Windows Analysis Report
https://fsharetv.io/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://fsharetv.io

{
    "risk_score": 7,
    "reasoning": "This script demonstrates high-risk behavior by dynamically executing code and sending sensitive data (ad-blocker status) to an external, potentially untrusted domain. The use of obfuscated URLs and the redirection to an unknown domain further increase the risk. While the script may have a legitimate purpose, such as ad-blocker detection, the implementation raises significant security concerns."
}

function handleABPDetect(){try{if(!abp) return;var imglog = document.createElement("img");imglog.style.height="0px";imglog.style.width="0px";imglog.src="http://ww1.fsharetv.io/sk-logabpstatus.php?a=aGkwRmN2eEZZR2JNK0FKU2RjZyt5SnNZOTZ1MGpKM2t3MDJxMDVxUUx0ejRsL3g4VnBmWXo5QlR3WmdmaDZzSSsyc1ZYYWNkSUd0cXg5WFlGSDBXb01MZ1F6VzB5TFBCQncwR0htMm9IdDBjVXRlS1gxNXVrMmF0VitkeGFDdGE=&b="+abp;document.body.appendChild(imglog);if(typeof abperurl !== "undefined" && abperurl!="")window.top.location=abperurl;}catch(err){}}

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be setting a cookie with the name 'isframesetenabled' and the value '1'. This behavior is commonly used for tracking or analytics purposes, which is a low-risk indicator. The code is also wrapped in a try-catch block, which is a common practice to handle potential exceptions. Overall, this script does not exhibit any high-risk behaviors and is likely benign."
}

try{document.cookie = 'isframesetenabled=1; path=/;';}catch(exception){}

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including redirecting the user to an untrusted domain (fsharetv.io) and passing encoded data in the URL, which could be used for malicious purposes such as credential theft or other types of data exfiltration. The combination of the redirect and the encoded data in the URL is highly suspicious and indicative of a potential phishing or malware attempt."
}

window.location.replace('https://fsharetv.io/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTczNTEzNzEwNSwiaWF0IjoxNzM1MTI5OTA1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMGE2bXQ2Z2p0OWprNnVvNmcwZHI2Z2oiLCJuYmYiOjE3MzUxMjk5MDUsInRzIjoxNzM1MTI5OTA1OTA0OTIwfQ.kHSo-2ThC6VSDNvaNVDritFeDOWm5xrVUTjVNfaOwWw&sid=344f65c5-c2bc-11ef-83ee-6c17e29e5ae6');

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate script that checks for the presence of certain regulation keys and displays or hides a DNS link accordingly. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script uses standard DOM manipulation and interval-based polling, which are common practices. While the use of the `__cmp` function may be a legacy practice, it does not pose a significant security risk in this context. Overall, the script seems to be implementing a benign functionality and can be considered low risk."
}

                        function checkDNS()
                        {
                            __cmp('getCMPData', true, function (x)
                            {
                                var possibleKeys = ['CCPA','USVCDPA','USCPA','USUCPA','USCAPDP','USTDPSA','USOCDPA','USMTCDPA','USFDBR']; //add possible regulations where to show the DNS-link
                                if('regulationKey' in x && possibleKeys .indexOf(x.regulationKey) != -1)
                                {
                                document.getElementById('dnslink').style.display='block'; /* show the link*/
                                }
                                else{
                                document.getElementById('dnslink').style.display='none'; /* dont show the link*/
                                }
                            }
                           );
                        }
                        setInterval(checkDNS,1000);
                    

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript code appears to be related to cookie management and consent handling, which is a common practice for websites that need to comply with privacy regulations like the GDPR. The code sets a cookie with a value of '1' or '-1' depending on the user's consent preferences, which is a legitimate behavior. While the code uses some older APIs like `document.cookie`, it does not exhibit any high-risk indicators such as dynamic code execution, data exfiltration, or suspicious redirects. Overall, the script seems to be implementing standard consent management functionality and poses a low risk."
}

              function _cmpclbk(cvalue,e,o)
              {
                var days = 180;
                var cname = "_cmp_dmst";
                var secure = (window.location.protocol !== "https:") ? "" : ";secure";
                var d = new Date();
                d.setTime(d.getTime() + (days * 24 * 60 * 60 * 1000));
                var expire_date = d.toUTCString();
                var expires = "expires=" + expire_date;
                document.cookie = cname + "=" + cvalue + ";" + expires + ";path=/" + secure;
              }
              __cmp("addEventListener",["consentapproved",function(e,o){_cmpclbk("1",e,o);},false],null);
              __cmp("addEventListener",["consentrejected",function(e,o){_cmpclbk("-1",e,o);},false],null);
              __cmp("addEventListener",["consentcustom",function(e,o){_cmpclbk("-1",e,o);},false],null); 

