Windows Analysis Report
https://u46572644.ct.sendgrid.net/ss/c/u001.7BTxB98bYe88lmQCKsz4HIUFNbf01nIu4ZcW2aaj0_pd-l6kidrn8FZ1e4mQuSvQbCCTviI-SCCVd1ROqf4SHYEvPXndfDx61afLByHPSZcFQrBthkk5rMcJkTcWcsh2Y-04Q7_JEfWcTBXPxGiRwnM6zn7lKLdtrKqrgIvHZ7-ZHGnbTg0RqOtmbRRIr4nTaTDT-FfA0-iHw8aKci1JA5ozJdj9jMCTsyvfXnsSI2VmtCNQJeZkVL3XN7Fq7YIc

{
    "risk_score": 4,
    "reasoning": "The script appears to be a subscription management interface that retrieves and displays content based on query parameters. While it does not exhibit any high-risk behaviors, it has some moderate-risk indicators, such as external data transmission and fallback domains. Additionally, the script uses dynamic content rendering, which could potentially be abused. Overall, the script requires further review due to its aggressive DOM manipulation and potential for misuse, but it does not appear to be inherently malicious."
}

			const search = new URLSearchParams(window?.location?.search);
			const getContent = () => {
				const c = search.get("content");
				const content = c ? c : "";
				return content;
			};
			const getLange = () => {
				const c = search.get("lange");
				const lange = c ? c : "";
				return lange;
			};
			const start = () => {
				document.title = "Subscribe";
				document
					.querySelector('meta[property="og:title"]')
					?.setAttribute("content", "Subscribe");

				subscribeInterface({ content: getContent() })
					.then((res) => {
						const companyInfo = res?.data?.data;
						const changeInfo = (companyInfo) => {
							if (
								companyInfo &&
								companyInfo.logo &&
								companyInfo.logo.length > 0
							) {
								document.getElementById("img").src = companyInfo.logo;
							}
							if (
								res?.data?.data?.companyId == "173" &&
								location?.pathname === "/resubscribe"
							) {
								document.getElementById("text").innerHTML =
									"";
							} else {
								let lange = getLange()
								let resubTest = ''
								let ubTest = ''
								if(lange === 'US'){
									resubTest = `You've successfully been resubscribed.`
									ubTest = `You've successfully been subscribed.`
								}
								if(lange === 'KR'){
									resubTest = ` .`
									ubTest = `  `
								}
								if(lange === 'DK'){
									resubTest = `Du er blevet tilmeldt igen`
									ubTest = `Du er blevet tilmeldt.`
								}
								if(lange === 'SE'){
									resubTest = `Du har prenumererats p nytt.`
									ubTest = `Du har framgngsrikt prenumererat.`
								}
								if(!lange){
									resubTest = `You've successfully been resubscribed.`
									ubTest = `You've successfully been subscribed.`
								}
								document.getElementById("text").innerHTML =
									location.pathname === "/resubscribe"
										? resubTest
										: ubTest;
							}
						};

						if (window?.document?.body) {
							changeInfo(companyInfo);
						} else {
							let hasListen = false;
							window?.document?.addEventListener(
								"readystatechange",
								(event) => {
									if (
										event.target.readyState === "interactive" ||
										event.target.readyState === "complete"
									) {
										if (!hasListen) {
											hasListen = true;
											changeInfo(companyInfo);
										}
									}
								}
							);
						}
					})
					.catch((res) => {});
			};
			start();
		

{
    "risk_score": 4,
    "reasoning": "The script has some moderate-risk indicators, such as external data transmission and aggressive DOM manipulation, but it also has legitimate use cases like analytics and unsubscribe functionality. The script requires further review due to the unclear or potentially overly aggressive behavior."
}

			const start = () => {
				logUnsubscribeInfo({ type: "Unsubscribe-PV" });
				document.title = "Unsubscribe";
				document
					.querySelector('meta[property="og:title"]')
					?.setAttribute("content", "Unsubscribe");
			};
			start();

			const search = new URLSearchParams(window?.location?.search);
			const getContent = () => {
				const c = search.get("content");
				const content = c ? c : "";
				return content;
			};

			let companySite = "";
			const hasHttpRegex = (str) => {
				// const reg = new RegExp("http://");
				// return reg.test(str);
				return /https?:\/\//.test(str);
			};
			const browseWebsite = () => {
				logUnsubscribeInfo({ type: "Unsubscribe-Website" });
				console.log(companySite,'site--------------site')
				const url = hasHttpRegex(companySite)
					? companySite
					: "http://" + companySite;
				console.log(url,'url-------url')
				window.open(url);
			};

