urlscan.io logo urlscan.io
SecurityTrails logo

confirmation.reload-page.workers.dev Open in urlscan Pro
104.21.57.178  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://confirmation.reload-page.workers.dev/
Submission: On January 07 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 2 countries across 7 domains to perform 36 HTTP transactions. The main IP is 104.21.57.178, located in and belongs to CLOUDFLARENET, US. The main domain is confirmation.reload-page.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on December 15th 2023. Valid for: 3 months.
This is the only time confirmation.reload-page.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ourtime.com (Online)

Domain & IP information

3    104.21.57.178 (None, )

ASN13335 (CLOUDFLARENET, US)
confirmation.reload-page.workers.dev
24    2620:0:890::100 (United States)

ASN54113 (FASTLY, US)
likeacharmsto.web.app
astgnuring.web.app
1    146.75.28.193 (Ashburn, United States)

ASN54113 (FASTLY, US)
i.imgur.com
1    2607:f8b0:4006:816::2003 (United States)

ASN15169 (GOOGLE, US)
www.gstatic.com
2    2607:f8b0:4006:816::200e (United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2607:f8b0:4004:c06::9a (Washington, United States)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2607:f8b0:4006:80f::2004 (United States)

ASN15169 (GOOGLE, US)
www.google.com
Apex Domain
Subdomains		 Transfer
24 web.app
likeacharmsto.web.app
astgnuring.web.app
228 KB
3 workers.dev
confirmation.reload-page.workers.dev
399 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 101
21 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 6
408 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 184
362 B
1 gstatic.com
www.gstatic.com
7 KB
1 imgur.com
i.imgur.com — Cisco Umbrella Rank: 6429
910 B
36 7
Domain Requested by
23 likeacharmsto.web.app confirmation.reload-page.workers.dev
likeacharmsto.web.app
3 confirmation.reload-page.workers.dev confirmation.reload-page.workers.dev
2 www.google-analytics.com likeacharmsto.web.app
1 www.google.com
1 stats.g.doubleclick.net likeacharmsto.web.app
1 www.gstatic.com confirmation.reload-page.workers.dev
1 i.imgur.com confirmation.reload-page.workers.dev
1 astgnuring.web.app confirmation.reload-page.workers.dev
36 8

This site contains links to these domains. Also see Links.

Domain
www.ourtime.com
www.peoplemedia.com
Subject Issuer Validity Valid
reload-page.workers.dev
GTS CA 1P5		 2023-12-15 -
2024-03-14		 3 months crt.sh
web.app
GTS CA 1D4		 2023-11-13 -
2024-02-11		 3 months crt.sh
*.imgur.com
Sectigo RSA Domain Validation Secure Server CA		 2023-03-13 -
2024-03-12		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://confirmation.reload-page.workers.dev/
Frame ID: 69667870B5ADCE5498A9E73AE468F3E4
Requests: 38 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • /firebasejs/([\d.]+)/firebase
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • moment(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

36
Requests

92 %
HTTPS

71 %
IPv6

7
Domains

8
Subdomains

8
IPs

2
Countries

657 kB
Transfer

2156 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

36 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
confirmation.reload-page.workers.dev/ 		375 KB
133 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.57.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
534099197ae07c461128ad4047d522db1f84b55d3dc23e8f33b4939b177e7dbf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
84184890afec39fc-YYZ
content-encoding
br
content-type
text/html;charset=UTF-8
date
Sun, 07 Jan 2024 01:03:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qh%2FdRnMb3I0l0OzJgdVlvQn%2FMz8XAVaoybY4nrA49Qs80hZc%2BoRxASWUl6AUOFOL91Za4ZBYlUk3AtEATdtvUSeubO4jmM5kIZduT5jcqrtjIvbqrBYNNtlS9Y6ucnX1ahGPN7%2BYIS6ThQXN%2FvATF0s3sxnd6Yc%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
analytics.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		48 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/analytics.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053617,VS0,VE2
etag
"e4478670f4fdafb5d213a38fcc7709c2d7f5a3a1580c6fab93775314a652efc9-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
17511
x-cache-hits
1
fbevents.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		92 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/fbevents.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ba6856b3aa462b18c9f5fc3b0d553eca0fe0f03d5ff668ba7d465394c85896b1
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053446,VS0,VE1
etag
"510e96a54df71459b4249b11040c5060d6d8de714d6c7549057d56e9debea948-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
20017
x-cache-hits
1
recaptcha__en.js
confirmation.reload-page.workers.dev/ 		375 KB
133 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://confirmation.reload-page.workers.dev/recaptcha__en.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.57.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
534099197ae07c461128ad4047d522db1f84b55d3dc23e8f33b4939b177e7dbf

