Windows Analysis Report
http://t.notif-moncompte-laposte.info

```json{  "brand": "La Poste",  "brand_classification": "wellknown",  "legit_url": "https://www.laposte.fr",  "similarity": 6,  "spoofed": 7,  "reasoning": "The URL 'http://t.notif-moncompte-laposte.info' appears to be attempting to mimic a legitimate La Poste service. The use of 'laposte' in the domain suggests an association with the well-known French postal service. The subdomain 'notif-moncompte' implies a notification service related to a user account, which could be a plausible service offered by La Poste. However, the domain extension '.info' is not typically associated with La Poste, which primarily uses '.fr'. The structural similarity is moderate due to the inclusion of 'laposte' and the plausible subdomain, but the use of a different top-level domain and the additional elements ('notif-moncompte') suggest a potential typosquatting attempt. The likelihood of user confusion is increased by the plausible service name, but the different domain extension reduces the similarity score. Overall, the URL is likely a typosquatting attempt aimed at misleading users into thinking it is associated with La Poste."}

URL: http://t.notif-moncompte-laposte.info

```json
{
    "risk_score": 5,
    "reasoning": "The script sends data to a potentially suspicious domain ('notif-moncompte-laposte.info') using fetch, which is a moderate-risk indicator. The domain is not recognized as a reputable one, adding to the risk. However, there is no evidence of high-risk behaviors like dynamic code execution or data exfiltration of sensitive information."
}

	var domain = "notif-moncompte-laposte.info";
	var pendingSiteAnalysis = "2a24638212d2c07d32c1433dcf3f85fdb80ed0ee5926ae67ab785100658d355a";
	var pendingDomainCheck = "81cc4c1a0932371c820edf8d3945059ae090f9a2890dccb72aeb7fb450a96274";
	var cacheTimeLeft = "";

	function postInit() {
		if (domain) {
			fetch("/api/whois/getDomainSiteAnalysis/" + domain, {
					method: "POST",
					headers: {
						"Content-Type": "application/x-www-form-urlencoded"
					},
					body: new URLSearchParams({
						"pendingSiteAnalysis": pendingSiteAnalysis
					})
				})
				.then(response => response.json())
				.then(data => {
					document.getElementById("siteStatusStatus").innerHTML = data['active'] == "1" ? "<span class='text-success'>Active</span>" : "<span class='text-danger'>Inactive</span>";
					document.getElementById("siteStatusServerType").innerHTML = data['server'];
				});

			doDomainSearches(domain, pendingDomainCheck);
		}
	}

```json{  "brand": "La Poste",  "brand_classification": "wellknown",  "legit_url": "https://www.laposte.fr",  "similarity": 7,  "spoofed": 8,  "reasoning": "The URL 'notif-moncompte-laposte.info' appears to target the well-known French postal service brand 'La Poste'. The legitimate URL for La Poste is 'https://www.laposte.fr'. The analyzed URL uses the term 'laposte', which is directly associated with the brand, and includes 'moncompte' (French for 'my account'), suggesting a potential phishing attempt to mimic a login or notification page. The use of the '.info' domain extension is less common for official brand websites, which often use '.fr' for French entities. The subdomain 'notif' implies notifications, which could mislead users into thinking it is an official communication from La Poste. The structural similarity and context suggest a high likelihood of typosquatting, as the URL is crafted to appear as a legitimate service notification from La Poste."}

```json
{
    "risk_score": 2,
    "reasoning": "The script sends user data to a local API endpoint using fetch, which is a moderate-risk indicator. However, there are no high-risk behaviors such as dynamic code execution or data exfiltration to external domains. The script appears to be part of a legitimate form submission process."
}

function makeOfferSubmit() {
    document.getElementById('makeOfferModalError').style.display = 'none';
    document.getElementById('makeOfferModalSuccess').style.display = 'none';

    var domain = document.getElementById('makeOfferModalDomain').innerHTML.trim();
    var firstName = document.getElementById('firstName').value.trim();
    var lastName = document.getElementById('lastName').value.trim();
    var email = document.getElementById('email').value.trim();
    var phone = document.getElementById('phone').value.trim();
    var offer = document.getElementById('offer').value.trim();

    if (!domain || !firstName || !lastName || !email || !phone || !offer) {
        document.getElementById('makeOfferModalError').innerHTML = "All fields are required. Please be sure to complete the entire form before submitting your offer.";
        document.getElementById('makeOfferModalError').style.display = 'block';
        return;
    }
    fetch("/api/whois/makeOffer", {
        method: "POST",
        headers: {
            "Content-Type": "application/x-www-form-urlencoded"
        },
        body: new URLSearchParams({
            domain: domain,
            firstName: firstName,
            lastName: lastName,
            email: email,
            phone: phone,
            offer: offer
        }).toString()
    })
    .then(response => response.json())
    .then(data => {
        if (data['sent']) {
            document.getElementById('makeOfferModalSuccess').style.display = 'block';
        } else {
            document.getElementById('makeOfferModalError').innerHTML = "Uh oh. Something went wrong and we were unable to submit your offer.";
            document.getElementById('makeOfferModalError').style.display = 'block';
        }
    })
    .catch(error => {
        document.getElementById('makeOfferModalError').innerHTML = "Uh oh. Something went wrong and we were unable to submit your offer.";
        document.getElementById('makeOfferModalError').style.display = 'block';
    });
}

```json
{
    "contains_trigger_text": false,
    "trigger_text": "unknown",
    "prominent_button_name": "unknown",
    "text_input_field_labels": "unknown",
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false,
    "contains_security_review": false,
    "page_classification": "unknown"
}