			let copywriting = {
				Copywriting1: "You've Been Unsubscribed.",
				Copywriting2:
					"If you'd like to re-subscribe to this list, use the link below.",
				Copywriting3: "re-subscribe",
				loadingText:'Unsubscribe'
			};
			let unsubscribePageLanguage

			const domain = window.location.origin
				? window.location.origin
				: window.location.protocol + "//" + window.location.hostname;

			const UnsubscribeOk = () => {
				logUnsubscribeInfo({ type: "Unsubscribe-OK" });
				document.getElementById("img").src = "./img/logo.svg";
				document.getElementById("ok-before").style.display = 'none';
				document.getElementById("ok-ing").style.display = 'inline-block';
				document.getElementById("loadText").innerHTML = copywriting.loadingText
				document.getElementById("ok").style.borderColor = '#B9B2FF';
				unsubscribeInterface({ content: getContent() })
					.then((res) => {
						if (res?.data?.data?.companyId == "173") {
							copywriting.Copywriting1 =
								"";
							copywriting.Copywriting2 =
								"";
							copywriting.Copywriting3 = "";
						} 
						// else {
						// 	copywriting.Copywriting1 = "You've Been Unsubscribed.";
						// 	copywriting.Copywriting2 =
						// 		"If you'd like to re-subscribe to this list, use the link below.";
						// 	copywriting.Copywriting3 = "re-subscribe";
						// }
						document.getElementById("tip").style.display = "none";
						document.getElementById("ok").style.display = "none";
						document.getElementById("no").style.display = "none";
						document.getElementById("browse").style.display = "none";

						const writing1 = document?.getElementById("writing1");
						const writing2 = document?.getElementById("writing2");
						const writing3 = document?.getElementById("writing3");
						document.getElementById("writing1Text").innerHTML =
							copywriting.Copywriting1;
						writing2.innerHTML = copywriting.Copywriting2;
						document.getElementById("writing3Text").innerHTML =
							copywriting.Copywriting3;
						writing1.style.display = "block";
						writing2.style.display = "block";
						writing3.style.display = "block";
					})
					.catch((res) => {
						document.getElementById("ok-before").style.display = 'inline-block';
						document.getElementById("ok-ing").style.display = 'none';
						document.getElementById("ok").style.borderColor = 'rgb(81, 62, 255)';
					});
			};

			const UnsubscribeNo = () => {
				logUnsubscribeInfo({ type: "Unsubscribe-NO" });

				document.getElementById("ok").style.display = "none";
				document.getElementById("no").style.display = "none";
				if(unsubscribePageLanguage === 'US'){
					document.getElementById("tip").innerHTML = "Thank you for your trust, we will provide you with better service.";
					document.getElementById("browseId").innerHTML = "browse the website";
				}
				if(unsubscribePageLanguage === 'KR'){
					document.getElementById("tip").innerHTML = "  ,     .";
					document.getElementById("browseId").innerHTML = "  ";

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript code has a moderate risk level. It includes some behaviors that could be concerning, such as sending user data to external servers and using the `FormData` object to transmit data. However, the code also has some legitimate use cases, such as logging errors and performance metrics. The overall risk is mitigated by the fact that the code appears to be part of a larger application and the data being sent is not highly sensitive. Further review may be necessary to fully understand the context and intent of the code."
}

/**
 * 
 * @param params 
 */
const logToServer = (params) => {
  let data = Object.assign({date:Date.now()}, params);
  // 
  data = Object.assign(data, readGlobalParams());
  // 
  data = Object.assign(data, readBrowserParams());
  // 
  const fd = new FormData(); 
  if (data['companyId']) {
    fd.append('companyId', data['companyId']);
    delete data.companyId;
  }
  if (data['site']) {
    fd.append('site', data['site']);
    delete data.site;
  }
  if (data['ru']) {
    fd.append('requestUrl', data['ru']);
    delete data.ru;
  }
  if (data['em']) {
    fd.append('reason', data['em']);
    delete data.em;
  }
  if (data['type']) {
    fd.append('type', data['type']);
  }
  if (data['time']) {
    fd.append('time', `${Math.ceil(Number(data['time']))}`);
    delete data.time;
  }
  if (data['cost']) {
    fd.append('cost', data['cost']);
    delete data.cost;
  }
  fd.append('param', JSON.stringify(data));
  
