3 ms·
seems like they are using a javascript redirect to a local php script with a cryptic HTTP-Payload which then uses another form of redirecting. ```
by phoehnel 2y ago
seems like they are using a javascript redirect to a local php script with a cryptic HTTP-Payload which then uses another form of redirecting.
```
var destinationUrl = "/page/bouncy.php?&bpae=GbhOtycGokx7NouoZAxNQOiMIDJ9XOt%2FaJHfNyHzYqRxb3fjQafa8AJ7JN5pE7%2Fo3NVhaQVhjHtRyu6EA8%2FhONViovJ2P5Mg8ddJhyJVXClWFiQch3k6NJZHL7zrQL9j39yn7FUglnvQjCIyZRjSx8O%2B8VgA2DKtr6nzkrUu7H9JbXZL%2FXS5248sPDJBpSFl81nnDGmM3sJxHMCQ3qE9glW42uiRagbv62f51U0NnRdUCJCMw11eLIs9bFVpEe99tSM%2BClL6pbxYAkRhK801TL3%2FA%2BisFwbsBlIgj89wW9e0AO2wJZefHmweRpWC2ScpiZ4PnFsFnu6EIsd7CsjVea9N5dSRVl44AXsv%2FLgFNMAQT3oBnaObVKY12IOejGwFafju8daU&redirectType=meta";
var addDetection = true;
if (addDetection) {
var inIframe = window.self !== window.top;
forwardingUrl += "&inIframe=" + inIframe;
* TLSv1.2 (IN), TLS header, Supplemental data (23):
var inPopUp = (window.opener !== undefined && window.opener !== null && window.opener !== window);
forwardingUrl += "&inPopUp=" + inPopUp;
}
window.location.replace(forwardingUrl);
```