```json
{
  "brands": [
    "La Poste"
  ]
}

```json
{
    "risk_score": 1,
    "reasoning": "The script is a Facebook SDK integration, which is a common and legitimate use case. It loads the Facebook SDK from a trusted domain (facebook.net) and does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. The script's purpose aligns with typical analytics and social media integration functionality."
}

/*1738184401,,JIT Construction: v1019677935,en_US*/

/**
 * Copyright (c) 2017-present, Facebook, Inc. All rights reserved.
 *
 * You are hereby granted a non-exclusive, worldwide, royalty-free license to use,
 * copy, modify, and distribute this software in source code or binary form for use
 * in connection with the web services and APIs provided by Facebook.
 *
 * As with any software that integrates with the Facebook platform, your use of
 * this software is subject to the Facebook Platform Policy
 * [http://developers.facebook.com/policy/]. This copyright notice shall be
 * included in all copies or substantial portions of the software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
 * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
 * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
(function _(a,b,c,d,e){var f=window.console;f&&Math.floor(new Date().getTime()/1e3)-b>7*24*60*60&&f.warn("The Facebook JSSDK is more than 7 days old.");if(window[c])return;if(!window.JSON)return;var g=window[c]={__buffer:{replay:function(){var a=this,b=function(d){var b=window[c];a.calls[d][0].split(".").forEach(function(a){return b=b[a]});b.apply(null,a.calls[d][1])};for(var d=0;d<this.calls.length;d++)b(d);this.calls=[]},calls:[],opts:null},getUserID:function(){return""},getAuthResponse:function(){return null},getAccessToken:function(){return null},init:function(a){g.__buffer.opts=a}};for(b=0;b<d.length;b++){f=d[b];if(f in g)continue;var h=f.split("."),i=h.pop(),j=g;for(var k=0;k<h.length;k++)j=j[h[k]]||(j[h[k]]={});j[i]=function(a){if(a==="init")return;return function(){g.__buffer.calls.push([a,Array.prototype.slice.call(arguments)])}}(f)}k=document.createElement("script");k.src=a;k.async=!0;e&&(k.crossOrigin="anonymous");h=document.getElementsByTagName("script")[0];h.parentNode&&h.parentNode.insertBefore(k,h)})("https:\/\/connect.facebook.net\/en_US\/sdk.js?hash=786782fe22e04053eb1787677b0d0ccc", 1738184401, "FB", ["AppEvents.EventNames","AppEvents.ParameterNames","AppEvents.activateApp","AppEvents.clearAppVersion","AppEvents.clearUserID","AppEvents.getAppVersion","AppEvents.getUserID","AppEvents.logEvent","AppEvents.logPageView","AppEvents.logPurchase","AppEvents.setAppVersion","AppEvents.setUserID","AppEvents.updateUserProperties","Canvas.Plugin.showPluginElement","Canvas.Plugin.hidePluginElement","Canvas.Prefetcher.addStaticResource","Canvas.Prefetcher.setCollectionMode","Canvas.getPageInfo","Canvas.scrollTo","Canvas.setAutoGrow","Canvas.setDoneLoading","Canvas.setSize","Canvas.setUrlHandler","Canvas.startTimer","Canvas.stopTimer","Event.subscribe","Event.unsubscribe","XFBML.parse","addFriend","api","getAccessToken","getAuthResponse","getLoginStatus","getUserID","init","login","logout","publish","share","ui"], true);

```json
{
    "risk_score": 3,
    "reasoning": "The script primarily handles user interactions and data processing within the same domain, with no high-risk indicators like dynamic code execution or data exfiltration. It uses fetch to send data to the server, which is a moderate-risk indicator, but the endpoint is relative, suggesting internal communication. The script appears to be part of a legitimate application for domain management and does not interact with suspicious domains."
}

function handleOutboundLinkClicks(event, e) {
	gtag('event', 'outbound_link', {
        'event_category': 'Outbound Link',
		'event_action': 'click',
        'event_label': e.getAttribute('data-label'),
      });
}

function addToAccount(e) {
	var domainName = e.getAttribute('data-domain').trim();
	var userID = e.getAttribute('data-userid').trim();

	fetch("/api/whois/addAccountDomains", {
		method: "POST",
		headers: {
			"Content-Type": "application/x-www-form-urlencoded"
		},
		body: new URLSearchParams({
			domainName: domainName,
			userID: userID
		})
	})
	.then(function (response) {
		return response.json();
	})
	.then(function (data) {
		if (data['error'] == '1') {
			e.innerHTML = data['message'];
			e.classList.remove('btn-primary');
			e.classList.add('btn-danger');
			return;
		} else if (data['error'] == '2') {
			e.innerHTML = data['message'];
			e.classList.remove('btn-primary');
			e.classList.add('btn-success');
			return;
		} else {
			e.innerHTML = 'Added!';
			e.classList.remove('btn-primary');
			e.classList.add('btn-success');
		}
	}, "json");
}