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Sun, 07 Jan 2024 01:03:52 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BekGvToDaqBb3rwDw9Ct%2BSeF8aa2aslTQ2FauQofBFIX992E9maodds3M2l32XskNrlPG6j%2Fbw5Rza5%2F2LBnYdOWCPtMIYfX3V86DOzJMqGZN7MgvllC9r5CHqh8jc6Ok9LfCo0YUN43pkXG6JbNUglrlqcPz%2FM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
84184893cfc739fc-YYZ
alt-svc
h3=":443"; ma=86400
otSDKStub.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		17 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1dd4c3f1ea5b28ca04d4f2391197c4b57ef93d2d79ca0656bf6c5d588408e325
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053882,VS0,VE2
etag
"da8761e6709e533ef986fff57413f518f0fd514a6be49a3b0640f1ceb669130b-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
5112
x-cache-hits
1
css-3.css
confirmation.reload-page.workers.dev/ 		375 KB
133 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://confirmation.reload-page.workers.dev/css-3.css
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.57.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
534099197ae07c461128ad4047d522db1f84b55d3dc23e8f33b4939b177e7dbf

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Sun, 07 Jan 2024 01:03:52 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mTdH0QiyclAxLAikZAvN7q8HevMhl9pkbQ%2FBG6bv1nmKz0tBRzoD%2BVudGHLqDxnolKg8j3Arr2S5UB35sj8pmaYDzxiSmrD1oFrYXHxLqfUu0HHAAXE1fl6KXWA%2FSYzjXnaVpY%2FUc9EPXt359QdMedU4D3HheQA%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
84184893cfd039fc-YYZ
alt-svc
h3=":443"; ma=86400
css-1.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		1 KB
457 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/css-1.css
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0c470ec509df884415fa015b9bd291d995af7c4bf2f8008ab902ebcecb0ca81f
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.027259,VS0,VE1
etag
"51a8399e5330ed608b6709135576cc151a2cb8179134f5128d4713e58111a238-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
342
x-cache-hits
1
css-2.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		1 KB
461 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/css-2.css
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2d94290210c3c745a81025a463cf7c9b5f771df81f59bdc86b72ecb9bf93e09d
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.027807,VS0,VE1
etag
"7c8d976efab571ad6864257eef3c436d04c7c82ebf345605073c891e193b3d20-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
349
x-cache-hits
1
css.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		1 KB
458 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/css.css
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
27772d7166e861333a7feeda5314296740c74a4e54b89b34eae9ca5da82510ac
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.028142,VS0,VE1
etag
"c509c66c2896b8ee63e43dc7778babd921be4e05bd22ddd0a77ada267b0185e1-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
346
x-cache-hits
1
font-1.2.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		1 KB
324 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/font-1.2.css
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
29bb230665449654db3e588310185005192a1ebcc76ea0ee4c56465d0179775f
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.027745,VS0,VE1
etag
"7175d253300d9b48e7363d2b9abbc229307c2a34420a5e0fe44d45ca9a2cfdd1-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
212
x-cache-hits
1
redesign_fonts.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		4 KB
469 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/redesign_fonts.css
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fca102a234de9df526bd266625c7de1d8bbeb0edd2b643905e9fedcdbd6e517a
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.027725,VS0,VE4
etag
"9ea2ed0dc291bbba7d85e73b7b4a642b7b78d022d00b59bf8f96d631d5e3ea4e-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
357
x-cache-hits
1
base_external.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		29 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/base_external.css
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e32c82396f4d0755b4c8172bf295bc8ac4445c113184dcb468aadc56e25cd009
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.028142,VS0,VE0
etag
"361fddaf0cdf7cb608c6245ca9d1eb154e57b395e92271fac53f884e9ff4ad0e-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
4671
x-cache-hits
