Windows Analysis Report
https://registry.paratext.org

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://registry.paratext.org

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a configuration object for a Meteor.js application. It contains information about the Meteor release version, Git commit hash, environment variables, and various application settings. While the snippet includes some potentially sensitive information like the ROOT_URL and Kadira configuration, it does not exhibit any high-risk behaviors like dynamic code execution, data exfiltration, or suspicious redirects. The script seems to be part of a legitimate Meteor.js application and does not pose a significant security risk."
}

__meteor_runtime_config__ = JSON.parse(decodeURIComponent("%7B%22meteorRelease%22%3A%22METEOR%402.5.8%22%2C%22gitCommitHash%22%3A%2202f278a537c61776195bb54f531bac928cba74da%22%2C%22meteorEnv%22%3A%7B%22NODE_ENV%22%3A%22production%22%2C%22TEST_METADATA%22%3A%22%7B%7D%22%7D%2C%22PUBLIC_SETTINGS%22%3A%7B%7D%2C%22ROOT_URL%22%3A%22https%3A%2F%2Fregistry.paratext.org%22%2C%22ROOT_URL_PATH_PREFIX%22%3A%22%22%2C%22reactFastRefreshEnabled%22%3Atrue%2C%22autoupdate%22%3A%7B%22versions%22%3A%7B%22web.browser%22%3A%7B%22version%22%3A%221ef8af81ff2af469f2cc60fb144bdb0857168003%22%2C%22versionRefreshable%22%3A%22ea578a6c19dd46d09df9c10937454e8943cada9e%22%2C%22versionNonRefreshable%22%3A%225f385c490772c711a6769b48a1cd6c1c0edafb69%22%2C%22versionReplaceable%22%3A%221952018619999f014765d73c14db1f446971e849%22%7D%2C%22web.browser.legacy%22%3A%7B%22version%22%3A%2254a7b6deb049b06b5f3b22072af929a535280d4e%22%2C%22versionRefreshable%22%3A%22ea578a6c19dd46d09df9c10937454e8943cada9e%22%2C%22versionNonRefreshable%22%3A%2265e6f424094e747d85b1b6ef8150701246058e0f%22%2C%22versionReplaceable%22%3A%221952018619999f014765d73c14db1f446971e849%22%7D%7D%2C%22autoupdateVersion%22%3Anull%2C%22autoupdateVersionRefreshable%22%3Anull%2C%22autoupdateVersionCordova%22%3Anull%2C%22appId%22%3A%22g4hn9u1tq6ega17bpzw3%22%7D%2C%22appId%22%3A%22g4hn9u1tq6ega17bpzw3%22%2C%22accountsConfigCalled%22%3Atrue%2C%22kadira%22%3A%7B%22appId%22%3A%2236kux7GwpFsnA6bjx%22%2C%22endpoint%22%3A%22https%3A%2F%2Fengine.montiapm.com%22%2C%22clientEngineSyncDelay%22%3A10000%2C%22recordIPAddress%22%3A%22full%22%2C%22disableClientErrorTracking%22%3Afalse%2C%22enableErrorTracking%22%3Atrue%7D%2C%22isModern%22%3Atrue%7D"))

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a part of the Meteor.js framework and does not contain any high-risk indicators. It primarily sets up the Meteor environment, handles package management, and provides utility functions like `wrapAsync` and `_setImmediate`. While the code uses some legacy practices like `XDomainRequest`, these are not inherently malicious and are likely used for compatibility purposes. Overall, the script seems to be a legitimate part of the Meteor.js framework and poses a low risk."
}

