一、用户牵引
1. 短视频民间拍摄,基本上都是富豪权贵佯装贫民被欺负各式背景较量、不忍直视的社会现象等
2. 以上为视频正文,正要剧情反转时,各式理由要求转发才能继续观看
二、技术特征
1. 页面由 标题、日期、模仿公众号的”作者“(链接地址,而非公众号)、视频窗口、短链接化的其他视频链接清单
2. 两种地址格式
<!DOCTYPE html><html><head><meta charset="gb2312" />
<meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" name="viewport"/><title>收取中</title>
<script src="https://res.wx.qq.com/open/js/jweixin-1.2.0.js"></script>
<script type="text/javascript" src="https://cdn.bdstatic.com/jwplayer/latest/cyberplayer.js"></script>
<script src="http://jiangcen.net.cn/css/jquery.js"></script>
<script src="http://jiangcen.net.cn/css/jquery.cookie.js"></script>
<script src="http://jiangcen.net.cn/css/zepto.js"></script>
<script src="http://jiangcen.net.cn/css/swiper.jquery.js"></script>
<script src="https://imgcache.qq.com/tencentvideo_v1/tvp/js/tvp.player_v2_zepto.js" charset="utf-8"></script>
<script src="http://jiangcen.net.cn/css/wwnet.js"></script>
<link rel="stylesheet" type="text/css" href="http://jiangcen.net.cn/css/main.css" />
<link rel="stylesheet" type="text/css" href="http://jiangcen.net.cn/css/more.css" />
<link rel="stylesheet" type="text/css" href="http://jiangcen.net.cn/css/fei.css" />
</head><body style="margin:0 auto;background-color:#ffffff">
<script type="text/javascript">window.name = 'zh44';</script>
<script type="text/javascript" charset="gb2312" src="http://gn2.tianchengol.com/jd51lm/!atmm4vbvsc8f?pop=zh44"></script></body></html>
- 页面底部短链接推荐清单:http://toupiwenxue.cn/5ad2ib02mmyy7a24bwt.fei?pop=zh44
- 打开后添加类似时间戳锚点为http://toupiwenxue.cn/5ad2ib02mmyy7a24bwt.fei?pop=zh44#1534600454556,刷新更新锚点
- 该页面标题”收取中“,为中间页面,其中脚本调用http://gn2.tianchengol.com/qw0p8x/!sklicd3nhpjo?pop=zh44 去获取页面内容,页面标题重置为空
- 直接打开他人分享的链接,微信转发和复制 URL 的地址:
http://toupiwenxue.cn/phunw.bmp?y=8b1850b9589dfa919c449fcb68a7f291&t=1534600574778/3?@zh14,打开后添加类时间戳锚点#1534600601230
http://toupiwenxue.cn/orcl5.bmp?y=10dd32cc7da6834a99c9e0090872ec6f&t=1534602790950/3?@zh14,二次打开他人分享的链接并复制的地址,稍有变化
- 每次打开复制的地址不一样,但是视频(通过关键参数@zh14)固定
- 服务器后台具有过滤功能,刷新第一第二次能打开,之后不论在微信还是 PC的浏览器都将内容空白
3. 部分样式文件从http://jiangcen.net.cn获取,该网站正常打开,是个淘宝客类导购站”优惠赚“
4. 使用到的技术与效果
- jQuery
- Zepto
- Swiper
- TencentVideo
- WeUI - 微信团队设计的开源微信样式风格
- 百度统计
- Clipboardjs - 选定页面标题自动复制下面的手机淘宝钱包推广码到剪切板
三、页面行为
1. 选定页面内容自动复制”下载手机淘宝客户端,领新人专享10元红包。¥QCl3bcjNy1l¥打开【手机淘宝】即可领取“到剪切板,不同页面不同红包推广码会乱序重复出现,如”¥QCl3bcjNy1l¥“、”¥c3tMbcjNSu6¥“、”¥cUhjbcjN52q¥“
2. 打开上述的http://gn2.tianchengol.com/和http://toupiwenxue.cn/,都直接返回一字符串
3. PC浏览器点击”作者“跳转到无效链接http://j16w0uc34d1hd0ijp5x5p_yjb5zgohhhi76wu8klwpvcy18559u7h8h/
4. 点击返回,不论顶部导航还是底部剪头,都会切换不同视频页面而非正常的返回
四、链路分析
看到这,这个网站没啥问题。但是利益驱动在哪?目的是什么?不应该只是想推广那个手机淘宝红包,毕竟没啥人会去选定内容或者复制甚至真去拿手机淘宝的红包。
1. 微信中点击”作者“”今日劲爆新视频”,跳转到http://e00a8g.jdtnbjk.com/kviu3325.fei?pop=zh16#1534607293126
<!DOCTYPE html><html><head><meta charset="gb2312" />
<meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" name="viewport"/><title>收取中</title>
