transform: rotate(360deg);
-ms-transform: rotate(360deg);
-webkit-transform: rotate(360deg);
-o-transform: rotate(360deg);
-moz-transform: rotate(360deg)
}
}
@-moz-keyframes loading-text-opacity {
0%, 100%, 20% {
opacity: 0
}
50% {
opacity: 1
}
}
@-o-keyframes loading-text-opacity {
0%, 100%, 20% {
opacity: 0
}
50% {
opacity: 1
}
}
@-webkit-keyframes loading-text-opacity {
0%, 100%, 20% {
opacity: 0
}
50% {
opacity: 1
}
}
@keyframes loading-text-opacity {
0%, 100%, 20% {
opacity: 0
}
50% {
opacity: 1
}
}
.loading-ani,
.loading-container {
height: 100px;
position: relative;
width: 100px;
border-radius: 100%
}
.loading-container {
margin: 40vh auto
}
.loading-ani {
border: 2px solid transparent;
border-color: transparent #fff transparent #FFF;
-moz-animation: rotate-loading 1.5s linear 0s infinite normal;
-moz-transform-origin: 50% 50%;
-o-animation: rotate-loading 1.5s linear 0s infinite normal;
-o-transform-origin: 50% 50%;
-webkit-animation: rotate-loading 1.5s linear 0s infinite normal;
-webkit-transform-origin: 50% 50%;
animation: rotate-loading 1.5s linear 0s infinite normal;
transform-origin: 50% 50%
}
.loading-container:hover .loading-ani {
border-color: transparent #E45635
}
.loading-container .loading-ani,
.loading-container:hover .loading-ani {
-webkit-transition: all .5s ease-in-out;
-moz-transition: all .5s ease-in-out;
-ms-transition: all .5s ease-in-out;
-o-transition: all .5s ease-in-out;
transition: all .5s ease-in-out
}
.loading-container .loading-text {
-moz-animation: loading-text-opacity 2s linear 0s infinite normal;
-o-animation: loading-text-opacity 2s linear 0s infinite normal;
-webkit-animation: loading-text-opacity 2s linear 0s infinite normal;
animation: loading-text-opacity 2s linear 0s infinite normal;
color: #fff;
font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
font-size: 10px;
font-weight: 700;
margin-top: 45px;
opacity: 0;
position: absolute;
text-align: center;
text-transform: uppercase;
top: 0;
width: 100px
}
.jw-rightclick-link.jw-info-overlay-item, .jw-rightclick-item.jw-featured {
display: none !important;
}
.jw-button-container .jw-settings-sharing, .jw-button-container .jw-icon-cc {
display: none !important;
}
.jw-rightclick-link {
color: #d2d2d2 !important;
}
.jw-rightclick-link span {
color: #fff !important;
}
.jw-svg-icon-download {
height: 16px !important;
width: auto !important;
}
.jw-svg-icon-qswitch {
width: auto !important;
}
.jw-button-container .jw-logo-button {
margin-right: 10px;
}
</style>
<script>var USER_ID = '223067';</script>
</head>
<body>
<div id="vstr"></div>
<div id="loading">
<div class="loading-container">
<div class="loading-ani"></div>
<div class="loading-text">loading</div>
</div>
</div>
<!-- Javascript -->
<script src="/asset/default/js/core.min.js?v=1525941125"></script>
<script src="/asset/default/player/base.js?v=1550137736"></script>
<script type="text/javascript">
/* global Ya, USER_ID */
(function (d, w, c) {
(w[c] = w[c] || []).push(function() {
try {
w.yaCounter49788082 = new Ya.Metrika2({
id:49788082,
accurateTrackBounce:true,
params:{owner:USER_ID}
});
} catch(e) { }
});
var n = d.getElementsByTagName("script")[0],
s = d.createElement("script"),
f = function () { n.parentNode.insertBefore(s, n); };
s.type = "text/javascript";
s.async = true;
s.src = "https://mc.yandex.ru/metrika/tag.js";
if (w.opera == "[object Opera]") {
d.addEventListener("DOMContentLoaded", f, false);
} else { f(); }
})(document, window, "yandex_metrika_callbacks2");
</script>
</body>
</html>
<!-- cached at 2019-02-14 19:16:16 -->
When you go to that domain home page it conveniently says "Nothing here".. Lolz. wth ? You can then go to do more detective work on WHOIS...
It's just on namecheap privacy gaurd.. Nothing we can do there..
So this guy is probably running main site: www1.123movies.la on a regular server and then has his own CDN on bmoviesfree.io which is tough to crack as it is behind reverse proxy of Cloudflare.. So he probably just running 2 decent quality VPS or maybe dedi and getting all this traffic.. he probably has a shit ton of links but i dont have time to check for those. Also, since everything is well hidden he probably doesnt even need cyber bunker et al. He just uses regular offshore hosting.. though we dont know as he is behing cloudflare.
