billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev Open in urlscan Pro
172.67.138.151  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/	3 MB 548 KB	976ms 758ms	Document text/html	172.67.138.151 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.138.151 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash be6710b06d4414a65f2c662a28de2917b9e997b1ce74e13c891b9c9c840006cc Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-ray 7b60c09b3d05a965-SYD content-encoding br content-type text/html;charset=UTF-8 date Tue, 11 Apr 2023 05:15:33 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZJeXRqbhHJzYXd7f3vGIQRGgANLkiiB1tC5hljcmUEJYWL0MgkOOvRVllL9tE15Xpihw7dbcvuHnx2OqyccUZDctdX9m1xaLkGOtcUvXUQm1mHUyVox0%2BqpDizZo0h5chdvsQplNAetjGAmQKEJxwpyYONn4N668fq7l1pmmianiVpjIGrogIGBmMg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	sse-hooks.f742b80f43c5a2e0e619b0d97b5886cd.js Show response codesandbox.io/public/sse-hooks/	172 KB 44 KB	329ms 119ms	Script application/javascript	104.18.6.114 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/public/sse-hooks/sse-hooks.f742b80f43c5a2e0e619b0d97b5886cd.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.6.114 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7b792d9cff94a4f92d164ec7233833c903b4fdbaef13e37a0dc4258b8312ca83 Request headers accept-language en-AU,en;q=0.9 Referer https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:33 GMT via 1.1 google content-encoding br cf-cache-status HIT age 384259 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sat, 13 Aug 2022 13:00:47 GMT server cloudflare etag W/"62f7a07f-2aeb3" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 7b60c0a15ad5557b-SYD expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	banner.0b5d84a2b.js Show response codesandbox.io/static/js/	4 KB 2 KB	325ms 114ms	Script application/javascript	104.18.6.114 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/banner.0b5d84a2b.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.6.114 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 683fbdef88b2ebf85e44c498687952697f4093fb1ff40f884eb6a2f3c74d0bb7 Request headers accept-language en-AU,en;q=0.9 Referer https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:33 GMT via 1.1 google content-encoding br cf-cache-status HIT age 3072674 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 06 Mar 2023 08:37:20 GMT server cloudflare etag W/"6405a640-f37" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 7b60c0a15ad6557b-SYD expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	755ms 248ms	Script application/javascript	69.16.175.42 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS hwcdn.net Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers accept-language en-AU,en;q=0.9 Referer https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:34 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-15851" vary Accept-Encoding x-hw 1681190134.dop111.sj3.t,1681190134.cds111.sj3.hn,1681190134.cds114.sj3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30638
GET H3	200	watermark-button.f4f9aed52.js Show response codesandbox.io/static/js/	3 KB 2 KB	327ms 124ms	Script application/javascript	104.18.6.114 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/watermark-button.f4f9aed52.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.6.114 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f74bf2cf5a8225beb66712ff4e859c5d4ba9c24123e6de2f427b4b9fde408928 Request headers Referer https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Origin https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:34 GMT via 1.1 google content-encoding br cf-cache-status HIT age 8646 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 03 Apr 2023 07:40:49 GMT server cloudflare etag W/"642a8301-ae5" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 7b60c0a3ec29a80e-SYD expires Thu, 31 Dec 2037 23:55:55 GMT
GET		phishing codesandbox.io/api/v1/sandboxes/billowing-firefly-4c67/	0 0
GET BLOB	200 OK	eff9ef6f-0988-458f-b6d2-e68c9a50b886 Show response https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/	3 MB 0		Document text/html
General Check archive.org Show headers Download Go to Full URL blob:https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/eff9ef6f-0988-458f-b6d2-e68c9a50b886 Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 17a1954e4be2e347d3b8900500f666c10358819f4afb133ccebd89c3dacc2779 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Content-Length 2654390 Content-Type text/html
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	581ms 193ms	Script text/javascript	142.250.4.95 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.4.95 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f95.1e100.net Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Fri, 07 Apr 2023 23:44:45 GMT content-encoding gzip x-content-type-options nosniff age 279051 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 06 Apr 2024 23:44:45 GMT
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	251ms 250ms	Script application/javascript	69.16.175.42 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS hwcdn.net Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers Referer accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 11 Apr 2023 05:15:35 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-152b5" vary Accept-Encoding x-hw 1681190135.dop111.sj3.t,1681190135.cds111.sj3.hn,1681190135.cds207.sj3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30070
