Windows Analysis Report
https://yogalisbon.gitcz.pw/sign-in

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true,
    "reasoning": "The URL uses a suspicious TLD '.pw' (Palau) which is often abused by malicious actors. The domain appears to be using a third-party hosting service (gitcz) and the TLD is uncommon for legitimate business websites."
}

URL: https://yogalisbon.gitcz.pw

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate user interface interaction script with no clear malicious intent. It handles UI elements like dropdown menus, input fields, and button interactions. While it uses some legacy practices like `XDomainRequest`, the overall behavior is consistent with typical form and UI functionality. The script does not exhibit any high-risk indicators like dynamic code execution or data exfiltration. Some moderate-risk behaviors, such as aggressive DOM manipulation, are present, but the context suggests these are part of a legitimate user experience implementation. Overall, the script poses a low risk and can be considered a benign, if somewhat outdated, user interface implementation."
}

var flag = document.getElementById("sign-in-phone-code");
var backdrop = document.getElementById("backdrop");
var backd = document.getElementById("iteM");
$("#labelhp").hide()
$("#Menu").hide();
flag.addEventListener("click", function(){
    $("#Menu").show();
    document.getElementById("arow").classList.add("open");
    backdrop.addEventListener("click",hideMenu);
    backd.addEventListener("click",hideMenu);
    function hideMenu(){
        flag.value = "Portugal";
        document.getElementById("labelFlag").classList.add("touched");
        document.getElementById("arow").classList.remove("open");
        $("#Menu").hide();
        aktip()
    }
})
var inpHp = document.getElementById("sign-in-phone-number");
var btnnext = document.getElementById("nextBtn");
$(btnnext).css("display","none");
inpHp.addEventListener("click",aktip);
var btnnext = document.getElementById("nextBtn");
btnnext.addEventListener("click",set_item);
function set_item(){
    sessionStorage.setItem("nohp", inpHp.value);
}
function aktip(){
    $("#labelhp").fadeIn();
    var inpHp = document.getElementById("sign-in-phone-number");
    inpHp.focus();
    var label = document.getElementById("labelhp");
    var btnnext = document.getElementById("nextBtn");
    $(btnnext).css("display","none");
    label.classList.add("touched");
    inpHp.value = "+351 "
    inpHp.addEventListener("input", validate);
    function validate(){
        if (inpHp.value.length > 0){
            label.classList.add("touched");
        } else {
            label.classList.remove("touched");
        }
        if (inpHp.value.length > 6){
            $(btnnext).fadeIn(300);
        } else {
            $(btnnext).fadeOut("fast");
        }
        if (inpHp.value == "60"){
            inpHp.value = "+351 "
        } else if (inpHp.value == "08"){
            inpHp.value = "+351 8"
        }
    }
}
function loadd(){
    $("#loader").fadeIn();
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "FAA LOGIN POR QR CODE",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": true,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Telegram"
  ]
}