function doDomainSearches(domain, pendingDomainCheck) {
	fetch("/api/whois/checkDomainAvailability/" + domain, {
		method: "POST",
		headers: {
			"Content-Type": "application/x-www-form-urlencoded"
		},
		body: new URLSearchParams({ "pendingDomainCheck": pendingDomainCheck })
	})
	.then(function (response) {
		return response.json();
	})
	.then(function (data) {
		// Update power bar if it exists
		const powerBarHeading = document.getElementById("domainAvailabilityPowerBarHeading");
		if (powerBarHeading) {
			if (!data['domains'][domain]) {
				var headingHtml = `<h3 class="mt-2">${domain} is already registered. Interested in buying it? <a data-label='above power bar name.com make offer 2' href='https://domainagents.com/${domain}-whodot'>Make an Offer</a></h3>`;
			} else if (data['domains'][domain].avail && data['domains'][domain].product_type == 'rightside_make_offer') {
				var headingHtml = `<h3 class="mt-2">${domain} may be available!</h3><p><button style='margin-bottom:10px;' class='btn btn-success' data-domain='${domain}' onclick='makeOffer(this); handleOutboundLinkClicks(event, this);' data-label='above power bar name.com make offer 1'>Make an offer!</button></p>`;
			} else if (data['domains'][domain].avail) {
				var headingHtml = `<h3 class="mt-2">${domain} is available for $${data['domains'][domain].price}!</h3><p><button class='btn btn-success' data-domain='${domain}' data-label='buy it now top bar' onclick='purchaseThisDomains(this); handleOutboundLinkClicks(event, this);'>Buy it now!</button></p>`;
			} else {
				var headingHtml = `<h3 class="mt-2">${domain} is already registered. Interested in buying it? <a data-label='above power bar name.com make offer 2' href='https://domainagents.com/${domain}-whodot'><strong>Make an Offer</strong></a></h2>`;
			}

			powerBarHeading.innerHTML = headingHtml;

			var haveAvailable = false;
			for (var key in data['domains']) {
				var domainInfo = data['domains'][key];
				var statusText = domainInfo.avail ? 'Available' : 'Taken';
				var statusClass = domainInfo.avail ? 'powerBarTldContainerStatusAvailable' : 'powerBarTldContainerStatusTaken';
				var tld = key.split('.')[1];
				// Update the existing TLD status and price
				var statusElement = document.getElementById(`powerBarTldContainerStatus-${tld}`);
				var priceElement = document.getElementById(`powerBarTldContainerPrice-${tld}`);
				if (statusElement) {
					statusElement.innerHTML = statusText;
					statusElement.className = `powerBarTldContainerStatus ${statusClass}`;
					if (domainInfo.avail) {
						priceElement.innerHTML = `$${domainInfo.price}`; // Set the price if available
						haveAvailable = true;
					} else {
						priceElement.innerHTML = ''; // Clear price if not available
					}

