The code appears to be a complex and obfuscated JavaScript...
The code appears to be a complex and obfuscated JavaScript program embedded in an HTML document. Here's an explanation of what the code seems to be doing:
Primary Functions:
-
Detecting Ad Blockers:
- The code performs several checks to detect the presence of ad-blockers. It does this by creating a hidden element styled in such a way that ad-blockers might hide or modify it (e.g., by setting its
display
tonone
or its size to zero). - It uses element style and various properties (
offsetHeight
,clientHeight
, etc.) to assess whether modifications have been made.
- The code performs several checks to detect the presence of ad-blockers. It does this by creating a hidden element styled in such a way that ad-blockers might hide or modify it (e.g., by setting its
-
Redirecting the User or Writing an Element:
- If certain conditions are met (e.g., ad blocker detected or a response from a remote server), it sets up a redirection by dynamically creating an
<a>
tag with a specifichref
and programmatically "clicking" it to navigate the user to a different page. - It also interacts with cookies, using
document.cookie
to store certain tokens or flags that may influence its behavior.
- If certain conditions are met (e.g., ad blocker detected or a response from a remote server), it sets up a redirection by dynamically creating an
-
Making Asynchronous Requests:
- It sends an HTTP POST request to a specified remote URL (
https://router.parklogic.com/
), transmitting data about the browser's environment and potentially information about whether an ad-blocker was detected. - The request payload includes encoded metadata decoded via the
atob
function. This metadata contains client information, such as IP address, country, browser timezone, detailed system information, and whether the browser'snavigator.webdriver
is enabled.
- It sends an HTTP POST request to a specified remote URL (
-
Decision Logic:
- Depending on the server response or detection results, the code decides what to do:
- If a positive result is detected (e.g., ad blocker found), it redirects the user or modifies the page content in some way.
- If a negative result occurs (e.g., no ad-blocker), it might simply interact with cookies or reload the page.
- Depending on the server response or detection results, the code decides what to do:
-
Server Interaction and Error Handling:
- If the server returns an HTTP response starting with "http", it interprets this as a redirect URL and sends the user there.
- If the server returns non-HTTP content, it replaces the page's body with the server's response content.
-
Runtime Behavior:
- The script is obfuscated to make understanding its logic difficult for humans.
- It attempts to execute certain actions only after the page has fully loaded, as indicated by checking the
document.readyState
or attaching an event listener (window.addEventListener("load", ...)
).
Key Observations:
-
Ad-Blocking Detection: The primary purpose seems to be identifying ad-blockers and acting based on their presence.
-
Redirection: Based on the results of its detection logic or an external server response, the script can redirect the user to another page or reload the current one.
-
Remote Data Transmission: The script gathers browser/system information (e.g., timezone, WebGL information, and potentially GPU data) and sends it to a remote server.
-
Obfuscation and Complexity: The code is heavily obfuscated and splits its logic across multiple functions and variables with unclear names, which makes debugging or understanding its exact behavior difficult. This obfuscation could be intentional to evade detection or scrutiny.
-
Potential Malicious or Tracking Intent: The use of encoded metadata, remote server communication, redirection, and deliberate effort to evade detection (e.g., faking user actions with programmatic clicks) could indicate that this script is designed for tracking, ad-fraud, or potentially malicious purposes.
Summary:
This code detects ad-blockers, collects browser data, sends this data to a remote server, and dynamically redirects or modifies the user's browsing experience based on server responses. Due to its obfuscated nature, coupled with its interaction with user behavior and external servers, it could be part of a larger ad-tech, tracking, or potentially harmful system.