Windows Analysis Report
https://pozaweclip.upnana.com/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://pozaweclip.upnana.com

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript code has a mix of low-risk and moderate-risk indicators. While it does not contain any high-risk behaviors, it exhibits some behaviors that require further review. The code checks the user's login status, loads an external script, and handles message display using a Bootstrap toast. The main concerns are the external script loading and the potential for data transmission to unknown domains."
}

function isLoggedIn() {
    return fetch('/me')
        .then(response => {
            if (!response.ok) {
                // If the response is not OK (e.g., not 200), return false
                return false;
            }
            return response.text();
        })
        .then(body => {
            // Check if the body contains "admin" or "editor"
            return body === "admin" || body === "editor" || body === "first";
        })
        .catch(error => {
            // Log other errors to the console
            console.error('Error checking login status:', error);
            return false;
        });
}
function doSiteSetup() {
    isLoggedIn()
        .then(isLoggedIn => {
            if (isLoggedIn) {
                yesLoggedIn();
            }
        })
        .catch(error => console.error('Error checking login status:', error));
}
function yesLoggedIn() {
    var script = document.createElement('script');
    script.src = '/js/wolf.js';
    document.head.appendChild(script);
}

document.addEventListener('DOMContentLoaded', doSiteSetup);

// Function to handle the 'msg' parameter and show the message
function handleMsgParameter() {
    const url = new URL(window.location.href);
    const message = url.searchParams.get('msg');
    if (message) {
      url.searchParams.delete('msg');
      window.history.replaceState({}, document.title, url.toString());
      showMessage(message);
    }
}
document.addEventListener("DOMContentLoaded", handleMsgParameter);

// Function to display a Bootstrap toast with a given message
function showMessage(message) {
    // Create a new toast container if it doesn't exist
    let toastContainer = document.getElementById("toast-container");
    if (!toastContainer) {
      toastContainer = document.createElement("div");
      toastContainer.id = "toast-container";
      toastContainer.className = "position-fixed bottom-0 end-0 p-3";
      toastContainer.style.zIndex = "1100";
      document.body.appendChild(toastContainer);
    }
    const toast = document.createElement("div");
    toast.className = "toast align-items-center text-bg-primary border-0";
    toast.setAttribute("role", "alert");
    toast.setAttribute("aria-live", "assertive");
    toast.setAttribute("aria-atomic", "true");
    toast.innerHTML = `
      <div class="d-flex">
        <div class="toast-body p-4">${message}</div>
        <button type="button" class="btn-close btn-close-white me-2 m-auto" data-bs-dismiss="toast" aria-label="Close"></button>
      </div>
    `;
    toastContainer.appendChild(toast);
    const bsToast = new bootstrap.Toast(toast, {
        autohide: true,
        delay: 5000 // 5 seconds
    });
    bsToast.show();
    toast.addEventListener("hidden.bs.toast", function () {
      toastContainer.removeChild(toast);
    });
}
function listen_for_message() {
    document.body.addEventListener('htmx:beforeSwap', function(evt) {
        var xhr = evt.detail.xhr;
        var showMessageHeader = xhr.getResponseHeader('Show-Message');
        if (showMessageHeader) {
            showMessage(xhr.responseText);
        }
    });
}
document.addEventListener('DOMContentLoaded', listen_for_message);

{
    "risk_score": 5,
    "reasoning": "The script sends user data (user agent, referrer, site, and page name) to an external domain 'https://api.defendium.com/protect' without clear transparency or user consent. This behavior is considered a moderate risk, as it could potentially be used for data exfiltration or tracking purposes. However, the script does not exhibit any high-risk indicators like dynamic code execution or redirects to malicious domains, so the overall risk is assessed as medium."
}

window.onload=function e(){var n=new XMLHttpRequest;n.open("POST","https://api.defendium.com/protect",!0),n.setRequestHeader("Content-Type","application/json"),n.send(JSON.stringify({user_agent:navigator.userAgent,referrer:document.referrer||"Direct",site:window.location.hostname,page_name:window.location.pathname}))};

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be the source code for the Bootstrap library, which is a widely-used and trusted front-end framework. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is well-structured and follows common practices for a library of this nature. Overall, this script is considered low-risk and is likely a legitimate part of the Bootstrap framework."
}

