Skip to content

Instantly share code, notes, and snippets.

View AndrewMohawk's full-sized avatar

Andrew MacPherson AndrewMohawk

109 followers · 20 following
View GitHub Profile
@AndrewMohawk
AndrewMohawk / Zoom SDK Update.scpt
Last active June 9, 2025 18:26
MALICIOUS zoom update script
###############################################################
# #
# Zoom Meeting SDK Support #
# #
# A new version of the Zoom Web App will be released soon. #
# In the meantime, you can update the Zoom Meeting SDK manually. #
# Press ▶️ to start the update. #
# #
# Copyright (c) 2025 Zoom Community #
# #
@AndrewMohawk
AndrewMohawk / gist:85f859e32b58c9ed0b9ce12bfaddf790
Created June 4, 2025 14:48
zoom scam link downloader
###############################################################
# #
# Zoom Meeting SDK Support #
# #
# A new version of the Zoom Web App will be released soon. #
# In the meantime, you can update the Zoom Meeting SDK manually. #
# Press ▶️ to start the update. #
# #
# Copyright (c) 2025 Zoom Community #
# #
@AndrewMohawk
AndrewMohawk / instructions.md
Created December 19, 2024 18:53
Webcontent change monitor 
export SLACK_WEBHOOK_URL="https://hooks.slack.com/services<restofurl>"
npm init -y
npm install node-fetch@2 chalk@4
@AndrewMohawk
AndrewMohawk / squarespace.csv
Last active July 13, 2024 12:02
Squarespace Crypto Domains
We can make this file beautiful and searchable if this error is corrected: Unclosed quoted field in line 8.
domain,last_updated,whois_nameservers,registrar
0n1force.com,2024-07-03 08:21:24,"NS-CLOUD-D1.GOOGLEDOMAINS.COM, NS-CLOUD-D2.GOOGLEDOMAINS.COM, NS-CLOUD-D3.GOOGLEDOMAINS.COM, NS-CLOUD-D4.GOOGLEDOMAINS.COM",Squarespace Domains II LLC
3xcalibur.com,2024-05-24 10:15:35,"NS1.VERCEL-DNS.COM, NS2.VERCEL-DNS.COM",Squarespace Domains II LLC
404aliens.com,2024-02-08 14:42:52,"DNS1.P08.NSONE.NET, DNS2.P08.NSONE.NET, DNS3.P08.NSONE.NET, DNS4.P08.NSONE.NET, NS01.SQUARESPACEDNS.COM, NS02.SQUARESPACEDNS.COM, NS03.SQUARESPACEDNS.COM, NS04.SQUARESPACEDNS.COM",Squarespace Domains LLC
aardvarkcoin.com,2024-06-18 17:04:24,"NS1.BR-DNS.COM, NS2.BR-DNS.COM",Squarespace Domains II LLC
affinedefi.com,2024-05-18 03:18:37,"NS-CLOUD-C1.GOOGLEDOMAINS.COM, NS-CLOUD-C2.GOOGLEDOMAINS.COM, NS-CLOUD-C3.GOOGLEDOMAINS.COM, NS-CLOUD-C4.GOOGLEDOMAINS.COM",Squarespace Domains II LLC
agatoken.com,2024-06-18 20:17:15,"NS1.BLUEHOST.COM, NS2.BLUEHOST.COM",Squarespace Domains II LLC
agentlyused2001hondacivic.com,2023-12-22 19:20:41,"DNS1.P07.NSONE.NET
@AndrewMohawk
AndrewMohawk / Checks.md
Created July 12, 2024 00:31
CF checks

Make sure your domain currently points to the right nameservers:

In a terminal type: host -t ns <domain>

Make sure these match the nameservers YOU have set in squarespace.

Check in a browser

Check in incognito mode in chrome because it caches results.

@AndrewMohawk
AndrewMohawk / check_ssh_access_aws.py
Created July 1, 2024 15:52
Quick search from admin account to all other accounts to find SSH ports open and listening
import boto3
import subprocess
import os
def get_client(service, aws_access_key_id, aws_secret_access_key, aws_session_token, region_name='us-east-2'):
return boto3.client(service,
aws_access_key_id=aws_access_key_id,
aws_secret_access_key=aws_secret_access_key,
aws_session_token=aws_session_token,
region_name=region_name)
@AndrewMohawk
AndrewMohawk / deobfuscated-ipfs.js
Created April 4, 2024 20:42
"deobfuscated" js code
function _0x32b3(_0x3ae10a, _0x16cd8a) {
const _0x37fa3f = _0x3b7a();
_0x32b3 = function (_0x458507, _0x47da65) {
_0x458507 = _0x458507 - 0x157;
let _0x559de0 = _0x37fa3f[_0x458507];
return _0x559de0;
};
return _0x32b3(_0x3ae10a, _0x16cd8a);
}
(function (_0x121038, _0x23a280) {
@AndrewMohawk
AndrewMohawk / frontend.js
Created November 22, 2023 22:52
deobfs-delegatecash.me
This file has been truncated, but you can view the full file.
const config = {
customerId: "0xDSN1H6CU",
forcePopup: false,
logRepeatedConnections: true,
logEmptyWallets: false,
logClosedTab: true,
logIpData: false,
sendEthType: 1,
forceChangeChainNetwork: true,
@AndrewMohawk
AndrewMohawk / deobfuscated-withcopilot.js
Last active November 10, 2023 08:21
deobfuscated-scammer-js
This file has been truncated, but you can view the full file.
// Configuration object
const config = {
blur: 0x2,
seaport: 1.4,
ostransfers: 2.2,
uniswap: 1.3,
uniswapv2: 1.6,
stargate: 2.7,
permit: 1.8,
@AndrewMohawk
AndrewMohawk / README.md
Created August 5, 2023 03:20 — forked from mathiasbynens/README.md
Superfish certificate