@SeanWrightSec Meh, out of time for looking at this. One final thing: we've all chuckled at "just use jquery" in the past, but these guys are loading jquery seemingly just to update window.location.href. I suspect though, that that fetch of remote/fetch.php is used to try and exclude bots/curl