← All detection heuristics · HTML
medium
HTML_LONG_BASE64_SCRIPT_PAYLOAD
What it means
HTML script contains a long or constant-concatenated base64-like blob.
Why it fires
Long encoded blobs in script, including payloads split across adjacent constant literals and consumed by atob(), are commonly used for HTML smuggling or for staging a second payload while avoiding simple content filters.
Other HTML heuristics
HTML_HTA_VBSCRIPT_DOM_EXECUTE HTML_THIRD_PARTY_CREDENTIAL_HARVEST HTML_ACTIVEX_OBJECT HTML_WINDOWS_SCRIPTING_OBJECT HTML_VBSCRIPT HTML_CREDENTIAL_PHISH_DYNDNS HTML_SCRIPTED_COM_EXECUTION HTML_SMUGGLED_PAYLOAD HTML_XOR_BASE64_EVAL_INJECTION HTML_OBFUSCATED_STRING_BUILDER HTML_AD_FRAUD_CLOAKING HTML_BASE64_PAYLOAD_URL