Windows Analysis Report
https://share.hsforms.com/1ERkb7-8BRoi6cEFhMJVsvgt08ok

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://share.hsforms.com

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be setting up variables and arrays for Hubspot-related functionality, such as forms, popups, and local environment detection. There are no high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The code seems to be setting up a standard Hubspot integration, which is a common and legitimate practice."
}

        var isQa = false;
        window.hsFormsOnReady = [];
        window._hsq = window._hsq || [];
        window.disabledHsPopups = ['ADS', 'LEADFLOW', 'LIVE_CHAT', 'FEEDBACK', 'CALLS_TO_ACTION'];
        window.isQa = isQa;
        window.isLocal = window.location.hostname.split('.')[0] === 'local';
      

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate script that loads resources from known domains (HubSpot) and does not exhibit any high-risk behaviors. It uses common web performance optimization techniques like DNS prefetching and preconnecting to improve page load times. The script is also properly structured, with no use of dynamic code execution or data exfiltration. Overall, this script is likely benign and poses a low risk."
}

      (function (jsHsFormsUrl, formsHsFormsUrl, isLocal) {
        var dnsPrefetchJs = document.createElement('link');
        var dnsPrefetchForms = document.createElement('link');
        var preconnectJs = document.createElement('link');
        var preconnectForms = document.createElement('link');
        var scriptJs = document.createElement('script');

        var hsVersion =
          (window.location.search.match(/[?&]{1}_hsVersion=([^&#]*)/) || [])[1] ||
          'v3';

        dnsPrefetchJs.rel = 'dns-prefetch';
        dnsPrefetchForms.rel = 'dns-prefetch';
        preconnectJs.rel = 'preconnect';
        preconnectForms.rel = 'preconnect';
        dnsPrefetchJs.href = jsHsFormsUrl;
        preconnectJs.href = jsHsFormsUrl;
        dnsPrefetchForms.href = formsHsFormsUrl;
        preconnectForms.href = formsHsFormsUrl;
        scriptJs.type = 'text/javascript';
        scriptJs.src = isLocal ? jsHsFormsUrl :  jsHsFormsUrl + '/forms/embed/' + hsVersion + '.js';
        scriptJs.async = true;
        scriptJs.defer = true;

        document.head.appendChild(dnsPrefetchJs);
        document.head.appendChild(dnsPrefetchForms);
        document.head.appendChild(preconnectJs);
        document.head.appendChild(preconnectForms);
        document.head.appendChild(scriptJs);
      })(window.jsHsFormsUrl, window.formsHsFormsUrl, window.isLocal);
    

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a simple browser compatibility check, which is a common practice. It checks if the current browser supports the `WeakMap` and `requestAnimationFrame` APIs, and if not, it appends a query parameter `isSupportedBrowser` to the current URL to indicate the browser's compatibility status. This behavior is low-risk and does not exhibit any malicious indicators."
}

      (function () {
        function isSupportedBrowser() {
          return (
            typeof window.WeakMap === 'function' &&
            typeof window.requestAnimationFrame === 'function'
          );
        }

        function setUrlQueryParamSupportedBrowser() {
          var url;
          var separator;
          var urlToGoTo;
          var hasHref = Object.prototype.hasOwnProperty.call(window.location, 'href');
          var supportedBrowser = isSupportedBrowser();

          if (!supportedBrowser) {
            if (hasHref) {
              url = window.location.href;
            } else {
              url = window.location;
            }

            if (url.indexOf('isSupportedBrowser') === -1) {
              separator = url.indexOf('?') === -1 ? '?' : '&';
              urlToGoTo = url + separator + 'isSupportedBrowser=' + supportedBrowser;
              if (supportedBrowser === false) {
                if (hasHref) {
                  window.location.href = urlToGoTo;
                } else {
                  window.location = urlToGoTo;
                }
              }
            }
          }
        }

        setUrlQueryParamSupportedBrowser();
      })();
    

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a configuration script for loading various HubSpot-related resources. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or redirects to malicious domains. The script primarily focuses on constructing URLs based on environment variables (isQa and isLocal) and the current hostname. This behavior is consistent with a legitimate script for loading HubSpot's forms and analytics functionality. While the script uses some legacy APIs like XDomainRequest, which pose minor risks, the overall intent and context suggest this is a low-risk script."
}

