Windows Analysis Report
http://divisioninfo.net/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: http://divisioninfo.net

{
    "risk_score": 4,
    "reasoning": "Base64 encoded data stored in window object. While obfuscation is present (+3 points), decoding reveals standard tracking parameters (UUID, page info, IP). Domain 'divisioninfo.net' appears non-standard (+1 point). No immediate malicious behaviors, but obfuscation warrants caution."
}

window.park = "eyJ1dWlkIjoiYTVlNDJiZGYtZWJkOS00NDc4LWJiY2ItYjhlYTYxYTc3MDExIiwicGFnZV90aW1lIjoxNzMzMjU1NTQxLCJwYWdlX3VybCI6Imh0dHA6Ly93dzI1LmRpdmlzaW9uaW5mby5uZXQvP3N1YmlkMT0yMDI0MTIwNC0wNjUyLTE5ZmUtOWU2NS01ZWJjZmU4ZDYwZTgiLCJwYWdlX21ldGhvZCI6IkdFVCIsInBhZ2VfcmVxdWVzdCI6eyJzdWJpZDEiOiIyMDI0MTIwNC0wNjUyLTE5ZmUtOWU2NS01ZWJjZmU4ZDYwZTgifSwicGFnZV9oZWFkZXJzIjp7fSwiaG9zdCI6Ind3MjUuZGl2aXNpb25pbmZvLm5ldCIsImlwIjoiOC40Ni4xMjMuMjI4In0K";

{
    "risk_score": 7,
    "reasoning": "Script exhibits several high-risk behaviors: 1) Forces browser redirect to suspicious domain 'divisioninfo.net' 2) Collects browser fingerprint data for tracking 3) Uses fallback mechanisms to ensure redirect happens 4) Domain name pattern suggests potential malicious intent. While fingerprinting itself is common, the combination with forced redirects to an unusual domain raises significant concerns."
}

var redirect_link = 'http://divisioninfo.net/?';

// Set a timeout of 300 microseconds to execute a redirect if the fingerprint promise fails for some reason
function fallbackRedirect() {
	window.location.replace(redirect_link+'fp=-7');
}

try {
	const rdrTimeout = setTimeout(fallbackRedirect, 300);
	var fpPromise = FingerprintJS.load({monitoring: false});
	fpPromise
		.then(fp => fp.get())
		.then(
			result => { 
				var fprt = 'fp='+result.visitorId;
				clearTimeout(rdrTimeout);
				window.location.replace(redirect_link+fprt);
		});
} catch(err) {
	fallbackRedirect();
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://divisioninfo.net

{
    "risk_score": 4,
    "reasoning": "This is the FingerprintJS library, a known browser fingerprinting tool. While it collects browser characteristics for tracking (+2 points for tracking behavior), it's from a legitimate vendor and is MIT licensed. The code contains complex mathematical operations for generating fingerprints but doesn't exhibit malicious behaviors like data exfiltration or suspicious redirects. However, its tracking capabilities warrant moderate scrutiny (+2 for privacy implications)."
}

