Windows Analysis Report
https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://dnsextension.pro

{
    "risk_score": 5,
    "reasoning": "The script appears to be a common email obfuscation technique, which is a moderate-risk indicator. It decodes email addresses embedded in the HTML and replaces them with obfuscated versions. While this is a common practice to protect email addresses from spam, the script also performs aggressive DOM manipulation, which is another moderate-risk indicator. Overall, the script exhibits some potentially concerning behaviors, but it does not appear to be inherently malicious."
}

!function(){"use strict";function e(e){try{if("undefined"==typeof console)return;"error"in console?console.error(e):console.log(e)}catch(e){}}function t(e){return d.innerHTML='<a href="'+e.replace(/"/g,"&quot;")+'"></a>',d.childNodes[0].getAttribute("href")||""}function r(e,t){var r=e.substr(t,2);return parseInt(r,16)}function n(n,c){for(var o="",a=r(n,c),i=c+2;i<n.length;i+=2){var l=r(n,i)^a;o+=String.fromCharCode(l)}try{o=decodeURIComponent(escape(o))}catch(u){e(u)}return t(o)}function c(t){for(var r=t.querySelectorAll("a"),c=0;c<r.length;c++)try{var o=r[c],a=o.href.indexOf(l);a>-1&&(o.href="mailto:"+n(o.href,a+l.length))}catch(i){e(i)}}function o(t){for(var r=t.querySelectorAll(u),c=0;c<r.length;c++)try{var o=r[c],a=o.parentNode,i=o.getAttribute(f);if(i){var l=n(i,0),d=document.createTextNode(l);a.replaceChild(d,o)}}catch(h){e(h)}}function a(t){for(var r=t.querySelectorAll("template"),n=0;n<r.length;n++)try{i(r[n].content)}catch(c){e(c)}}function i(t){try{c(t),o(t),a(t)}catch(r){e(r)}}var l="/cdn-cgi/l/email-protection#",u=".__cf_email__",f="data-cfemail",d=document.createElement("div");i(document),function(){var e=document.currentScript||document.scripts[document.scripts.length-1];e.parentNode.removeChild(e)}()}();

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet is generating a QR code for the current URL, which is a common and benign practice. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The code is straightforward and does not appear to have any malicious intent."
}

        const currentUrl = window.location.href;
        QRCode.toCanvas(document.getElementById("qrcode"), currentUrl, function (error) {
            if (error) console.error(error);
            console.log("QR code generated for", currentUrl);
        });
    

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate script that handles date calculations, fetches country information, and performs form calculations and validations. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The script's functionality is consistent with typical web application requirements, and it does not contain any obvious malicious intent. While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, the script demonstrates benign behavior and can be considered low-risk."
}

document.addEventListener("DOMContentLoaded", function () {
    // Past due date and dates calculation
    const currentDate = new Date();
    document.getElementById("pastDueDate").textContent = currentDate.toDateString();
    
    const oneYearDate = new Date();
    oneYearDate.setFullYear(currentDate.getFullYear() + 1);
    document.getElementById("oneYearPeriod").textContent = "Until - " + oneYearDate.toDateString();
    
    const twoYearsDate = new Date();
    twoYearsDate.setFullYear(currentDate.getFullYear() + 2);
    document.getElementById("twoYearsPeriod").textContent = "Until - " + twoYearsDate.toDateString();
    
    const fiveYearsDate = new Date();
    fiveYearsDate.setFullYear(currentDate.getFullYear() + 5);
    document.getElementById("fiveYearsPeriod").textContent = "Until - " + fiveYearsDate.toDateString();
    
    // Flag and country name fetching
    fetch("https://ipapi.co/json").then(response => response.json()).then(data => {
        const countryCode = data.country_code;
        const countryName = data.country_name;
        const flagUrl = `https://flagcdn.com/w320/${countryCode.toLowerCase()}.png`;
        document.getElementById("country-flag").src = flagUrl;
        document.getElementById("country-placeholder").textContent = countryName;
    }).catch(error => {
        console.error("Error fetching IP information:", error);
    });
    
    // Form calculations and validations
    const checkboxes = document.querySelectorAll('input[type="checkbox"]');
    const radios = document.querySelectorAll('input[type="radio"]');
    const totalPrice = document.getElementById("total_price");
    const basePrice = document.getElementById("baseprice");
    const price = document.getElementById("price");
    const dueToday = document.getElementById("dueToday");
    const submitButton = document.getElementById("submit-button");
    const form = document.querySelector("form");
    const emailError = document.getElementById("email-error");
    
    function calculateTotal() {
        let total = 0;
        
        // Calculate from radio buttons (term selection) using data-price
        radios.forEach(radio => {
            if (radio.checked) {
                const radioPrice = parseFloat(radio.getAttribute('data-price'));
                if (!isNaN(radioPrice)) {
                    total += radioPrice;
                }
            }
        });

        // Calculate from checkboxes using data-price
        checkboxes.forEach(checkbox => {
            if (checkbox.checked) {
                const checkboxPrice = parseFloat(checkbox.getAttribute('data-price'));
                if (!isNaN(checkboxPrice)) {
                    total += checkboxPrice;
                }
            }
        });

        // Update all price fields
        console.log(`Calculated total: $${total.toFixed(2)}`);
        dueToday.textContent = "$" + total.toFixed(2);
        totalPrice.value = total.toFixed(2);
        basePrice.value = total.toFixed(2);
        price.value = total.toFixed(2);
    }
    