      (function (isQa, isLocal) {
        var getHubletSuffixFromUrl = function () {
          var host = window.location.hostname;
          return host.indexOf('-') !== -1
            ? host.split('.')[0].substring(host.indexOf('-'))
            : '';
        };

        var protocol = 'https://';
        var hubletSuffix = getHubletSuffixFromUrl();
        var qaSuffix = isQa ? 'qa' : '';

        var domainBuilders = {
          'js.hsforms.net': function () {
            return protocol + 'js' + hubletSuffix + '.hsforms' + qaSuffix + '.net';
          },
          'forms.hsforms.com': function () {
            return protocol + 'forms' + hubletSuffix + '.hsforms' + qaSuffix + '.com';
          },
          'js.hs-scripts.com': function () {
            return protocol + 'js' + hubletSuffix + '.hs-scripts' + qaSuffix + '.com';
          },
          'api.hubspot.com': function () {
            return protocol + 'api' + hubletSuffix + '.hubspot' + qaSuffix + '.com';
          },
          'local.hsformsqa.com': function () {
            return 'https://local.hsappstatic.net/forms-embed/static/bundles/project-v3.js'
          }
        };

        window.apiHubspotUrl = domainBuilders['api.hubspot.com']();
        window.formsHsFormsUrl = domainBuilders['forms.hsforms.com']();
        window.jsHsFormsUrl = domainBuilders[ isLocal ? 'local.hsformsqa.com' : 'js.hsforms.net']();
        window.jsHsScriptsUrl = domainBuilders['js.hs-scripts.com']();
      })(window.isQa, window.isLocal);
    

{
    "risk_score": 4,
    "reasoning": "The script appears to be a legacy HubSpot forms script that handles form-related functionality, including setting the canonical URL and handling form rendering. While it uses some older APIs like `XDomainRequest`, the overall behavior is consistent with typical analytics and form-related functionality. However, the script does send data to external HubSpot domains, which requires further review to ensure no sensitive information is being transmitted without user consent."
}

!function(){"use strict";const t="hsforms",r={hsforms:{prod:"hsforms.com",qa:"hsformsqa.com"}},n="share",o="survey",e={[n]:"share",[o]:"survey"},s=t=>t&&"na1"!==t?`-${t}`:"",a=t=>"local"===t||"qa"===t?"qa":"prod",i=t=>e[t],c=(t,n)=>r[t][a(n)],u=(r,n={})=>{const o=Object.assign({hublet:"",isQA:!1},n),e=o.isQA?"qa":"prod";return`https://${i(r)}${s(o.hublet)}.${c(t,e)}`},l=1,d="-",f=[...Array(256)].map(((t,r)=>(r+256).toString(16).substr(1))),h=/\/([a-z0-9-_]+)([?#].*|\/)?$/i,p=/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/,w=[["+","-"],["/","_"]],m=(t,r)=>{let n=r||0;return[f[t[n++]],f[t[n++]],f[t[n++]],f[t[n++]],"-",f[t[n++]],f[t[n++]],"-",f[t[n++]],f[t[n++]],"-",f[t[n++]],f[t[n++]],"-",f[t[n++]],f[t[n++]],f[t[n++]],f[t[n++]],f[t[n++]],f[t[n++]]].join("")},g=t=>{const r=[];t.replace(/[a-fA-F0-9]{2}/g,(t=>{r.push(parseInt(t,16))}));return r},b=t=>{const r=new Uint8Array(t);return window.btoa([...Array(r.byteLength)].reduce(((t,n,o)=>t+String.fromCharCode(r[o])),""))},y=t=>{const r=window.atob(t);return new Uint8Array([...Array(r.length)].map(((t,n)=>r.charCodeAt(n))))},A=t=>b(g(t)),$=t=>m(y(t)),q=t=>w.reduce(((t,r)=>t.replace(new RegExp(`\\${r[0]}`,"g"),r[1])),t),I=t=>w.reduce(((t,r)=>t.replace(new RegExp(`\\${r[1]}`,"g"),r[0])),t),S=t=>p.test(t),C=t=>parseInt(t,36)+(isNaN(1*t)&&t===t.toUpperCase()?26:0),F=()=>l<36?l.toString(36):(l-26).toString(36).toUpperCase(),U=t=>{const r=h.exec(t);return r&&r.length?r[1]:null},x=t=>{const r=t.charAt(0)===d,n=r?2:1,o=$(I(t.substring(n,22+n)));return{formGuid:r?o.replace(/-/g,""):o,portalId:parseInt(t.substring(22+n),36),version:C(t.charAt(n-1))}},R=t=>{const r=U(t);return r?x(r):null},G=(t,r)=>`${S(t)?"":d}${F()}${q(A(t.replace(/[^a-fA-F0-9]/g,"")).substring(0,22))}${r.toString(36)}`,v=(t,r,o=!1,e)=>`${u(n,{hublet:e,isQA:o})}/${G(t,r)}`,E=/^[^/]+\/\/[^/]+\/([0-9]+)\/([a-z0-9-]+)/i,L="test-share";function Q(){return/(hubspot|hsforms)(qa).com/.test(window.location.href)}function _(){try{return!/(test.html|test-share)/.test(window.location.href)&&/(hubspot|hsforms)(qa)?.com/.test(window.location.href)}catch(t){return!1}}function j(t){return E.test(t)}function z(){return j(window.location.href)}function N(){return window.location.hostname.split(".")[0].split("-")[1]||""}function O(t){const r=E.exec(t),n={portalId:null,formGuid:null};if(r&&r[1]&&r[2]){n.portalId=parseInt(r[1],10);n.formGuid=r[2]}return n}function H(){return window.location.href.replace("/"+L,"")}function k(){const t=z()?O(window.location.href):R(H());t.region=N();return t}function B(){const t=k();return v(t.formGuid,t.portalId,Q(),t.region)}function D(){return _()?B():window.location.href}const J=()=>window._hsq,K=()=>window.HubSpotForms;!function(t){function r(){J().push(["setCanonicalUrl",D()]);K().onFormReady((function(){K().currentForm.setContext({pageUrl:B()+""+window.location.search});document.querySelector(".container").classList.add("loaded")}));K().onRenderError((function(){document.querySelector(".container").classList.add("error")}))}K()&&r();t.push(r)}((()=>window.hsFormsOnReady)())}();
//# sourceMappingURL=//static.hsappstatic.net/forms-submission-pages/static-1.5572/bundles/share-legacy.js.map

