Lilyjade is back and has moved up in the world. After Google chrome prevented the installation of extensions from sources other than the official webstore (due to the actions of malicious extensions such as lilyjade), lilyjade had a problem. Rather than explain the complicated steps needed to bypass the restriction, lilyjade spreaders have bypassed the restriction by registering at the webstore. Here are some lilyjade scripts hosted on the chrome webstore.
https://chrome.google.com/webstore/detail/demcpmafdoldpikmeijecnejbdhalegf
https://chrome.google.com/webstore/detail/imifilddnbnjclipnefjdpjkipbchmdk
https://chrome.google.com/webstore/detail/amoobcjlpgloocplpikcldcpjjdnoeii
Example extension:https://chrome.google.com/webstore/detail/eijbdinddjecmebnlienfoijpjjobkjh
They only have around 800 users between them, hinting at a pretty dismal performance for lilyjade’s vaunted spreading ability.
The sites used to host scripts are here:
Main script is still at the same site, just a different url
http://lilyjadev2.com/panel/cache/c059ca83c22e28bfd712343a23f3327a.js
http://jsbeautifier.org/ is handy for looking at this.
The new google ads id is:pub-0321047848968757
Additional scripts
https://fbapprep.com/classict.js
https://fbapprep.com/external_script.js 404 right now
https://fbapprepoa.com/adbrite.js
New dropbox account
https://dl.dropbox.com/u/62399492/wau.js
https://dl.dropbox.com/u/62399492/AdInjecting.txt
There is one “Webplayer Extention Update” extension and two “Dislike – Final” extensions. The fourth extension appears to be an example extension provided by the developers.
The two “Dislike – Final” extensions actually function as disliking applications due to wholesale code theft from another disliking extension. The facebook disliking code appears to have been ripped out and plugged into lilyjade, and still uses the website of the other extension to keep track of dislikes. The other coder is now having to deal with people bitching about ads on his extension page because people have the shitty lilyjade version.
New spreading attempt appears to be buying “viral” likes on semi popular facebook pages.
https://www.facebook.com/permalink.php?story_fbid=428298427209006&id=296121079380
https://www.facebook.com/ROcker.Fans.Club/posts/293496637424171
https://www.facebook.com/permalink.php?story_fbid=435033876543529&id=244254240771
Urls used for spreading
Facebook dislike extensions
http://fbappupdater.com/APPUPDATER/
https://fbapprepoa.com/APPUPDATER/
https://fbapprep.com/APPUPDATER/
Webplayer update extension
stalkerwatcher.info/GameofThronesS03E01.html
A bit.ly url was used to redirect to the page opened after first installing, so we can see the install statistics by adding a + to the end of it.
https://bitly.com/NQuM9J+
Not very impressive.
Two other generic lilyjade extensions
http://www.marketingconceptsreview.com/BrowserExtension.crx
Panel url:http://lilyjadev2.com/panel/cache/629b10b5a8e89fe616bf887ab7e44825.js
Google ads id: pub-7182608930620297
http://dl.dropbox.com/u/94625960/google.crx
Panel url: http://lilyjadev2.com/panel/cache/a07b28af1d4a3f792484645a326eb202.js
Google ads id: ca-pub-2957341046889941
Thanks to whoever posted this:http://pastebin.com/KW8tEvt9