    // Add event listeners
    checkboxes.forEach(checkbox => {
        checkbox.addEventListener("change", calculateTotal);
    });
    
    radios.forEach(radio => {
        radio.addEventListener("change", calculateTotal);
    });
    
    // Calculate initial total
    calculateTotal();
    
    // Form submission handler
    form.addEventListener("submit", function (e) {
        e.preventDefault();
        
        // Hide any existing error messages
        if (emailError) {
            emailError.style.display = 'none';
            emailError.textContent = '';
        }
        
        // Recalculate total before submission
        calculateTotal();
        
        // Check if a term is selected
        const isRadioSelected = Array.from(radios).some(radio => radio.checked);
        if (!isRadioSelected) {
            alert("Please select a term option.");
            submitButton.disabled = false;
            return;
        }

{
    "risk_score": 4,
    "reasoning": "The script appears to be a web analytics/tracking script, with some moderate-risk behaviors. It collects user data like screen size, language, and URL information, and sends it to an external API endpoint. While this is a common practice for analytics, the script also has some concerning behaviors like using legacy APIs, obfuscating URLs, and modifying the browser history. Overall, the script requires further review due to the unclear intent and potential for abuse, but it does not appear to be outright malicious."
}

!function(){"use strict";(t=>{const{screen:{width:e,height:a},navigator:{language:r},location:n,document:i,history:c}=t,{hostname:s,href:o,origin:u}=n,{currentScript:l,referrer:d}=i,h=o.startsWith("data:")?void 0:t.localStorage;if(!l)return;const f="data-",m=l.getAttribute.bind(l),p=m(f+"website-id"),g=m(f+"host-url"),y=m(f+"tag"),b="false"!==m(f+"auto-track"),v="true"===m(f+"exclude-search"),S=m(f+"domains")||"",w=S.split(",").map((t=>t.trim())),N=`${(g||""||l.src.split("/").slice(0,-1).join("/")).replace(/\/$/,"")}/api/send`,T=`${e}x${a}`,A=/data-umami-event-([\w-_]+)/,x=f+"umami-event",O=300,U=t=>{if(t){try{const e=decodeURI(t);if(e!==t)return e}catch(e){return t}return encodeURI(t)}},j=t=>{try{const{pathname:e,search:a,hash:r}=new URL(t,u);t=e+a+r}catch(t){}return v?t.split("?")[0]:t},k=()=>({website:p,hostname:s,screen:T,language:r,title:U(q),url:U(W),referrer:U(_),tag:y||void 0}),E=(t,e,a)=>{a&&(_=W,W=j(a.toString()),W!==_&&setTimeout(K,O))},L=()=>!p||h&&h.getItem("umami.disabled")||S&&!w.includes(s),$=async(t,e="event")=>{if(L())return;const a={"Content-Type":"application/json"};void 0!==B&&(a["x-umami-cache"]=B);try{const r=await fetch(N,{method:"POST",body:JSON.stringify({type:e,payload:t}),headers:a}),n=await r.text();return B=n}catch(t){}},I=()=>{D||(K(),(()=>{const t=(t,e,a)=>{const r=t[e];return(...e)=>(a.apply(null,e),r.apply(t,e))};c.pushState=t(c,"pushState",E),c.replaceState=t(c,"replaceState",E)})(),(()=>{const t=new MutationObserver((([t])=>{q=t&&t.target?t.target.text:void 0})),e=i.querySelector("head > title");e&&t.observe(e,{subtree:!0,characterData:!0,childList:!0})})(),i.addEventListener("click",(async t=>{const e=t=>["BUTTON","A"].includes(t),a=async t=>{const e=t.getAttribute.bind(t),a=e(x);if(a){const r={};return t.getAttributeNames().forEach((t=>{const a=t.match(A);a&&(r[a[1]]=e(t))})),K(a,r)}},r=t.target,i=e(r.tagName)?r:((t,a)=>{let r=t;for(let t=0;t<a;t++){if(e(r.tagName))return r;if(r=r.parentElement,!r)return null}})(r,10);if(!i)return a(r);{const{href:e,target:r}=i,c=i.getAttribute(x);if(c)if("A"===i.tagName){const s="_blank"===r||t.ctrlKey||t.shiftKey||t.metaKey||t.button&&1===t.button;if(c&&e)return s||t.preventDefault(),a(i).then((()=>{s||(n.href=e)}))}else if("BUTTON"===i.tagName)return a(i)}}),!0),D=!0)},K=(t,e)=>$("string"==typeof t?{...k(),name:t,data:"object"==typeof e?e:void 0}:"object"==typeof t?t:"function"==typeof t?t(k()):k()),R=t=>$({...k(),data:t},"identify");t.umami||(t.umami={track:K,identify:R});let B,D,W=j(o),_=d.startsWith(u)?"":d,q=i.title;b&&!L()&&("complete"===i.readyState?I():i.addEventListener("readystatechange",I,!0))})(window)}();

{
  "contains_trigger_text": true,
  "trigger_text": "Do Not Close This Window : Invoice Processing",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "If you can access this system, your record has not been deleted yet and can still be renewed.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "DNS System"
  ]
}

{
  "brands": [
    "MYSATINOBL ACK.COM"
  ]
}