Windows Analysis Report
https://cine-support-service-6p9n.vercel.app/verset.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true,
    "reasoning": "This is a legitimate Vercel deployment URL. Vercel is a known platform for hosting web applications. The subdomain 'cine-support-service-6p9n' is automatically generated by Vercel for project deployment. While the subdomain is relatively long, this is normal for Vercel's naming convention."
}

URL: https://cine-support-service-6p9n.vercel.app

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be a simple function to detect if the user is accessing the website from a mobile device. It uses a regular expression to check the user agent string and sets a boolean flag accordingly. This is a common and legitimate practice for providing a better user experience on mobile devices. The script does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or obfuscation, and is likely used for benign purposes."
}

        window.mobileCheck = function () {
            let check = false;
            (function (a) {
                if (/(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|mobile.+firefox|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows ce|xda|xiino/i
                    .test(a) ||
                    /1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-/i
                        .test(a.substr(0, 4))) check = true;
            })(navigator.userAgent || navigator.vendor || window.opera);

            return check;
        };
    

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet exhibits some potentially concerning behaviors, but they are not inherently malicious. The code redirects the user to a different page after a 4-second delay, disables the F12 key (which is often used to access browser developer tools), and prevents the context menu and certain keyboard shortcuts (Ctrl+Shift, Ctrl+U, Ctrl+I). These actions could be considered aggressive or restrictive, but they do not directly indicate data exfiltration, dynamic code execution, or other high-risk activities. The overall behavior suggests an attempt to limit user interaction with the page, which may be a legitimate security measure or a poor user experience design choice. Without further context, this script is assessed as a low-to-medium risk."
}

        setTimeout(function () {
            window.location.href = "intest.html";
        }, 4000);
        document.addEventListener("keydown", function (event) {
            if (event.key === "F12") {
                event.preventDefault(); 
            }
        });
        document.addEventListener("contextmenu", function (event) {
            event.preventDefault();
        });

        document.addEventListener("keydown", function (event) {
            if (event.ctrlKey && (event.shiftKey || event.key === "U" || event.key === "I")) {
                event.preventDefault();
            }
        });
    

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of the Bootstrap library, which is a popular front-end framework for building responsive and mobile-first websites. The code does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or obfuscated code/URLs. The behaviors observed, such as DOM manipulation and use of legacy APIs, are common in modern web development and do not pose significant security risks. Additionally, the code is likely used for legitimate purposes, such as providing a consistent user interface and enhancing the user experience. Therefore, the overall risk score is low."
}

        ! function (t, e) {
            "object" == typeof exports && "undefined" != typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define(e) : (t = "undefined" != typeof globalThis ? globalThis : t || self).bootstrap = e()
        }(this, (function () {
            "use strict";
            const t = {
                find: (t, e = document.documentElement) => [].concat(...Element.prototype.querySelectorAll.call(e, t)),
                findOne: (t, e = document.documentElement) => Element.prototype.querySelector.call(e, t),
                children: (t, e) => [].concat(...t.children).filter(t => t.matches(e)),
                parents(t, e) {
                    const i = [];
                    let n = t.parentNode;
                    for (; n && n.nodeType === Node.ELEMENT_NODE && 3 !== n.nodeType;) n.matches(e) && i.push(n), n = n.parentNode;
                    return i
                },
                prev(t, e) {
                    let i = t.previousElementSibling;
                    for (; i;) {
                        if (i.matches(e)) return [i];
                        i = i.previousElementSibling
                    }
                    return []
                },
                next(t, e) {
                    let i = t.nextElementSibling;
                    for (; i;) {
                        if (i.matches(e)) return [i];
                        i = i.nextElementSibling
                    }
                    return []
                }
            },
                e = t => {
                    do {
                        t += Math.floor(1e6 * Math.random())
                    } while (document.getElementById(t));
                    return t
                },
                i = t => {
                    let e = t.getAttribute("data-bs-target");
                    if (!e || "#" === e) {
                        let i = t.getAttribute("href");
                        if (!i || !i.includes("#") && !i.startsWith(".")) return null;
                        i.includes("#") && !i.startsWith("#") && (i = "#" + i.split("#")[1]), e = i && "#" !== i ? i.trim() : null
                    }
                    return e
                },
                n = t => {
                    const e = i(t);
                    return e && document.querySelector(e) ? e : null
                },
                s = t => {
                    const e = i(t);
                    return e ? document.querySelector(e) : null
                },
                o = t => {
                    t.dispatchEvent(new Event("transitionend"))
                },
                r = t => !(!t || "object" != typeof t) && (void 0 !== t.jquery && (t = t[0]), void 0 !== t.nodeType),
                a = e => r(e) ? e.jquery ? e[0] : e : "string" == typeof e && e.length > 0 ? t.findOne(e) : null,
                l = (t, e, i) => {
                    Object.keys(i).forEach(n => {
                        const s = i[n],
                            o = e[n],
                            a = o && r(o) ? "element" : null == (l = o) ? "" + l : {}.toString.call(l).match(/\s([a-z]+)/i)[1].toLowerCase();
                        var l;
                        if (!new RegExp(s).test(a)) throw new TypeError(`${t.toUpperCase()}: Option "${n}" provided type "${a}" but expected type "${s}".`)
                    })
                },
                c = t => !(!r(t) || 0 === t.getClientRects().length) && "visible" === getComputedStyle(t).getPropertyValue("visibility"),
                h = t => !t || t.nodeType !== Node.ELEMENT_NODE || !!t.classList.contains("disabled") || (void 0 !== t.disabled ? t.disabled : t.hasAttribute("disabled") && "false" !== t.getAttribute("disabled")),
                d = t => {
                    if (!document.documentElement.attachShadow) return null;
                    if ("function" == typeof t.getRootNode) {
                        const e = t.getRootNode();
                        retur

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Facebook",
    "Facebook Messenger",
    "Instagram",
    "WhatsApp"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "We have suspend your page",
  "prominent_button_name": "Request Review",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Meta"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Appeal",
"prominent_button_name": "unknown",
"text_input_field_labels": [
"Full Name",
"Personal Email",
"Business Email",
"Mobile phone number",
"Facebook Page Name"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Meta"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

The provided image appears to be a screenshot of the Meta Privacy Center webpage, which does not contain any of the trigger text, prominent buttons, input fields, PDF icons, CAPTCHAs, urgent text, QR codes, Chinese text, or fake security alerts that the analysis is looking for. The page appears to be a standard informational page about Meta's terms of use and privacy policy, without any clear indications of a potential landing page.

{
  "brands": [
    "Meta"
  ]
}

```json{  "legit_domain": "meta.com",  "classification": "wellknown",  "reasons": [    "The brand 'Meta' is well-known and is associated with the legitimate domain 'meta.com'.",    "The URL 'cine-support-service-6p9n.vercel.app' does not match the legitimate domain for Meta.",    "The URL contains multiple hyphens and a subdomain structure that is not typical for a well-known brand like Meta.",    "The use of a Vercel app subdomain suggests it is hosted on a platform that allows user-generated content, which is often used for phishing.",    "The input fields requested (Full Name, Personal Email, Business Email, Mobile phone number, Facebook Page Name) are sensitive and could be used for phishing purposes."  ],  "riskscore": 9}
Google indexed: False