/**
 * FingerprintJS v3.4.0 - Copyright (c) FingerprintJS, Inc, 2023 (https://fingerprint.com)
 * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
 *
 * This software contains code from open-source projects:
 * MurmurHash3 by Karan Lyons (https://github.com/karanlyons/murmurHash3.js)
 */
var FingerprintJS=function(e){"use strict";var n=function(){return n=Object.assign||function(e){for(var n,t=1,r=arguments.length;t<r;t++)for(var o in n=arguments[t])Object.prototype.hasOwnProperty.call(n,o)&&(e[o]=n[o]);return e},n.apply(this,arguments)};function t(e,n,t,r){return new(t||(t=Promise))((function(o,a){function i(e){try{u(r.next(e))}catch(n){a(n)}}function c(e){try{u(r.throw(e))}catch(n){a(n)}}function u(e){var n;e.done?o(e.value):(n=e.value,n instanceof t?n:new t((function(e){e(n)}))).then(i,c)}u((r=r.apply(e,n||[])).next())}))}function r(e,n){var t,r,o,a,i={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]};return a={next:c(0),throw:c(1),return:c(2)},"function"==typeof Symbol&&(a[Symbol.iterator]=function(){return this}),a;function c(c){return function(u){return function(c){if(t)throw new TypeError("Generator is already executing.");for(;a&&(a=0,c[0]&&(i=0)),i;)try{if(t=1,r&&(o=2&c[0]?r.return:c[0]?r.throw||((o=r.return)&&o.call(r),0):r.next)&&!(o=o.call(r,c[1])).done)return o;switch(r=0,o&&(c=[2&c[0],o.value]),c[0]){case 0:case 1:o=c;break;case 4:return i.label++,{value:c[1],done:!1};case 5:i.label++,r=c[1],c=[0];continue;case 7:c=i.ops.pop(),i.trys.pop();continue;default:if(!(o=i.trys,(o=o.length>0&&o[o.length-1])||6!==c[0]&&2!==c[0])){i=0;continue}if(3===c[0]&&(!o||c[1]>o[0]&&c[1]<o[3])){i.label=c[1];break}if(6===c[0]&&i.label<o[1]){i.label=o[1],o=c;break}if(o&&i.label<o[2]){i.label=o[2],i.ops.push(c);break}o[2]&&i.ops.pop(),i.trys.pop();continue}c=n.call(e,i)}catch(u){c=[6,u],r=0}finally{t=o=0}if(5&c[0])throw c[1];return{value:c[0]?c[1]:void 0,done:!0}}([c,u])}}}function o(e,n,t){if(t||2===arguments.length)for(var r,o=0,a=n.length;o<a;o++)!r&&o in n||(r||(r=Array.prototype.slice.call(n,0,o)),r[o]=n[o]);return e.concat(r||Array.prototype.slice.call(n))}function a(e,n){return new Promise((function(t){return setTimeout(t,e,n)}))}function i(e){return!!e&&"function"==typeof e.then}function c(e,n){try{var t=e();i(t)?t.then((function(e){return n(!0,e)}),(function(e){return n(!1,e)})):n(!0,t)}catch(r){n(!1,r)}}function u(e,n,o){return void 0===o&&(o=16),t(this,void 0,void 0,(function(){var t,i,c;return r(this,(function(r){switch(r.label){case 0:t=Date.now(),i=0,r.label=1;case 1:return i<e.length?(n(e[i],i),(c=Date.now())>=t+o?(t=c,[4,a(0)]):[3,3]):[3,4];case 2:r.sent(),r.label=3;case 3:return++i,[3,1];case 4:return[2]}}))}))}function l(e){e.then(void 0,(function(){}))}function s(e,n){e=[e[0]>>>16,65535&e[0],e[1]>>>16,65535&e[1]],n=[n[0]>>>16,65535&n[0],n[1]>>>16,65535&n[1]];var t=[0,0,0,0];return t[3]+=e[3]+n[3],t[2]+=t[3]>>>16,t[3]&=65535,t[2]+=e[2]+n[2],t[1]+=t[2]>>>16,t[2]&=65535,t[1]+=e[1]+n[1],t[0]+=t[1]>>>16,t[1]&=65535,t[0]+=e[0]+n[0],t[0]&=65535,[t[0]<<16|t[1],t[2]<<16|t[3]]}function d(e,n){e=[e[0]>>>16,65535&e[0],e[1]>>>16,65535&e[1]],n=[n[0]>>>16,65535&n[0],n[1]>>>16,65535&n[1]];var t=[0,0,0,0];return t[3]+=e[3]*n[3],t[2]+=t[3]>>>16,t[3]&=65535,t[2]+=e[2]*n[3],t[1]+=t[2]>>>16,t[2]&=65535,t[2]+=e[3]*n[2],t[1]+=t[2]>>>16,t[2]&=65535,t[1]+=e[1]*n[3],t[0]+=t[1]>>>16,t[1]&=65535,t[1]+=e[2]*n[2],t[0]+=t[1]>>>16,t[1]&=65535,t[1]+=e[3]*n[1],t[0]+=t[1]>>>16,t[1]&=65535,t[0]+=e[0]*n[3]+e[1]*n[2]+e[2]*n[1]+e[3]*n[0],t[0]&=65535,[t[0]<<16|t[1],t[2]<<16|t[3]]}function m(e,n){return 32===(n%=64)?[e[1],e[0]]:n<32?[e[0]<<n|e[1]>>>32-n,e[1]<<n|e[0]>>>32-n]:(n-=32,[e[1]<<n|e[0]>>>32-n,e[0]<<n|e[1]>>>32-n])}function f(e,n){return 0===(n%=64)?e:n<32?[e[0]<<n|e[1]>>>32-n,e[1]<<n]:[e[1]<<n-32,0]}function v(e,n){return[e[0]^n[0],e[1]^n[1]]}function h(e){return e=v(e,[0,e[0]>>>1]),e=v(e=d(e,[4283543511,3981806797]),[0,e[0]>>>1]),e=v(e=d(e,[3301882366,444984403]),[0,e[0]>>>1])}function 