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a script loader for HubSpot, a legitimate marketing and sales platform. It dynamically creates a script element, sets its attributes, and appends it to the document body. This is a common practice for loading external scripts asynchronously. The script checks for a specific query parameter to determine whether to skip the script loading, which is a reasonable optimization. Overall, the behavior of this script is consistent with typical script loading functionality and does not exhibit any high-risk indicators."
}

      (function (requestParams, jsHsScriptsUrl) {
        var script = document.createElement('script');
        var shouldSkipScriptLoader;
        var regex;
        var results;

        function getParameterByName(name, url) {
          if (!url) {
            url = window.location.href;
          }
          name = name.replace(/[[]]/g, '$&');
          regex = new RegExp('[?&]' + name + '(=([^&#]*)|&|#|$)');
          results = regex.exec(url);
          if (!results) return null;
          if (!results[2]) return '';
          return decodeURIComponent(results[2].replace(/\+/g, ' '));
        }

        shouldSkipScriptLoader = getParameterByName('hs_skipScriptLoader');
        if (!shouldSkipScriptLoader) {
          script.type = 'text/javascript';
          script.id = 'hs-script-loader';
          script.async = true;
          script.defer = true;
          script.src = jsHsScriptsUrl + '/' + requestParams.portalId + '.js';
          document.body.appendChild(script);
        }
      })(window.hs_RequestParams, window.jsHsScriptsUrl);
    

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript code appears to be a utility function that extracts portal and form IDs from the URL and performs some base64 decoding and UUID manipulation. While it uses some legacy APIs like `window.atob()`, the overall behavior seems to be focused on parsing and processing URL parameters, which is a common and legitimate use case. There are no clear indicators of malicious intent or high-risk behaviors in the code."
}

      /*
      This parses the portalId and the formId from the hash in the url and then makes the request
      for form embed response.
      Make sure to minify when making changes
      npx uglify-js --compress --mangle -o <RESULT_PATH> <PATH_TO_THIS_FILE>
    */
    (function (RequestParams) {
      var LEGACY_UUID_IDENTIFIER = '-';
      var BYTE_TO_HEX_MAP = [];
      var BASE64_URL_SAFE_MAP = [
        ['+', '-'],
        ['/', '_'],
      ];
      var requestObj;

      function generateHexMap() {
        var result = [];
        var index;
        for (index = 0; index < 256; index++) {
          result.push((index + 0x100).toString(16).substr(1));
        }
        return result;
      }