/*!
  * Bootstrap v5.3.1 (https://getbootstrap.com/)
  * Copyright 2011-2023 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)
  * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
  */
!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e(require("@popperjs/core")):"function"==typeof define&&define.amd?define(["@popperjs/core"],e):(t="undefined"!=typeof globalThis?globalThis:t||self).bootstrap=e(t.Popper)}(this,(function(t){"use strict";function e(t){const e=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(t)for(const i in t)if("default"!==i){const s=Object.getOwnPropertyDescriptor(t,i);Object.defineProperty(e,i,s.get?s:{enumerable:!0,get:()=>t[i]})}return e.default=t,Object.freeze(e)}const i=e(t),s=new Map,n={set(t,e,i){s.has(t)||s.set(t,new Map);const n=s.get(t);n.has(e)||0===n.size?n.set(e,i):console.error(`Bootstrap doesn't allow more than one instance per element. Bound instance: ${Array.from(n.keys())[0]}.`)},get:(t,e)=>s.has(t)&&s.get(t).get(e)||null,remove(t,e){if(!s.has(t))return;const i=s.get(t);i.delete(e),0===i.size&&s.delete(t)}},o="transitionend",r=t=>(t&&window.CSS&&window.CSS.escape&&(t=t.replace(/#([^\s"#']+)/g,((t,e)=>`#${CSS.escape(e)}`))),t),a=t=>{t.dispatchEvent(new Event(o))},l=t=>!(!t||"object"!=typeof t)&&(void 0!==t.jquery&&(t=t[0]),void 0!==t.nodeType),c=t=>l(t)?t.jquery?t[0]:t:"string"==typeof t&&t.length>0?document.querySelector(r(t)):null,h=t=>{if(!l(t)||0===t.getClientRects().length)return!1;const e="visible"===getComputedStyle(t).getPropertyValue("visibility"),i=t.closest("details:not([open])");if(!i)return e;if(i!==t){const e=t.closest("summary");if(e&&e.parentNode!==i)return!1;if(null===e)return!1}return e},d=t=>!t||t.nodeType!==Node.ELEMENT_NODE||!!t.classList.contains("disabled")||(void 0!==t.disabled?t.disabled:t.hasAttribute("disabled")&&"false"!==t.getAttribute("disabled")),u=t=>{if(!document.documentElement.attachShadow)return null;if("function"==typeof t.getRootNode){const e=t.getRootNode();return e instanceof ShadowRoot?e:null}return t instanceof ShadowRoot?t:t.parentNode?u(t.parentNode):null},_=()=>{},g=t=>{t.offsetHeight},f=()=>window.jQuery&&!document.body.hasAttribute("data-bs-no-jquery")?window.jQuery:null,m=[],p=()=>"rtl"===document.documentElement.dir,b=t=>{var e;e=()=>{const e=f();if(e){const i=t.NAME,s=e.fn[i];e.fn[i]=t.jQueryInterface,e.fn[i].Constructor=t,e.fn[i].noConflict=()=>(e.fn[i]=s,t.jQueryInterface)}},"loading"===document.readyState?(m.length||document.addEventListener("DOMContentLoaded",(()=>{for(const t of m)t()})),m.push(e)):e()},v=(t,e=[],i=t)=>"function"==typeof t?t(...e):i,y=(t,e,i=!0)=>{if(!i)return void v(t);const s=(t=>{if(!t)return 0;let{transitionDuration:e,transitionDelay:i}=window.getComputedStyle(t);const s=Number.parseFloat(e),n=Number.parseFloat(i);return s||n?(e=e.split(",")[0],i=i.split(",")[0],1e3*(Number.parseFloat(e)+Number.parseFloat(i))):0})(e)+5;let n=!1;const r=({target:i})=>{i===e&&(n=!0,e.removeEventListener(o,r),v(t))};e.addEventListener(o,r),setTimeout((()=>{n||a(e)}),s)},w=(t,e,i,s)=>{const n=t.length;let o=t.indexOf(e);return-1===o?!i&&s?t[n-1]:t[0]:(o+=i?1:-1,s&&(o=(o+n)%n),t[Math.max(0,Math.min(o,n-1))])},A=/[^.]*(?=\..*)\.|.*/,E=/\..*/,C=/::\d+$/,T={};let k=1;const $={mouseenter:"mouseover",mouseleave:"mouseout"},S=new Set(["click","dblclick","mouseup","mousedown","contextmenu","mousewheel","DOMMouseScroll","mouseover","mouseout","mousemove","selectstart","selectend","keydown","keypress","keyup","orientationchange","touchstart","touchmove","touchend","touchcancel","pointerdown","pointermove","pointerup","pointerleave","pointercancel","gesturestart","gesturechange","gestureend","focus","blur","change","reset","select","submit","focusin","focusout","load","unload","beforeunload","resize","move","DOMContentLoaded","readystatechange","error","abort","scroll"]);function L(t,e){return e&&`${e}::${k++}`||t.uidEvent||k++}function O(t){const e=L(t);ret

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript code appears to be a legitimate implementation of a form creation and handling functionality. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code primarily focuses on creating a form, handling responses, and displaying popup messages. While it uses some legacy practices like `XDomainRequest`, these are not inherently malicious and are considered low-risk. Overall, the code seems to be implementing common web development patterns without any clear signs of malicious intent."
}