{
    "risk_score": 2,
    "reasoning": "This appears to be a legitimate Google AdSense/AFS (Ads For Search) script with standard ad population functionality. It uses DOM manipulation (innerHTML) but in a controlled manner, sets timing variables, and contains structured ad configuration data. No high-risk behaviors like eval(), external data transmission, or suspicious redirects are present. The code is not obfuscated and follows expected patterns for ad serving."
}

window.AFS_AD_REQUEST_RETURN_TIME_ = Date.now();window.IS_GOOGLE_AFS_IFRAME_ = true;function populate(el) { var adBlock = document.getElementById("adBlock"); adBlock.innerHTML += el;}
var IS_GOOGLE_AFS_IFRAME_ = true;
var ad_json = {"caps":[{"n":"queryId","v":"fGFPZ8-eC5XkhcIP_L2H-Qc"},{"n":"popstripeRs","v":"#1F8A70,#BEDB39,#FFE11A,#FD7400,#004358"}],"rs_attr":{"t":"Related Links","u":""},"gd":{"ff":{"fd":"swap","eiell":true,"pcsbs":"44","pcsbp":"8"},"cd":{"pid":"dp-bodis31_3ph","eawp":"partner-dp-bodis31_3ph","qi":"fGFPZ8-eC5XkhcIP_L2H-Qc"},"pc":{"cgab":true,"ct":true},"dc":{"d":true}}};

{
    "risk_score": 4,
    "reasoning": "The script shows moderate risk indicators including external data transmission to 'bodis.com' domains and tracking behavior. It contains ad-related functionality and domain tracking, but uses standard fetch APIs and known domains. The obfuscation (base64 encoding) is present but appears to be for configuration rather than malicious purposes. The script appears to be legitimate ad-tech code but warrants attention due to its tracking capabilities."
}

