When requested, with the correct Internet Explorer User-Agent, this host would serve additional obfuscated JavaScript code. As with the initial redirect, the attacker chose to bury their malicious code amongst legitimate code. In this particular case, the attacker used the "bPopUp" JavaScript library alongside their own code. This decision has two effects