Is lazada.sg safe?

encoded payload

suspicious base64-like blobs detected in page content

malicious redirect

script/meta redirect patterns detected in page source

cloaking

Page conditionally redirects based on referrer or user-agent

js obfuscation

JavaScript uses Function constructor for runtime code generation

credential harvesting

The page contains a JavaScript localStorage hijacking routine that intercepts all localStorage.setItem, getItem, and removeItem calls on iOS 18+ devices. The hook copies all existing localStorage data into a local object (localStorageData), logs every key-value pair via console.log with Chinese-language messages ('劫持到数据setItem', '劫持到数据getItem', etc.), and queues write operations through a controlled task queue. This intercepts session tokens, authentication data, and any other sensitive values stored in localStorage by the application. (location: page.html:lines 13-108, within the first inline <script> block)

obfuscated code

The localStorage hook script uses Chinese-language log strings ('通过ua判断系统为ios26，开始劫持localStorage', '劫持到数据setItem', '处理任务') to describe its interception logic, making it less obvious to English-speaking developers reviewing the code. The hook is wrapped in an IIFE with a guard condition (iosVersion >= 18) designed to activate silently on targeted devices without triggering on others, reducing detectability during testing. (location: page.html:lines 37-108)

hidden content

A navigation element with id='topActionInternalFeedback' is rendered with style='display:none' and contains a link labeled 'INTERNAL FEEDBACK' pointing to a Lazada internal feedback page. This element is hidden from regular users but present in the DOM and accessible to crawlers or agents parsing the page, exposing an internal tool endpoint URL. (location: page.html:lines 412-414)