{
    "risk_score": 4,
    "reasoning": "This script appears to be related to consent management, which is a common practice for websites to comply with privacy regulations like GDPR. While it uses some legacy APIs like `XDomainRequest` and has some obfuscation, the overall behavior seems to be focused on managing user consent preferences and loading the appropriate consent management platform. The script does not exhibit any clear signs of malicious intent, but the use of some outdated practices and obfuscation warrant further review to ensure there are no hidden risks."
}

window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in window)){window.cmp_codesrc="1"}window.cmp_getsupportedLangs=function(){var b=["DE","EN","FR","IT","NO","DA","FI","ES","PT","RO","BG","ET","EL","GA","HR","LV","LT","MT","NL","PL","SV","SK","SL","CS","HU","RU","SR","ZH","TR","UK","AR","BS"];if("cmp_customlanguages" in window){for(var a=0;a<window.cmp_customlanguages.length;a++){b.push(window.cmp_customlanguages[a].l.toUpperCase())}}return b};window.cmp_getRTLLangs=function(){var a=["AR"];if("cmp_customlanguages" in window){for(var b=0;b<window.cmp_customlanguages.length;b++){if("r" in window.cmp_customlanguages[b]&&window.cmp_customlanguages[b].r){a.push(window.cmp_customlanguages[b].l)}}}return a};window.cmp_getlang=function(j){if(typeof(j)!="boolean"){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.push(e.substr(e.indexOf("cmplang=")+8,2).toUpperCase())}else{if("cmp_setlang" in window&&window.cmp_setlang!=""){c.push(window.cmp_setlang.toUpperCase())}else{if(a.length>0){for(var d=0;d<a.length;d++){c.push(a[d])}}}}}if("language" in navigator){c.push(navigator.language)}if("userLanguage" in navigator){c.push(navigator.userLanguage)}var h="";for(var d=0;d<c.length;d++){var b=c[d].toUpperCase();if(g.indexOf(b)!=-1){h=b;break}if(b.indexOf("-")!=-1){b=b.substr(0,2)}if(g.indexOf(b)!=-1){h=b;break}}if(h==""&&typeof(cmp_getlang.defaultlang)=="string"&&cmp_getlang.defaultlang!==""){return cmp_getlang.defaultlang}else{if(h==""){h="EN"}}h=h.toUpperCase();return h};(function(){var u=document;var v=u.getElementsByTagName;var h=window;var o="";var b="_en";if("cmp_getlang" in h){o=h.cmp_getlang().toLowerCase();if("cmp_customlanguages" in h){for(var q=0;q<h.cmp_customlanguages.length;q++){if(h.cmp_customlanguages[q].l.toUpperCase()==o.toUpperCase()){o="en";break}}}b="_"+o}function x(i,e){var w="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.substr(d.hash.indexOf(i)+s,9999)}else{if(d.search.indexOf(i)!=-1){w=d.search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.indexOf("&"))}return w}var k=("cmp_proto" in h)?h.cmp_proto:"https:";if(k!="http:"&&k!="https:"){k="https:"}var g=("cmp_ref" in h)?h.cmp_ref:location.href;var j=u.createElement("script");j.setAttribute("data-cmp-ab","1");var c=x("cmpdesign","cmp_design" in h?h.cmp_design:"");var f=x("cmpregulationkey","cmp_regulationkey" in h?h.cmp_regulationkey:"");var r=x("cmpgppkey","cmp_gppkey" in h?h.cmp_gppkey:"");var n=x("cmpatt","cmp_att" in h?h.cmp_att:"");j.src=k+"//"+h.cmp_host+"/delivery/cmp.php?"+("cmp_id" in h&&h.cmp_id>0?"id="+h.cmp_id:"")+("cmp_cdid" in h?"&cdid="+h.cmp_cdid:"")+"&h="+encodeURIComponent(g)+(c!=""?"&cmpdesign="+encodeURIComponent(c):"")+(f!=""?"&cmpregulationkey="+encodeURIComponent(f):"")+(r!=""?"&cmpgppkey="+encodeURIComponent(r):"")+(n!=""?"&cmpatt="+encodeURIComponent(n):"")+("cmp_params" in h?"&"+h.cmp_params:"")+(u.cookie.length>0?"&__cmpfcc=1":"")+"&l="+o.toLowerCase()+"&o="+(new Date()).getTime();j.type="text/javascript";j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a simple script that adds a hidden input field to a search form on the page. This behavior is likely related to some form of analytics or tracking functionality, which is a common practice and does not demonstrate any high-risk indicators. The script does not contain any dynamic code execution, data exfiltration, or suspicious redirects, and it interacts with the local DOM only. While the use of a custom input field name ('_opnslfp') could be considered a low-risk indicator, the overall context suggests this is a benign script with no clear malicious intent."
}

(function() {var srchForm = document.getElementById("searchform1"); if(srchForm) { var _e = document.createElement("input");_e.type='hidden'; _e.name = '_opnslfp'; _e.id='_opnslfp'; _e.value=1;srchForm.appendChild(_e); }})();

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Watch Movies",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Fsharetv.io"
  ]
}

{
  "brands": [
    "Fsharetv.io"
  ]
}