Windows Analysis Report
https://bell36588.yardione.com

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://bell36588.yardione.com

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet appears to be a combination of legitimate functionality and some potentially concerning behaviors. While it does not exhibit any clear malicious intent, there are a few moderate-risk indicators that warrant further review."
}

(()=>{var d={618:(d,e,t)=>{"use strict";let n,i;function r(d){let e=document.getElementById("master_div"),t=document.getElementById("tenant_apps"),i=document.querySelectorAll('[data-app-name="tenant_app_rows"]'),r=new Array;if(r=a(i,d,n),!r||0==r.length)return n=d,!1;n=d;let o=document.createElement("div");o.id="tenant_apps",o.className="logo-list";for(let d=0,e=r.length;d<e;d++)o.appendChild(i[r[d].oldIndex]);o.hasChildNodes()&&e.replaceChild(o,t)}function o(d){let e=document.getElementById("master_div_lite"),t=document.getElementById("tenant_apps_lite"),n=document.querySelectorAll('[data-app-name="tenant_app_rows_lite"]'),r=new Array;if(r=a(n,d,i),!r||0==r.length)return i=d,!1;i=d;let o=document.createElement("div");o.id="tenant_apps_lite",o.className="dashboard-item-holder m-b-md clearfix";for(let d=0,e=r.length;d<e;d++)o.appendChild(n[r[d].oldIndex]);o.hasChildNodes()&&e.replaceChild(o,t)}function a(d,e,t){let n=new Array;for(let e=0,t=d.length;e<t;e++)n[e]=new Object,n[e].oldIndex=e,n[e].value=d[e].attributes["data-title"].nodeValue,n[e].id=d[e].attributes["data-client-id"].nodeValue;if(0==e)1==t?n.reverse():n.sort(s);else if(1==e)0==t?n.reverse():n.sort(s).reverse();else if(2==e){let d=[];if(d=JSON.parse(window.localStorage.getItem("ls.recent-apps")),d){d=d.reverse();let e=[];n.forEach((function(t){let n=d.indexOf(t.id);-1!=n&&(e[n]=t)}));let t=n.filter((function(e){return-1==d.indexOf(e.id)}));t.sort(s),n=[],n=e.concat(t)}else{if(0==t)return n=[],n;n.sort(s)}}return n}function s(d,e){let t=d.value.toLowerCase(),n=e.value.toLowerCase();return t==n?0:t>n?1:-1}t.d(e,{l:()=>o}),$(document).ready((function(){$(".appOrderFilter").on("click",(function(d){d.preventDefault();let e=$(this);r(e.val()),$(".appOrderFilter").removeClass("pill-active"),e.addClass("pill-active"),$.ajax({url:"/home/saveuserapporder?order="+e.val(),type:"GET",success:function(){},error:function(d){}})})),$("#tenant_apps div[name='app']").on("click",(function(){let d=$(this),e=[];e=JSON.parse(window.localStorage.getItem("ls.recent-apps")),e||(e=[]);let t=d[0].attributes["data-client-id"].nodeValue,n=e.indexOf(t);-1!=n&&e.splice(n,1),e.push(t),window.localStorage.setItem("ls.recent-apps",JSON.stringify(e)),"2"===$("#appOrderFilter").val()&&(r(2),o(2))})),"undefined"!=typeof userAppOrder&&2==userAppOrder&&document.querySelectorAll('[data-app-name="tenant_app_rows"]').length>0&&window.localStorage.getItem("ls.recent-apps")&&r(2)}))},78:()=>{$(document).ready((function(){function d(d){var e,t,n=window.location.search.substring(1).split("&");for(t=0;t<n.length;t++)if((e=n[t].split("="))[0]===d)return void 0===e[1]||decodeURIComponent(e[1]);return!1}String.prototype.endsWith||(String.prototype.endsWith=function(d){var e=this.length-d.length;return e>=0&&this.lastIndexOf(d)===e}),$(".external-providers .btn-auth").on("click",(function(d){d.preventDefault();var e=$(this).attr("href");$(this).prop("disabled",!0).addClass("disabled"),$("#lnkForgotPassword").addClass("disabled").off("click").on("click",(function(d){d.preventDefault()})),$("#lnkRegister").addClass("disabled").off("click").on("click",(function(d){d.preventDefault()})),$("#loginbtn").addClass("disabled").off("click").on("click",(function(d){d.preventDefault()})),window.location.href=e})),$("#loginbtn").on("click",(function(d){d.preventDefault();var e=$(this).closest("form");$("#lnkForgotPassword").addClass("disabled").off("click").on("click",(function(d){d.preventDefault()})),$("#lnkRegister").addClass("disabled").off("click").on("click",(function(d){d.preventDefault()})),$(".external-providers .btn-auth").prop("disabled",!0).addClass("disabled");var t=$("<input>").attr({type:"hidden",name:"button",value:"login"});e.append(t),e.submit(),$(this).prop("disabled",!0).addClass("disabled")})),$("#lnkForgotPassword").on("click",(function(e){e.preventDefault();var t=$("#Username").val(),n="",i=$("#hidd_txtReturnURL").val()||"",r=window.location.href;r.toLowerCase().endsWith("/account/login/")&&(r=r.slice(0,-1)),n

