|
|
|
|
|
|
by livre
1846 days ago
|
|
|
I can't edit the original comment anymore, I posted it in a rush and didn't have time to check the script contents. The loaded script also loads a script called "firebase.js" from this URL: https://1658209995.rsc.cdn77.org/firebase.js (archive: https://archive.is/gdij8). That script is obviously not the actual Firebase, you can paste it in a deobfuscator and see what it does, it has some funny things such as a postMessage called "GimmeResults." |
|
|