Thanks a lot. I had the same result with some online decoder and thought it wasn’t fully decoded yet but it probably is?
Looks like it’s trying it’s own server availability and then sending the URL that the theme is running on and the surfers’s IPS host name to it’s servers, and sending a file to the surfer?
Can anybody shed some light on what the script is doing?