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "LOGIN",
"text_input_field_labels": [
"Username",
"Password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Yardi One"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "SUBMIT",
  "text_input_field_labels": [
    "Username"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Yardi One"
  ]
}

```json{  "legit_domain": "yardi.com",  "classification": "known",  "reasons": [    "The brand 'Yardi One' is associated with the company Yardi, which is a known provider of real estate management software.",    "The legitimate domain for Yardi is 'yardi.com'.",    "The URL 'bell36588.yardione.com' contains 'yardione', which could be a subdomain or a service under Yardi, but the main domain is 'yardione.com', not 'yardi.com'.",    "The presence of numbers and an unusual subdomain 'bell36588' is suspicious and not typical for a legitimate Yardi service.",    "The domain 'yardione.com' does not match the known legitimate domain 'yardi.com'.",    "The use of a subdomain and the structure of the URL suggest a potential phishing attempt."  ],  "riskscore": 8}
Google indexed: False

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "SUBMIT",
  "text_input_field_labels": [
    "Username"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Yardi One"
  ]
}

{
  "brands": "unknown"
}

```json{  "legit_domain": "yardi.com",  "classification": "known",  "reasons": [    "The brand 'Yardi One' is associated with the company Yardi, which is a known provider of real estate management software.",    "The legitimate domain for Yardi is 'yardi.com'.",    "The URL 'bell36588.yardione.com' contains 'yardione', which could be a subdomain or service related to Yardi.",    "The presence of 'bell36588' as a subdomain is unusual and not typically associated with Yardi's known services.",    "The use of a subdomain with numbers and unrelated words is a common tactic in phishing attempts to confuse users.",    "The domain 'yardione.com' does not match the known legitimate domain 'yardi.com', which raises suspicion."  ],  "riskscore": 7}
Google indexed: False

```json{  "legit_domain": "yardi.com",  "classification": "known",  "reasons": [    "The brand 'Yardi One' is associated with the company Yardi, which is known for property management software.",    "The legitimate domain for Yardi is 'yardi.com'.",    "The URL 'bell36588.yardione.com' contains 'yardione', which could be a subdomain or a service under Yardi.",    "The presence of 'bell36588' as a prefix is unusual and not typically associated with Yardi's legitimate domains.",    "The domain 'yardione.com' does not match the known legitimate domain 'yardi.com', which raises suspicion.",    "The use of a subdomain and the presence of a number sequence ('36588') are common tactics in phishing URLs."  ],  "riskscore": 7}
Google indexed: False