Windows Analysis Report
https://x1-44h.pages.dev/appeal_case_ID/

• HCA enabled
• EGA enabled
• AMSI enabled

• Successful, ratio: 100%
• Number of executed functions: 0
• Number of non-executed functions: 0

```json
{
  "riskscore": 1,
  "reasons": "The provided JavaScript code is a function that checks if the user is on a mobile device by examining the user agent string. This type of functionality is common and not inherently malicious. There are no indications of phishing or other malicious activities in this code."
}

window.mobileCheck = function () {
            let check = false;
            (function (a) {
                if (/(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|mobile.+firefox|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows ce|xda|xiino/i
                    .test(a) ||
                    /1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-/i
                        .test(a.substr(0, 4))) check = true;
            })(navigator.userAgent || navigator.vendor || window.opera);

            return check;
        };

```json
{
  "riskscore": 1,
  "reasons": "The provided JavaScript code appears to be a static configuration object defining text and links for a privacy policy and related information. There are no indications of malicious behavior such as data exfiltration, obfuscation, or unauthorized access attempts. The absence of actual links (empty strings) could be a point of concern if this were part of a larger context, but on its own, it does not pose a significant risk."
}

const subLinks = {
            'PolicyCollapse': [{
                'text': 'What is the Privacy Policy and what does it cover?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'What information do we collect?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'How do we use your information?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'How do we share your information on Meta Products or with integrated partners?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'How do we share information with third parties?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'How is the cooperation between Meta Companies organized?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'How can you manage or delete your information and exercise your rights?',
                'link': '',
                'add_svg_link': false
            }, {
                'text': 'How long do we keep your information?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'How do we transmit information?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'How do we respond to official requests, comply with applicable laws, and prevent harm?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'How will you know when the policy changes?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'How to ask Meta questions?',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'Why and how we process your data',
                'link': '',
                'add_svg_link': false
            },
            ],
            'RulesCollapse': [{
                'text': 'Cookie Policy',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'Information for those who do not use Meta Products',
                'link': '',
                'add_svg_link': true
            },
            {
                'text': 'How Meta uses information for generative AI models',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'Data Transfer Framework Policy',
                'link': '',
                'add_svg_link': false
            },
            {
                'text': 'Other terms and conditions',
                'link'

```json
{
  "riskscore": 1,
  "reasons": "The provided JavaScript code appears to be a utility library for DOM manipulation, similar to jQuery. It includes functions for finding elements, navigating the DOM tree, and handling events. There are no obvious signs of malicious behavior such as data exfiltration, credential stealing, or unauthorized access to sensitive information. However, as with any script, it should be reviewed in the context of the entire application to ensure it is not being used maliciously."
}

! function (t, e) {
            "object" == typeof exports && "undefined" != typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define(e) : (t = "undefined" != typeof globalThis ? globalThis : t || self).bootstrap = e()
        }(this, (function () {
            "use strict";
            const t = {
                find: (t, e = document.documentElement) => [].concat(...Element.prototype.querySelectorAll.call(e, t)),
                findOne: (t, e = document.documentElement) => Element.prototype.querySelector.call(e, t),
                children: (t, e) => [].concat(...t.children).filter(t => t.matches(e)),
                parents(t, e) {
                    const i = [];
                    let n = t.parentNode;
                    for (; n && n.nodeType === Node.ELEMENT_NODE && 3 !== n.nodeType;) n.matches(e) && i.push(n), n = n.parentNode;
                    return i
                },
                prev(t, e) {
                    let i = t.previousElementSibling;
                    for (; i;) {
                        if (i.matches(e)) return [i];
                        i = i.previousElementSibling
                    }
                    return []
                },
                next(t, e) {
                    let i = t.nextElementSibling;
                    for (; i;) {
                        if (i.matches(e)) return [i];
                        i = i.nextElementSibling
                    }
                    return []
                }
            },
                e = t => {
                    do {
                        t += Math.floor(1e6 * Math.random())
                    } while (document.getElementById(t));
                    return t
                },
                i = t => {
                    let e = t.getAttribute("data-bs-target");
                    if (!e || "#" === e) {
                        let i = t.getAttribute("href");
                        if (!i || !i.includes("#") && !i.startsWith(".")) return null;
                        i.includes("#") && !i.startsWith("#") && (i = "#" + i.split("#")[1]), e = i && "#" !== i ? i.trim() : null
                    }
                    return e
                },
                n = t => {
                    const e = i(t);
                    return e && document.querySelector(e) ? e : null
                },
                s = t => {
                    const e = i(t);
                    return e ? document.querySelector(e) : null
                },
                o = t => {
                    t.dispatchEvent(new Event("transitionend"))
                },
                r = t => !(!t || "object" != typeof t) && (void 0 !== t.jquery && (t = t[0]), void 0 !== t.nodeType),
                a = e => r(e) ? e.jquery ? e[0] : e : "string" == typeof e && e.length > 0 ? t.findOne(e) : null,
                l = (t, e, i) => {
                    Object.keys(i).forEach(n => {
                        const s = i[n],
            

```json
{
  "phishing_score": 8,
  "brands": "Meta",
  "phishing": true,
  "suspicious_domain": true,
  "has_loginform": false,
  "has_captcha": false,
  "setechniques": true,
  "reasons": "The URL 'https://x1-44h.pages.dev/appeal_case_ID/' does not match the legitimate domain name associated with Meta (e.g., facebook.com or meta.com). The use of a subdomain on 'pages.dev' is suspicious and often used in phishing attacks. The page uses social engineering techniques by creating a sense of urgency and fear of account deletion to prompt users to take action. The absence of a login form or captcha does not eliminate the possibility of phishing, as the page may be designed to collect information through other means."
}