hxxps://accounts[.]google[.]com/ServiceLogin?service=wise&passive=1209600&osid=1&continue=hxxps://drive[.]google[.]com/file/d/1thJ3r_goEZ3BA-wE8sNYbGUhGv6gTnXz/view?usp%3Dg2a_refund_exploit_440439[.]pdf&followup=hxxps://drive[.]google[.]com/file/d/1thJ3r_goEZ3BA-wE8sNYbGUhGv6gTnXz/view?usp%3Dg2a_refund_exploit_440439[.]pdf&ec=GAZAGQ

hxxps://www[.]g2a[.]com/

hxxps://chrome[.]google[.]com/webstore/detail/tampermonkey/dhdgffkkebhmkfjojejmpbldmpobfkfo

hxxps://text[.]is/g2aexploit/raw