!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).version={})}(this,(function(exports){"use strict";function __awaiter(e,t,n,i){return new(n||(n=Promise))((function(s,a){function o(e){try{d(i.next(e))}catch(e){a(e)}}function r(e){try{d(i.throw(e))}catch(e){a(e)}}function d(e){var t;e.done?s(e.value):(t=e.value,t instanceof n?t:new n((function(e){e(t)}))).then(o,r)}d((i=i.apply(e,t||[])).next())}))}var Blocking;"function"==typeof SuppressedError&&SuppressedError,function(e){e.PENDING="pending",e.NONE="none",e.BLOCKED="blocked",e.ALLOWED="allowed"}(Blocking||(Blocking={}));class Adblock{constructor(e){this.state=Blocking.PENDING,this._mocked=!1,e?(this.state=e,this._mocked=!0):this.state=Blocking.ALLOWED}inject(){return __awaiter(this,void 0,void 0,(function*(){}))}hasAdblocker(){if(void 0===window.google)return!0;const e=document.querySelectorAll("style");return Array.from(e).some((e=>!!e.innerHTML.includes("adblockkey")))}handleAdblocked(){this.removeAdblockKey(),this.state=Blocking.BLOCKED}removeAdblockKey(){var e;null===(e=document.documentElement.dataset)||void 0===e||delete e.adblockkey}get isBlocked(){return this.state===Blocking.BLOCKED}get isAllowed(){return this.state===Blocking.ALLOWED}toContext(){return{user_has_ad_blocker:null,is_ad_blocked:null}}}const OBFUSCATING_BASE_64_PREFIX="UxFdVMwNFNwN0wzODEybV",encode=e=>OBFUSCATING_BASE_64_PREFIX+btoa(unescape(encodeURIComponent(JSON.stringify(e))));function decode$1(e){return JSON.parse(decodeURIComponent(escape(atob(e.replace(OBFUSCATING_BASE_64_PREFIX,"")))))}var version="0.5.3";const APP_ENV="production",TRACKING_DOMAIN="https://click-use1.bodis.com/",SALES_JS_URL="https://parking.bodiscdn.com/js/inquiry.js",GOOGLE_CAF_TIMEOUT_SCRIPTS="0",GOOGLE_CAF_TIMEOUT_CALLBACKS="0",GOOGLE_MV3_URL_PARAMS="abp=1&bodis=true",APP_VERSION=version,COOKIE_CONSENT_JS_URL="",isLocal=(e=!0)=>"production"!==APP_ENV;function log(...e){}const FIND_DOMAIN_URL="_fd",getFindDomain=(e="",t=!1)=>{const n=`${e}/${FIND_DOMAIN_URL}${window.location.search}`,i=e?"include":"same-origin",s=Object.assign({Accept:"application/json","Content-Type":"application/json"},t?{"X-HOST":window.location.host}:{});return fetch(n,{method:"POST",headers:s,credentials:i}).then((e=>e.text())).then(decode$1)};var ZeroClickReasons;!function(e){e.CAF_TIMEDOUT="caf_timedout",e.CAF_ADLOAD_FAIL_RS="caf_adloadfail_rs",e.CAF_ADLOAD_FAIL_ADS="caf_adloadfail_ads",e.DISABLED_GB="disabled_gb",e.DISABLED_AB="disabled_ab",e.DISABLED_DS="disabled_ds",e.AD_BLOCKED="ad_blocked",e.PREFERRED="preferred"}(ZeroClickReasons||(ZeroClickReasons={}));const getZeroClick=e=>__awaiter(void 0,void 0,void 0,(function*(){const t=Object.assign(Object.assign({},e),{type:"zc_fetch"});return fetch("/_zc",{method:"POST",body:JSON.stringify({signature:encode(t)}),headers:{Accept:"application/json","Content-Type":"application/json"}}).then((e=>__awaiter(void 0,void 0,void 0,(function*(){try{return decode$1(yield e.text())}catch(e){return{}}}))))})),waiter=(e,t)=>new Promise((n=>{t(e),e<=0&&n();let i=e;const s=()=>{i>0?(i-=1,t(i),setTimeout(s,1e3)):n()};s()})),decode=()=>JSON.parse(atob(window.park||""));var PAGE_STYLES='* {\n  font-smoothing: antialiased;\n  -webkit-font-smoothing: antialiased;\n  -moz-osx-font-smoothing: grayscale;\n}\n\nhtml, body {\n  width: 100%;\n  margin: 0;\n}\n\nhtml {\n  background-color: #2B2B2B;\n  height: 100%;\n}\n\nbody {\n  min-height: 90%;\n  font-family: Arial, sans-serif;\n  letter-spacing: 1.2px;\n  color: #ccc;\n  text-align: center;\n}\n\n/* App Target - This starts hidden until we apply a class to "activate" it */\n\n#target {\n  opacity: 0;\n  visibility: hidden;\n}\n\n/* Status Messages - These are displayed when we are not rendering ad blocks or Related Search */\n\n#pk-status-message {\n  height: 75vh;\n  width: 100%;\n  display: flex;\n  flex-direction: column;\n  align-items

{
    "contains_trigger_text": true,
    "trigger_text": "Number Search",
    "prominent_button_name": "Number Search",
    "text_input_field_labels": "unknown",
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: http://ww25.divisioninfo.net