// Functions

function popupMessage(message) {
    let popup = document.createElement('div');
    popup.className = 'wolf_popup';
    popup.innerHTML = message;
    document.body.appendChild(popup);
    setTimeout(() => popup.remove(), 3000);
}

function handleResponse(response) {
    if (response.status === 401) {
        popupMessage('Unauthorized. Please <a href="/login">Login</a>.');
        throw new Error('Unauthorized');
    }
    if (!response.ok) {
        throw new Error('Network response was not ok');
    }
    return response.text();
}

function createWolfForm() {
    // Check if the form already exists
    if (document.getElementById('wolfForm')) {
        document.getElementById('wolfForm').classList.remove('d-none');
        return;
    }

    // Add the wolf.css stylesheet to the head
    let styleLink = document.createElement('link');
    styleLink.rel = 'stylesheet';
    styleLink.href = '/css/wolf.css';
    document.head.appendChild(styleLink);

    // Create form and its elements
    // let form = document.createElement('form');
    // form.id = 'wolfForm';
    // form.method = 'post';
    // form.action = '#'; // Prevent form from submitting without our intervention

    // // Create the wolfpage div
    // let wolfpageDiv = document.createElement('div');
    // wolfpageDiv.className = 'wolfpage row';

    // // Create main content column (col-md-9)
    // let contentDiv = document.createElement('div');
    // contentDiv.className = 'col-md-9';

    // let editPageTextDiv = document.createElement('div');
    // editPageTextDiv.className = 'editPageText row';
    // let titleDiv = document.createElement('div');
    // titleDiv.className = 'fileTitle';
    // editPageTextDiv.appendChild(titleDiv);
    // contentDiv.appendChild(editPageTextDiv);

    // let title = document.createElement('h2');
    // title.classList.add('wolfTitle','text-white');
    // title.innerText = 'Edit Page';
    // titleDiv.appendChild(title);

    // let textarea = document.createElement('textarea');
    // textarea.id = 'wolfEditor';
    // textarea.rows = '10';
    // textarea.cols = '50';
    // contentDiv.appendChild(textarea);


    // let submitButton = document.createElement('button');
    // submitButton.id = 'wolfUpdate';
    // submitButton.innerText = 'Update';
    // submitButton.type = 'button';
    // submitButton.className = 'btn btn-primary bg-light mt-2 mx-2 btn-lg';
    // submitButton.addEventListener('click', handleUpdateButtonClick);
    // contentDiv.appendChild(submitButton);

    // let cancelButton = document.createElement('button');
    // cancelButton.id = 'wolfCancel';
    // cancelButton.innerText = 'Cancel';
    // cancelButton.type = 'button';
    // cancelButton.className = 'btn btn-secondary mt-2 mx-2 btn-lg';
    // cancelButton.style.float = 'right';
    // cancelButton.addEventListener('click', function() {
    //     document.getElementById('wolfForm').classList.add('d-none');
    // });
    // contentDiv.appendChild(cancelButton);

    // // Append contentDiv to wolfpageDiv
    // wolfpageDiv.appendChild(contentDiv);

    // // Create sidebar column (col-md-3)
    // let sidebarDiv = document.createElement('div');
    // sidebarDiv.className = 'col-md-2';

    // let sidebarTitle = document.createElement('h4');
    // sidebarTitle.classList.add('wolfTitle','text-white');
    // sidebarTitle.innerText = 'Options';
    // sidebarDiv.appendChild(sidebarTitle);

    // let sidebarButtonsDiv = document.createElement('div');
    // sidebarButtonsDiv.className = 'wolfSidebarButtons d-grid gap-2 mx-auto';
    // sidebarDiv.appendChild(sidebarButtonsDiv);

    // // Create and add buttons to sidebar
    // let othersButton = document.createElement('button');
    // othersButton.id = 'wolfOthers';
    // othersButton.innerText = 'Other Content';
    // othersButton.type = 'button';
    // othersButton.className = 'btn btn-light mt-2 mx-2';
    // othersButton.addEventListener('click', handleOthersButtonClick

