Windows Analysis Report
https://147y3.trk.elasticemail.com/tracking/click?d=l6DX1ZxoYxoIu3Ps_nHCw2dpTGYsp50KhPgdcLAPZ98lDQqXluI2jbk2Kz6cWaRjWchw5Igbhe-BSjXhcIk5khB6_31XWJ3KxF070e3rxxM9hJmShBhAM7tP0jesqnjYkgFpEuivEIV6QQKt0-F18YQ1#out/0023m/435/85jy1/26p0/41/77

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://147y3.trk.elasticemail.com

{
    "risk_score": 6,
    "reasoning": "The script demonstrates moderate-risk behavior by redirecting the user to a potentially suspicious domain ('trackdaily.co.uk') without clear transparency or user consent. While the intent may be to track user activity or redirect to an 'offer' page, the lack of context and use of a third-party domain raises concerns and requires further investigation."
}

var link = 'http://trackdaily.co.uk/redirect/';
var locate = window.location.href;
var out = "/outtt/";
if (!locate.includes("out")){
     var content = locate.replace(/#[^\/]+/, '/offer');
}else{
     var content = locate.replace(/#/, '/') ;
}
document.location.href = content;