					statusElement.setAttribute('data-domain', key);
				}
			}

			document.querySelectorAll(".powerBarTldContainerStatusAvailable").forEach(function(eleme

```json
{
    "risk_score": 1,
    "reasoning": "The script primarily consists of user agent checks and utility functions without any high-risk behaviors. It does not perform dynamic code execution, data exfiltration, or interact with suspicious domains. The script appears to be part of a library for handling browser-specific operations, likely for compatibility or feature detection purposes."
}

(function(){'use strict';/*

 Copyright The Closure Library Authors.
 SPDX-License-Identifier: Apache-2.0
*/
var l=this||self;var n,p;a:{for(var aa=["CLOSURE_FLAGS"],w=l,z=0;z<aa.length;z++)if(w=w[aa[z]],w==null){p=null;break a}p=w}var ba=p&&p[610401301];n=ba!=null?ba:!1;function ca(){var a=l.navigator;return a&&(a=a.userAgent)?a:""}var A;const da=l.navigator;A=da?da.userAgentData||null:null;function B(a){return n?A?A.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function C(a){return ca().indexOf(a)!=-1};function E(){return n?!!A&&A.brands.length>0:!1}function F(){return E()?B("Chromium"):(C("Chrome")||C("CriOS"))&&!(E()?0:C("Edge"))||C("Silk")};function ea(a,b){Array.prototype.forEach.call(a,b,void 0)};function G(a){G[" "](a);return a}G[" "]=function(){};var fa=ca().toLowerCase().indexOf("webkit")!=-1&&!C("Edge");!C("Android")||F();F();C("Safari")&&(F()||(E()?0:C("Coast"))||(E()?0:C("Opera"))||(E()?0:C("Edge"))||(E()?B("Microsoft Edge"):C("Edg/"))||E()&&B("Opera"));function ha(a){var b=window;b.addEventListener&&b.addEventListener("load",a,!1)};/*

 Copyright Google LLC
 SPDX-License-Identifier: Apache-2.0
*/
let ia=globalThis.trustedTypes,H;function ja(){let a=null;if(!ia)return a;try{const b=c=>c;a=ia.createPolicy("goog#html",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};var ka=class{constructor(a){this.g=a}toString(){return this.g+""}};function la(a){if(a instanceof ka)return a.g;throw Error("");};var ma=RegExp("^(?:([^:/?#.]+):)?(?://(?:([^\\\\/?#]*)@)?([^\\\\/?#]*?)(?::([0-9]+))?(?=[\\\\/?#]|$))?([^?#]+)?(?:\\?([^#]*))?(?:#([\\s\\S]*))?$");function I(a){try{var b;if(b=!!a&&a.location.href!=null)a:{try{G(a.foo);b=!0;break a}catch(c){}b=!1}return b}catch{return!1}}function na(a=!1){const b=[l.top],c=[];let d=0,f;for(;f=b[d++];){a&&!I(f)||c.push(f);try{if(f.frames)for(let e=0;e<f.frames.length&&b.length<1024;++e)b.push(f.frames[e])}catch{}}return c}function oa(a,b){if(a)for(const c in a)Object.prototype.hasOwnProperty.call(a,c)&&b(a[c],c,a)}function pa(a=document){return a.createElement("img")};function qa(a){l.google_image_requests||(l.google_image_requests=[]);const b=pa(l.document);b.src=a;l.google_image_requests.push(b)};let J=null;function ra(){if(!J)b:{var a=na();for(var b=0;b<a.length;b++)try{const c=a[b].frames.google_esf;if(c&&I(c)){J=c;break b}}catch(c){}J=null}(a=J)?((b=a.esf_propArray)||(b=a.esf_propArray={}),a=b):a=null;return a?.[2]};var K=window;var sa=/#(R?S)-(.*)/,ta=/^(\d+)-(.*)/;var ya=class{constructor(a,b){this.error=a;this.context=b.context;this.msg=b.message||"";this.id=b.id||"jserror";this.meta={}}};function L(a){let b=a.toString();a.name&&b.indexOf(a.name)==-1&&(b+=": "+a.name);a.message&&b.indexOf(a.message)==-1&&(b+=": "+a.message);if(a.stack)a:{a=a.stack;var c=b;try{a.indexOf(c)==-1&&(a=c+"\n"+a);let d;for(;a!=d;)d=a,a=a.replace(RegExp("((https?:/..*/)[^/:]*:\\d+(?:.|\n)*)\\2"),"$1");b=a.replace(RegExp("\n *","g"),"\n");break a}catch(d){b=c;break a}b=void 0}return b};const za=RegExp("^https?://(\\w|-)+\\.cdn\\.ampproject\\.(net|org)(\\?|/|$)");var Aa=class{constructor(a,b){this.g=a;this.h=b}},Ba=class{constructor(a,b){this.url=a;this.l=!!b;this.depth=null}};let M=null;function Ca(){const a=l.performance;return a&&a.now&&a.timing?Math.floor(a.now()+a.timing.navigationStart):Date.now()}function Da(){const a=l.performance;return a&&a.now?a.now():null};var Ea=class{constructor(a,b){var c=Da()||Ca();this.label=a;this.type=b;this.value=c;this.duration=0;this.taskId=this.slotId=void 0;this.uniqueId=Math.random()}};const O=l.performance,Fa=!!(O&&O.mark&&O.measure&&O.clearMarks),P=function(a){let b=!1,c;return function(){b||(c=a(),b=!0);return c}}(()=>{var a;if(a=Fa){var b;if(M===null){M="";try{a="";try{a=l.top.location.hash}catch(c){a=l.location.hash}a&&(M=(b=a.match(/\bdeid=([\d,]+)/))?b[1]:"")}catch(c){}}b=M;a=!!b.indexOf&&b.indexOf("1337")>=0}return a});function Ga(a){a&&O&&P()&&(O.clearMarks(`goog_${a.label}_${a.uniqueId}_start`),O.clearMarks(`goog_${a.label}_${a.uniqueId}_e

```json
{
    "risk_score": 5,
    "reasoning": "The script uses dynamic code execution through 'execScript', which is a high-risk indicator (+3 points). It also includes aggressive DOM manipulation and legacy practices, such as 'execScript', which are moderate-risk indicators (+2 points). However, there is no clear evidence of data exfiltration or interaction with suspicious domains, so the score remains in the medium risk range."
}

(function(sttc){'use strict';var aa=Object.defineProperty,ba=globalThis,ca=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",da={},ea={};function fa(a,b,c){if(!c||a!=null){c=ea[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} 
function ha(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],f;!a&&e in da?f=da:f=ba;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=ca&&c==="es6"?f[d]:null;b=b(c);b!=null&&(a?aa(da,d,{configurable:!0,writable:!0,value:b}):b!==c&&(ea[d]===void 0&&(a=Math.random()*1E9>>>0,ea[d]=ca?ba.Symbol(d):"$jscp$"+a+"$"+d),aa(f,ea[d],{configurable:!0,writable:!0,value:b})))}}ha("Symbol.dispose",function(a){return a?a:Symbol("Symbol.dispose")},"es_next");/* 
 