8
theme.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		38 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/theme.css
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
355f6fe361163e85cd574394db481689266987fe3f9f2a56bdf60137d88251ce
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.027718,VS0,VE2
etag
"bc28fb1be67a69894658747550d8ebb9da649d153006156610e491eba64d9a7c-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
6153
x-cache-hits
1
jquery-3.5.1.min.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		87 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/jquery-3.5.1.min.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053515,VS0,VE1
etag
"b9cf792daa968d7a06449227ae703eefca8874c6760e918ecb3de59514bd08dd-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
27960
x-cache-hits
1
jquery-migrate-3.3.1.min.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/jquery-migrate-3.3.1.min.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
90a8d6a27a26f746b4b263102f4fe120e956d99e3789325aafc7d6b7ca0ff0e4
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053546,VS0,VE1
etag
"ed5def0860e4697ece4a0419bc95d221d57f444a0a2265a32805080589b296f6-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
3567
x-cache-hits
1
moment.min.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/moment.min.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
5a52005e60e92f39a0744fe733d45496ad3769634edbbbc74df1267f9639f522
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053877,VS0,VE1
etag
"5574f2d89349968c81cea5fb015d51650ecc6539088d45b780906e64d9afeeea-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
5955
x-cache-hits
1
polyfill.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		141 B
226 B 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/polyfill.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4ee389219cbe96c6146afcbb2d57eea6ed70da6b2116eaf171f87d28672e3c04
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053875,VS0,VE2
etag
"0a9063c9ffffa453cf3f270ed7398293c9d1a11db3ce537d12dbd6dfa6c26c83-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
114
x-cache-hits
1
url-search-params-polyfill.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/url-search-params-polyfill.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9472d39218e91315437ed9cd40f68d2b5fc5013e7916ecb3867325410a8b5c54
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.054175,VS0,VE2
etag
"5e7c1ff44e0609d909877d1adc66c4ee0234b7e20b0461baed82ed5af44c3076-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1234
x-cache-hits
1
peoplemedia.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		74 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/peoplemedia.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e5e7f3c39357e9c0bcb5cdfdf90c5393857c32a2a1485210f87156fe95c1d246
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.054189,VS0,VE1
etag
"987e53f048549cac8472e603b3228e69b5a8d732f29331bb39224637560a5219-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
15815
x-cache-hits
1
menu.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		3 KB
900 B 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/menu.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b9d7d8d050d62818c532f2229d1d5a807c5d33ffa949918b6d9452578d117e32
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053590,VS0,VE1
etag
"b68cb152ca715d188f77153bc3c086bb3b6556aff46a00ee81e395fb74282073-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
788
x-cache-hits
1
loggerv2.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		9 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/loggerv2.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
58597e3384d340cc06c55b25a5f2e997fd023e54ef38d1821c260a6e66114435
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053501,VS0,VE4
etag
"ad23c9b437a34dce86ceb0804e814e0f7df6b1e4ae9bccd6c6e28c64f65c61c5-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1334
x-cache-hits
1
stacktrace-min-0.3.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/stacktrace-min-0.3.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f40c7802fed53bf864c2bb1ed8ae01f70866eb8ec379dbac518053427d904fd0
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053475,VS0,VE1
etag
"0485880e8e2b423cb5dec18c82b31c6a24512109a2b5d10457483aeddd622111-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1557
