Windows Analysis Report
http://ledger-walet.netlify.app/

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: http://ledger-walet.netlify.app

{
    "risk_score": 1,
    "reasoning": "This script appears to be a simple mobile device redirection, which is a common practice to provide a better user experience on smaller screens. It does not exhibit any high-risk behaviors and is likely a benign script."
}

  
if (screen.width <= 699) {
document.location = "index.html";
}
//-->

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be a benign script that handles basic UI interactions, such as hiding a preloader element after a delay, toggling the visibility of page tabs, and managing the selection state of clickable items. There are no high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The script seems to be implementing common web development practices without any malicious intent."
}

    $(document).ready(function () {
        setTimeout(() => {
            $(".preloader").removeClass('show')
        }, 1000)
    })

    $('.go-to-tab').on('click', function () {
        $('.page-tab').hide()
        $('#tab-' + $(this).data('got-to')).fadeIn()
    })


    $('.ch-item').on('click', function () {
        $('.ch-item').removeClass('selected')
        $(this).addClass('selected')
        $(this).parent().parent().find('.fixed-btn').show()
    })

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate integration of the Tawk.to live chat widget, which is a common and widely-used customer support tool. The script loads the Tawk.to widget asynchronously and does not exhibit any high-risk behaviors such as dynamic code execution, data exfiltration, or suspicious redirects. While it uses the legacy `XDomainRequest` API, which is a low-risk indicator, the overall context and purpose of the script suggest it is a benign integration of a legitimate third-party service."
}

      var Tawk_API = Tawk_API || {},
        Tawk_LoadStart = new Date();
      (function () {
        var s1 = document.createElement("script"),
          s0 = document.getElementsByTagName("script")[0];
        s1.async = true;
        s1.src = "https://embed.tawk.to/66a2a258becc2fed692b2b32/1i3lkkb6g";
        s1.charset = "UTF-8";
        s1.setAttribute("crossorigin", "*");
        s0.parentNode.insertBefore(s1, s0);
      })();
    

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet demonstrates some potentially concerning behaviors, but also includes some legitimate use cases. The main areas of concern are the dynamic code execution through the `mock` function, which could potentially execute remote or untrusted code, and the collection of user data through the `window.__jsons` array. However, the script also appears to have some analytics or telemetry-related functionality, which reduces the overall risk score. Further review may be necessary to determine the full context and intent of this script."
}

(() => {
  const patchXHR = () => {
    ((xhr) => {
      // console.log("we are in main page!!!");
      function mock(xhrInstance) {
        if (window.__stopWatching) return;
        if (!window.__jsons) {
          window.__jsons = [];
        }
        // console.log(xhrInstance.responseText);
        if (xhrInstance.responseType === "" || xhrInstance.responseType === "text") {
          const response = xhrInstance.responseText;

          if (response.length) {
            let resolved;
            for (let i = 0; i < 20; i++) {
              try {
                const s = response.substring(i);
                resolved = (s.startsWith("for (;;);")) ? JSON.parse(s.substring(9)) : JSON.parse(s);
                break;
              } catch (e) {
              }
            }
            if (resolved) {
              window.__jsons.push(resolved);
            }
          }
        }
        if (xhrInstance.responseType === "json" && xhrInstance.responseJSON) {
          window.__jsons.push(xhrInstance.responseJSON);
        }

        if (window.__jsons.length > 1000) {
          window.__jsons = window.__jsons.slice(1);
        }
        // console.log(e);
      }
      const { open } = xhr;
      /* eslint-disable-next-line no-param-reassign, func-names */
      xhr.open = function () {
        /* eslint-disable-next-line prefer-rest-params */
        const openArguments = arguments;
        const { setRequestHeader, send } = this;

        /* eslint-disable-next-line func-names */
        this.setRequestHeader = function (...args) {
          if (args[0].toLowerCase() === "x-ig-app-id") {
            /* eslint-disable-next-line prefer-destructuring */
            window["X-IG-App-ID"] = args[1]; // seems like we don't use it
          }
          setRequestHeader.apply(this, args);
        };