{
    "risk_score": 2,
    "reasoning": "This appears to be a legitimate Google loader script with standard functionality. It includes Google's domain handling, Promise polyfills, and symbol definitions. While it contains some obfuscated variable names (common in minified code), it communicates with trusted Google domains and follows standard practices. The only minor risk factors are the use of dynamic properties (window['googleNDT_']) and some DOM manipulation capabilities."
}

if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"12378535711633033738",packages:"domains",module:"ads",version:"1",m:{cei:"17301437,17301439,17301442,17301542,17301266",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:"syndicatedsearch.goog",cdem:{"afs_aa_baseline":500,"afs_chatbot":500,"afs_chatbot_aa":500,"afs_gpp_api":0,"disable_usp_api":0,"heterodyne_test":372}}};var n;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};
function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ea=da(this);function q(a,b){if(b)a:{var c=ea;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ca(c,a,{configurable:!0,writable:!0,value:b})}}
q("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g){this.je=f;ca(this,"description",{configurable:!0,writable:!0,value:g})}if(a)return a;c.prototype.toString=function(){return this.je};var d="jscomp_symbol_"+(Math.random()*1E9>>>0)+"_",e=0;return b});
q("Symbol.iterator",function(a){if(a)return a;a=Symbol("Symbol.iterator");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=ea[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&ca(d.prototype,a,{configurable:!0,writable:!0,value:function(){return fa(aa(this))}})}return a});function fa(a){a={next:a};a[Symbol.iterator]=function(){return this};return a}
var ha=typeof Object.create=="function"?Object.create:function(a){function b(){}b.prototype=a;return new b},ia;if(typeof Object.setPrototypeOf=="function")ia=Object.setPrototypeOf;else{var ja;a:{var ka={a:!0},la={};try{la.__proto__=ka;ja=la.a;break a}catch(a){}ja=!1}ia=ja?function(a,b){a.__proto__=b;if(a.__proto__!==b)throw new TypeError(a+" is not extensible");return a}:null}var ma=ia;
function na(a,b){a.prototype=ha(b.prototype);a.prototype.constructor=a;if(ma)ma(a,b);else for(var c in b)if(c!="prototype")if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.lg=b.prototype}function u(a){var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:aa(a)};throw Error(String(a)+" is not an iterable or ArrayLike");}
function oa(a){if(!(a instanceof Array)){a=u(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}function pa(a){return qa(a,a)}function qa(a,b){a.raw=b;Object.freeze&&(Object.freeze(a),Object.freeze(b));return a}function ra(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=arguments[c];return b}
q("Promise",function(a){function b(g){this.B=0;this.Xa=void 0;this.ya=[];this.Ld=!1;var h=this.nc();try{g(h.resolve,h.reject)}catch(k){h.reject(k)}}function c(){this.Y=null}function d(g){return g instanceof b?g:new b(function

{
  "brands": [
    "Divisioninfo.net"
  ]
}

{
    "risk_score": 4,
    "reasoning": "The script contains a base64 encoded JSON object with tracking parameters and user information. While encoding itself isn't malicious, the script collects user data including UUID, page information, and IP address. The domain 'divisioninfo.net' isn't a widely known trusted domain. The presence of tracking tokens and user behavioral data collection warrants moderate scrutiny."
}