 Copyright The Closure Library Authors. 
 SPDX-License-Identifier: Apache-2.0 
*/ 
var p=this||self;function ia(a){a=a.split(".");for(var b=p,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b}function ja(a){var b=typeof a;return b=="object"&&a!=null||b=="function"}function ka(a){return Object.prototype.hasOwnProperty.call(a,la)&&a[la]||(a[la]=++ma)}var la="closure_uid_"+(Math.random()*1E9>>>0),ma=0;function na(a,b,c){return a.call.apply(a.bind,arguments)} 
function oa(a,b,c){if(!a)throw Error();if(arguments.length>2){var d=Array.prototype.slice.call(arguments,2);return function(){var e=Array.prototype.slice.call(arguments);Array.prototype.unshift.apply(e,d);return a.apply(b,e)}}return function(){return a.apply(b,arguments)}}function pa(a,b,c){pa=Function.prototype.bind&&Function.prototype.bind.toString().indexOf("native code")!=-1?na:oa;return pa.apply(null,arguments)} 
function qa(a,b,c){a=a.split(".");c=c||p;a[0]in c||typeof c.execScript=="undefined"||c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length||b===void 0?c[d]&&c[d]!==Object.prototype[d]?c=c[d]:c=c[d]={}:c[d]=b}function ra(a){return a};function sa(a){p.setTimeout(()=>{throw a;},0)};function ta(a){return/^[\s\xa0]*([\s\S]*?)[\s\xa0]*$/.exec(a)[1]} 
function ua(a,b){let c=0;a=ta(String(a)).split(".");b=ta(String(b)).split(".");const d=Math.max(a.length,b.length);for(let g=0;c==0&&g<d;g++){var e=a[g]||"",f=b[g]||"";do{e=/(\d*)(\D*)(.*)/.exec(e)||["","","",""];f=/(\d*)(\D*)(.*)/.exec(f)||["","","",""];if(e[0].length==0&&f[0].length==0)break;c=va(e[1].length==0?0:parseInt(e[1],10),f[1].length==0?0:parseInt(f[1],10))||va(e[2].length==0,f[2].length==0)||va(e[2],f[2]);e=e[3];f=f[3]}while(c==0)}return c}function va(a,b){return a<b?-1:a>b?1:0};var wa,ya=ia("CLOSURE_FLAGS"),za=ya&&ya[610401301];wa=za!=null?za:!1;function Aa(){var a=p.navigator;return a&&(a=a.userAgent)?a:""}var Ba;const Ca=p.navigator;Ba=Ca?Ca.userAgentData||null:null;function Da(a){return wa?Ba?Ba.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function q(a){return Aa().indexOf(a)!=-1};function Ea(){return wa?!!Ba&&Ba.brands.length>0:!1}function Fa(){return Ea()?!1:q("Trident")||q("MSIE")}function Ga(){return Ea()?Da("Microsoft Edge"):q("Edg/")}function Ha(){!q("Safari")||Ia()||(Ea()?0:q("Coast"))||(Ea()?0:q("Opera"))||(Ea()?0:q("Edge"))||Ga()||Ea()&&Da("Opera")}function Ia(){return Ea()?Da("Chromium"):(q("Chrome")||q("CriOS"))&&!(Ea()?0:q("Edge"))||q("Silk")}function Ja(a){const b={};a.forEach(c=>{b[c[0]]=c[1]});return c=>b[c.find(d=>d in b)]||""} 
function Ka(){var a=Aa();if(Fa()){var b=/rv: *([\d\.]*)/.exec(a);if(b&&b[1])a=b[1];else{b="";var c=/MSIE +([\d\.]+)/.exec(a);if(c&&c[1])if(a=/Trident\/(\d.\d)/.exec(a),c[1]=="7.0")if(a&&a[1])switch(a[1]){case "4.0":b="8.0";break;case "5.0":b="9.0";break;case "6.0":b="10.0";break;case "7.0":b="11.0"}else b="7.0";else b=c[1];a=b}return a}c=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s*(?:\\((.*?)\\))?","g");b=[];let d;for(;d=c.exec(a);)b.push([d[1],d[2],d[3]||void 0]);a=Ja(b);return(Ea()?0:q("Opera"))?a(["Version", 
"Opera"]):(Ea()?0:q("Edge"))?a(["Edge"]):Ga()?a(["Edg"]):q("Silk")?a(["Silk"]):Ia()?a(["Chrome","CriOS","HeadlessChrome"]):(a=b[2])&&a[1]||""};function La(a,b){if(typeof a==="string")return typeof b!=="stri

```json{  "brand": "unknown",  "brand_classification": "unknown",  "legit_url": "unknown",  "similarity": 0,  "spoofed": 0,  "reasoning": "The URL 'https://who.is' does not appear to be attempting to spoof any known brand. It is a legitimate domain used for WHOIS lookup services, which is a common and recognized purpose. There are no visual character substitutions or structural changes that suggest typosquatting. The domain name 'who.is' is straightforward and descriptive of its function, and there is no indication of an attempt to confuse users into thinking it is associated with a different brand."}

URL: https://who.is

