Anybody have any idea about how they did it? Sorry for the noob question but I can't really figure out how they did it, since the original page loads fine and o

Anybody have any idea about how they did it? Sorry for the noob question but I can't really figure out how they did it, since the original page loads fine and only after this there's some kind of redirect. And as I can see it only affects certain pages so maybe there's a compromised component that's loaded on those pages?