{
"contains_trigger_text": true,
"trigger_text": "Click here to view document",
"prominent_button_name": "Click here to view document",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "GEICO Advantage Insurance Company"
  ]
}

```json
{
    "risk_score": 1,
    "reasoning": "The script is a part of the Popper.js library, which is a well-known and widely used library for managing popups and tooltips. It does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. The script primarily deals with DOM manipulation and positioning calculations, which are typical for its intended functionality. There are no interactions with external domains or obfuscated code present."
}

/**
 * @popperjs/core v2.9.3 - MIT License
 */

"use strict";!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).Popper={})}(this,(function(e){function t(e){return null==e?window:"[object Window]"!==e.toString()?(e=e.ownerDocument)&&e.defaultView||window:e}function n(e){return e instanceof t(e).Element||e instanceof Element}function o(e){return e instanceof t(e).HTMLElement||e instanceof HTMLElement}function r(e){return"undefined"!=typeof ShadowRoot&&(e instanceof t(e).ShadowRoot||e instanceof ShadowRoot)}function i(e,t){void 0===t&&(t=!1);var n=e.getBoundingClientRect(),r=1,i=1;return o(e)&&t&&(r=n.width/e.offsetWidth||1,i=n.height/e.offsetHeight||1),{width:q(n.width/r),height:q(n.height/i),top:q(n.top/i),right:q(n.right/r),bottom:q(n.bottom/i),left:q(n.left/r),x:q(n.left/r),y:q(n.top/i)}}function a(e){return{scrollLeft:(e=t(e)).pageXOffset,scrollTop:e.pageYOffset}}function s(e){return e?(e.nodeName||"").toLowerCase():null}function f(e){return((n(e)?e.ownerDocument:e.document)||window.document).documentElement}function p(e){return i(f(e)).left+a(e).scrollLeft}function c(e){return t(e).getComputedStyle(e)}function l(e){return e=c(e),/auto|scroll|overlay|hidden/.test(e.overflow+e.overflowY+e.overflowX)}function u(e,n,r){void 0===r&&(r=!1);var c,u=o(n);if(c=o(n)){var d=(c=n.getBoundingClientRect()).height/n.offsetHeight||1;c=1!==(c.width/n.offsetWidth||1)||1!==d}d=c,c=f(n),e=i(e,d),d={scrollLeft:0,scrollTop:0};var h={x:0,y:0};return(u||!u&&!r)&&(("body"!==s(n)||l(c))&&(d=n!==t(n)&&o(n)?{scrollLeft:n.scrollLeft,scrollTop:n.scrollTop}:a(n)),o(n)?((h=i(n,!0)).x+=n.clientLeft,h.y+=n.clientTop):c&&(h.x=p(c))),{x:e.left+d.scrollLeft-h.x,y:e.top+d.scrollTop-h.y,width:e.width,height:e.height}}function d(e){var t=i(e),n=e.offsetWidth,o=e.offsetHeight;return 1>=Math.abs(t.width-n)&&(n=t.width),1>=Math.abs(t.height-o)&&(o=t.height),{x:e.offsetLeft,y:e.offsetTop,width:n,height:o}}function h(e){return"html"===s(e)?e:e.assignedSlot||e.parentNode||(r(e)?e.host:null)||f(e)}function m(e){return 0<=["html","body","#document"].indexOf(s(e))?e.ownerDocument.body:o(e)&&l(e)?e:m(h(e))}function v(e,n){var o;void 0===n&&(n=[]);var r=m(e);return e=r===(null==(o=e.ownerDocument)?void 0:o.body),o=t(r),r=e?[o].concat(o.visualViewport||[],l(r)?r:[]):r,n=n.concat(r),e?n:n.concat(v(h(r)))}function g(e){return o(e)&&"fixed"!==c(e).position?e.offsetParent:null}function y(e){for(var n=t(e),r=g(e);r&&0<=["table","td","th"].indexOf(s(r))&&"static"===c(r).position;)r=g(r);if(r&&("html"===s(r)||"body"===s(r)&&"static"===c(r).position))return n;if(!r)e:{if(r=-1!==navigator.userAgent.toLowerCase().indexOf("firefox"),-1===navigator.userAgent.indexOf("Trident")||!o(e)||"fixed"!==c(e).position)for(e=h(e);o(e)&&0>["html","body"].indexOf(s(e));){var i=c(e);if("none"!==i.transform||"none"!==i.perspective||"paint"===i.contain||-1!==["transform","perspective"].indexOf(i.willChange)||r&&"filter"===i.willChange||r&&i.filter&&"none"!==i.filter){r=e;break e}e=e.parentNode}r=null}return r||n}function b(e){function t(e){o.add(e.name),[].concat(e.requires||[],e.requiresIfExists||[]).forEach((function(e){o.has(e)||(e=n.get(e))&&t(e)})),r.push(e)}var n=new Map,o=new Set,r=[];return e.forEach((function(e){n.set(e.name,e)})),e.forEach((function(e){o.has(e.name)||t(e)})),r}function w(e){var t;return function(){return t||(t=new Promise((function(n){Promise.resolve().then((function(){t=void 0,n(e())}))}))),t}}function x(e){return e.split("-")[0]}function O(e,t){var n=t.getRootNode&&t.getRootNode();if(e.contains(t))return!0;if(n&&r(n))do{if(t&&e.isSameNode(t))return!0;t=t.parentNode||t.host}while(t);return!1}function j(e){return Object.assign({},e,{left:e.x,top:e.y,right:e.x+e.width,bottom:e.y+e.height})}function E(e,n){if("viewport"===n){n=t(e);var r=f(e);n=n.visualViewport;var s=r.clientWidth;r=r.clientHeight;var l=0,u=0;n&&(s=n.width,r=n.height,/^((?!