```json
{
    "risk_score": 2,
    "reasoning": "The script uses the Function constructor, which is a high-risk indicator for dynamic code execution (+3 points). However, it is associated with Facebook, a known and reputable domain, which allows for a subtraction of 2 points for trusted domain interaction. The final risk score is 2, indicating low risk due to the legitimate context."
}

/*1738181558,,JIT Construction: v1019677935,en_US*/

/**
 * Copyright (c) 2017-present, Facebook, Inc. All rights reserved.
 *
 * You are hereby granted a non-exclusive, worldwide, royalty-free license to use,
 * copy, modify, and distribute this software in source code or binary form for use
 * in connection with the web services and APIs provided by Facebook.
 *
 * As with any software that integrates with the Facebook platform, your use of
 * this software is subject to the Facebook Platform Policy
 * [http://developers.facebook.com/policy/]. This copyright notice shall be
 * included in all copies or substantial portions of the software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
 * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
 * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
try {(window.FB && !window.FB.__buffer) || (function() {  var apply = Function.prototype.apply;  function bindContext(fn, thisArg) {    return function _sdkBound() {      return apply.call(fn, thisArg, arguments);    };  }  var global = {    __type: 'JS_SDK_SANDBOX',    window: window,    document: window.document  };  var sandboxSafelist = [    'setTimeout',    'setInterval',    'clearTimeout',    'clearInterval'  ];  for (var i = 0; i < sandboxSafelist.length; i++) {    global[sandboxSafelist[i]] = bindContext(      window[sandboxSafelist[i]],      window    );  }  (function() {    var self = window;    var globalThis = this;    var __DEV__ = 0;    function emptyFunction() {};    var __transform_includes = {};    var __annotator, __bodyWrapper;    var __w, __t;    var undefined;    with (this) {      (function(a){var b={},c=function(a,b){if(!a&&!b)return null;var c={};typeof a!=="undefined"&&(c.type=a);typeof b!=="undefined"&&(c.signature=b);return c},d=function(a,b){return c(a&&/^[A-Z]/.test(a)?a:void 0,b&&(b.params&&b.params.length||b.returns)?"function("+(b.params?b.params.map(function(a){return/\?/.test(a)?"?"+a.replace("?",""):a}).join(","):"")+")"+(b.returns?":"+b.returns:""):void 0)},e=function(a,b,c){return a},f=function(a,b,c){"sourcemeta"in __transform_includes&&(a.__SMmeta=b);if("typechecks"in __transform_includes){b=d(b?b.name:void 0,c);b&&__w(a,b)}return a},g=function(a,b,c){return c.apply(a,b)},h=function(a,c,d,e,f){if(f){f.callId||(f.callId=f.module+":"+(f.line||0)+":"+(f.column||0));e=f.callId;b[e]=(b[e]||0)+1}return d.apply(a,c)};typeof __transform_includes==="undefined"?(a.__annotator=e,a.__bodyWrapper=g):(a.__annotator=f,"codeusage"in __transform_includes?(a.__annotator=e,a.__bodyWrapper=h,a.__bodyWrapper.getCodeUsage=function(){return b},a.__bodyWrapper.clearCodeUsage=function(){b={}}):a.__bodyWrapper=g)})(typeof globalThis!=="undefined"?globalThis:typeof global!=="undefined"?global:typeof window!=="undefined"?window:typeof this!=="undefined"?this:typeof self!=="undefined"?self:{});
(function(a){a.__t=function(a){return a[0]},a.__w=function(a){return a}})(typeof globalThis!=="undefined"?globalThis:typeof global!=="undefined"?global:typeof window!=="undefined"?window:typeof this!=="undefined"?this:typeof self!=="undefined"?self:{});
(function(a){var b={},c=["global","require","requireDynamic","requireLazy","module","exports"],d=["global","require","importDefault","importNamespace","requireLazy","module","exports"],e=1,f=32,g=64,h=256,i={},j=Object.prototype.hasOwnProperty;function k(e,h){if(!j.call(b,e)){if(h)return null;throw new Error("Module "+e+" has not been defined")}h=b[e];if(h.resolved)return h;e=h.special;var i=h.factory.length,k=e&f?d.concat(h.deps):c.concat(h.deps),o=[],p;for(var q=0;q<i;q++){switch(k[q]){case"module":p=h;break;case"exports":p=h.exports;break;case"global":p=a;break;cas

```json
{
    "risk_score": 1,
    "reasoning": "The script contains a JSON configuration string with CSS styling and DOM element selectors. There are no high-risk indicators such as dynamic code execution or data exfiltration. The script appears to be related to UI configuration, with no evidence of malicious intent."
