Windows Analysis Report
https://218.4.51.20:85/sztjj/qytb.action

• HCA enabled
• EGA enabled
• AMSI enabled

• Successful, ratio: 100%
• Number of executed functions: 0
• Number of non-executed functions: 0

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": true,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: URL: https://218.4.51.20:85

```json
{
  "contains_trigger_text": true,
  "trigger_text": ": ",
  "prominent_button_name": "",
  "text_input_field_labels": [
    "",
    " ",
    ""
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json
{
  "brands": [
    ""
  ]
}

```json{  "legit_domain": "unknown",  "classification": "unknown",  "reasons": [    "The URL is an IP address (218.4.51.20), which is uncommon for legitimate brand websites and often used in phishing.",    "The brand name '' translates to 'Suzhou Statistical Network Direct Reporting System', which is not a well-known international brand and is likely a local or governmental system.",    "IP addresses in URLs are often used to obscure the true destination of a link, which is a common phishing tactic.",    "There is no direct association between the brand name and a well-known domain, making it difficult to verify legitimacy.",    "The use of generic input fields like '' (user account), '' (password), and '' (verification code) is typical for login pages, but without a known domain, it raises suspicion."  ],  "riskscore": 8}

URL: 218.4.51.20
            Brands: 
            Input Fields: ,  , 

```json
{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "",
  "text_input_field_labels": [
    "",
    "",
    ""
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json
{
  "brands": [
    ""
  ]
}

```json
{
  "contains_trigger_text": true,
  "trigger_text": "",
  "prominent_button_name": "",
  "text_input_field_labels": [
    "",
    ""
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json{  "legit_domain": "unknown",  "classification": "unknown",  "reasons": [    "The URL is an IP address (218.4.51.20), which is uncommon for legitimate brand websites and often used in phishing.",    "The brand name '' translates to 'Suzhou Statistical Network Direct Reporting System', which is not a well-known international brand and is likely a local or governmental system.",    "IP addresses in URLs are often used to obscure the true destination of a link, which is a common phishing tactic.",    "There is no direct association between the brand name and a well-known domain, making it difficult to verify legitimacy.",    "The presence of input fields for '' (user account), '' (password), and '' (verification code) suggests a login page, which is a common target for phishing attacks."  ],  "riskscore": 8}

URL: 218.4.51.20
            Brands: 
            Input Fields: , , 

```json
{
  "brands": [
    "China.com"
  ]
}

```json
{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "",
  "text_input_field_labels": [
    "",
    ""
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json{  "legit_domain": "china.com",  "classification": "known",  "reasons": [    "The URL is an IP address (218.4.51.20) which is unusual for legitimate brand websites, as they typically use domain names.",    "The brand 'China.com' is a known brand and typically associated with the domain 'china.com'.",    "IP addresses are often used in phishing attempts to obscure the true destination of the link.",    "The presence of input fields for '' (user account) and '' (password) suggests an attempt to collect sensitive information.",    "There is no direct association between the IP address and the legitimate domain 'china.com'."  ],  "riskscore": 9}
Google indexed: False

```json
{
  "brands": [
    ""
  ]
}

```json{  "legit_domain": "unknown",  "classification": "unknown",  "reasons": [    "The URL is an IP address, which is uncommon for legitimate brand websites and often used in phishing.",    "The brand name '' translates to 'Suzhou Statistical Network Direct Reporting System', which is not a well-known brand internationally.",    "The brand appears to be a local or governmental system, which makes it difficult to associate with a specific well-known domain.",    "IP addresses in URLs are often used to obscure the true destination of a link, which is a common phishing tactic.",    "No clear association between the brand and a legitimate domain name can be established."  ],  "riskscore": 8}

URL: 218.4.51.20
            Brands: 
            Input Fields: , 

```json
{
  "contains_trigger_text": true,
  "trigger_text": ": ",
  "prominent_button_name": "",
  "text_input_field_labels": [
    "",
    " ",
    ""
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json
{
  "brands": [
    ""
  ]
}

```json{  "legit_domain": "tj.sz.gov.cn",  "classification": "unknown",  "reasons": [    "The URL is an IP address (218.4.51.20), which is unusual for legitimate brand websites and often used in phishing.",    "The brand name '' translates to 'Suzhou Statistical Network Direct Reporting System', which is a specific governmental or statistical service.",    "The legitimate domain for Suzhou government-related services is likely to be under a .gov.cn domain, such as 'tj.sz.gov.cn'.",    "IP addresses are commonly used in phishing attempts to obscure the true destination of the link.",    "The input fields (user account, password, verification code) are typical for login pages, which are common targets for phishing."  ],  "riskscore": 8}

URL: 218.4.51.20
            Brands: 
            Input Fields: ,  ,