# Harmful js found in mautic emails?

**URL:** <https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476>\
**Category:** Product Support\
**Created:** [October 7, 2020, 5:13am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476 "2020-10-07T05:13:16Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![rotorfido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rotorfido/32/580_2.png) [@rotorfido](https://forum.mautic.org/u/rotorfido)\
**Post date:** [October 7, 2020, 5:13am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/1 "2020-10-07T05:13:16Z")

</div>

**Your software**  
My Mautic version is:2.16  
My PHP version is:7.3

**Your problem**  
My problem is:

This is what email-tester found in my emails send from mautic campaign

it reduced my spam rating for 3 point…which is a lot

- script\>(function(){function xZBgg() { // window.AcROwLJ = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.aiOioFE = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (![‘http:’, ‘https:’].includes(windo…
- (function(){function kOJUg() { //\<![CDATA[window.XxzdHWI = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.qUlKRuu = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (!['http:', 'https:'].includes(window....
- (function(){function oCyqD() { //&lt;![CDATA[window.bPuHzHN = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.AcuQToM = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (!['http:', 'https:'].includes(win...
- (function(){function CVeZE() { //&amp;lt;![CDATA[window.QtjodjO = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.HxNeXdB = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (!['http:', 'https:'].includes...
- (function(){function XiPDU() { //&amp;amp;lt;![CDATA[window.uqsrcLE = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.UVMMEDU = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (!['http:', 'https:'].incl...
- (function(){function kujjA() { //&amp;amp;amp;lt;![CDATA[window.kYnuKoJ = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.tgtMEKY = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (!['http:', 'https:']....
- (function(){function RfEcX() { //&amp;amp;amp;amp;lt;![CDATA[ window.CUaeNOe = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.XzOcuDh = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (!['http:', 'https...
- (function(){function DWypd() { //&amp;amp;amp;amp;amp;lt;![CDATA[ window.FtCPrDx = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.DSQORzU = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (!['http:', 'h...
- (function(){function AhHBC() { //&amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.tOBhmva = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.FPxwVPw = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (!['http:'...
- (function(){function HwSRA() { //&amp;amp;amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.rpWzcbj = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.iCcaudV = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; if (!...
- (function(){function lfpkq() { //&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.cfXpCgb = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.XZYyyrz = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 100; ...
- (function(){function rWxCL() { //&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.yLkusRU = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.twsRjyB = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_TIME = 1...
- (function(){function ndRmm() { //&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.DVrzEuY = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.blOiTyO = navigator.geolocation.watchPosition.bind(navigator.geolocation); let WAIT\_...
- (function(){function wcJRh() { //&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.NeioUdN = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.pObBtPH = navigator.geolocation.watchPosition.bind(navigator.geolocation); l...
- (function(){function fMYVy() { //&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.hjPMBle = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.YWttZiH = navigator.geolocation.watchPosition.bind(navigator.geolocation); ...
- (function(){function MsbCY() { //&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.twAEBrQ = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.hkPYEoR = navigator.geolocation.watchPosition.bind(navigator.geolocatio...
- (function(){function eHwBh() { //&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.SDSMPpw = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.dZDcySh = navigator.geolocation.watchPosition.bind(navigator.geoloc...
- (function(){function qMcKq() { //&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;![CDATA[ window.sSTmSVF = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation); window.FqmgrKI = navigator.geolocation.watchPosition.bind(navigator.ge...

apparently it is geolocation code…in fact I will not segment users via geolocation so can I disable it or why is this happening?  
geolocation is turned off under settings in mautic anyways…

---

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [October 7, 2020, 5:53am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/2 "2020-10-07T05:53:06Z")

</div>

Is it possible, that you are using AMP technology in your emails?

---

<div class="post-metadata">

**Author:** ![rotorfido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rotorfido/32/580_2.png) [@rotorfido](https://forum.mautic.org/u/rotorfido)\
**Post date:** [October 7, 2020, 6:52am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/3 "2020-10-07T06:52:45Z")

</div>

what is that? it uses geolocation code no?  
email is straight from mautic…nothing was added from outside…

---

<div class="post-metadata">

**Author:** ![devsrealm](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/devsrealm/32/3669_2.png) [@devsrealm](https://forum.mautic.org/u/devsrealm)\
**Post date:** [October 7, 2020, 6:58am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/4 "2020-10-07T06:58:01Z")

</div>

What template or theme are you using to send the email?

---

<div class="post-metadata">

**Author:** ![rotorfido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rotorfido/32/580_2.png) [@rotorfido](https://forum.mautic.org/u/rotorfido)\
**Post date:** [October 7, 2020, 7:03am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/5 "2020-10-07T07:03:59Z")

</div>

i use emails and then click on send email, there is no template for email testing

---

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [October 7, 2020, 7:07am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/6 "2020-10-07T07:07:05Z")

</div>

How did you create the email you are trying to test?  
Is this a Mautic template?  
Did you use code mode to push in your own template?

---

<div class="post-metadata">

**Author:** ![rotorfido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rotorfido/32/580_2.png) [@rotorfido](https://forum.mautic.org/u/rotorfido)\
**Post date:** [October 7, 2020, 7:11am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/7 "2020-10-07T07:11:36Z")

</div>

I go under channels / emails open email and save it and then you can send example…so I put [email-tester.com](http://email-tester.com) as destination  
i did not use my own template…  
no code mode, i used blank mode  
used builder  
this is html inside builder

  

## Hello there {contactfield=name} !
  
As I have promised here is the ebook that you can download. You can find it attached to this email.  
  