window.park = "eyJ1dWlkIjoiYTVlNDJiZGYtZWJkOS00NDc4LWJiY2ItYjhlYTYxYTc3MDExIiwicGFnZV90aW1lIjoxNzMzMjU1NTYxLCJwYWdlX3VybCI6Imh0dHA6Ly93dzI1LmRpdmlzaW9uaW5mby5uZXQvP2NhZj0xXHUwMDI2YnB0PTM0NVx1MDAyNnN1YmlkMT0yMDI0MTIwNC0wNjUyLTE5ZmUtOWU2NS01ZWJjZmU4ZDYwZThcdTAwMjZxdWVyeT1OdW1iZXIrU2VhcmNoXHUwMDI2YWZkVG9rZW49Q2hNSTRyMkNpckNNaWdNVm9fLTdDQjA0Q3lkTEVtc0JsTHFwajlhLVBQdFRQREFSNk41azEyRVVjUGczNWl1Y2VTU2lEMmJqUjBvdHY0cEJmdXZ2Z1ZweDQ2dFlEZExRQ05WWEFnQVZfdmZkWVNIeVlVcEpjMGtoOHpoSmpReVMycGpOSG8takFJczFITHBESm9ZaXhfcG5TX1FDRHRTSGczQlVTWWlLOWZ2MzRRXHUwMDI2cGNzYT1mYWxzZVx1MDAyNm5iPTBcdTAwMjZubT0yNVx1MDAyNm54PTM2N1x1MDAyNm55PTU2XHUwMDI2aXM9NzAweDQ4MFx1MDAyNmNsa3Q9NDgiLCJwYWdlX21ldGhvZCI6IkdFVCIsInBhZ2VfcmVxdWVzdCI6eyJhZmRUb2tlbiI6IkNoTUk0cjJDaXJDTWlnTVZvXy03Q0IwNEN5ZExFbXNCbExxcGo5YS1QUHRUUERBUjZONWsxMkVVY1BnMzVpdWNlU1NpRDJialIwb3R2NHBCZnV2dmdWcHg0NnRZRGRMUUNOVlhBZ0FWX3ZmZFlTSHlZVXBKYzBraDh6aEpqUXlTMnBqTkhvLWpBSXMxSExwREpvWWl4X3BuU19RQ0R0U0hnM0JVU1lpSzlmdjM0USIsImJwdCI6IjM0NSIsImNhZiI6IjEiLCJjbGt0IjoiNDgiLCJpcyI6IjcwMHg0ODAiLCJuYiI6IjAiLCJubSI6IjI1IiwibngiOiIzNjciLCJueSI6IjU2IiwicGNzYSI6ImZhbHNlIiwicXVlcnkiOiJOdW1iZXIrU2VhcmNoIiwic3ViaWQxIjoiMjAyNDEyMDQtMDY1Mi0xOWZlLTllNjUtNWViY2ZlOGQ2MGU4In0sInBhZ2VfaGVhZGVycyI6eyJyZWZlcmVyIjpbImh0dHBzOi8vc3luZGljYXRlZHNlYXJjaC5nb29nLyJdfSwiaG9zdCI6Ind3MjUuZGl2aXNpb25pbmZvLm5ldCIsImlwIjoiOC40Ni4xMjMuMjI4In0K";

{
    "risk_score": 2,
    "reasoning": "This appears to be a legitimate Google syndicated search JavaScript code. It contains standard Google initialization code, Promise polyfills, and Symbol definitions. While it includes some obfuscated variable names (common in minified code), it interacts with known trusted Google domains (syndicatedsearch.goog) and implements standard functionality. The code patterns are consistent with legitimate Google services."
}

if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"syndicatedsearch.goog",hash:"12378535711633033738",packages:"domains",module:"ads",version:"1",m:{cei:"17301437,17301439,17301442,17301542,17301266",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:"syndicatedsearch.goog",cdem:{"afs_aa_baseline":500,"afs_chatbot":500,"afs_chatbot_aa":500,"afs_gpp_api":0,"disable_usp_api":0,"heterodyne_test":372}}};var n;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};
function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ea=da(this);function q(a,b){if(b)a:{var c=ea;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ca(c,a,{configurable:!0,writable:!0,value:b})}}
q("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g){this.je=f;ca(this,"description",{configurable:!0,writable:!0,value:g})}if(a)return a;c.prototype.toString=function(){return this.je};var d="jscomp_symbol_"+(Math.random()*1E9>>>0)+"_",e=0;return b});
q("Symbol.iterator",function(a){if(a)return a;a=Symbol("Symbol.iterator");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=ea[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&ca(d.prototype,a,{configurable:!0,writable:!0,value:function(){return fa(aa(this))}})}return a});function fa(a){a={next:a};a[Symbol.iterator]=function(){return this};return a}
var ha=typeof Object.create=="function"?Object.create:function(a){function b(){}b.prototype=a;return new b},ia;if(typeof Object.setPrototypeOf=="function")ia=Object.setPrototypeOf;else{var ja;a:{var ka={a:!0},la={};try{la.__proto__=ka;ja=la.a;break a}catch(a){}ja=!1}ia=ja?function(a,b){a.__proto__=b;if(a.__proto__!==b)throw new TypeError(a+" is not extensible");return a}:null}var ma=ia;
function na(a,b){a.prototype=ha(b.prototype);a.prototype.constructor=a;if(ma)ma(a,b);else for(var c in b)if(c!="prototype")if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.lg=b.prototype}function u(a){var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:aa(a)};throw Error(String(a)+" is not an iterable or ArrayLike");}
function oa(a){if(!(a instanceof Array)){a=u(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}function pa(a){return qa(a,a)}function qa(a,b){a.raw=b;Object.freeze&&(Object.freeze(a),Object.freeze(b));return a}function ra(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=arguments[c];return b}
q("Promise",function(a){function b(g){this.B=0;this.Xa=void 0;this.ya=[];this.Ld=!1;var h=this.nc();try{g(h.resolve,h.reject)}catch(k){h.reject(k)}}function c(){this.Y=null}function d(g){return g instanceof b?g:new b(f