      BYTE_TO_HEX_MAP = generateHexMap();

      function base64ToArrayBuffer(base64) {
        var binaryString = window.atob(base64);
        var result = [];
        var index;
        for (index = 0; index < binaryString.length; index++) {
          result.push(binaryString.charCodeAt(index));
        }
        return new window.Uint8Array(result);
      }

      function getVersionFromSymbol(symbol) {
        return (
          parseInt(symbol, 36) +
          (isNaN(symbol * 1) && symbol === symbol.toUpperCase() ? 26 : 0)
        );
      }

      function bytesToUuid(buf, offset) {
        var i = offset || 0;
        return [
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          '-',
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          '-',
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          '-',
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          '-',
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
          BYTE_TO_HEX_MAP[buf[i++]],
        ].join('');
      }

      function unescapeBase64(b64) {
        return BASE64_URL_SAFE_MAP.reduce(function (t, v) {
          return t.split('').map(c => c === v[1] ? v[0] : c).join('');
        }, b64);
      }

      function B64ToUuid(b64) {
        return bytesToUuid(base64ToArrayBuffer(b64));
      }

      function decodeFormToken(encodedString) {
        var legacyUuid = encodedString.charAt(0) === LEGACY_UUID_IDENTIFIER;
        var offset = legacyUuid ? 2 : 1;
        var formGuid = B64ToUuid(
          unescapeBase64(encodedString.substring(offset, 22 + offset))
        );
        return {
          formId: legacyUuid ? formGuid.replace(/-/g, '') : formGuid,
          portalId: parseInt(encodedString.substring(22 + offset), 36),
          version: getVersionFromSymbol(encodedString.charAt(offset - 1)),
        };
      }

      function getHubletFromUrl() {
        var subdomain = window.location.hostname.split('.')[0];
        var hublet = subdomain.split('-')[1];
        return hublet || '';
      }

      function getPathParams() {
        var pathParams = window.location.pathname.split('/');
        return pathParams.filter(function (param) {
          return param !== '' && param.indexOf('test-') === -1;
        });
      }

      function parseRequestParamsFromUrl() {
        var pathParams = getPathParams();
        var token = pathParams[0];
        var isPortalAndFormUrl = pathParams.length === 2;
        var requestParams;

        if (isPortalAndFormUrl) {
          return {
            region: getHubletFromUrl(),
            portalId: pathParams[0],
            formId: pathParams[1],
          };
        }

        requestParams = decodeFormToken(token);
        requestParams.region = getHubletFromUrl();

        return requestParams;
      }

      // Get Form request params hash from url
      requestObj = parseRequestParamsFromUrl();

      // Set to global
      RequestParams.portalId = requestObj.portalId;
      RequestParams.for

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate script loader for HubSpot's services, including their Collected Forms, Analytics, and Cookie Banner features. The script interacts with known, reputable HubSpot domains and does not exhibit any high-risk behaviors like dynamic code execution or data exfiltration. While it uses some legacy APIs like `XDomainRequest`, this is a minor risk factor and the overall intent of the script is transparent and aligned with typical analytics and tracking functionality. Therefore, the risk score is assessed as low."
}

// HubSpot Script Loader. Please do not block this resource. See more: http://hubs.ly/H0702_H0

