Windows Analysis Report
http://txto.eu.org/

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: http://txto.eu.org

{
    "risk_score": 5,
    "reasoning": "The script exhibits a mix of behaviors, some of which are potentially concerning. It uses cryptographic functions and makes POST requests to external servers, which could indicate data exfiltration. However, the script also appears to have legitimate functionality related to user authentication and content management. Further review is needed to determine the full context and intent of the script."
}

    "use strict";var __awaiter=this&&this.__awaiter||function(e,t,n,o){return new(n||(n=Promise))((function(i,r){function c(e){try{u(o.next(e))}catch(e){
r(e)}}function a(e){try{u(o.throw(e))}catch(e){r(e)}}function u(e){var t;e.done?i(e.value):(t=e.value,t instanceof n?t:new n((function(e){e(t)
}))).then(c,a)}u((o=o.apply(e,t||[])).next())}))};!function(){function e(e){return __awaiter(this,void 0,void 0,(function*(){
for(var t=(""+Date.now()).substring(0,10),n=t+e,o=new TextEncoder,i=new Uint8Array(32);;){yield crypto.getRandomValues(i)
;var r=btoa(i).substring(0,32);let e=yield crypto.subtle.digest("SHA-256",o.encode(n+r));e=yield crypto.subtle.digest("SHA-256",e)
;let a=new Uint8Array(e);var c=0;for(let e=0;e<32;e++){const t=a[e];if(0!=(128&t))break;if(c+=1,0!=(64&t))break;if(c+=1,0!=(32&t))break;if(c+=1,
0!=(16&t))break;if(c+=1,0!=(8&t))break;if(c+=1,0!=(4&t))break;if(c+=1,0!=(2&t))break;if(c+=1,0!=(1&t))break;if((c+=1)>=16)break}if(c>=16)return{
time:t,sign:r}}}))}var t;!function(){__awaiter(this,void 0,void 0,(function*(){let t=yield e("count");var n=JSON.stringify({time:t.time,sign:t.sign})
;const o=new XMLHttpRequest;o.open("POST","/count"),o.setRequestHeader("Content-type","application/json"),o.responseType="json",o.onload=function(){
if(200!==o.status)alert("Error fetching data.");else{var e=o.response;(0,console.log)(e),
0==e.code&&(document.getElementById("statuslink").innerHTML=e.count)}},o.onloadend=function(){i(!1)},o.send(n)}))}(),
document.querySelector(".close-btn").onclick=function(){i(!1)},(t=decodeURIComponent(function(e){const t=document.cookie.split(";");let n=""
;for(let o=0;o<t.length;o++){const i=t[o].split("=");if(i[0].trim()===e){n=i[1];break}}return n
}("accname")))?(document.getElementById("currentdomain").innerHTML=`<a href="/my">${decodeURIComponent(t)}</a> | <a href="#" id='logout'>logout</a>`,
setTimeout((()=>{document.querySelector("#logout").onclick=()=>{u(),location.href="/"}
}),300)):document.getElementById("currentdomain").innerHTML='  <a href="/login">Login</a>',document.getElementById("submit").onclick=function(){
return __awaiter(this,void 0,void 0,(function*(){if(!r("content-input"))return void o("please input content");i(!0);let t=yield a();if(t>10){
let e=Math.pow(1.5,t-10);e=e>180?180:e,yield function(e){return __awaiter(this,void 0,void 0,(function*(){return new Promise((t=>{setTimeout((()=>{
t(1)}),1e3*e)}))}))}(e)}setTimeout((()=>{!function(){__awaiter(this,void 0,void 0,(function*(){var t=r("content-input")
;if(!t)return void o("please input content");var u="",l=document.getElementsByClassName("radio");for(let e=0;e<l.length;e++){const t=l[e]
;t.checked&&(u=t.value)}let d=yield e(t);var s=Object.assign({content:t,expire:u},d);let f=yield a();if(s.C=f,n>0){
var m=r("custom-url-input"),y=r("custom-edit-code");s.url=m,s.editcode=y}if(n>1){var p=r("title-input"),v=r("author-input"),g=r("description-input")
;s.title=p,s.author=v,s.desc=g}var h=JSON.stringify(s);const w=new XMLHttpRequest;w.open("POST","/addPost"),
w.setRequestHeader("Content-type","application/x-www-form-urlencoded"),w.responseType="json",w.onload=function(){var e=w.response;if(e&&0==e.code){
!function(){__awaiter(this,void 0,void 0,(function*(){let e=yield a();e+=1;var t=(new Date).toISOString().substring(0,10)
;localStorage.setItem(yield c(t),""+e)}))}();var t=encodeURIComponent(JSON.stringify(e));setTimeout((()=>{location.href="/succ#"+t}),100)
}else o(e&&e.err||"error happened")},w.onloadend=function(){i(!1)},w.send(h)}))}()}),0)}))},document.getElementById("showmore").onclick=function(){
0==n?(n++,document.getElementById("adv-field").style.display="block"):1==n&&(n++,document.getElementById("meta-field").style.display="block",
document.getElementById("showmore").style.display="none")};var n=0;function o(e){alert(e)}function i(e){
document.querySelector(".overlay").style.display=e?"flex":"none"}function r(e){return document.getElementById(e).value}function c(e){
return __awaiter(this,void 0,void 0,(function*(){var

{
    "risk_score": 8,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscation of the script's purpose raise significant security concerns. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of a potential attack vector."
}

(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'9000a57fe9721899',t:'MTczNjU1MzgzNS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "Markdown syntax supported",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Txto"
  ]
}

{
  "brands": [
    "Txto"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Txto"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Txto"
  ]
}

{
  "brands": [
    "Txto"
  ]
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}