朋友被色情直播+网赌骗了 2w+

现在给我打电话借4w块钱说把钱提出来。。。

我无语死了 一个大学同学

我解包APK后找到的有可能的url 大佬们帮忙分析分析

http://lovechat323.com
https://static-maps.yandex.ru/1.x/?ll=%.6f,%.6f&z=%d&size=%d,%d&l=map&scale=%d&lang=%s

https://106.13.253.90/
https://106.13.253.35/
https://live.cailiao.im/
https://impyq.gz.bcebos.com/

.field public static final BASE_FC_LOCAL_TEST_URL:Ljava/lang/String; = “http://192.200.1.242:1999/

.field public static final BASE_FC_TEST_URL:Ljava/lang/String; = “http://m.bjz.com/

.field public static final BASE_FC_URL:Ljava/lang/String; = “https://106.13.253.35/

.field public static final BASE_LIVE_URL:Ljava/lang/String; = “https://live.cailiao.im/

.field public static final BASE_MINI_GAME_TEST_URL:Ljava/lang/String; = “http://game.bjz.com/

.field public static final BASE_MINI_GAME_URL:Ljava/lang/String; = “https://game.cailiao.im

.field public static final BASE_MINI_PROGRAM_TEST_URL:Ljava/lang/String; = “http://192.168.1.4:20000/

.field public static final BASE_MINI_PROGRAM_URL:Ljava/lang/String; = “https://106.13.253.90/

.field public static final BASE_URL_FC_VIDEO:Ljava/lang/String; = “https://impyq.gz.bcebos.com/

.field public static final GET_IP_LOCATION:Ljava/lang/String; = “http://ip-api.com/json/

.field public static final PICTURE_FILE_URI_PATH:Ljava/lang/String; = “mediasvc/download/”

解包后 可以看到 软件是用uniapp开发的,里面js有uinapp的文档 ,他的所有统计数据全都用的是百度的

1 个赞

这是想通过技术手段找到骗子的信息或地址吗

不明觉厉啊

aigc 回复要截图,自爆小火车 :laughing:
否则一会就被举报了

建议直接报警

aigc 你这是在诱惑大伙儿举报啊

1 个赞

maybe不想在学校里声败名裂吧 :rofl: :rofl: :rofl:

1 个赞

是 但是感觉希望不是很大,我手头没有安卓设备 只能通过逆向apk来分析

还是别整那些个虚的,报警实在点,还可能把钱追回来

3 个赞

:rofl:就看认为钱和名声哪个重要了;自己处理感觉找回来希望渺茫

1 个赞

看了一下,除了oss其他都歇逼了

还有几个可能有用的 url

https://coub.com/api/v2/coubs/%s.json

https://lovechat323.com/authtoken/

还有一个可能是要携带认证token来进去的 否则就是404

这种东西, 报警了就算抓到了 钱也基本上回不来

我是通过 apktool逆向的

这个是 apktool.yml

version: 2.9.3

apkFileName: base.apk

isFrameworkApk: false

usesFramework:

ids:

  • 1

tag: null

sdkInfo:

packageInfo:

forcedPackageId: 0

renameManifestPackage: null

versionInfo:

versionCode: 92

versionName: null

resourcesAreCompressed: false

sharedLibrary: false

sparseResources: false

unknownFiles:

play-services-base.properties: 8

firebase-measurement-connector.properties: 8

firebase-config.properties: 8

play-services-clearcut.properties: 8

play-services-auth.properties: 8

firebase-datatransport.properties: 8

builddef.lst: 8

play-services-phenotype.properties: 8

transport-backend-cct.properties: 8

firebase-common.properties: 8

play-services-stats.properties: 8

firebase-abt.properties: 8

play-services-location.properties: 8

play-services-basement.properties: 8

play-services-places-placereport.properties: 8

androidsupportmultidexversion.txt: 0

play-services-flags.properties: 8

firebase-encoders-json.properties: 8

transport-api.properties: 8

play-services-vision.properties: 8

firebase-iid-interop.properties: 8

play-services-tasks.properties: 8

firebase-iid.properties: 8

version.txt: 0

play-services-auth-api-phone.properties: 8

transport-runtime.properties: 8

firebase-components.properties: 8

isoparser-default.properties: 8

firebase-messaging.properties: 8

play-services-maps.properties: 8

play-services-wearable.properties: 8

play-services-auth-base.properties: 8

play-services-vision-common.properties: 8

openinstall: 0

okhttp3/internal/publicsuffix/publicsuffixes.gz: 0

fabric/com.stripe.stripe-android.properties: 8

doNotCompress:

  • AndroidManifest.xml

  • resources.arsc

  • png

  • gif

  • jpg

  • webp

  • mp3

  • wav

  • mp4

  • META-INF/androidx.savedstate_savedstate.version

  • META-INF/androidx.palette_palette.version

  • META-INF/androidx.core_core.version

  • META-INF/androidx.vectordrawable_vectordrawable-animated.version

  • META-INF/android.support.design_material.version

  • META-INF/androidx.localbroadcastmanager_localbroadcastmanager.version

  • META-INF/androidx.legacy_legacy-support-core-utils.version

  • META-INF/androidx.arch.core_core-runtime.version

  • META-INF/androidx.activity_activity.version

  • META-INF/androidx.interpolator_interpolator.version

  • META-INF/androidx.loader_loader.version

  • META-INF/androidx.legacy_legacy-support-core-ui.version

  • META-INF/androidx.appcompat_appcompat-resources.version

  • META-INF/androidx.appcompat_appcompat.version

  • META-INF/androidx.fragment_fragment.version

  • META-INF/androidx.lifecycle_lifecycle-viewmodel-savedstate.version

  • META-INF/androidx.transition_transition.version

  • META-INF/androidx.tracing_tracing.version

  • META-INF/androidx.drawerlayout_drawerlayout.version

  • META-INF/androidx.swiperefreshlayout_swiperefreshlayout.version

  • META-INF/androidx.customview_customview.version

  • META-INF/androidx.lifecycle_lifecycle-runtime.version

  • META-INF/androidx.lifecycle_lifecycle-livedata.version

  • META-INF/androidx.vectordrawable_vectordrawable.version

  • META-INF/androidx.lifecycle_lifecycle-livedata-core.version

  • META-INF/androidx.print_print.version

  • META-INF/androidx.asynclayoutinflater_asynclayoutinflater.version

  • META-INF/androidx.lifecycle_lifecycle-viewmodel.version

  • META-INF/com.google.android.material_material.version

  • META-INF/androidx.slidingpanelayout_slidingpanelayout.version

  • META-INF/androidx.versionedparcelable_versionedparcelable.version

  • META-INF/androidx.cursoradapter_cursoradapter.version

  • META-INF/androidx.viewpager2_viewpager2.version

  • META-INF/androidx.documentfile_documentfile.version

  • META-INF/androidx.viewpager_viewpager.version

  • META-INF/androidx.cardview_cardview.version

  • META-INF/androidx.coordinatorlayout_coordinatorlayout.version

  • META-INF/androidx.annotation_annotation-experimental.version

是的,大家分析的有道理,光静态分析一点用没有,对方的手法是专业的,色情直播里面内嵌 url 放赌博网页,然后有聊天室,也有人带着玩,然后诱骗你下单,充值全部都是支付宝给他们指定的账户转账,然后后台加款的,感觉很像是缅北的操作,然后我发现他没看过孤注一掷 我想让他看一下孤注一掷,结果 我发现 所有平台全下架了!没法我从油管给他下了一个看,哎 能劝的都劝了 昨晚劝到两点多,就这样了如果真的在被骗我也无能为力,他还跟我讲他的发小拉着他去做什么游戏推广,我一问啥游戏?捕鱼。。。。。。cao

赌徒就该做好倾家荡产的准备,不比同情他。

真看这兄弟可怜,家里农村的,去当了两年兵苦哈哈的边疆站岗,拿了10w转业费回来了现在就被骗了2w+

骗子要是能这么容易被找到,也不会如此肆无忌惮了。不过从警告和技术的角度出发,也有探讨的价值,也有不少大佬有过这种经验。

我感觉通过静态分析分析不出来什么东西,因为他的赌博网站是内嵌的那么可能通过url来获取的赌博网站连接,来获取的 应该是只有抓包

1 个赞

这个分析不出来啥啊 能在国内骗到人 不知道伪装多少了