<script src="https://res.wx.qq.com/open/js/jweixin-1.2.0.js"></script>
<script type="text/javascript" src="https://cdn.bdstatic.com/jwplayer/latest/cyberplayer.js"></script>
<script src="http://jiangcen.net.cn/css/jquery.js"></script>
<script src="http://jiangcen.net.cn/css/jquery.cookie.js"></script>
<script src="http://jiangcen.net.cn/css/zepto.js"></script>
<script src="http://jiangcen.net.cn/css/swiper.jquery.js"></script>
<script src="https://imgcache.qq.com/tencentvideo_v1/tvp/js/tvp.player_v2_zepto.js" charset="utf-8"></script>
<script src="http://jiangcen.net.cn/css/wwnet.js"></script>
<link rel="stylesheet" type="text/css" href="http://jiangcen.net.cn/css/main.css" />
<link rel="stylesheet" type="text/css" href="http://jiangcen.net.cn/css/more.css" />
<link rel="stylesheet" type="text/css" href="http://jiangcen.net.cn/css/fei.css" />
</head><body style="margin:0 auto;background-color:#ffffff">
<script type="text/javascript">window.name = 'zh06';</script>
<script type="text/javascript" charset="gb2312" src="http://gn1.tianchengol.com/7t6s8t/!zk4pkk11h4s8?pop=zh06"></script></body></html>
- 域名地址从toupiwenxue.cn变为e00a8g.jdtnbjk.com
- 调用的 JS 域名从gn2.tianchengol.com变为gn1.tianchengol.com
- “作者”从今日劲爆新视频“变为”乱伦之双面娇妻“
- 其他用户牵引、技术特征、页面行为等和之前页面一样
2. 基本上知道套路了,直接点击”作者“”乱伦之双面娇妻“跳转到
<!DOCTYPE html><html><head>
<meta charset="gb2312">
<meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=no">
</head><body>
<span style="color:#000000;font-size:19px;background-color:#F3F3F3!important;height: 30px;width: 100%;position: absolute;z-index: 301;position: fixed;" href="#" onClick="javaScript:history.go(-1)"> < 返回</span>
<div style="height: 30px"></div>
<script>
localStorage.setItem('uid','https://img30.360buyimg.com/jdsurvey/jfs/t23296/205/2155409630/15078/611b1d16/5b751df6N710e0d62.png');
</script>
<script type="text/javascript" charset="gb2312" src="http://jiangcen.net.cn/ggao/smjiaoqi.js"></script>
<script>function kai(){history.pushState(history.length+1,"message","#"+(new Date).getTime())}window.onhashchange=function(){var viewName=location.hash.replace("#","");if(viewName!="buy"){top.location.href="http://e00a8g.jdtnbjk.com/g1on83o9k8n4r5aa.js?_b=cykd6led4l822yu3m4h7k6a9sly9zslraa8=="}},setTimeout("kai();",100);
</script>
<script>
var _hmt = _hmt || [];
(function() {
var hm = document.createElement("script");
hm.src = "https://hm.baidu.com/hm.js?6d34d92b4cdcabdaccdf4cf17801eed7";
var s = document.getElementsByTagName("script")[0];
s.parentNode.insertBefore(hm, s);
})();
</script></body></html>
- 注意其中图片来源是http://img30.360buyimg.com/,没错,是京东;当然只是用京东来存放的图片
- 页面拉倒底部,终极二维码出现
- 扫描下,原来是个小说公众号
3. 如果(用 PC 浏览器打开上面页面,)点击返回,那么更多推广页面出现,各式二维码;不过这个返回貌似服务器在控制是否继续启用更多的推广二维码,写到这里的此时已看不到之前的”精彩“了
五、最后总结
1. 用容易引起公愤的半截视频吸引小白用户并激发分享
2. 二级跳转到目标图文页面,同样半截并附二维码
3. 扫描二维码,那么鱼儿上钩,临门一脚完成
另外:
1. 图片来自https://img30.360buyimg.com
2. 视频来自http://imgcache.qq.com