Tracking a Suspicious JavaScript Loader Chain (Work in Progress)
I was recently told that a website was behaving strangely — it was reportedly redirecting users, but only once. After that initial redirect, the behavior would stop or change, which immediately raised some questions about what was happening behind the scenes. I found the obfuscated Javascript snippet in a custom JS section in a pop…