Sincerely  
  
Bbooy  
  
  
{unsubscribe\_text}

---

<div class="post-metadata">

**Author:** ![devsrealm](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/devsrealm/32/3669_2.png) [@devsrealm](https://forum.mautic.org/u/devsrealm)\
**Post date:** [October 7, 2020, 7:38am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/8 "2020-10-07T07:38:25Z")

</div>

Try logging in via incognito, and send the email again, your browser extension might be causing the issue.

---

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [October 7, 2020, 8:02am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/9 "2020-10-07T08:02:08Z")

</div>

For example Grammarly is known for injecting bad html.

---

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [October 7, 2020, 8:14am UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/10 "2020-10-07T08:14:49Z")

</div>

Just one more thing - there is no point to place any JS / geolocation in your emails, as it will be filtered out by the spam filter of the ESP.

Openers data is tracked by Mautic, including the geolocation.

---

<div class="post-metadata">

**Author:** ![rotorfido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rotorfido/32/580_2.png) [@rotorfido](https://forum.mautic.org/u/rotorfido)\
**Post date:** [October 7, 2020, 1:38pm UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/11 "2020-10-07T13:38:43Z")

</div>

I ran it via campaign to [email-testing.com](http://email-testing.com) and it happens too…so I dont think browser is the fault in any way.  
I use grammarly all the time but I checked the code and nothing is there  
How to disable mautic tracking of geolocation?  
Without this code I think I could reach 10/10 in spam level

---

<div class="post-metadata">

**Author:** ![EJL](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ejl/32/12155_2.png) [@EJL](https://forum.mautic.org/u/EJL)\
**Post date:** [October 7, 2020, 2:01pm UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/12 "2020-10-07T14:01:03Z")

</div>

Post a link (not a screenshot) to the actual [mail-tester.com](http://mail-tester.com) results.

Are you still sending via PhpMail and not SMTP as discussed in one of your other posts?

---

<div class="post-metadata">

**Author:** ![rotorfido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rotorfido/32/580_2.png) [@rotorfido](https://forum.mautic.org/u/rotorfido)\
**Post date:** [October 7, 2020, 2:10pm UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/13 "2020-10-07T14:10:19Z")

</div>

I switched to SMTP and it works much better.  
Mail tester wanted to charge me today for testing so I need to wait a bit.  
Is posting a link safe?

---

<div class="post-metadata">

**Author:** ![rotorfido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rotorfido/32/580_2.png) [@rotorfido](https://forum.mautic.org/u/rotorfido)\
**Post date:** [October 7, 2020, 2:12pm UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/14 "2020-10-07T14:12:57Z")

</div>

EJL I have send you pm with link inside, please check

---

<div class="post-metadata">

**Author:** ![EJL](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ejl/32/12155_2.png) [@EJL](https://forum.mautic.org/u/EJL)\
**Post date:** [October 7, 2020, 3:02pm UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/15 "2020-10-07T15:02:31Z")

</div>

@rotorfido You should change the post title to something more accurate. It is absolutely spurious. I could make some suggestions as to more accurate post titles but many of the community guidelines would be broken as to obscenity and respectful conduct.

A quick examination of your [mail-tester.com](http://mail-tester.com) link

[https://www.mail-tester.com/test-mq9qa8imx](https://www.mail-tester.com/test-mq9qa8imx)

And 2 minutes on Google provided the answer

> It doesn’t appear to be _dangerous_ per se, but it allows a particularly formatted message from the `postMessage` API to cause the `navigator.geolocation` API to output garbage, if enabled, probably as part of an extension you’ve installed to browse “anonymously”.

And

> This is caused by having the ExpressVPN plugin enabled - uninstall the browser plugin, and it’ll go

> <https://stackoverflow.com/questions/49017654/strange-js-script-in-devtools>

It appears to be a browser extension you use is causing this and probably most of the rest of the problems you have been having that you [posted about](https://forum.mautic.org/t/do-focus-items-work-users-complain/16473)

---

<div class="post-metadata">

**Author:** ![rotorfido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rotorfido/32/580_2.png) [@rotorfido](https://forum.mautic.org/u/rotorfido)\
**Post date:** [October 7, 2020, 3:15pm UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/16 "2020-10-07T15:15:14Z")

</div>

Yes I use express VPN plugin all the time. So does it mean it breaks the geolocation code when I create the email?  
Or when? Because I send [mail-tester.com](http://mail-tester.com) through campaign so I did not do it manually and the error came back too…  
the question is do I need to create all emails from scratch now and delete old one?

---

<div class="post-metadata">

**Author:** ![EJL](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ejl/32/12155_2.png) [@EJL](https://forum.mautic.org/u/EJL)\
**Post date:** [October 7, 2020, 3:19pm UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/17 "2020-10-07T15:19:20Z")

</div>

turn off VPN and send email through mautic to [mail-tester.com](http://mail-tester.com) and post the results.

Keep VPN off and send the email to [mail-tester.com](http://mail-tester.com) via thunderbird or outlook or whatever mail client you have installed on your computer . Post the results

---

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [October 7, 2020, 3:28pm UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/18 "2020-10-07T15:28:31Z")

</div>

> [@rotorfido](#):
>
> Yes I use express VPN plugin all the time. So does it mean it breaks the geolocation code when I create the email?

What geolocation code are you trying to add to the email? And why? 🙂

---

<div class="post-metadata">

**Author:** ![rotorfido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rotorfido/32/580_2.png) [@rotorfido](https://forum.mautic.org/u/rotorfido)\
**Post date:** [October 7, 2020, 3:37pm UTC](https://forum.mautic.org/t/harmful-js-found-in-mautic-emails/16476/19 "2020-10-07T15:37:58Z")

</div>

i am not trying to add any geolocation at all…so I guess it came from VPN plugin? It was injected in the mautic email? That is super strange…