}

var apcnf = '{"googMsgType":"apcnf","config":"[[[[null,0,null,[],null,null,\\\"DIV#gcaptcha\\\"],1,[\\\"10px\\\",\\\"16px\\\",true],[2],null,[],[],1,[],[],[]],[[null,1,null,[],null,null,\\\"DIV.container-lg\\\\u003eDIV.row\\\\u003eDIV.queryResponseContainer\\\\u003eDIV.row\\\\u003eDIV.queryResponseBody\\\\u003eDIV.row.queryResponseBodyRow\\\\u003eDIV.queryResponseBodyKey\\\"],4,[\\\"10px\\\",\\\"10px\\\",true],[3],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"BODY\\\\u003eDIV.container-fluid\\\\u003eDIV.row.home-video-blurb\\\\u003eDIV\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[2],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"DIV.container-lg\\\\u003eDIV.row\\\\u003eDIV.queryResponseContainer\\\\u003eDIV.row\\\\u003eDIV.queryResponseBody\\\\u003eDIV.row.queryResponseBodyRow\\\\u003eDIV.queryResponseBodyKey\\\"],4,[\\\"10px\\\",\\\"10px\\\",true],[3],null,[],[],1,[],[],[]],[[null,6,null,[],null,null,\\\"BODY\\\\u003eDIV.container-fluid\\\\u003eDIV.container\\\\u003eDIV.row\\\\u003eDIV.queryResponseContainer\\\\u003eDIV.row\\\\u003eDIV.queryResponseBody\\\\u003eDIV\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[3],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"BODY\\\\u003eDIV.container-fluid\\\\u003eDIV.row.teaser-bar\\\"],2,[\\\"10px\\\",\\\"10px\\\",true],[2],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"DIV.progress\\\"],4,[\\\"10px\\\",\\\"10px\\\",true],[0],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"DIV.container-lg\\\\u003eDIV.row\\\\u003eDIV.queryResponseContainer\\\\u003eDIV.row\\\\u003eDIV.queryResponseBody\\\"],4,[\\\"10px\\\",\\\"10px\\\",true],[3],null,[],[],1,[],[],[]],[[null,4,null,[],null,null,\\\"DIV.container-lg\\\\u003eDIV.row\\\\u003eDIV\\\"],2,[\\\"10px\\\",\\\"10px\\\",true],[0],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"H1\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[4],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"BODY\\\\u003eDIV.container-fluid\\\\u003eDIV.row.teaser-bar\\\"],3,[\\\"10px\\\",\\\"10px\\\",true],[2],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"BODY\\\\u003eFOOTER.footer\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[0],null,[],[],1,[],[2,4],[]],[[null,0,null,[],null,null,\\\"DIV.container-lg\\\\u003eDIV.row\\\\u003eDIV.alert.alert-info\\\\u003eDIV.d-flex.flex-wrap\\\"],3,[\\\"10px\\\",\\\"10px\\\",true],[2],null,[],[],1,[],[],[]],[[null,4,null,[],null,null,\\\"BODY\\\\u003eDIV.container-fluid\\\\u003eDIV.container\\\\u003eDIV.row\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[3],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"BODY\\\\u003eDIV.container-fluid\\\\u003eDIV.row.home-icon-blurbs\\\\u003eDIV\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[3],null,[],[],1,[],[],[]],[[null,4,null,[],null,null,\\\"BODY\\\\u003eDIV.container-fluid\\\\u003eDIV.container\\\\u003eDIV.row\\\\u003eDIV.queryResponseContainer\\\\u003eDIV.row\\\\u003eDIV.queryResponseBody\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[3],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"DIV.container-lg\\\\u003eDIV.row\\\\u003eDIV.alert.alert-info\\\\u003eDIV.d-flex.flex-wrap\\\"],2,[\\\"10px\\\",\\\"10px\\\",true],[2],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"BODY\\\\u003eFOOTER.footer\\\\u003eDIV.container\\\\u003eDIV.row.justify-content-center\\\\u003eDIV\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[5],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"DIV.container-lg\\\\u003eDIV.row\\\\u003eDIV.queryResponseContainer\\\\u003eDIV.row\\\\u003eDIV.queryResponseBody\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[1],null,[],[],1,[],[],[]],[[null,4,null,[],null,null,\\\"DIV.container-lg\\\\u003eDIV.row\\\\u003eDIV\\\"],3,[\\\"10px\\\",\\\"10px\\\",true],[0],null,[],[],1,[],[],[]],[[null,1,null,[],null,null,\\\"DIV.container-lg\\\\u003eDIV.row\\\\u003eDIV.queryResponseContainer\\\\u003eDIV.row\\\\u003eDIV.queryResponseBody\\\"],1,[\\\"10px\\\",\\\"10px\\\",true],[3],null,[],[],1,[],[],[]],[[null,0,null,[],null,null,\\\"DIV#domainAvailabilityPowerBarContent\\\"],4,[\\\"20px\\\",\\\"