!function(t,e,r){if(!document.getElementById(t)){var n=document.createElement("script");for(var a in n.src="https://js.hscollectedforms.net/collectedforms.js",n.type="text/javascript",n.id=t,r)r.hasOwnProperty(a)&&n.setAttribute(a,r[a]);var i=document.getElementsByTagName("script")[0];i.parentNode.insertBefore(n,i)}}("CollectedForms-48720116",0,{"crossorigin":"anonymous","data-leadin-portal-id":48720116,"data-leadin-env":"prod","data-loader":"hs-scriptloader","data-hsjs-portal":48720116,"data-hsjs-env":"prod","data-hsjs-hublet":"na1"});
!function(e,t){if(!document.getElementById(e)){var c=document.createElement("script");c.src="https://js.hs-analytics.net/analytics/1735843800000/48720116.js",c.type="text/javascript",c.id=e;var n=document.getElementsByTagName("script")[0];n.parentNode.insertBefore(c,n)}}("hs-analytics");
var _hsp = window._hsp = window._hsp || [];
_hsp.push(['addEnabledFeatureGates', []]);
_hsp.push(['setBusinessUnitId', 0]);
!function(t,e,r){if(!document.getElementById(t)){var n=document.createElement("script");for(var a in n.src="https://js.hs-banner.com/v2/48720116/banner.js",n.type="text/javascript",n.id=t,r)r.hasOwnProperty(a)&&n.setAttribute(a,r[a]);var i=document.getElementsByTagName("script")[0];i.parentNode.insertBefore(n,i)}}("cookieBanner-48720116",0,{"data-cookieconsent":"ignore","data-hs-ignore":true,"data-loader":"hs-scriptloader","data-hsjs-portal":48720116,"data-hsjs-env":"prod","data-hsjs-hublet":"na1"});

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate HubSpot analytics tracking code. It sets up the HubSpot analytics tracking functionality, including setting the portal ID, tracking page views, and adding hashed cookie domains. The code does not exhibit any high-risk behaviors such as dynamic code execution, data exfiltration, or redirects to malicious domains. The only low-risk indicator is the use of the legacy `XDomainRequest` API, which poses a minor risk but is not inherently malicious. Overall, this script is likely used for legitimate analytics and tracking purposes, and the risk score is low."
}

/** 
 * HubSpot Analytics Tracking Code Build Number 1.1194
 * Copyright 2024 HubSpot, Inc.  http://www.hubspot.com
 */
var _hsq = _hsq || [];
_hsq.push(['setPortalId', 48720116]);
_hsq.push(['trackPageView']);
_hsq.push(['setLegacy', false]);
_hsq.push(['addHashedCookieDomain', '224894981']);
_hsq.push(['addHashedCookieDomain', '233546881']);
_hsq.push(['addHashedCookieDomain', '20629287']);
_hsq.push(['addHashedCookieDomain', '251652889']);
_hsq.push(['addHashedCookieDomain', '175378749']);
_hsq.push(['embedHubSpotScript', 'https://js-na1.hs-scripts.com/48720116.js', 'hs-script-loader']);
_hsq.push(['initEventVisualizerScript']);
_hsq.push(['setTrackingDomain', 'track.hubspot.com']);
/** _anon_wrapper_ **/ (function() {
/*! For license information please see hsa-prod.js.LICENSE.txt */