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a simple function that submits the first form on the page. This behavior is relatively benign and does not exhibit any high-risk indicators. While it could potentially be used for malicious purposes, such as automatically submitting a form without user interaction, the context is unclear. Therefore, the risk score is assessed as low."
}

            function OrchidBreeze() {
                document.forms[0].submit();
            }
        

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other automated threats. The script sets up various configuration options and translations for the Cloudflare challenge, and it does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script's behavior is consistent with its intended purpose of providing a Cloudflare challenge, and it does not exhibit any suspicious or malicious activities. Therefore, the risk score is assessed as 1 (Low Risk)."
}

window._cf_chl_opt.uaO=false;window._cf_chl_opt.qqQL2={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F"},"translations":{"turnstile_feedback_report":"Having%20trouble%3F","turnstile_failure":"Error","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","turnstile_footer_privacy":"Privacy","human_button_text":"Verify%20you%20are%20human","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","turnstile_timeout":"Timed%20out","turnstile_footer_terms":"Terms","turnstile_expired":"Expired","turnstile_feedback_description":"Send%20Feedback","turnstile_success":"Success%21","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","turnstile_verifying":"Verifying...","turnstile_overrun_description":"Stuck%20here%3F","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","testing_only":"Testing%20only.","turnstile_refresh":"Refresh","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists."},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eQ,eR,fh,fi,fm,fn,fo,fp,fv,fy,fA,fB,fC,fO,g0,g6,g7,g8,gi,gt,gx,gE,eO,eP){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(593))/1+-parseInt(gI(1122))/2+parseInt(gI(1492))/3*(-parseInt(gI(559))/4)+-parseInt(gI(1162))/5*(parseInt(gI(1411))/6)+-parseInt(gI(845))/7+-parseInt(gI(857))/8*(parseInt(gI(1308))/9)+-parseInt(gI(1359))/10*(-parseInt(gI(1376))/11),d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,860358),eM=this||self,eN=eM[gJ(1709)],eO=[],eP=0;256>eP;eO[eP]=String[gJ(745)](eP),eP++);eQ=(0,eval)(gJ(1300)),eR=atob(gJ(899)),fh={},fh[gJ(1431)]='o',fh[gJ(880)]='s',fh[gJ(1535)]='u',fh[gJ(784)]='z',fh[gJ(1433)]='n',fh[gJ(1024)]='I',fh[gJ(578)]='b',fi=fh,eM[gJ(808)]=function(g,h,i,j,hk,o,x,B,C,D,E,F){if(hk=gJ,o={'IkBtg':function(G,H){return H!==G},'WtUDF':hk(1764),'bRwTs':function(G,H){return G<H},'EzByL':function(G,H){return H===G},'XJrjC':function(G,H){return G+H},'Sqpze':function(G,H){return G===H},'Dcwmy':function(G,H){return H===G},'YlVHv':function(G,H){return G(H)},'DvCAa':function(G,H,I){return G(H,I)},'CJlCZ':function(G,H){return G+H},'flTZE':function(G,H,I){return G(H,I)}},o[hk(1748)](null,h)||o[hk(359)](void 0,h))return j;for(x=o[hk(1806)](fl,h),g[hk(507)][hk(727)]&&(x=x[hk(1080)](g[hk(507)][hk(727)](h))),x=g[hk(1445)][hk(991)]&&g[hk(1124)]?g[hk(1445)][hk(991)](new g[(hk(1124))](x)):function(G,hm,H){if(hm=hk,o[hm(822)](hm(433),o[hm(1516)])){for(G[hm(1085)](),H=0;o[hm(1096)](H,G[hm(1440)]);o[hm(924)](G[H],G[o[hm(828)](H,1)])?G[hm(499)](H+1,1):H+=1);return G}else x(s+1)}(x),B='nAsAaAb'.split('A'),B=B[hk(1378)][hk(599)](B),C=0;o[hk(1096)](C,x[hk(1440)]);D=x[C],E=fk(g,h,