GET H2	200	images encrypted-tbn0.gstatic.com/	2 KB 3 KB	586ms 195ms	Image image/png	74.125.200.101 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSji3uKkCIRNa58VvKNMk1J-nCZF2gpyVTw8h6jbk5Z3PKiV7Lxt0ZVOCJGcEs8a6gRfkY&usqp=CAU Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 74.125.200.101 , United States, ASN15169 (GOOGLE, US), Reverse DNS sa-in-f101.1e100.net Software sffe / Resource Hash 7880c9f62276695fce3f26918074d143fa309bf4c6280798e5ecc8f2c364cbc2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:37 GMT x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2509 x-xss-protection 0 last-modified Fri, 04 Oct 2019 02:41:50 GMT server sffe report-to {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="images-tbn" expires Wed, 10 Apr 2024 05:15:37 GMT
GET H2	200	images encrypted-tbn0.gstatic.com/	3 KB 4 KB	196ms 195ms	Image image/png	74.125.200.101 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcT_nWscHt0NMdQ4G2yJql7JkGXaouoS5bKezYi3ioReBoW1VJo5gpINKDkf8ShxbjobVfs&usqp=CAU Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 74.125.200.101 , United States, ASN15169 (GOOGLE, US), Reverse DNS sa-in-f101.1e100.net Software sffe / Resource Hash ebc2d86ef6b6d39d5458ccbe1f45058e56aa64757f296975ec5ccaf53835bbf5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:37 GMT x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3541 x-xss-protection 0 last-modified Tue, 01 Oct 2019 06:56:54 GMT server sffe report-to {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="images-tbn" expires Wed, 10 Apr 2024 05:15:37 GMT
GET H/1.1	200 OK	email-marketing-icon-vector-graphics-vector-id1257404830 media.istockphoto.com/vectors/	23 KB 23 KB	681ms 241ms	Image image/jpeg	18.155.68.34 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://media.istockphoto.com/vectors/email-marketing-icon-vector-graphics-vector-id1257404830?k=20&m=1257404830&s=612x612&w=0&h=LOwm34ubd_vUzqIi5k3rxflh04NbZTZEnSTYSVmX2Jk= Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.155.68.34 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-155-68-34.sin52.r.cloudfront.net Software Kestrel / Resource Hash 7598958848975c8849ded4f745ba48265a345f2b50553e49a5a7081c34816a33 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 10 Apr 2023 15:00:01 GMT Via 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront) Last-Modified Mon, 10 Apr 2023 15:00:01 GMT Server Kestrel X-Amz-Cf-Pop SIN52-P1 Age 51336 X-Cache Hit from cloudfront Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control public, max-age=7776000 Content-Disposition inline; filename=istockphoto-1257404830-612x612.jpg Connection keep-alive Link </vectors/email-marketing-icon-vector-graphics-vector-id1257404830>; rel= "canonical" Content-Length 23140 X-Amz-Cf-Id Y--KLqDLqHSdIbohyrlghmei8ZqlOUVShraaj6p3Aj17cNv_1KtMwg==
GET H2	200	images encrypted-tbn0.gstatic.com/	4 KB 4 KB	195ms 195ms	Image image/png	74.125.200.101 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSYoaTYJflBPn6wW0hkuPHtzLBmsq-IrqYUjjJb-3CkzQahkDGOQgjvktbm8falSL3Pxy8&usqp=CAU Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 74.125.200.101 , United States, ASN15169 (GOOGLE, US), Reverse DNS sa-in-f101.1e100.net Software sffe / Resource Hash d731f0696eb6b81aed66210f7b2caf1cd18e888386a0bfaa3168dfb87f958855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:37 GMT x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4242 x-xss-protection 0 last-modified Wed, 14 Aug 2019 11:48:03 GMT server sffe report-to {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="images-tbn" expires Wed, 10 Apr 2024 05:15:37 GMT
GET H2	200	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	728ms 242ms	Script application/javascript	69.16.175.42 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS hwcdn.net Software nginx / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Request headers Referer Origin https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 11 Apr 2023 05:15:36 GMT content-encoding gzip last-modified Fri, 12 Aug 2022 13:47:02 GMT server nginx etag W/"62f659d6-10fdd" vary Accept-Encoding x-hw 1681190136.dop001.la3.t,1681190136.cds238.la3.hn,1681190136.cds204.la3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 23856
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	313ms 107ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer Origin https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 11 Apr 2023 05:15:36 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 2788918 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6157 last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xWw6A0IYjRhMqtiVzolvF6iEHjzmwdmG65q3hQi57nRyKIPbjNLlJGbxW%2B7GRAPL9Hl1fxlkaXS1PwOyp6BPISSeDrSh8gC72iXxEdFRv%2BOQL0bcKEYq1jzBNw6Q85plNjuG%2F%2FSp"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7b60c0ae2991a81a-SYD expires Sun, 31 Mar 2024 05:15:36 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 14 KB	315ms 109ms	Script application/javascript	104.18.11.207 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer Origin https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 11 Apr 2023 05:15:36 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 1001 age 8702 cdn-cachedat 10/01/2022 01:42:47 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:04 GMT cdn-proxyver 1.02 cdn-requestpullcode 200 server cloudflare etag W/"14d449eb8876fa55e1ef3c2cc52b0c17" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 2d1db790ce2f11f911caab10d40c675e timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 7b60c0ae2ce0a979-SYD cdn-requestpullsuccess True
