What is this redirect? Password stealer?

Viruses and worms
1

Going nowhere, as we are to believe here: https://urlquery.net/report/42400e16-41ae-4a56-a922-832cec3b1beb
or going here: htxp://leafcat.net/
GoogleSafe:
OK Load:
487ms Server: 64.90.42.246
Apache ASN: 26347 United-States
New Dream Network, LLC Reverse DNS:
on -apache2-moon.monmouth.dreamhost.com

Google Safe Browse: OK
Spamhaus Check: OK
Compromised Hosts: OK
Dshield Blocklist: OK
Shadowserver C&C: OK

In malzilla I get

We detected a sure PHISH here: https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=leafcat.net%2Fwp-content%2Fthemes%2F2019%2F%3Femail%3D&ref_sel=GSP2&ua_sel=ff&fs=1

as

The location line in the header above has redirected the request to: -http://leafcat.net/wp-content/themes/2019/?email=
Note: Content displayed is from the redirect location, the URL o9geu1s04iw4cvzdm8usb54i.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
Note: Google has been flagging sites that collect user information (passwords) over HTTP.

polonus (volunteer website security analyst and website error-hunter)