Windows Analysis Report
https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false,
    "reasoning": "This appears to be a legitimate subdomain of Kroll (formerly known as Duff & Phelps), a professional services firm. The domain structure is normal, using a corporate subdomain pattern (restructuring.rh-kroll.com) which is common for business services."
}

URL: https://restructuring.rh-kroll.com

{
    "risk_score": 5,
    "reasoning": "The script demonstrates moderate-risk behavior by dynamically executing code and manipulating the DOM aggressively. However, it appears to be part of a legitimate form submission process, so the overall risk is medium."
}

$(document).ready(()=>{
  $("#doExecute").click(function(){
    if($("#email").val() != "")
  {
    $(this).attr("disabled", "true")
    $("#toast").fadeIn();
    let v = 1;
    let x = setInterval(() => {
      if(v == 100) $("form").submit()
      v++
      $("#bg").css("transform", `translateX(${v}%)`)
    }, 20);
  }

  })
})

{
  "contains_trigger_text": true,
  "trigger_text": "Initiate Account Owner Authentication",
  "prominent_button_name": "Log In",
  "text_input_field_labels": [
    "Email"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "FTX"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "Initiate Account Owner Authentication",
  "prominent_button_name": "Log In",
  "text_input_field_labels": [
    "Email"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "FTX"
  ]
}

```json{  "legit_domain": "ftx.com",  "classification": "wellknown",  "reasons": [    "The brand 'FTX' is a well-known cryptocurrency exchange platform.",    "The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'.",    "The domain 'rh-kroll.com' does not appear to be directly associated with FTX.",    "The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX.",    "The use of a different domain name suggests potential phishing, especially when combined with a well-known brand like FTX."  ],  "riskscore": 8}
Google indexed: False

{
  "contains_trigger_text": true,
  "trigger_text": "Initiate Account Owner Authentication",
  "prominent_button_name": "Log In",
  "text_input_field_labels": [
    "Email"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "FTX"
  ]
}

```json{  "legit_domain": "ftx.com",  "classification": "wellknown",  "reasons": [    "The brand 'FTX' is a well-known cryptocurrency exchange platform.",    "The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'.",    "The domain 'rh-kroll.com' does not appear to be directly associated with FTX.",    "The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX.",    "The URL structure suggests a potential phishing attempt as it does not align with the known domain of the brand."  ],  "riskscore": 8}
Google indexed: False

{
"contains_trigger_text": true,
"trigger_text": "Initiate Account Owner Authentication",
"prominent_button_name": "Log In",
"text_input_field_labels": ["Email"],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "FTX"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Initiate Account Owner Authentication",
"prominent_button_name": "Log In",
"text_input_field_labels": ["Email"],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

```json{  "legit_domain": "ftx.com",  "classification": "wellknown",  "reasons": [    "The brand 'FTX' is a well-known cryptocurrency exchange platform.",    "The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'.",    "The domain 'rh-kroll.com' does not appear to be directly associated with FTX.",    "The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX.",    "The URL structure includes multiple segments and does not directly reflect the brand name, which is a common phishing tactic."  ],  "riskscore": 8}
Google indexed: False

{
  "brands": [
    "FTX"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "Initiate Account Owner Authentication",
  "prominent_button_name": "Log In",
  "text_input_field_labels": [
    "Email"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

```json{  "legit_domain": "ftx.com",  "classification": "wellknown",  "reasons": [    "The brand 'FTX' is a well-known cryptocurrency exchange platform.",    "The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'.",    "The domain 'rh-kroll.com' does not appear to be directly associated with FTX.",    "The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX.",    "The URL structure includes multiple segments and does not clearly indicate a direct association with FTX.",    "The use of a different domain name could be an attempt to impersonate or mislead users into thinking it is associated with FTX."  ],  "riskscore": 8}
Google indexed: False

{
  "brands": [
    "FTX"
  ]
}

```json{  "legit_domain": "ftx.com",  "classification": "wellknown",  "reasons": [    "The brand 'FTX' is a well-known cryptocurrency exchange platform.",    "The legitimate domain for FTX is 'ftx.com'.",    "The provided URL 'restructuring.rh-kroll.com' does not match the legitimate domain for FTX.",    "The URL contains multiple subdomains and does not directly relate to FTX, which is suspicious.",    "The domain 'rh-kroll.com' does not have any known association with FTX.",    "The presence of an email input field could be used to harvest credentials, which is a common phishing tactic."  ],  "riskscore": 8}
Google indexed: False

{
  "contains_trigger_text": true,
  "trigger_text": "Initiate Account Owner Authentication",
  "prominent_button_name": "Log In",
  "text_input_field_labels": [
    "Email"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "FTX"
  ]
}