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 21 KB	114ms 113ms	Stylesheet text/css	104.18.11.207 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: blob:https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/eff9ef6f-0988-458f-b6d2-e68c9a50b886 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer Origin https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:36 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 1000 age 8702 cdn-cachedat 03/25/2023 05:22:19 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:04 GMT cdn-proxyver 1.03 cdn-requestpullcode 200 server cloudflare etag W/"450fc463b8b1a349df717056fbb3e078" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 99433698101605b3607473ac2fde52fe timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 7b60c0b1b8fea979-SYD cdn-requestpullsuccess True
GET H2	200	css fonts.googleapis.com/	398 B 723 B	586ms 197ms	Stylesheet text/css	74.125.130.95 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Yellowtail&display=swap Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: blob:https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/eff9ef6f-0988-458f-b6d2-e68c9a50b886 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 74.125.130.95 Nashville, United States, ASN15169 (GOOGLE, US), Reverse DNS sb-in-f95.1e100.net Software ESF / Resource Hash b1cefc60fdfae6ec2b1fccb76fed899987517c7a8485a2e3bbce85e73de4bf7b Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 11 Apr 2023 05:15:37 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 11 Apr 2023 05:08:59 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 11 Apr 2023 05:15:37 GMT
GET H2	200	585b051251.js Show response kit.fontawesome.com/	11 KB 4 KB	322ms 112ms	Script text/javascript	104.18.23.52 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kit.fontawesome.com/585b051251.js Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: blob:https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/eff9ef6f-0988-458f-b6d2-e68c9a50b886 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.23.52 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb735764ab1aefbec2633325db64f1a4cffbd7172524cdf29e8f4cbd897aff4d Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers Referer Origin https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 11 Apr 2023 05:15:37 GMT strict-transport-security max-age=31536000; preload content-encoding gzip cf-cache-status HIT server cloudflare age 40 access-control-max-age 3000 access-control-allow-methods GET, OPTIONS content-type text/javascript access-control-allow-origin * cache-control max-age=60, public, must-revalidate vary origin, accept-encoding, access-control-request-headers, access-control-request-method cf-ray 7b60c0b6ba67a94f-SYD access-control-allow-headers accept, accept-langauge, content-language, content-type, fa-kit-token x-request-id F1TBm0SrwcLm7iPAYG9B
GET H2	200	hover.css runn1rnl8xzmqeh0kvov.web.app/ucspqsuf8bxoiymvvdy5p6pp9uzvyqj/	112 KB 6 KB	354ms 100ms	Stylesheet text/css	199.36.158.100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://runn1rnl8xzmqeh0kvov.web.app/ucspqsuf8bxoiymvvdy5p6pp9uzvyqj/hover.css Requested by Host: billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev URL: blob:https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/eff9ef6f-0988-458f-b6d2-e68c9a50b886 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.36.158.100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bb88454962767eb6f2ddb1aabaaf844d8a57de7e8f848d7f6928f81b54998452 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers x-served-by cache-syd10156-SYD strict-transport-security max-age=31556926; includeSubDomains; preload content-encoding br date Tue, 11 Apr 2023 05:15:37 GMT last-modified Wed, 22 Sep 2021 15:24:31 GMT x-timer S1681190137.438682,VS0,VE0 etag "e4c7b38ebf0c1bb7f7bc9193113d305dfd11817279517afe7904b1a9cf19a91f-br" vary x-fh-requested-host, accept-encoding x-cache HIT content-type text/css; charset=utf-8 cache-control max-age=3600 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 6272 x-cache-hits 3
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	59 KB 13 KB	609ms 209ms	Fetch text/css	172.64.169.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/585b051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.169.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:37 GMT via 1.1 1ce5b4ee9f2f36701e8515d9d8ae140c.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop SIN52-C3 age 8639 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sGQlV5y1W4vHHjD1hljwwezekG1KrmSjYbysydTTeWjRUwJAPK%2BmUBxNg%2FjQWBtBJ2ylE5bbE2aiHCrrX9I1TEQ3AfH%2FsBvLptZZ6RgHBGgycmQFLyG3XFvMO9NNrWr5xYRXjmpUMQ%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7b60c0ba4fb56bee-SIN access-control-allow-headers fa-kit-token x-amz-cf-id yk4_ltrAFabmQ3VcqoZVPIlhBKsFYAo7JduVU0K4cR4m2eo9zchvGA==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	26 KB 5 KB	605ms 204ms	Fetch text/css	172.64.169.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/585b051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.169.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 11 Apr 2023 05:15:37 GMT via 1.1 f06aaad108598501fc8aab5df5423ad8.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop SIN52-C3 age 8639 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"76f34b71fc9fb641507ff6a822cc07f5" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kOYd%2BUwlnkxx%2FIBr4go6Kl%2FOHG6IQPW0xi6Ufd6c0oq0CcXoz0rnqVzGMk5V5aCd08%2FD4DBBMv2PB2EcDy4rbhPDsq4aCTSKBqBCl4NTecFI2JUbtPJHSB3FikY7m6xV8y1tTHp4nA%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7b60c0ba4fb76bee-SIN access-control-allow-headers fa-kit-token x-amz-cf-id yZymeC49eACv7axVexswTHnAlm4usJbIYFVA2DHXBzdbv2gbDwpq2g==
GET DATA	200 OK	truncated /	4 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 659230429ecbaa32d61632fdae1e585dc35ce8a27579c02d4fd9ecb2b35e0289 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	144 KB 0		Image image/jpg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1515bc37b1739d942f9e3f99dd14d5021910b1b061ba3b3169ee88246d4f8cf6 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/jpg

