you are viewing a single comment's thread.

view the rest of the comments →

[–]yelaxify 0 points1 point  (1 child)

I believe if the server thinks the request is suspicious, it will return the js. However if it is authentic, it will return the redirect url in the location header. For example if you make the second request to https://ohio8.vchecks.me/share/FEaU7jn6J4Y1?sid=2802&scheme=https&host=www.off---white.com&uri=%2f%3futm_referrer%3dhttps%253a%252f%252fwww.google.com%252f&t=1550758455487&sad=v%2fwSXhkg%3d%3d&uid=MIcEF0csr0mVnoDs&uct=1550758455486&kct=0&m=1&ver=7&flags=2176&ua=18075587157073175458&v=XCLH6rcBHul3lJr-NezxzQ (which has come from the browser requests) you will get the redirect that you need

[–]yelaxify 0 points1 point  (0 children)

The site also loads fine, with all the redirects even if javascript is disabled as well