{
    "risk_score": 4,
    "reasoning": "Script shows characteristics of ad-related functionality with moderate risk factors: 1) Dynamic DOM manipulation through innerHTML (+2), 2) Cross-frame communication attempts (+1), 3) URL parameter parsing that could be used for tracking (+1). However, appears to be legitimate AdSense integration (-1 for trusted Google context), though implementation has some security concerns with cross-frame scripting."
}

if (window.name.match(/^{"name":"master-\d+"/)) {var script = document.createElement('script');script.src = "/adsense/search/ads.js";var href = window.location.href;if (!!href && (href.indexOf('?pac=') > 0 || href.indexOf('&pac=') > 0)) {if (href.indexOf('?pac=1') > 0 || href.indexOf('&pac=1') > 0) {script.src += '?pac=1';} else if (href.indexOf('?pac=2') > 0 || href.indexOf('&pac=2') > 0) {script.src += '?pac=2';} else {script.src += '?pac=0';}}document.head.appendChild(script);window.IS_GOOGLE_AFS_IFRAME_ = true;}function populate(el) {var adBlock = document.getElementById('adBlock');adBlock.innerHTML += el;}function getMaster() {var m = null;var pIndex = window.name.indexOf('|');if (pIndex > -1 && window.name.charAt(0) != '{') {try {m = window.parent.frames[window.name.substring(pIndex + 1)];} catch (e) {}if (m) {return m;}var nameInfo = window.name.match(/^(slave-\d+)-(\d+)/);var masterNum = (nameInfo && nameInfo[2]) ? nameInfo[2] : null;if (masterNum) {try {m = window.parent.frames['master-' + masterNum];} catch (e) {}}}return m;}window.onresize = function() {var resizeMaster = getMaster();try {resizeMaster && resizeMaster.sPH && resizeMaster.sPH();} catch(e) {}};var masterFrame = getMaster();try {masterFrame && masterFrame.mPAASH && masterFrame.mPAASH();} catch(e) {}

{
    "contains_trigger_text": true,
    "trigger_text": "App Apk Free Download - Phone Number Lookup Free",
    "prominent_button_name": "Visit Website",
    "text_input_field_labels": "unknown",
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
    "risk_score": 2,
    "reasoning": "Script appears to be a legitimate Google AdSense/AFS (Ads for Search) implementation. Contains DOM manipulation via innerHTML (moderate risk) but operates within expected ad serving behavior. Variables and data structure suggest standard Google advertising functionality. No high-risk behaviors like eval() or suspicious data transmission observed."
}

window.AFS_AD_REQUEST_RETURN_TIME_ = Date.now();window.IS_GOOGLE_AFS_IFRAME_ = true;function populate(el) { var adBlock = document.getElementById("adBlock"); adBlock.innerHTML += el;}
var IS_GOOGLE_AFS_IFRAME_ = true;
var ad_json = {"caps":[{"n":"queryId","v":"jGFPZ8qrFp_KhcIP28L4-A8"}],"rs_attr":{"t":"Related Links","u":""},"gd":{"ff":{"fd":"swap","eiell":true,"pcsbs":"44","pcsbp":"8","eovd":false,"efovd":true},"cd":{"pid":"dp-bodis31_3ph","eawp":"partner-dp-bodis31_3ph","ru":"https://syndicatedsearch.goog/","qi":"jGFPZ8qrFp_KhcIP28L4-A8"},"pc":{"cgab":true,"ct":true},"dc":{"d":true}}};

{
  "brands": [
    "Divisioninfo.net"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": false
}

URL: https://www.appurse.com

{
  "brands": [
    "APPURSE"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}