(hstc=hstc||{}).JS_VERSION=1.1;hstc.ANALYTICS_HOST="track.hubspot.com";(hstc=hstc||{}).Math={uuid:function(){if(window.navigator.userAgent.indexOf("googleweblight")>-1)return hstc.Math._mathRandomUuid();var t=window.crypto||window.msCrypto;return void 0!==t&&void 0!==t.getRandomValues&&void 0!==window.Uint16Array?hstc.Math._cryptoUuid():hstc.Math._mathRandomUuid()},_mathRandomUuid:function(){var t=(new Date).getTime();return"xxxxxxxxxxxx4xxxyxxxxxxxxxxxxxxx".replace(/[xy]/g,(function(e){var i=(t+16*Math.random())%16|0;t=Math.floor(t/16);return("x"===e?i:3&i|8).toString(16)}))},_cryptoUuid:function(){var t=window.crypto||window.msCrypto,e=new Uint16Array(8);t.getRandomValues(e);var i=function(t){for(var e=t.toString(16);e.length<4;)e="0"+e;return e};return i(e[0])+i(e[1])+i(e[2])+i(e[3])+i(e[4])+i(e[5])+i(e[6])+i(e[7])}};Math.uuid=Math.uuid||function(){hstc.utils.logError(new Error("Attempt to use Math.uuid()"));return hstc.Math.uuid()};(hstc=hstc||{}).debug=!1;hstc.log=function(){try{var t=new hstc.cookies.Cookie,e="hs_dbg",i=document.location.hash.indexOf("#hsdbg")>-1;if(hstc.debug||i||"1"===t.get(e)){var n=window.console;n&&"function"==typeof n.log&&n.log.apply(n,arguments);if(document.location.hash.indexOf("#hsdbg")>-1){hstc.__logs=hstc.__logs||[];hstc.__logs.push.apply(hstc.__logs,arguments)}t.set(e,1)}}catch(t){}};(hstc=hstc||{}).global={};hstc.global.Context=function(t,e,i,n,r,s,o){this.doc=t||document;this.nav=e||navigator;this.scr=i||screen;this.win=n||window;this.loc=r||this.win.location;this.top=s||top;this.parent=o||parent};hstc.global.Context.prototype.getDocument=function(){return this.doc};hstc.global.Context.prototype.getNavigator=function(){return this.nav};hstc.global.Context.prototype.getScreen=function(){return this.scr};hstc.global.Context.prototype.getWindow=function(){return this.win};hstc.global.Context.prototype.getLocation=function(){return this.loc};hstc.global.Context.prototype.getHostName=function(){try{return this.loc.hostname}catch(t){return this.doc.domain}};hstc.global.Context.prototype.getPathName=function(){return this.loc.pathname};hstc.global.Context.prototype.getTop=function(){return this.top};hstc.global.Context.prototype.getParent=function(){return this.parent};hstc.global.Context.prototype.getReferrer=function(){var t="";try{t=this.top.document.referrer}catch(e){if(parent)try{t=this.parent.document.referrer}catch(e){t=""}}""===t&&(t=this.doc.referrer);return t};hstc.global.Context.prototype.getCharacterSet=function(){return this.doc.characterSet?this.doc.characterSet:this.doc.charset?this.doc.charset:""};hstc.global.Context.prototype.getLanguage=function(){return this.nav.language?this.nav.language:this.nav.browserLanguage?this.nav.browserLanguage:""};hstc.global.Context.prototype.getOrigin=function(){return this.loc.origin?this.loc.origin:this.loc.protocol+"//"+this.getHostName()+(this.loc.port?":"+this.loc.port:"")};hstc.global.Context.prototype.getCurrentHref=function(t){return t?this.getOrigin().toLowerCase()+t.toLowerCase():this.loc.href.toLowerCase()};(hstc=hstc||{}).utils={};hstc.utils.tostr=Object.prototype.toString;hstc.utils.getNextWeekStart=function(t){var e=t||new Date,i=e.getDay(),n=e.getDate()+(

