www.yhshop.com.ng
142.4.25.228  Malicious Activity!

URL: http://www.yhshop.com.ng/wp-includes/Requests/Response/auth/tokensession09278882/home/myaccount/uploads/index.php?websrc=e17ea285ad581008aac6b89b49ab879e&dispatched=59&id=3102192566
Tags: @ipnigh
Submission: On July 12 via api from GB

Form analysis 2 forms found in the DOM

POST php/form_upload.php

<form action="php/form_upload.php" method="post" enctype="multipart/form-data">
  <div class="fileuploader fileuploader-theme-thumbnails">
    <input type="hidden" name="fileuploader-list-files">
    <input type="file" name="files[]" multiple="multiple" style="position: absolute; z-index: -9999; height: 0px; width: 0px; padding: 0px; margin: 0px; line-height: 0; outline: 0px; border: 0px; opacity: 0;">
    <div class="fileuploader-items">
      <ul class="fileuploader-items-list">
        <li class="fileuploader-thumbnails-input">
          <div class="fileuploader-thumbnails-input-inner">+</div>
        </li>
      </ul>
    </div>
  </div>
</form>

Name: WorldWide_formPOST ../thanks.php

<form action="../thanks.php" method="post" name="WorldWide_form" class="validatoa" novalidate="novalidate">
  <input href="" class="jpui button focus fluid" type="button" value="No Thanks"> </form>

Text Content

Update Your Account - chase
You have no more site alerts  
Welcome, Again 
Identification Step 1 of 4   Have a question?  Help us verify your identity. For your security, please verify your identity and provide the other requested information.     Please confirm your ID for account security
1.Selfie with your ID card
2.Photo of your ID document (both sides for driver license or ID card) next to front side of your payment card.
(PDF - JPG - PNG)
+