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet appears to be a part of a Cloudflare challenge system, which is a legitimate security mechanism. While it uses some techniques that could be considered risky, such as dynamic code execution and data transmission, the context suggests these are part of a controlled challenge environment. The script also includes some safeguards, such as limiting the scope of the data transmission and providing a mechanism for refreshing the challenge. Overall, the risk level is moderate, as the script's behavior is likely intended for a specific security-focused purpose rather than malicious intent."
}

        (function(){
            window._cf_chl_opt={
                cvId: '3',
                cZone: 'challenges.cloudflare.com',
                cTplV: 5,
                chlApivId: '0',
                chlApiWidgetId: 'jkwko',
                chlApiSitekey: '0x4AAAAAAA2_FtrtI-q9RaMg',
                chlApiMode: 'managed',
                chlApiSize: 'normal',
                chlApiRcV: 'UZAfzgCr.j.wunkl6hw7HGLueVeTsS_dNAArJvCN7rc-1736279228-1.3.1.1-W5WsqbpmXPU2cK4RkZDCF7enbJbIk2hnASebTu8.od8',
                chlApiTimeoutEncountered: 0,
                chlApiOverrunBudgetMs:10000,
                chlTimeoutMs:120000,
                cK:[],
                cType: 'chl_api_m',
                cRay: '8fe6753cbc7a42fe',
                cH: 'bEL9Q0FAR98tK7xGm4sXXiAPoaEDx4CKzQXnMzUhCjI-1736279228-1.1.1.1-ovr1StbPsuIgGucT_VtmdXSIVocrqk4Hkl9zNpYKcxX5VUWAASbTHyBWA8Z1lJWh',
                cFPWv: 'g',
                cLt: 'n',
                chlApiFailureFeedbackEnabled:true,
                chlApiLoopFeedbackEnabled:false,
                wOL:false,
                wT: 'auto',
                wS: 'normal',
                md: 'F_GvEdGZLgfG.sT_5.SOxdyBxwAOQ9eMOYsVgxIDCtw-1736279228-1.1.1.1-6DeTlrzL4yZ8FwGVne4fHdku.t4lqiEqZyIxdwNzqQzifMuR9NkSlEjI3vUjuwjwUAecdkB8ph55u.87eKIoVbUrVJEC2ZPu7A6nve__9eZ7WRon9NtKYfkvRGKuwu92QhF_BZQ0kWxVfv.I2QIsutOseU5uzHh_P.wTBx.7CV761sjXOXYGOeCRB.b5wuRCqfdthBhEGuqdA3rcGqp3noBC4iwYNYOAjZ28hKCh.lv7ZvBL0yXRAqvX67Ba6q1xfwujJX1hpz0_K1vaaEQz3N5pueXHTtBZFAmDezL8cSum0LM5PgX3ydx0aguHrkIt1L3REfq5sgX9M1pDPmBFT0.4kHek2D1RIyeDbeqDJs0dFUCn7SqncUIIPu2OiNL_UVcKH5ayeR3rSuN4KArzFxW06Sn08MxHGfOMnox6dyc_FIA.h6jG9BAowCNZRtMOcixVw2aVPmccvTvynbo1nRAkzHotjFzxwkjYtFCCxK1K5mcsUhCzLs0dew1O09nfzMkf9ihqVGcxfdQJO9R4H_triu.RNNRf_.QnkKkfk2ObIDKtgTBTEkUuIEwakl8FlB5GcduTCo766fphsMwtA.J0ahkxTBvMuBDSNRIPsqp7aRscgUEvc_odQQsfSB4qZ1JpN25Uy_ElDNPq.QwAF8B89UNXC58aHI3b75AZYHkxdKrbvCtkc04OemIpqJBEJb_0gGqu2_Be4yff9gOw68yujXhh4hQm0TgaAuQRvIuY3nG4akQ90y.iJPHRGTBgF2Uz0RyQJDLkm_F.ULEzMfCpz_BUBxelIMSa_yDnZPZZX5Zj9._97L6J_rYYpKkkQ9cllqLQkXpYUzc_THl2eg25.cFEjt5cBgdOEBIsfhO3neQv1A0EfDiRvK0ol3CMOovAJS6nMOhkzn2mGVCDfcmV60ZpJD1WjM1DYEZF8NfRHW30yp8CZbcX4uFsTrfEihFubLe2YoTaMMUr4aYL9eMkwwZ.TnmuGXkVFFEEBsMYQqEf_3pGHRRF6Ko.kjfTgInPl80mLqlOV4yAY98ElBSiEQlIG.P1KlfAI5h79hs0hWSjuUMzjI6BAvyz5vo7gwnHZ7dm8Wops0GU4UqxQyma4Y36yG5pt_lLG3qNJQpFjS9Yy0kK9rd97lUpaHhMxUEsAryMRno6UjDuVqsdMpLSaUdzUa8w4J_.0MmLqZhoLqOM4HD3tgyoXzAUqnnZGevOvem72_UYCkUwKEVwlf9A_n.4ACZTcjmzXXE8DJs_NNTgKQmeeZ4a30LrLTid2pKmDB32idomKOxu6Bd7zRndZaK8QyVRg5dmbWGgrAs7nLkyYC8j6e2gm9VnNKKLujzxsVMM6qAW2OrMYZE6.BheD5Q3v_FlP4ndia2KgNfH75v4N_itw24VbY6ytTAHzlfVTqnNKGZVjgCMHqbmwrEFhRhG3nMWNv8FZlguW_w8g..IYQRoLgE0sLFjtQNx68SLxbrbuTf_PtekdLprg_IeZFP6DxUdA0RZj1Oa8Fk.kYsVHqCZ0DtuKLY3PsJXH6DvaoiwL0AD2YNbWgrfkAENaXqp6nyOFOmd4h8DlL5W84XiPhQhqTFGwiKtA2vrIW.svNFn2WFplrQFfRBqzznqkXI9aLz.f1DxG.FvHs0',
                cITimeS: '1736279228',
                refresh: function(){
                    if(window['parent']){
                        window['parent'].postMessage({
                            source: 'cloudflare-challenge',
                            widgetId: 'jkwko',
                            nextRcV: 'UZAfzgCr.j.wunkl6hw7HGLueVeTsS_dNAArJvCN7rc-1736279228-1.3.1.1-W5WsqbpmXPU2cK4RkZDCF7enbJbIk2hnASebTu8.od8',
                            event: 'reloadRequest',
                        }, "*");
                    }
                }
            };
            var handler = function(event) {
                var e = event.data;
                if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) {
                    if(window['parent']){
                        window['parent'].postMessage({
                            source: 'cloudflare-challenge',
                            widgetId: window._cf_chl_opt.chlApiWidgetId,
