Windows Analysis Report
https://logistics.sheincorp.cn/#/login

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://logistics.sheincorp.cn

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be setting configuration variables for the SHEIN environment, which is likely a legitimate use case. There are no high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The code seems to be setting environment-specific variables, which is a common practice in web development. Overall, this snippet does not demonstrate any malicious behavior and can be considered low risk."
}

          window.shein_env_config = {};
          window.shein_env_config['CI_COMMIT_SHA']='fed8abef51ab2a025d3f96ce2f3362375b7ce2c5';
          window.shein_env_config['CI_COMMIT_REF_NAME']='master';
        

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a browser compatibility check, which is a common practice to ensure the website functions correctly on different browsers. The script checks the user agent string to detect mobile devices, iPads, and modern versions of Chrome and Edge browsers. While it redirects users to an error page if the browser is not compatible, this behavior is likely for legitimate purposes and does not demonstrate any high-risk indicators. The script uses standard browser APIs and does not exhibit any suspicious activities, such as dynamic code execution, data exfiltration, or malicious redirects. Therefore, the overall risk score is low."
}

function browserCheck() {
        var ua = navigator.userAgent.toLowerCase();
        // 
        if (window.screen.width < 500 || !!ua.match(/(iphone|android|mobi)/i)) {
          return true;
        }
        // ipad
        if (!!ua.match(/(ipad|macintosh)/i)) {
          return true;
        }

        function isRight(browser) {
          var index = ua.indexOf(browser);
          if (index >= 0) {
            var version = parseInt(
              ua.substring(+index + +browser.length, ua.indexOf('.', index)),
              10,
            );
            if (version >= 79) {
              return true;
            }
          }
          return false;
        }
        try {
          if (window.chrome) {
            return isRight('chrome/') || isRight('edge/');
          }
          return false;
        } catch (e) {
          console.log('err:', e);
          return false;
        }
      }
      if (!browserCheck()) {
        window.location.replace('/error.html');
      }

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "",
"text_input_field_labels": [
"",
""
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": true,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Shein"
  ]
}

```json{  "legit_domain": "shein.com",  "classification": "wellknown",  "reasons": [    "The brand 'Shein' is a well-known online fashion retailer.",    "The legitimate domain for Shein is 'shein.com'.",    "The provided URL 'logistics.sheincorp.cn' does not match the legitimate domain.",    "The use of 'sheincorp.cn' is suspicious as it adds 'corp' and uses a '.cn' domain, which is not the standard domain for Shein.",    "The presence of input fields for email and password on a non-legitimate domain increases the risk of phishing."  ],  "riskscore": 8}
Google indexed: False