x-cache-hits
1
consent.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/consent.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c6f35072a2c354165a1c2b864a65c342745b7e82b13a09d512cf40ea6c04d187
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.053498,VS0,VE1
etag
"f20dda9855d4bc5daa0de61489f21d091477b5b904220afc77c2a43bfde6070a-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1494
x-cache-hits
1
login-form.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		2 KB
821 B 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/login-form.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d1a092bd21afd962b015db932f417201459fd3c3904faaffecc3ecdbb3b27b79
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.028391,VS0,VE1
etag
"1b838dc98f5e7e218c1793b91e2c52cbbb01765fb078ce876049bdac8a549fd5-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
686
x-cache-hits
1
otBannerSdk.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		356 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otBannerSdk.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.054281,VS0,VE2
etag
"1ad2ac0413b135d36a407bdf4c3da9e452548cd2e6db6c8431722667e6931b25-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
60173
x-cache-hits
1
js.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		89 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/js.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
95f7d8a9e89ac8086ab4532580b224aa1139fb15ddf750d16340328fb1a3ffce
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by
cache-nyc-kteb1890059-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1704589433.054419,VS0,VE10
etag
"4f64d3134afef18a85a7d0a9dfdb50eec3c814f9d48c56ff9d9c5031ab422acd-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
31024
x-cache-hits
1
countries.js
astgnuring.web.app/BWnTXc9zMBbpYMIou3RytaurkaDPGExIjhNzDFFgOlcWaed4/ 		54 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://astgnuring.web.app/BWnTXc9zMBbpYMIou3RytaurkaDPGExIjhNzDFFgOlcWaed4/countries.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
40f83d55d1eb3244af67ef893b4694ebc15a9c09f27a4401a69a9b2aa7c5dc2f
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-served-by
cache-nyc-kteb1890058-NYC
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 07 Jan 2024 01:03:53 GMT
last-modified
Sun, 09 May 2021 16:21:17 GMT
x-timer
S1704589433.053908,VS0,VE2
etag
"2d866980b5568ccc8f499617d8b55814a79fb26650646d363036d78fe29a3c05-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
23173
x-cache-hits
1
Z4repaS.gif
i.imgur.com/ 		509 B
910 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/Z4repaS.gif
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.28.193 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
275b7a867831a923bb2ab17160004afef43973ac2192b04724506608b8255d99
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Sun, 07 Jan 2024 01:03:53 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
PHL51-P1
age
134977
x-cache
Miss from cloudfront, HIT
content-length
509
x-served-by
cache-iad-kiad7000050-IAD
last-modified
Tue, 13 Oct 2015 12:42:54 GMT
server
cat factory 1.0
x-timer
S1704589433.022517,VS0,VE1
etag
"96558bf66ed388fef4dc1385be54111e"
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
9OdZ5MTP-j7uC8W4FSuiDJUsgeGaQuTLGVBlwGO6TfGJcaue9TJIpg==
x-cache-hits
1
firebase-app.js
www.gstatic.com/firebasejs/8.0.2/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/firebasejs/8.0.2/firebase-app.js
Requested by
Host: confirmation.reload-page.workers.dev
URL: https://confirmation.reload-page.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c9466a6d400491fb07de2dd7fbd8aa9f73e6ccb352ed868f17bf1453177b564d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 03 Jan 2024 00:17:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
348357
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6546
x-xss-protection
0
last-modified
Fri, 13 Nov 2020 00:33:12 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="firebase-js"
vary
Accept-Encoding
report-to
{"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 02 Jan 2025 00:17:55 GMT
acefe4aa-b70a-45d7-8ba8-ec49053046cf.json
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js/consent/acefe4aa-b70a-45d7-8ba8-ec49053046cf/ 		0
0
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7248b8c4a08b8a45d4add928a459a98f12d61c02f5a7886f14bec7084e8ffdcb

