Windows Analysis Report
https://forfbidrecrossboot.pages.dev/503.js

• HCA enabled
• EGA enabled
• AMSI enabled

• Successful, ratio: 100%
• Number of executed functions: 0
• Number of non-executed functions: 0

{
"loginform": true,
"reasons": [
"The text mentions 'you should login to Cloudflare'",
"The text suggests an error occurred while rendering the page, which could be related to authentication or session management in a login form"
]
}

```json
{
  "riskscore": 1,
  "reasons": "The provided JavaScript code appears to manipulate the visibility of HTML elements related to IP address display in the footer of a webpage. It does not exhibit any behavior typically associated with malicious activities such as data exfiltration, credential theft, or unauthorized access. The risk score is low, primarily due to the benign nature of the code."
}

(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();

```json
{
  "phishing_score": 7,
  "brands": null,
  "phishing": true,
  "suspicious_domain": true,
  "has_loginform": false,
  "has_captcha": false,
  "setechniques": true,
  "reasons": "The domain name 'forfbidrecrossboot.pages.dev' appears suspicious and does not match any known legitimate brand. The use of a Cloudflare error page could be a technique to make the site appear more legitimate. The URL structure and the domain name are unusual and could be indicative of a phishing attempt."
}