                            event: 'food',
                            seq: e.seq,
                        }, '*');
            

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other automated threats. While the script exhibits some behaviors that could be considered moderate-risk, such as external data transmission and the use of fallback domains, these are likely part of the challenge's functionality and not indicative of malicious intent. The script does not demonstrate any high-risk indicators like dynamic code execution or data exfiltration. Overall, the script seems to be a legitimate security mechanism, but it could benefit from some improvements to reduce its aggressive DOM manipulation and use of legacy APIs."
}

        (function(){
            window._cf_chl_opt={
                cvId: '3',
                cZone: 'challenges.cloudflare.com',
                cTplV: 5,
                chlApivId: '0',
                chlApiWidgetId: 'jkwko',
                chlApiSitekey: '0x4AAAAAAA2_FtrtI-q9RaMg',
                chlApiMode: 'managed',
                chlApiSize: 'normal',
                chlApiRcV: 'UZAfzgCr.j.wunkl6hw7HGLueVeTsS_dNAArJvCN7rc-1736279228-1.3.1.1-W5WsqbpmXPU2cK4RkZDCF7enbJbIk2hnASebTu8.od8',
                chlApiTimeoutEncountered: 0,
                chlApiOverrunBudgetMs:10000,
                chlTimeoutMs:120000,
                cK:[],
                cType: 'chl_api_m',
                cRay: '8fe6753cbc7a42fe',
                cH: 'bEL9Q0FAR98tK7xGm4sXXiAPoaEDx4CKzQXnMzUhCjI-1736279228-1.1.1.1-ovr1StbPsuIgGucT_VtmdXSIVocrqk4Hkl9zNpYKcxX5VUWAASbTHyBWA8Z1lJWh',
                cFPWv: 'g',
                cLt: 'n',
                chlApiFailureFeedbackEnabled:true,
                chlApiLoopFeedbackEnabled:false,
                wOL:false,
                wT: 'auto',
                wS: 'normal',
                md: 'F_GvEdGZLgfG.sT_5.SOxdyBxwAOQ9eMOYsVgxIDCtw-1736279228-1.1.1.1-6DeTlrzL4yZ8FwGVne4fHdku.t4lqiEqZyIxdwNzqQzifMuR9NkSlEjI3vUjuwjwUAecdkB8ph55u.87eKIoVbUrVJEC2ZPu7A6nve__9eZ7WRon9NtKYfkvRGKuwu92QhF_BZQ0kWxVfv.I2QIsutOseU5uzHh_P.wTBx.7CV761sjXOXYGOeCRB.b5wuRCqfdthBhEGuqdA3rcGqp3noBC4iwYNYOAjZ28hKCh.lv7ZvBL0yXRAqvX67Ba6q1xfwujJX1hpz0_K1vaaEQz3N5pueXHTtBZFAmDezL8cSum0LM5PgX3ydx0aguHrkIt1L3REfq5sgX9M1pDPmBFT0.4kHek2D1RIyeDbeqDJs0dFUCn7SqncUIIPu2OiNL_UVcKH5ayeR3rSuN4KArzFxW06Sn08MxHGfOMnox6dyc_FIA.h6jG9BAowCNZRtMOcixVw2aVPmccvTvynbo1nRAkzHotjFzxwkjYtFCCxK1K5mcsUhCzLs0dew1O09nfzMkf9ihqVGcxfdQJO9R4H_triu.RNNRf_.QnkKkfk2ObIDKtgTBTEkUuIEwakl8FlB5GcduTCo766fphsMwtA.J0ahkxTBvMuBDSNRIPsqp7aRscgUEvc_odQQsfSB4qZ1JpN25Uy_ElDNPq.QwAF8B89UNXC58aHI3b75AZYHkxdKrbvCtkc04OemIpqJBEJb_0gGqu2_Be4yff9gOw68yujXhh4hQm0TgaAuQRvIuY3nG4akQ90y.iJPHRGTBgF2Uz0RyQJDLkm_F.ULEzMfCpz_BUBxelIMSa_yDnZPZZX5Zj9._97L6J_rYYpKkkQ9cllqLQkXpYUzc_THl2eg25.cFEjt5cBgdOEBIsfhO3neQv1A0EfDiRvK0ol3CMOovAJS6nMOhkzn2mGVCDfcmV60ZpJD1WjM1DYEZF8NfRHW30yp8CZbcX4uFsTrfEihFubLe2YoTaMMUr4aYL9eMkwwZ.TnmuGXkVFFEEBsMYQqEf_3pGHRRF6Ko.kjfTgInPl80mLqlOV4yAY98ElBSiEQlIG.P1KlfAI5h79hs0hWSjuUMzjI6BAvyz5vo7gwnHZ7dm8Wops0GU4UqxQyma4Y36yG5pt_lLG3qNJQpFjS9Yy0kK9rd97lUpaHhMxUEsAryMRno6UjDuVqsdMpLSaUdzUa8w4J_.0MmLqZhoLqOM4HD3tgyoXzAUqnnZGevOvem72_UYCkUwKEVwlf9A_n.4ACZTcjmzXXE8DJs_NNTgKQmeeZ4a30LrLTid2pKmDB32idomKOxu6Bd7zRndZaK8QyVRg5dmbWGgrAs7nLkyYC8j6e2gm9VnNKKLujzxsVMM6qAW2OrMYZE6.BheD5Q3v_FlP4ndia2KgNfH75v4N_itw24VbY6ytTAHzlfVTqnNKGZVjgCMHqbmwrEFhRhG3nMWNv8FZlguW_w8g..IYQRoLgE0sLFjtQNx68SLxbrbuTf_PtekdLprg_IeZFP6DxUdA0RZj1Oa8Fk.kYsVHqCZ0DtuKLY3PsJXH6DvaoiwL0AD2YNbWgrfkAENaXqp6nyOFOmd4h8DlL5W84XiPhQhqTFGwiKtA2vrIW.svNFn2WFplrQFfRBqzznqkXI9aLz.f1DxG.FvHs0',
                cITimeS: '1736279228',
                refresh: function(){
                    if(window['parent']){
                        window['parent'].postMessage({
                            source: 'cloudflare-challenge',
                            widgetId: 'jkwko',
                            nextRcV: 'UZAfzgCr.j.wunkl6hw7HGLueVeTsS_dNAArJvCN7rc-1736279228-1.3.1.1-W5WsqbpmXPU2cK4RkZDCF7enbJbIk2hnASebTu8.od8',
                            event: '

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://you.doclabcourt.com

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

