twcvhjlksdmx@1.0.0

Analysis

A static HTML page impersonating Cloudflare's "Performing security verification" Turnstile bot-check. The page's JavaScript is obfuscated with a string-array decoder and anti-debug checks; when the Turnstile challenge completes it copies the current page's query-string parameters into an obfuscated destination URL and redirects the browser to it via window.location.href. This is a phishing redirect that forwards the victim's URL parameters to an attacker-controlled destination. The destination URL is obfuscated within the page and not recoverable from static inspection.