3 ms·
would this imply their dns is compromised? redirecting to other places? Or is it like a 302 redirect on application layer??
by sim7c00 2y ago
would this imply their dns is compromised? redirecting to other places? Or is it like a 302 redirect on application layer??
- phoehnel 2y agoseems like they are using a javascript redirect to a local php script with a cryptic HTTP-Payload which then uses another form of redirecting. ``` var destinationUrl = "/page/bouncy.php?&bpae=GbhOtycGokx7NouoZAxNQOiMIDJ9XOt%2FaJHfNyHzYqRxb3fjQafa8AJ7JN5pE7%2Fo3NVhaQVhjHtRyu6EA8%2FhONViovJ2P5Mg8ddJhyJVXClWFiQch3k6NJZHL7zrQL9j39yn7FUglnvQjCIyZRjSx8O%2B8VgA2DKtr6nzkrUu7H9JbXZL%2FXS5248sPDJBpSFl81nnDGmM3sJxHMCQ3qE9glW42uiRagbv62f51U0NnRdUCJCMw11eLIs9bFVpEe99tSM%2BClL6pbxYAkRhK801TL3%2FA%2BisFwbsBlIgj89wW9e0AO2wJZefHmweRpWC2ScpiZ4PnFsFnu6EIsd7CsjVea9N5dSRVl44AXsv%2FLgFNMAQT3oBnaObVKY12IOejGwFafju8daU&redirectType=meta"; var addDetection = true; if (addDetection) { var inIframe = window.self !== window.top; forwardingUrl += "&inIframe=" + inIframe; * TLSv1.2 (IN), TLS header, Supplemental data (23): var inPopUp = (window.opener !== undefined && window.opener !== null && window.opener !== window); forwardingUrl += "&inPopUp=" + inPopUp; } window.location.replace(forwardingUrl); ```