{
"contains_trigger_text": true,
"trigger_text": "Project proposal. pdf. Exp:01-12-2024",
"prominent_button_name": "Open",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Williamson County Animal Center"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Project proposal. pdf. Exp:01-12-2024",
"prominent_button_name": "Open",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

```json
{
    "risk_score": 2,
    "reasoning": "The script contains obfuscated code, which is a high-risk indicator (+3 points). However, it interacts with a trusted domain (hsappstatic.net), which suggests a legitimate context, leading to a subtraction of 1 point. The final risk score is 2, indicating a low risk due to the trusted domain interaction."
}

!function(e){var t={};function n(r){if(t[r])return t[r].exports;var a=t[r]={i:r,l:!1,exports:{}};e[r].call(a.exports,a,a.exports,n);a.l=!0;return a.exports}n.m=e;n.c=t;n.d=function(e,t,r){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})};n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"});Object.defineProperty(e,"__esModule",{value:!0})};n.t=function(e,t){1&t&&(e=n(e));if(8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);n.r(r);Object.defineProperty(r,"default",{enumerable:!0,value:e});if(2&t&&"string"!=typeof e)for(var a in e)n.d(r,a,function(t){return e[t]}.bind(null,a));return r};n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};n.d(t,"a",t);return t};n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)};n.p="//static.hsappstatic.net/forms-embed/static-1.6926/";n(n.s="CEb6")}({"+1EL":function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));n.d(t,"b",(function(){return o}));var r=n("G3IP");const a="RENDER_ERROR_EVENT",i=(e,t)=>({type:r.C,payload:{parentEventKey:e,eventKey:t}}),o=e=>i(a,e)},"+VkO":function(e,t,n){"use strict";n.d(t,"a",(function(){return r}));function r(e,t){if(null==e)return{};var n,r,a={},i=Object.keys(e);for(r=0;r<i.length;r++){n=i[r];t.indexOf(n)>=0||(a[n]=e[n])}return a}},"+Z2S":function(e,t,n){"use strict";const r=(e={},t="",n,a={})=>{const[i,...o]=t.split(".");if(0===o.length)e.hasOwnProperty(t)&&!a.overwrite||(e[t]=n);else{(!e.hasOwnProperty(i)||e.hasOwnProperty(i)&&!e[i])&&(e[i]={});r(e[i],o.join("."),n,a)}};t.a=r},"+xNg":function(e,t,n){"use strict";var r=n("ijHp");var a=function(e,t){switch(e){case 1:return t%4==0&&t%100||t%400==0?29:28;case 8:case 3:case 5:case 10:return 30;default:return 31}};var i=function(e,t,n){const r=parseInt(e,10),i=parseInt(t,10)-1,o=parseInt(n,10);return i>=0&&i<12&&o>0&&o<=a(i,r)},o=n("6Nfw");n.d(t,"a",(function(){return l}));const s=/^[0-9]{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$/,l=e=>Object(r.a)(e)||s.test(e)&&i(...e.split("-"))?null:[o.INVALID_DATE]},"/8NC":function(e,t,n){"use strict";const r=({target:{value:e}})=>e;t.a=r},"0WKS":function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var r=n("ijHp"),a=n("6Nfw");const i=/^-?[0-9]*[.]?[0-9]{0,2}$/,o=e=>Object(r.f)(e)||Object(r.h)(e)||Object(r.l)(e)||i.test(e)?null:[a.INVALID_NUMBER]},"0d07":function(e,t,n){"use strict";var r=n("6QzN");const a=e=>{if(Object(r.a)(e)){if("true"===e.toLowerCase())return!0;if("false"===e.toLowerCase())return!1}return e};t.a=a},"0oVg":function(e,t,n){"use strict";var r=n("G3IP"),a=n("DtSd"),i=n("wenO"),o=n("GjuR"),s=n("Jax0"),l=n("XKAh"),u=n("7XKT"),c=n("6Nfw");const d=e=>e.split("@")[1].toLowerCase(),f=e=>e.blockedDomainAddresses.split(",").map(e=>e.trim());var p=(e={},t,n)=>{const r=[],a=[],i=d(e.email),o=[...f(e),...e.contextBlockedDomains?e.contextBlockedDomains:[]],s=!!e.success,l=!!e.emailShouldResubscribe,u=e.emailSuggestion,p=!!e.emailFree;n&&a.push([c.RESUBSCRIBE_MESSAGE_CONFIRM]);s&&l&&!n&&a.push([c.RESUBSCRIBE_MESSAGE,{email:e.email,isAction:!0}]);u&&a.push([c.EMAIL_SUGGESTION,{email:u,isAction:!0}]);(o.indexOf(i)>-1||Array.isArray(t)&&t.indexOf(i)>-1)&&r.push([c.MANUALLY_BLOCKED_EMAIL_DOMAIN,{domain:i}]);e.useDefaultBlockList&&p&&r.push([c.FORBIDDEN_EMAIL_DOMAIN,{domain:i}]);s||r.push([c.INVALID_EMAIL]);return{errors:r,infos:a}},m=n("I50/"),b=n("6QzN");var g=e=>Object(b.a)(e)?e.trim():e,h=n("r46I"),_=n("BLBL"),v=n("sBkf"),E=n("A9qg"),O=n("i7SF"),y=n("ijHp"),I=n("7y0O"),j=n("2g2v"),S=n.n(j);const k=({url:e,portalId:t,formId:n,email:r})=>S.a.post(e,g(r),{headers:{"Content-Type":"text/plain"},params:{portalId:t,formId:n,resub_form_name:encodeURIComponent(I.a.getWindow().document.title),resub_form_address:encodeURIComponent(I.a.getWindow().location.href)}}),N=({url:e,portalId:t,formId:n,email:r,includeFreemailSuggestions:a=!1})=>S.a.post(e,g(r),{headers:{"Content-Type":"text/plain"},params:{por

{
  "brands": [
    "Williamson County"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://williamsoncounty.appfordocument.com

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "Email, phone, or Skype"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The URL 'williamsoncounty.appfordocument.com' does not match the legitimate domain for Microsoft.",    "The domain 'appfordocument.com' is not associated with Microsoft and appears to be a third-party service.",    "The presence of 'williamsoncounty' as a subdomain suggests a specific regional or organizational focus, which is not typical for a Microsoft service.",    "The URL structure and domain name do not align with Microsoft's known web properties, indicating potential phishing."  ],  "riskscore": 8}
Google indexed: False

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://appfordocument.com