!function(){var t,e,n;(function(){t=this}).call(this),function(){var t=__meteor_runtime_config__;e=t.meteorEnv,n={isProduction:"production"===e.NODE_ENV,isDevelopment:"production"!==e.NODE_ENV,isClient:!0,isServer:!1,isCordova:!1,isModern:t.isModern},t.gitCommitHash&&(n.gitCommitHash=t.gitCommitHash),t.PUBLIC_SETTINGS&&(n.settings={public:t.PUBLIC_SETTINGS})}.call(this),function(){function e(){this._promiseInfoMap=Object.create(null)}var r=e.prototype;r._define=function t(e,n){n=n||{};for(var r=arguments.length,o=2;o<r;++o){var i=arguments[o];for(var s in i)s in n||(n[s]=i[s])}this[e]=n;var a=this._promiseInfoMap[e];return a&&a.resolve(n),n},r._has=function t(e){return Object.prototype.hasOwnProperty.call(this,e)},r._promise=function t(e){var r=this,o=r._promiseInfoMap[e];return o||((o=r._promiseInfoMap[e]={}).promise=new Promise((function(t,i){o.resolve=t,r._has(e)?t(r[e]):n.startup((function(){r._has(e)||i(new Error("Package "+e+" not installed"))}))}))),o.promise},t.Package=new e,"object"==typeof exports&&(exports.PackageRegistry=e)}.call(this),function(){if(n.isServer)var t=Npm.require("fibers/future");"object"==typeof __meteor_runtime_config__&&__meteor_runtime_config__.meteorRelease&&(n.release=__meteor_runtime_config__.meteorRelease),n._get=function(t){for(var e=1;e<arguments.length;e++){if(!(arguments[e]in t))return;t=t[arguments[e]]}return t},n._ensure=function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];n in t||(t[n]={}),t=t[n]}return t},n._delete=function(t){for(var e=[t],n=!0,r=1;r<arguments.length-1;r++){var o;if(!((o=arguments[r])in t)){n=!1;break}if("object"!=typeof(t=t[o]))break;e.push(t)}for(var r=e.length-1;r>=0;r--){var o=arguments[r+1];if(n)n=!1;else for(var i in e[r][o])return;delete e[r][o]}},n.wrapAsync=function(e,r){return function(){for(var i=r||this,s=Array.prototype.slice.call(arguments),a,u=s.length-1;u>=0;--u){var c=s[u],l=typeof c;if("undefined"!==l){"function"===l&&(a=c);break}}if(!a){if(n.isClient)a=o;else{var f=new t;a=f.resolver()}++u}s[u]=n.bindEnvironment(a);var p=e.apply(i,s);return f?f.wait():p}};var e=Object.prototype.hasOwnProperty;n._inherits=function(t,n){for(var r in n)e.call(n,r)&&(t[r]=n[r]);var o=function(){this.constructor=t};return o.prototype=n.prototype,t.prototype=new o,t.__super__=n.prototype,t};var r=!1;function o(t){if(t)return n._debug("Exception in callback of async function",t)}n._wrapAsync=function(t,e){return r||(n._debug("Meteor._wrapAsync has been renamed to Meteor.wrapAsync"),r=!0),n.wrapAsync.apply(n,arguments)}}.call(this),function(){"use strict";var t=this;function e(){if(t.setImmediate){var e=function(e){t.setImmediate(e)};return e.implementation="setImmediate",e}return null}function r(){if(!t.postMessage||t.importScripts)return null;var e=!0,n=t.onmessage;if(t.onmessage=function(){e=!1},t.postMessage("","*"),t.onmessage=n,!e)return null;var r=0,o={},i="Meteor._setImmediate."+Math.random()+".";function s(t,e){return"string"==typeof t&&t.substring(0,e.length)===e}function a(e){if(e.source===t&&s(e.data,i)){var n=e.data.substring(i.length);try{o[n]&&o[n]()}finally{delete o[n]}}}t.addEventListener?t.addEventListener("message",a,!1):t.attachEvent("onmessage",a);var u=function(e){++r,o[r]=e,t.postMessage(i+r,"*")};return u.implementation="postMessage",u}function o(){var e=function(e){t.setTimeout(e,0)};return e.implementation="setTimeout",e}n._setImmediate=e()||r()||o()}.call(this),function(){function t(t){if(Package.ddp){var e=Package.ddp.DDP,n=e._CurrentMethodInvocation||e._CurrentInvocation,r=n.get();if(r&&r.isSimulation)throw new Error("Can't set timers inside simulations");return function(){n.withValue(null,t)}}return t}function e(e,r){return n.bindEnvironment(t(r),e)}n.setTimeout=function(t,n){return setTimeout(e("setTimeout callback",t),n)},n.setInterval=function(t,n){return setInterval(e("setInterval callback",t),n)},n.clearInterval=function(t){return clearInterval(t)},n.clearTimeout=function(t){return clearTimeout(t)},n.defer=function(t){n._setImme

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "11lbjp@sxwhmsv.co",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "UBS SIL"
  ]
}

```json{  "legit_domain": "ubs.com",  "classification": "wellknown",  "reasons": [    "The brand 'UBS' is a well-known global financial services company.",    "The URL 'registry.paratext.org' does not match the legitimate domain 'ubs.com'.",    "The domain 'paratext.org' is unrelated to UBS and does not suggest any association with the financial services sector.",    "The presence of an unrelated domain with a well-known brand name is a common phishing tactic.",    "The email input field '11lbjp@sxwhmsv.co' does not provide any clear association with UBS and could be a phishing attempt to collect user information."  ],  "riskscore": 9}
Google indexed: True