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/jpg
truncated
/ 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d841754163f6d3f7a257af53c78c476857b03f211f41f931204a840770a089bb

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/jpg
gilroy-regular.otf
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		0
0
gilroy-bold.otf
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		0
0
collect
www.google-analytics.com/j/ 		2 B
222 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1909807602&t=pageview&_s=1&dl=https%3A%2F%2Fconfirmation.reload-page.workers.dev%2F&ul=en-us&de=UTF-8&dt=OurTime%20-%20Confirm%20Your%20Identity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAUABEAAAAC~&jid=1231704754&gjid=1007738121&cid=1841210468.1704589433&tid=UA-1817027-45&_gid=1694716187.1704589433&_r=1&gtm=2ou5q1&z=134629938
Requested by
Host: likeacharmsto.web.app
URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 07 Jan 2024 01:03:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://confirmation.reload-page.workers.dev
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: likeacharmsto.web.app
URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/js.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 06 Jan 2024 23:51:49 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
4324
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Sun, 07 Jan 2024 01:51:49 GMT
collect
stats.g.doubleclick.net/j/ 		2 B
362 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-1817027-45&cid=1841210468.1704589433&jid=1231704754&gjid=1007738121&_gid=1694716187.1704589433&_u=aEBAAUAAEAAAAC~&z=1872473397
Requested by
Host: likeacharmsto.web.app
URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c06::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://confirmation.reload-page.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Sun, 07 Jan 2024 01:03:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://confirmation.reload-page.workers.dev
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-1817027-45&cid=1841210468.1704589433&jid=1231704754&_u=aEBAAUAAEAAAAC~&z=923076297
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirmation.reload-page.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 07 Jan 2024 01:03:53 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
likeacharmsto.web.app
URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js/consent/acefe4aa-b70a-45d7-8ba8-ec49053046cf/acefe4aa-b70a-45d7-8ba8-ec49053046cf.json
Domain
likeacharmsto.web.app
URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-regular.otf
Domain
likeacharmsto.web.app
URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-bold.otf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ourtime.com (Online)

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| a0_0x51cb function| a0_0x39124b function| a0_0x1400 function| a0_0x2030d0 function| a0_0x1c2a8f function| a0_0x7c7b05 function| a0_0x2801a4 object| OneTrustStub string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer function| OptanonWrapper object| _gaq undefined| $ function| jQuery function| $jq function| moment object| PeopleMediaConfig object| PeopleMedia function| uaMatch object| matched object| browser object| PeopleMediaMenu object| google_tag_data function| ga object| gaplugins function| printStackTrace function| gtag object| Adomik object| country_arr object| s_a function| populateStates function| populateCountries object| google_tag_manager object| firebase string| GoogleAnalyticsObject object| gaGlobal object| gaData

3 Cookies

Domain/Path Name / Value
.reload-page.workers.dev/ Name: _ga
Value: GA1.3.1841210468.1704589433
.reload-page.workers.dev/ Name: _gid
Value: GA1.3.1694716187.1704589433
.reload-page.workers.dev/ Name: _gat_gtag_UA_1817027_45
Value: 1

23 Console Messages

Source Level URL
Text
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/jquery-migrate-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/moment.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/polyfill.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/url-search-params-polyfill.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/peoplemedia.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/menu.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/loggerv2.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/stacktrace-min-0.3.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/consent.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/login-form.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://astgnuring.web.app/BWnTXc9zMBbpYMIou3RytaurkaDPGExIjhNzDFFgOlcWaed4/countries.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
Mixed Content: The page at 'https://confirmation.reload-page.workers.dev/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Z4repaS.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
javascript warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.gstatic.com/firebasejs/8.0.2/firebase-app.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security warning URL: https://confirmation.reload-page.workers.dev/(Line 3)
Message:
Mixed Content: The page at 'https://confirmation.reload-page.workers.dev/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Z4repaS.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
javascript error URL: https://confirmation.reload-page.workers.dev/
Message:
Access to XMLHttpRequest at 'https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js/consent/acefe4aa-b70a-45d7-8ba8-ec49053046cf/acefe4aa-b70a-45d7-8ba8-ec49053046cf.json' from origin 'https://confirmation.reload-page.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js/consent/acefe4aa-b70a-45d7-8ba8-ec49053046cf/acefe4aa-b70a-45d7-8ba8-ec49053046cf.json
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://confirmation.reload-page.workers.dev/
Message:
Access to font at 'https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-regular.otf' from origin 'https://confirmation.reload-page.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-regular.otf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://confirmation.reload-page.workers.dev/
Message:
Access to font at 'https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-bold.otf' from origin 'https://confirmation.reload-page.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-bold.otf
Message:
Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