```json
{
    "risk_score": 1,
    "reasoning": "The script does not exhibit any high-risk or moderate-risk behaviors. It primarily consists of utility functions and error handling, with no signs of dynamic code execution, data exfiltration, or interaction with external domains. The code appears to be part of a larger library or framework, possibly for handling asynchronous operations or managing errors."
}

"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Ar(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function Bt(e){if(Array.isArray(e))return e}function jt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]||e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function qt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null||r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function zt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"||n==="Set")return Array.from(n);if(n==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return Bt(e)||jt(e,r)||zt(e,r)||qt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw||((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6||p[0]===2)){n=0;continue}if(p[0]===3&&(!u||p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Gt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Xt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j||(j={}));var L;(fun

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "To receive and download this PDF file, please enter specific professional email credentials that this document was sent to.",
"prominent_button_name": "Next",
"text_input_field_labels": [
"Enter email"
],
"pdf_icon_visible": true,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The URL 'you.doclabcourt.com' does not match the legitimate domain 'microsoft.com'.",    "The domain 'doclabcourt.com' is not associated with Microsoft and appears suspicious.",    "The presence of 'you.' as a subdomain is unusual and could be an attempt to mislead users.",    "The URL structure and domain name do not align with Microsoft's typical web properties."  ],  "riskscore": 9}
Google indexed: False

{
"contains_trigger_text": true,
"trigger_text": "To receive and download this PDF file, please enter specific professional email credentials that this document was sent to.",
"prominent_button_name": "next",
"text_input_field_labels": ["ryan_howard@office.com"],
"pdf_icon_visible": true,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "To receive and download this PDF file, please enter specific professional email credentials that this document was sent to.",
"prominent_button_name": "next",
"text_input_field_labels": [
"ryan_howard@outlook.com"
],
"pdf_icon_visible": true,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}