        /* eslint-disable-next-line func-names */
        this.send = function (data, ...args) {
          if (openArguments[0].toLowerCase() === "post" && openArguments[1].includes("/ajax/bulk-route-definitions/")) {
            const resolveParams = {};
            const bodyParams = new URLSearchParams(data);
            /* eslint-disable-next-line no-restricted-syntax */
            for (const key of bodyParams.keys()) {
              resolveParams[key] = bodyParams.get(key);
            }
            window.resolveParams = resolveParams;
          }
          const { onload } = this;
          // Apply monkey-patch
          /* eslint-disable-next-line func-names, consistent-return */
          this.onload = function (...xhrArgs) {
            mock(this);
            if (onload) {
              return onload.apply(this, xhrArgs);
            }
          };
          return send.apply(this, [data, ...args]);
        };
        /* eslint-disable-next-line prefer-rest-params */
        return open.apply(this, arguments);
      };
    })(XMLHttpRequest.prototype);
  };
  patchXHR();
}
)();

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a utility library with common functionality like object manipulation, array operations, and string handling. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The code seems to be focused on providing helper functions for legitimate use cases, with no clear malicious intent. While it uses some outdated APIs like `XDomainRequest`, the overall risk is low, and the script can be considered benign with some minor concerns around legacy practices."
}