  // 
  if (navigator?.sendBeacon) {
    navigator.sendBeacon('https://59b517704ce43f0f.cartx.cloud/monitor/request', fd);
  } else {
    const xhr = new XMLHttpRequest();
    xhr.open("POST", "https://59b517704ce43f0f.cartx.cloud/monitor/request");
    xhr.send(fd);
  }
}

/**
 * 
 * @returns 
 */
const readGlobalParams = () => {
  const companyInfo = localStorage.getItem('companyInfo');
  return {
    companyId: companyInfo ? (JSON.parse(companyInfo)?.id ?? '') : '', // id
    companyName: localStorage.getItem('companyName') ?? '', // 
    displayInfo: localStorage.getItem('displayInfo') ?? '', // 
  }
}

/**
 * 
 * @returns 
 */
const readBrowserParams = () => {
  return {
    site:window.location.href,
    ua:window.navigator?.userAgent,
  }
}

/**
 * js
 * @param error js
 */
var LogJsError = (error) => {
  // 
  let data = {
    type: 'JSERROR',
    error: null,
  }
  if (typeof error != 'object') {
    data.error = `${error}`;
  } else {
    data = Object.assign({type:'JSERROR'}, error);
  }
  // 
  logToServer(data);
}

/**
 * 500
 * @param error url
 */
var Log500Error = (error) => {
  // 
  let data = {
    type: '500ERROR',
    error: null,
  }
  if (typeof error != 'object') {
    data.error = `${error}`;
  } else {
    data = Object.assign({type:'500ERROR'}, error);
  }
  // 
  logToServer(data);
}

var LogTimeoutError = (error) => {
  // 
  let data = {
    type: 'TIMEOUTERROR',
    error: null,
  }
  if (typeof error != 'object') {
    data.error = `${error}`;
  } else {
    data = Object.assign({type:'TIMEOUTERROR'}, error);
  }
  // 
  logToServer(data);
}

/**
 * 
 */
var LogRequestInfo = (info) => {
  // 
  let data = {
    type: 'requestDuration',
    em: 'requestDuration',
    error: null,
  }
  if (typeof info != 'object') {
    data.error = `${info}`;
  } else {
    data = Object.assign({type:'requestDuration', em: 'requestDuration',}, info);
  }
  // 
  logToServer(data);
}

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a configuration for an Axios HTTP client, which is a common and legitimate practice. It sets up a base URL, timeout, and request/response interceptors to handle logging and error handling. While the code includes some logging and error reporting functionality, it does not exhibit any high-risk indicators like dynamic code execution, data exfiltration, or obfuscation. The overall behavior seems to be focused on improving the reliability and observability of the HTTP requests, which is a common and expected practice in web development."
}

var service2 = axios.create({
  baseURL: 'https://us-service.cartsee-from.cartx.cloud',
  // baseURL:'https://test-service.cartsee-form-us.cartx.cloud',
  timeout: 120000,
});

service2.interceptors.request.use(
  (config) => {
    config.cartxTime = performance?.now() || Date.now();
    return config;
  },
  (error) => {
    return Promise.reject(error);
  },
);

service2.interceptors.response.use(
  (response) => {
    const config = response?.config;
    if (config?.cartxTime) {
      const t = performance?.now() || Date.now();
      const duration = t - config?.cartxTime;
      LogRequestInfo({
        ru:response.config?.url||(response.request?.custom?.url||''), // request url
        rp:response.config?.data||(response.request?.custom?.options?.body||''), // request params
        ru1:response.request?.responseURL||'', // response url
        m:response.config?.method||'POST', // method
        em:response.status||'', // error message
        er:{code:response?.data?.code,message:response?.data?.message}||'', // error response
        time: duration,
      });
    }
    if (!response.data || response.data.code !== 0) {
      return Promise.reject(new Error(response && response.data && response.data.message|| 'Error'));
    }
    return response;
  },
  (error) => {
    if (error?.config?.cartxTime) {
      const t = performance?.now() || Date.now();
      const duration = t - error?.config?.cartxTime;
      LogRequestInfo({
        ru:error.config?.url||(error.request?.custom?.url||''), // request url
        rp:error.config?.data||(error.request?.custom?.options?.body||''), // request params
        ru1:error.request?.responseURL||'', // response url
        m:error.config?.method||'POST', // method
        em:error.message||(error.status||error.status?.status), // error message
        er:error.response?.data||'', // error response
        time: duration,
      });
    }

