> 1. Am I being overly paranoid or do I have a genuine concern?

You have a genuine concern.  Something is not right here.

> 2. Is it normal for a gateway provider to obfuscate their code like this?

Obfuscation is not, all by itself, abnormal.  However, at the point they're trying to open localhost connections to RDP, VNC, and other ports, that's not obfuscation, that's completely inappropriate and malicious.

> 3. Should I advise my client to immediately change supplier?

I would advise your client that the code provided for integration appears to be malicious and that you cannot assume the supplier is either a) legitimate or b) capable of securing their business (and by extension, your client's).  In addition, the supplier does not appear to integrate properly into a secure purchasing environment (the http: only js link), which calls into question their appropriateness even if legitimate.

As per @JaimeCastells's comment to the question, there is no "payforasia" service provider listed at http://www.visa.com/splisting/searchGrsp.do.  That could mean they're doing business under that name but are certified under a different name, or it could mean they're a "Level 2 Service Provider".  Neither of those options is reassuring, quite frankly.

> 4. Should I walk away and chalk it up to experience?

If the client wants to continue with this supplier, I would definitely consider walking away.  You can't make the client do the right thing, but you can choose not to be the one doing the wrong thing for them.

Javascript analysis
----------

The intent of the obfuscated Javascript seems important.  I've tried to untangle what's happening in the Javascript, and I'll link to readable partially de-obfuscated copies in this section.

Overall, my impression is that the level of de-obfuscation in play exceeds what is commercially reasonable and becomes suspicious as a result.  The limited amount of inferences I can draw about what it does are not inline with normal payments processing.  Lacking better information, I presume this is malicious javascript.

Here are files I'm looking at should you wish to explore the same question.  These files have been run through the [Online Javascript Beautifier][1]  and I've also used the [Online Javascript Editor][2] to pick apart bits of what the  scripts do.

There are at least four scripts involved:

 - [csid.js][3]
 - [tags.js][4]
 - [check.js][5]
 - checkcid.js

It's clear, for example, that the five ports the OP saw getting connection attempts are hardwired into check.js:

    td_0a = ['REF:63333', 'VNC:5900', 'VNC:5901', 'VNC:5902', 'VNC:5903', 'RDP:3389'];

I will continue to poke at them, and may pastebin some copies, but I think it's reasonable to be distrustful of this code at this point.


  [1]: http://jsbeautifier.org/
  [2]: http://js.do/
  [3]: http://pastebin.com/j1P7eU4v
  [4]: http://pastebin.com/vbUa1QEx
  [5]: http://pastebin.com/VD8qEkSV