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

codesandbox.io

URL

https://codesandbox.io/api/v1/sandboxes/billowing-firefly-4c67/phishing

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

123 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless string| s string| m function| $ function| jQuery object| FontAwesomeKitConfig function| Popper object| bootstrap function| iiII6y4cA56nC1o2nfu6se6iiii function| llll6y4ca56nc1o2nfu6se6iiii function| LLlI6y4cA56nC1o2nfu6se6iiii object| NqZOXX function| Su563Fw object| h13GPL number| S01h3W object| aPrVSt string| gzlGGJv string| dWcUdHh string| ie1lveL string| FlXKLfE string| tcZv2Q string| a37ECZT string| AoD3Yb8 string| wgG6f2 string| CzOeJi string| VAh_r3L string| gf_hcpE string| DNjBln string| LC3Jij string| dHNfzs string| rAtJTq string| rOmd6C string| pm4SB3Q string| ezaTC7 string| dfd7hI string| XDAJ8iK string| me9IyWS string| q2eMcg4 string| eCS5CTn string| ZMIxZQA string| a_6MI86 string| u7HEAX9 string| clAnES4 string| s4vbOj string| AAZo2r string| ZkFBrRp string| Jeqt97 string| QS7LOq string| sg1wm_f string| DEmyuX string| sH8bwk7 string| TGD8eL string| LAgf6Dv string| YUXJ6o string| Xiu4dB string| dKxgWkr string| B7xATHH string| P83Zppy string| CQEckk5 string| Oz9NQBW string| zF_WER string| QbXTD0V string| Wqe4Yv6 string| XeWqKS string| wCz1bf string| hTw1QM string| AGlhVKF string| WPcCR91 string| orfoq27 string| pr20dXy string| JfYq4M string| ZKIzX9N string| tDoR_O string| sxqZ5ly string| djNcrLT string| cxbe0C string| uii60V string| poVXMh string| CZiUYML string| Kbdrfcy string| QLqtdwX string| KlE693 string| zEsF8a string| WBAyaQD string| csPGbtO string| mVuge8v string| jy4IIVb string| q8OB1A string| qy2gfcR string| QUpcE4 string| jfetMq9 string| Bia3Fj string| _O8pLGt string| _nfLmS string| qIqQib string| qUhV4bO string| TX6fBV string| KhCekuP string| VgPOZn string| a7AFqS string| ioxEyve string| BQNkvBh string| D9kffxG string| lBGkqaM string| ZjQC0z object| wg12p3R object| AHT2Dj object| dI6OLF object| kuZtiu0 function| xyVneoD function| CS3UcC undefined| iPeFpk function| e80gCF function| lllll6y4ca56nc1o2nfu6se6llll function| e7Pzx9g function| lRU9xEZ function| liii6y4ca56nc1o2nfu6se6iiii function| bRpehX function| tQGU_x function| kxQHnC function| MHjlvTP function| FGwE81f function| llll6y4ca56nc1o2nfu6se6iii