    if (error.request && error.request.readyState == 4 && error.request.status >= 500) {
      Log500Error({
        ru:error.config?.url||(error.request?.custom?.url||''), // request url
        rp:error.config?.data||(error.request?.custom?.options?.body||''), // request params
        ru1:error.request?.responseURL||'', // response url
        m:error.config?.method||'POST', // method
        em:error.message||(error.status||'500+'), // error message
        er:error.response?.data||'', // error response
      });
    }


    if (error?.message?.includes('timeout')) {
      LogTimeoutError({
        ru:error.config?.url||(error.request?.custom?.url||''), // request url
        rp:error.config?.data||(error.request?.custom?.options?.body||''), // request params
        ru1:error.request?.responseURL||'', // response url
        m:error.config?.method||'POST', // method
        em:error?.message||(error?.status||error.request?.status||'504'), // error message
        er:error.response?.data||'', // error response
      });
    }
    return Promise.reject(error);
  },
);

window.service2 = service2;

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a logging/analytics utility that collects and sends data to a server. While it uses some legacy practices like `XDomainRequest`, the overall behavior is consistent with typical analytics functionality and does not demonstrate any high-risk indicators. The script interacts with a known domain (`cartsee-from.cartx.cloud`) and the data being sent does not appear to contain sensitive information. Therefore, this script is assessed as low risk."
}

			const logToServer1 = (params) => {
				let data = Object.assign({ date: Date.now() }, params);
				// 
				data = Object.assign(data, readGlobalParams1());
				// 
				data = Object.assign(data, readBrowserParams1());
				// 
				const fd = new FormData();
				if (data["companyId"]) {
					fd.append("companyId", data["companyId"]);
					delete data.companyId;
				}
				if (data["site"]) {
					fd.append("site", data["site"]);
					delete data.site;
				}
				if (data["ru"]) {
					fd.append("requestUrl", data["ru"]);
					delete data.ru;
				}
				if (data["em"]) {
					fd.append("reason", data["em"]);
					delete data.em;
				}
				if (data["type"]) {
					fd.append("type", data["type"]);
				}
				if (data["time"]) {
					fd.append("time", `${Math.ceil(Number(data["time"]))}`);
					delete data.time;
				}
				if (data["cost"]) {
					fd.append("cost", data["cost"]);
					delete data.cost;
				}
				fd.append("param", JSON.stringify(data));

				if (navigator?.sendBeacon) {
					navigator.sendBeacon(
						"https://us-service.cartsee-from.cartx.cloud/cartsee/form/monitor/request",
						fd
					);
				} else {
					const xhr = new XMLHttpRequest();
					xhr.open(
						"POST",
						"https://us-service.cartsee-from.cartx.cloud/cartsee/form/monitor/request"
					);
					xhr.send(fd);
				}
			};

			/**
			 * 
			 * @returns 
			 */
			const readGlobalParams1 = () => {
				const companyInfo = localStorage.getItem("companyInfo");
				return {
					companyId: companyInfo ? JSON.parse(companyInfo)?.id ?? "" : "", // id
					companyName: localStorage.getItem("companyName") ?? "", // 
					displayInfo: localStorage.getItem("displayInfo") ?? "", // 
				};
			};

			/**
			 * 
			 * @returns 
			 */
			const readBrowserParams1 = () => {
				return {
					site: window.location.href,
					ua: window.navigator?.userAgent,
				};
			};

			/**
			 * 
			 */
			var logUnsubscribeInfo = (info) => {
				// 
				let data = {
					type: "PV",
				};
				if (typeof info != "object") {
					data.error = `${info}`;
				} else {
					data = Object.assign({ type: "PV" }, info);
				}
				// 
				logToServer1(data);
			};
		