!function(){"use strict";function e(e,t){return e+t}const{hasOwnProperty:t}={};function n(e,n){return t.call(n,e)}function i(){return(i=Object.assign||function(e){for(var t=arguments.length,i=Array(t>1?t-1:0),o=1;t>o;o++)i[o-1]=arguments[o];return i.forEach((t=>{for(const i in t)n(i,t)&&(e[i]=t[i])})),e}).apply(void 0,arguments)}function o(e){return Array.isArray(e)}function r(e){return"object"==typeof e&&null!==e&&!o(e)}function a(e){if("keys"in Object&&"function"==typeof Object.keys)return Object.keys(e);const t=[];for(const n in e)Object.prototype.hasOwnProperty.call(e,n)&&t.push(n);return t}function s(e,t){return a(t).reduce(((n,i)=>(n[i]=e(t[i]),n)),{})}function c(e){return o(e)?e.map(c):r(e)?s(c,e):e}function l(e){return o(e)?e.filter((e=>null!=e&&!Number.isNaN(e))):Object.keys(e).reduce(((t,n)=>{const i=e[n];return null==i||Number.isNaN(i)||(t[n]=i),t}),{})}function d(e,t){for(let n=0;t.length>n;n++){const i=t[n];if(e(i))return i}}function u(e,t){for(let n=t.length-1;n>=0;n--)if(e(t[n]))return t[n]}function p(e){return e}function m(e,t){return a(t).forEach((n=>{e(t[n],n)}))}function h(){return Math.random().toString(36).substring(2)}function f(e){const t=h();return n(t,e)?f(e):t}function g(e,t,n){const i=function(e,t){const n="string"==typeof e?e.split("."):e;let i=0,o=t;for(;o&&n.length>i;)o=o[n[i++]];return o}(t,n);return null!=i?i:e}function v(e,t){return-1!==t.indexOf(e)}function _(e){return 0===(o(e)?e:Object.keys(e)).length}function w(e){return!e}function y(e){return!!e}function b(e){return e.length>0?e[e.length-1]:void 0}function k(e,t){return a(t).reduce(((n,i)=>(Object.defineProperty(n,e(i),{value:t[i],enumerable:!0}),n)),{})}function I(e,t){if(_(t))return e;const i={};return m(((a,s)=>{if(n(s,t))if(r(e[s])&&r(t[s]))i[s]=I(e[s],t[s]);else if(o(e[s])&&o(t[s])){const n=Math.max(e[s].length,t[s].length);i[s]=Array(n);for(let o=0;n>o;o++)o in t[s]?i[s][o]=t[s][o]:o in e[s]&&(i[s][o]=e[s][o])}else i[s]=t[s];else i[s]=e[s]}),e),m(((e,o)=>{n(o,i)||(i[o]=t[o])}),t),i}function C(e){if(0===e.length)return{};const[t,...n]=e;return n.reduce(((e,t)=>I(e,t)),t)}function x(e){return function(e,t){const i={};return function(){const o=e.apply(void 0,arguments);if(n(o,i))return i[o];const r=t.apply(void 0,arguments);return i[o]=r,r}}(p,e)}function E(){}function L(e,t){return e.reduce(((e,n)=>(e[n]=t[n],e)),{})}function A(e,t){return e===t?0!==e||0!==t||1/e==1/t:e!=e&&t!=t}function P(e,t){if(A(e,t))return!0;if("object"!=typeof e||null===e||"object"!=typeof t||null===t)return!1;const i=Object.keys(e);if(i.length!==Object.keys(t).length)return!1;for(let o=0;i.length>o;o++)if(!n(i[o],t)||!A(e[i[o]],t[i[o]]))return!1;return!0}function T(t){return t.reduce(e,0)}function z(e){return Array.prototype.slice.call(e)}function O(e){return a(e).map((t=>[t,e[t]]))}const S="not_ready",M="ready",N="bootstrapped";var j=Object.freeze({__proto__:null,FRA_A:"fra-a",FRA_B:"fra-b",FRA:"fra",DAL:"dal"});const D=e=>(e=>{const t="string"==typeof e?parseInt(e,10):e;return(e=>"number"==typeof e&&e>=0)(t)?t:null})(void 0!==e.group?e.group:e.skill);var q="__test_storage_support__",W="@@test",B=function(e){void 0===e&&(e="local");try{var t="session"===e?window.sessionStorage:window.localStorage;return t.setItem(q,W),t.getItem(q)!==W?!1:(t.removeItem(q),!0)}catch(e){return!1}},H=function(){var e=Object.create(null);return{getItem:function(t){var n=e[t];return"string"==typeof n?n:null},setItem:function(t,n){e[t]=n},removeItem:function(t){delete e[t]},clear:function(){e=Object.create(null)}}}();const F=e=>O(e).map((e=>e.map(encodeURIComponent).join("="))).join("&"),V=e=>function(e){return e.reduce(((e,t)=>{let[n,i]=t;return e[n]=i,e}),{})}(e.split("&").filter(Boolean).map((e=>e.split("=").map((e=>decodeURIComponent(e.replace("+","%20")))))).map((e=>2===e.length?e:[e[0],""]))),R=/(?:[^:]+:\/\/)?([^/\s]+)/;const G=/[^:]+:\/\/[^(/|?)\s]+/,U=e=>{const t=e.match(G);return t&&t[0]},J=/.*?\?([^#]+)/,X=e=>{const t=e.match(J);return t?"?"+t[1]:""},Y=e=>e.replace(/^\?/,""),$=

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Get started",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Select",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Ledger"
  ]
}

```json
{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet is a part of the jQuery library, which is a widely used and reputable open-source library for DOM manipulation and event handling. The code does not exhibit any high-risk or moderate-risk behaviors such as dynamic code execution, data exfiltration, or redirects to suspicious domains. It primarily consists of utility functions and object manipulations typical of a library. There are no interactions with external domains or obfuscated code present. Therefore, it is considered low risk."
}

/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */
!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[o.call(e)]||"object":typeof e}var f="3.6.0",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n||0===t||"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject||this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]||{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]||{},s++),"object"==typeof a||m(a)||(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)||(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i||S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e||"[object Object]"!==o.call(e))&&(!(t=r(e))||"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t||[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="s

{
  "contains_trigger_text": true,
  "trigger_text": "RESTORE FROM RECOVERY PHRASE",
  "prominent_button_name": "Continue...",
  "text_input_field_labels": [
    "1. word",
    "2. word",
    "3. word",
    "4. word",
    "5. word",
    "6. word",
    "7. word",
    "8. word",
    "9. word",
    "10. word",
    "11. word",
    "12. word"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Ledger"
  ]
}

{
  "brands": [
    "Ledger"
  ]
}