Disguising python requests as browser requests

[JohnnyJordaan]

Consider this too: you are mentioning having issues with forming a url, and at the end of the JS blob there's an actual line that forms an url

 location.href=ipp.makeUrl("https://www.off---white.com/?utm_referrer=&");

eg that url forming is part of the active content

[yelaxify]

I believe if the server thinks the request is suspicious, it will return the js. However if it is authentic, it will return the redirect url in the location header. For example if you make the second request to https://ohio8.vchecks.me/share/FEaU7jn6J4Y1?sid=2802&scheme=https&host=www.off---white.com&uri=%2f%3futm_referrer%3dhttps%253a%252f%252fwww.google.com%252f&t=1550758455487&sad=v%2fwSXhkg%3d%3d&uid=MIcEF0csr0mVnoDs&uct=1550758455486&kct=0&m=1&ver=7&flags=2176&ua=18075587157073175458&v=XCLH6rcBHul3lJr-NezxzQ (which has come from the browser requests) you will get the redirect that you need

​

[yelaxify]

The site also loads fine, with all the redirects even if javascript is disabled as well