{
    "risk_score": 5,
    "reasoning": "The provided JavaScript snippet has a mix of moderate-risk and low-risk indicators. It retrieves content and language parameters from the URL, updates the document title and meta tags, and then calls a 'subscribeInterface' function. While the code does not exhibit any high-risk behaviors, it has some potentially concerning aspects, such as the use of dynamic content retrieval and the possibility of sending user data to an external service. Further review of the 'subscribeInterface' function and the overall context of the application would be necessary to determine the full risk profile."
}

			const search = new URLSearchParams(window?.location?.search);
			const getContent = () => {
				const c = search.get("content");
				const content = c ? c : "";
				return content;
			};
			const getLange = () => {
				const c = search.get("lange");
				const lange = c ? c : "";
				return lange;
			};
			const start = () => {
				document.title = "Subscribe";
				document
					.querySelector('meta[property="og:title"]')
					?.setAttribute("content", "Subscribe");

				subscribeInterface({ content: getContent() })
					.then((res) => {
						const companyInfo = res?.data?.data;
						const changeInfo = (companyInfo) => {
							if (
								companyInfo &&
								companyInfo.logo &&
								companyInfo.logo.length > 0
							) {
								document.getElementById("img").src = companyInfo.logo;
							}
							if (
								res?.data?.data?.companyId == "173" &&
								location?.pathname === "/resubscribe"
							) {
								document.getElementById("text").innerHTML =
									"";
							} else {
								let lange = getLange()
								let resubTest = ''
								let ubTest = ''
								if(lange === 'US'){
									resubTest = `You've successfully been resubscribed.`
									ubTest = `You've successfully been subscribed.`
								}
								if(lange === 'KR'){
									resubTest = ` 

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false,
    "reasoning": "This appears to be a straightforward e-commerce domain with a conventional .com TLD. No suspicious elements are detected in the URL structure."
}

URL: https://cartseefashion.com

{
  "contains_trigger_text": true,
  "trigger_text": "Are you sure you want to unsubscribe?",
  "prominent_button_name": "Yes, unsubscribe",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

```json
{
    "risk_score": 1,
    "reasoning": "The script appears to be a minified version of a library (likely Axios) with no high-risk behaviors such as dynamic code execution or data exfiltration. It does not interact with external domains or exhibit obfuscation indicative of malicious intent. The use of modern JavaScript practices suggests a low risk."
}

!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).axios=t()}(this,(function(){"use strict";function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function t(t){for(var n=1;n<arguments.length;n++){var r=null!=arguments[n]?arguments[n]:{};n%2?e(Object(r),!0).forEach((function(e){a(t,e,r[e])})):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(r)):e(Object(r)).forEach((function(e){Object.defineProperty(t,e,Object.getOwnPropertyDescriptor(r,e))}))}return t}function n(e){return n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},n(e)}function r(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function o(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,r.key,r)}}function i(e,t,n){return t&&o(e.prototype,t),n&&o(e,n),Object.defineProperty(e,"prototype",{writable:!1}),e}function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function s(e,t){return c(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],a=!0,s=!1;try{for(n=n.call(e);!(a=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);a=!0);}catch(e){s=!0,o=e}finally{try{a||null==n.return||n.return()}finally{if(s)throw o}}return i}(e,t)||l(e,t)||p()}function u(e){return function(e){if(Array.isArray(e))return d(e)}(e)||f(e)||l(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function c(e){if(Array.isArray(e))return e}function f(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}function l(e,t){if(e){if("string"==typeof e)return d(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?d(e,t):void 0}}function d(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function p(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function h(e,t){return function(){return e.apply(t,arguments)}}var m,y=Object.prototype.toString,v=Object.getPrototypeOf,b=(m=Object.create(null),function(e){var t=y.call(e);return m[t]||(m[t]=t.slice(8,-1).toLowerCase())}),g=function(e){return e=e.toLowerCase(),function(t){return b(t)===e}},w=function(e){return function(t){return n(t)===e}},O=Array.isArray,E=w("undefined");var S=g("ArrayBuffer");var R=w("string"),A=w("function"),j=w("number"),T=function(e){return null!==e&&"object"===n(e)},P=function(e){if("object"!==b(e))return!1;var t=v(e);return!(null!==t&&t!==Object.prototype&&null!==Object.getPrototypeOf(t)||Symbol.toStringTag in e||Symbol.iterator in e)},N=g("Date"),x=g("File"),C=g("Blob"),k=g("FileList"),_=g("URLSearchParams");function F(e,t){var r,o,i=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{},a=i.allOwnKeys,s=void 0!==a&&a;if(null!=e)if("object"!==n(e)&&(e=[e]),O(e))for(r=0,o=e.length;r<o;r++)t.call(null,e[r],r,e);else{var u,c=s?Object.getOwnPropertyNames(e):Object.keys(e),f=c.length;for(r=0;r<f;r++)u=c[r],t.call(null,e[u],u,e)}}function U(e,t){t=t.toLowerCase();for(var n,r=Object.keys(e),o=r.length;o

{
  "brands": "unknown"
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}