astgnuring.web.app
confirmation.reload-page.workers.dev
i.imgur.com
likeacharmsto.web.app
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.gstatic.com
likeacharmsto.web.app
104.21.57.178
146.75.28.193
2607:f8b0:4004:c06::9a
2607:f8b0:4006:80f::2004
2607:f8b0:4006:816::2003
2607:f8b0:4006:816::200e
2620:0:890::100
0c470ec509df884415fa015b9bd291d995af7c4bf2f8008ab902ebcecb0ca81f
1dd4c3f1ea5b28ca04d4f2391197c4b57ef93d2d79ca0656bf6c5d588408e325
275b7a867831a923bb2ab17160004afef43973ac2192b04724506608b8255d99
27772d7166e861333a7feeda5314296740c74a4e54b89b34eae9ca5da82510ac
29bb230665449654db3e588310185005192a1ebcc76ea0ee4c56465d0179775f
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2d94290210c3c745a81025a463cf7c9b5f771df81f59bdc86b72ecb9bf93e09d
355f6fe361163e85cd574394db481689266987fe3f9f2a56bdf60137d88251ce
40f83d55d1eb3244af67ef893b4694ebc15a9c09f27a4401a69a9b2aa7c5dc2f
4ee389219cbe96c6146afcbb2d57eea6ed70da6b2116eaf171f87d28672e3c04
534099197ae07c461128ad4047d522db1f84b55d3dc23e8f33b4939b177e7dbf
58597e3384d340cc06c55b25a5f2e997fd023e54ef38d1821c260a6e66114435
5a52005e60e92f39a0744fe733d45496ad3769634edbbbc74df1267f9639f522
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
7248b8c4a08b8a45d4add928a459a98f12d61c02f5a7886f14bec7084e8ffdcb
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
90a8d6a27a26f746b4b263102f4fe120e956d99e3789325aafc7d6b7ca0ff0e4
9472d39218e91315437ed9cd40f68d2b5fc5013e7916ecb3867325410a8b5c54
95f7d8a9e89ac8086ab4532580b224aa1139fb15ddf750d16340328fb1a3ffce
b9d7d8d050d62818c532f2229d1d5a807c5d33ffa949918b6d9452578d117e32
ba6856b3aa462b18c9f5fc3b0d553eca0fe0f03d5ff668ba7d465394c85896b1
c6f35072a2c354165a1c2b864a65c342745b7e82b13a09d512cf40ea6c04d187
c9466a6d400491fb07de2dd7fbd8aa9f73e6ccb352ed868f17bf1453177b564d
d1a092bd21afd962b015db932f417201459fd3c3904faaffecc3ecdbb3b27b79
d841754163f6d3f7a257af53c78c476857b03f211f41f931204a840770a089bb
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e32c82396f4d0755b4c8172bf295bc8ac4445c113184dcb468aadc56e25cd009
e5e7f3c39357e9c0bcb5cdfdf90c5393857c32a2a1485210f87156fe95c1d246
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b
f40c7802fed53bf864c2bb1ed8ae01f70866eb8ec379dbac518053427d904fd0
fca102a234de9df526bd266625c7de1d8bbeb0edd2b643905e9fedcdbd6e517a