```json
{
    "risk_score": 1,
    "reasoning": "The script is a part of the Bootstrap library, a widely used and reputable front-end framework. It does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. The script primarily involves module exports and utility functions, which are typical for a library of this nature. There are no interactions with untrusted domains or suspicious behaviors present."
}

/*!
  * Bootstrap v5.3.3 (https://getbootstrap.com/)
  * Copyright 2011-2024 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)
  * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
  */
!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e(require("@popperjs/core")):"function"==typeof define&&define.amd?define(["@popperjs/core"],e):(t="undefined"!=typeof globalThis?globalThis:t||self).bootstrap=e(t.Popper)}(this,(function(t){"use strict";function e(t){const e=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(t)for(const i in t)if("default"!==i){const s=Object.getOwnPropertyDescriptor(t,i);Object.defineProperty(e,i,s.get?s:{enumerable:!0,get:()=>t[i]})}return e.default=t,Object.freeze(e)}const i=e(t),s=new Map,n={set(t,e,i){s.has(t)||s.set(t,new Map);const n=s.get(t);n.has(e)||0===n.size?n.set(e,i):console.error(`Bootstrap doesn't allow more than one instance per element. Bound instance: ${Array.from(n.keys())[0]}.`)},get:(t,e)=>s.has(t)&&s.get(t).get(e)||null,remove(t,e){if(!s.has(t))return;const i=s.get(t);i.delete(e),0===i.size&&s.delete(t)}},o="transitionend",r=t=>(t&&window.CSS&&window.CSS.escape&&(t=t.replace(/#([^\s"#']+)/g,((t,e)=>`#${CSS.escape(e)}`))),t),a=t=>{t.dispatchEvent(new Event(o))},l=t=>!(!t||"object"!=typeof t)&&(void 0!==t.jquery&&(t=t[0]),void 0!==t.nodeType),c=t=>l(t)?t.jquery?t[0]:t:"string"==typeof t&&t.length>0?document.querySelector(r(t)):null,h=t=>{if(!l(t)||0===t.getClientRects().length)return!1;const e="visible"===getComputedStyle(t).getPropertyValue("visibility"),i=t.closest("details:not([open])");if(!i)return e;if(i!==t){const e=t.closest("summary");if(e&&e.parentNode!==i)return!1;if(null===e)return!1}return e},d=t=>!t||t.nodeType!==Node.ELEMENT_NODE||!!t.classList.contains("disabled")||(void 0!==t.disabled?t.disabled:t.hasAttribute("disabled")&&"false"!==t.getAttribute("disabled")),u=t=>{if(!document.documentElement.attachShadow)return null;if("function"==typeof t.getRootNode){const e=t.getRootNode();return e instanceof ShadowRoot?e:null}return t instanceof ShadowRoot?t:t.parentNode?u(t.parentNode):null},_=()=>{},g=t=>{t.offsetHeight},f=()=>window.jQuery&&!document.body.hasAttribute("data-bs-no-jquery")?window.jQuery:null,m=[],p=()=>"rtl"===document.documentElement.dir,b=t=>{var e;e=()=>{const e=f();if(e){const i=t.NAME,s=e.fn[i];e.fn[i]=t.jQueryInterface,e.fn[i].Constructor=t,e.fn[i].noConflict=()=>(e.fn[i]=s,t.jQueryInterface)}},"loading"===document.readyState?(m.length||document.addEventListener("DOMContentLoaded",(()=>{for(const t of m)t()})),m.push(e)):e()},v=(t,e=[],i=t)=>"function"==typeof t?t(...e):i,y=(t,e,i=!0)=>{if(!i)return void v(t);const s=(t=>{if(!t)return 0;let{transitionDuration:e,transitionDelay:i}=window.getComputedStyle(t);const s=Number.parseFloat(e),n=Number.parseFloat(i);return s||n?(e=e.split(",")[0],i=i.split(",")[0],1e3*(Number.parseFloat(e)+Number.parseFloat(i))):0})(e)+5;let n=!1;const r=({target:i})=>{i===e&&(n=!0,e.removeEventListener(o,r),v(t))};e.addEventListener(o,r),setTimeout((()=>{n||a(e)}),s)},w=(t,e,i,s)=>{const n=t.length;let o=t.indexOf(e);return-1===o?!i&&s?t[n-1]:t[0]:(o+=i?1:-1,s&&(o=(o+n)%n),t[Math.max(0,Math.min(o,n-1))])},A=/[^.]*(?=\..*)\.|.*/,E=/\..*/,C=/::\d+$/,T={};let k=1;const $={mouseenter:"mouseover",mouseleave:"mouseout"},S=new Set(["click","dblclick","mouseup","mousedown","contextmenu","mousewheel","DOMMouseScroll","mouseover","mouseout","mousemove","selectstart","selectend","keydown","keypress","keyup","orientationchange","touchstart","touchmove","touchend","touchcancel","pointerdown","pointermove","pointerup","pointerleave","pointercancel","gesturestart","gesturechange","gestureend","focus","blur","change","reset","select","submit","focusin","focusout","load","unload","beforeunload","resize","move","DOMContentLoaded","readystatechange","error","abort","scroll"]);function L(t,e){return e&&`${e}::${k++}`||t.uidEvent||k++}function O(t){const e=L(t);ret

```json
{
    "risk_score": 9,
    "reasoning": "The script uses dynamic code execution through eval and obfuscated code, which are high-risk indicators. Additionally, the script is heavily obfuscated, making it difficult to determine its true intent, which suggests potential malicious behavior."
}

```json
{
    "contains_trigger_text": false,
    "trigger_text": "unknown",
    "prominent_button_name": "unknown",
    "text_input_field_labels": "unknown",
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false,
    "contains_security_review": false,
    "page_classification": "unknown"
}

```json
{
  "brands": [
    "whois"
  ]
}