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.codesandbox.io/	1969-12-31 23:59:59	Name: _cfuvid Value: 9oMX6rV6moFApxa17.MuOM3fMe83oskjuXx37ix8HOg-1681190133988-0-604800000

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/ Message: Access to fetch at 'https://codesandbox.io/api/v1/sandboxes/billowing-firefly-4c67/phishing' from origin 'https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://codesandbox.io/api/v1/sandboxes/billowing-firefly-4c67/phishing Message: Failed to load resource: net::ERR_FAILED
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 22) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 22) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 22) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 22) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: blob:https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/eff9ef6f-0988-458f-b6d2-e68c9a50b886(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://kit.fontawesome.com/585b051251.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: blob:https://billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev/eff9ef6f-0988-458f-b6d2-e68c9a50b886(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://kit.fontawesome.com/585b051251.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
billowing-firefly-4c67.eiraqaclautpliors8014.workers.dev
cdnjs.cloudflare.com
code.jquery.com
codesandbox.io
encrypted-tbn0.gstatic.com
fonts.googleapis.com
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
media.istockphoto.com
runn1rnl8xzmqeh0kvov.web.app
codesandbox.io

104.17.25.14
104.18.11.207
104.18.23.52
104.18.6.114
142.250.4.95
172.64.169.22
172.67.138.151
18.155.68.34
199.36.158.100
69.16.175.42
74.125.130.95
74.125.200.101
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
1515bc37b1739d942f9e3f99dd14d5021910b1b061ba3b3169ee88246d4f8cf6
17a1954e4be2e347d3b8900500f666c10358819f4afb133ccebd89c3dacc2779
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
659230429ecbaa32d61632fdae1e585dc35ce8a27579c02d4fd9ecb2b35e0289
683fbdef88b2ebf85e44c498687952697f4093fb1ff40f884eb6a2f3c74d0bb7
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
7598958848975c8849ded4f745ba48265a345f2b50553e49a5a7081c34816a33
7880c9f62276695fce3f26918074d143fa309bf4c6280798e5ecc8f2c364cbc2
7b792d9cff94a4f92d164ec7233833c903b4fdbaef13e37a0dc4258b8312ca83
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b1cefc60fdfae6ec2b1fccb76fed899987517c7a8485a2e3bbce85e73de4bf7b
bb735764ab1aefbec2633325db64f1a4cffbd7172524cdf29e8f4cbd897aff4d
bb88454962767eb6f2ddb1aabaaf844d8a57de7e8f848d7f6928f81b54998452
be6710b06d4414a65f2c662a28de2917b9e997b1ce74e13c891b9c9c840006cc
d731f0696eb6b81aed66210f7b2caf1cd18e888386a0bfaa3168dfb87f958855
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
ebc2d86ef6b6d39d5458ccbe1f45058e56aa64757f296975ec5ccaf53835bbf5
f74bf2cf5a8225beb66712ff4e859c5d4ba9c24123e6de2f427b4b9fde408928
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda