on-clouds-a96f.oifadccrsi.workers.dev Open in urlscan Pro
2606:4700:3035::ac43:db15  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 8614f31c-12b6-4d58-9a33-24c99d9582cf Show response on-clouds-a96f.oifadccrsi.workers.dev/	2 MB 760 KB	176ms 76ms	Document text/html	2606:4700:3035::ac43:db15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::ac43:db15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 62e17b9e51a3809fea218fe0adb3f56532bcf912d12946314bba8d58d22623ac Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-ray 840007276c654bcf-BUF content-encoding br content-type text/html;charset=UTF-8 date Thu, 04 Jan 2024 02:24:54 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hp0KXje%2B2eGTquyvCN%2FNgFt0%2FTiG9xUiW4MZsvXEZKp0xQhuaaK9PG7a1gDXvStltRax7Rg124MT3%2BvUog2jldl6ewQO48fpbCca%2BJcVgiIwPqBmPGV4SpqmoCZA%2BiWs187y%2Ba%2FFuQKH7WsD7eaiTbZztmPoH%2FW69gX9R48P0m22zHFr"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	94ms 30ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers accept-language en-US,en;q=0.9 Referer https://on-clouds-a96f.oifadccrsi.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 02:24:55 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 9534494 x-cache HIT, HIT content-length 30638 x-served-by cache-lga21965-LGA, cache-ewr18142-EWR last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1704335095.102173,VS0,VE0 etag W/"28feccc0-15851" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 438, 12613
GET BLOB	200 OK	4d184310-463f-473c-ae7a-e52faa570303 Show response https://on-clouds-a96f.oifadccrsi.workers.dev/	1 MB 0		Document text/html
General Check archive.org Show headers Download Go to Full URL blob:https://on-clouds-a96f.oifadccrsi.workers.dev/4d184310-463f-473c-ae7a-e52faa570303 Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b71c6fdcba7d71316e3457b3149b87bbfec8333313fd06730614c970e5857f2c Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Content-Length 1465886 Content-Type text/html
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	83ms 26ms	Script text/javascript	2607:f8b0:4006:816::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:816::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 03 Jan 2024 23:07:24 GMT content-encoding gzip x-content-type-options nosniff age 11852 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 02 Jan 2025 23:07:24 GMT
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	36ms 32ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers Referer accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 04 Jan 2024 02:24:56 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 9534495 x-cache HIT, HIT content-length 30070 x-served-by cache-lga21947-LGA, cache-ewr18142-EWR last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1704335096.276654,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 84, 1753
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 21 KB	119ms 55ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer Origin https://on-clouds-a96f.oifadccrsi.workers.dev accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 02:24:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 941 cdn-cachedat 10/31/2023 18:54:29 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:04 GMT cdn-proxyver 1.04 cdn-requestpullcode 200 server cloudflare etag W/"450fc463b8b1a349df717056fbb3e078" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 23c7811d35d9b949c9ff48e335f5cc3e timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 8400073009e24bc6-BUF cdn-requestpullsuccess True
GET H2	200	css fonts.googleapis.com/	1 KB 903 B	107ms 48ms	Stylesheet text/css	2607:f8b0:4006:822::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ad5f1ca3a94cebd89d45b7cf6a963a535bf28144862cffa3a41a31540f7a409f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 04 Jan 2024 02:24:56 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 04 Jan 2024 02:24:56 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 04 Jan 2024 02:24:56 GMT
GET H2	200	585b051251.js Show response kit.fontawesome.com/	12 KB 5 KB	150ms 88ms	Script text/javascript	2606:4700:4400::6812:2844 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kit.fontawesome.com/585b051251.js Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a Request headers Referer Origin https://on-clouds-a96f.oifadccrsi.workers.dev accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 04 Jan 2024 02:24:56 GMT content-encoding gzip cf-cache-status REVALIDATED server cloudflare vary origin, accept-encoding, access-control-request-headers, access-control-request-method access-control-max-age 3000 access-control-allow-methods GET, OPTIONS access-control-allow-origin * content-type text/javascript cache-control max-age=60, public, stale-while-revalidate=30 cf-ray 840007300ad64bcf-BUF access-control-allow-headers accept, accept-langauge, content-language, content-type, fa-kit-token x-request-id F6aZuQvRTpP9Mfew0Fmh
GET H/1.1	200 OK	80-804103_office-365-is-securable-but-not-secure-microsoft.png www.pinclipart.com/picdir/middle/	107 KB 43 KB	185ms 83ms	Image image/png	173.208.137.67 WII
General Check archive.org Show headers Download Go to Show image Full URL https://www.pinclipart.com/picdir/middle/80-804103_office-365-is-securable-but-not-secure-microsoft.png Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 173.208.137.67 , United States, ASN32097 (WII, US), Reverse DNS srv1-67.dzldns.net Software nginx/1.14.0 / Resource Hash c11e0dff418ff81f05a64998df774bf601715aeac44341959b918c34b41d3251 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Date Thu, 04 Jan 2024 02:24:56 GMT Content-Encoding gzip Last-Modified Sun, 22 Dec 2019 06:56:00 GMT Server nginx/1.14.0 ETag W/"5dff1380-1ab6d" Transfer-Encoding chunked Vary Accept-Encoding Content-Type image/png Connection keep-alive
GET H2	200	Outlook-icon-on-transparent-background-PNG.png image.similarpng.com/very-thumbnail/2021/09/	68 KB 68 KB	168ms 53ms	Image image/png	2606:4700::6812:dc0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image.similarpng.com/very-thumbnail/2021/09/Outlook-icon-on-transparent-background-PNG.png Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:dc0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e4aaea8bc5be7cc2e82bd23355aa9a29b5f8c58a234293e188b90d589e9033db Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 02:24:56 GMT strict-transport-security max-age=15552000; includeSubDomains; preload cf-cache-status HIT x-amz-request-id tx000000000000071d9ee72-00656a349a-4d33653d-nyc3b x-envoy-upstream-healthchecked-cluster content-length 69286 last-modified Mon, 13 Sep 2021 14:14:39 GMT server cloudflare etag "023bff6503a7c777fb61eb08bc9ce84a" vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding content-type image/png x-do-cdn-uuid 072a0ebe-bbef-4350-ab6e-e04d2ac99d6c x-rgw-object-type Normal cache-control max-age=3600 accept-ranges bytes cf-ray 8400073159714bcc-BUF
GET H2	200	images encrypted-tbn0.gstatic.com/	4 KB 4 KB	90ms 30ms	Image image/png	2607:f8b0:4006:80e::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSwt0Wr5uodzG7-sVzAC53bWMdf9_lngTlrKiQsRxw48YJ6hAOCn-GFa__IymxiQseYF0s&usqp=CAU Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80e::200e , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ac9ca3052e8894414df2ca5f150f03ea086e07899634a98c9452ae73a86ac9b0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 00:24:18 GMT x-content-type-options nosniff age 7238 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3974 x-xss-protection 0 last-modified Wed, 13 Nov 2019 04:48:28 GMT server sffe report-to {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="images-tbn" expires Fri, 03 Jan 2025 00:24:18 GMT
GET H2	200	images encrypted-tbn0.gstatic.com/	5 KB 5 KB	87ms 28ms	Image image/jpeg	2607:f8b0:4006:80e::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQEgm6xT0Oa1ZGAnJKTY4Ijvse1mMtUmNS43Ee1fTLRmkzvBaqkRFvykICJdk9KLfVV46Q&usqp=CAU Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80e::200e , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f278759a7bacecd4acecee9386bd0937cd0da327967de61c48381c8fe9a1963b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 00:24:18 GMT x-content-type-options nosniff age 7238 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4896 x-xss-protection 0 last-modified Sat, 13 Oct 2018 22:03:27 GMT server sffe report-to {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="images-tbn" expires Fri, 03 Jan 2025 00:24:18 GMT
GET H2	200	images encrypted-tbn0.gstatic.com/	7 KB 7 KB	90ms 32ms	Image image/png	2607:f8b0:4006:80e::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcR8X9YX2EtdgLet95X7sJ_9UI7Jst0vgxUMYNTt3m8npKpU6K_Wi9379Twj3GwyTnqrUiU&usqp=CAU Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80e::200e , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2b5e34b465ea48aa40348054e373b5cc8d72a04452cabaa1d54c1a3d0cab54a1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 00:24:18 GMT x-content-type-options nosniff age 7238 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 7164 x-xss-protection 0 last-modified Thu, 17 Oct 2019 04:38:22 GMT server sffe report-to {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="images-tbn" expires Fri, 03 Jan 2025 00:24:18 GMT
GET H2	200	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	86ms 27ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Request headers Referer Origin https://on-clouds-a96f.oifadccrsi.workers.dev accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 04 Jan 2024 02:24:56 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 9431295 x-cache HIT, HIT content-length 23856 x-served-by cache-lga21963-LGA, cache-nyc-kteb1890059-NYC last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1704335096.329460,VS0,VE0 etag W/"28feccc0-10fdd" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 4, 41180
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	94ms 34ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer Origin https://on-clouds-a96f.oifadccrsi.workers.dev accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 04 Jan 2024 02:24:56 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 1918244 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 6157 last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FLLBcCSvgf2j0cr0utvPlL3Aw3afz1UeY6QpY%2BKsIjwKkuyMg4CNxSKUntPSX82CoEVZvtNvOsPh62eajjGMUyyni67pecDT5r6GBYWWLhwAijDqPVE9FlpspRqE3OJhJ1N2%2B6WxSRKV3Fs43Qpmd1Uc"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8400073008b44bd3-BUF expires Tue, 24 Dec 2024 02:24:56 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 14 KB	98ms 37ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer Origin https://on-clouds-a96f.oifadccrsi.workers.dev accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 04 Jan 2024 02:24:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 845 age 116567 cdn-cachedat 10/31/2023 18:51:41 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:04 GMT cdn-proxyver 1.04 cdn-requestpullcode 200 server cloudflare etag W/"14d449eb8876fa55e1ef3c2cc52b0c17" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 57e1115de53a6fd3c98fc6b296b3de0e timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 8400073009e34bc6-BUF cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.2.1/	85 KB 30 KB	97ms 53ms	Script text/javascript	2607:f8b0:4006:816::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:816::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 01 Jan 2024 22:45:32 GMT content-encoding gzip x-content-type-options nosniff age 185964 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30306 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 31 Dec 2024 22:45:32 GMT
GET H2	200	kisspng-microsoft-office-365-office-online-computer-softwa-office-5abb01d66a0b39.1638325715222051424344.jpg img2.pngdownload.id/20180327/wfq/	53 KB 54 KB	278ms 36ms	Image image/jpeg	2606:4700:3032::ac43:b6a2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://img2.pngdownload.id/20180327/wfq/kisspng-microsoft-office-365-office-online-computer-softwa-office-5abb01d66a0b39.1638325715222051424344.jpg Requested by Host: on-clouds-a96f.oifadccrsi.workers.dev URL: https://on-clouds-a96f.oifadccrsi.workers.dev/8614f31c-12b6-4d58-9a33-24c99d9582cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:b6a2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e6e8d049eae71adc7885cd270fb033e975af9ead0ca3535a40debdd00a78e502 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 02:24:56 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 116567 alt-svc h3=":443"; ma=86400 content-length 54749 last-modified Wed, 28 Mar 2018 02:45:42 GMT server cloudflare etag "5abb01d6-d5dd" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eWY%2FyQvVQci6QQAli9Lb1ce%2Bv6%2FDpycapNpwQN4RU%2FKNObPBpfna%2F5o6A4K%2BgSZxIjh%2BlhkQsHfUE5Qa7O%2Bm7g6QEk3m13rwAl2zQZWoaI04KFMjKqhdLpd%2BGSYpQC500o9qICuklr%2Bq8vr%2B9v2Wqr8X"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control max-age=864000 accept-ranges bytes cf-ray 840007323b224bc7-BUF expires Fri, 12 Jan 2024 18:00:13 GMT
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	59 KB 13 KB	103ms 39ms	Fetch text/css	2606:4700:e0::ac40:6b17 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/585b051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:6b17 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 02:24:56 GMT via 1.1 bb230469f03d4df9d78eb6119c0e0ccc.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop JFK50-P8 age 116567 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TTrf7bF85LlF07hIjJjKLUJED7mxmGbAjgWrO8fF%2FlaW2ijVoYYf92a2XYubCnjHougkGplqo9BOVejAW9kUGzp1xPygoxWVgCGQ52qBLyASN4Ja7yEjFI4fB%2Bqu8BxZsO4lifpOiQzrVmUHwASjgiaN3g%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 840007310c58423d-EWR access-control-allow-headers fa-kit-token x-amz-cf-id flREWcjwzCwn-d0EjD7eN6knGZjurc7afe0TbmtWG-qHecemJs5eFw==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	26 KB 5 KB	100ms 37ms	Fetch text/css	2606:4700:e0::ac40:6b17 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/585b051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:6b17 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 02:24:56 GMT via 1.1 774fddee085016d16b500fd9201faeb2.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop JFK50-P8 age 116567 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"76f34b71fc9fb641507ff6a822cc07f5" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CpVDqz5H80EPIXZjbefbbnofI5bmohDrDL7hrbGPjY0ev7anpFDcSOreClxyJ0tNXIY2fLWBXRz2lz016ZRH8XEKaqDCe0lwc%2BwEAFlsup4ivJMmq0ql8cLScp8C4qvY%2F1sOSJpyX5M2bsQQcx9VuRW6pA%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 840007310c57423d-EWR access-control-allow-headers fa-kit-token x-amz-cf-id xMAcNIVmo4kRNsphl3ZZR0KRsMWvK2ZbZrrlpYeyQi115IeatO1-aw==
GET		jquery.min.js ajax.googleapis.com/ajax/libs/jquery/1.10.2/	0 0
GET DATA	200 OK	truncated /	83 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 990e62cf9f4a4c76ea6406df72453e97d8fb439b77ca975f08d1d727acfdb071 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	27 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 94f584a17bcf5868513c7e0b8a7085df161aac6fc6deef8907d1579ed8312899 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Content-Type image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

ajax.googleapis.com

URL

http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

167 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture string| s string| m function| _0x2e52 function| _0x2d0f function| _0xc491fa function| $ function| jQuery object| FontAwesomeKitConfig string| message function| rtclickcheck string| version_ function| _0x4c55 function| _0x5a8349 function| _0x1369 function| _0x140e function| _0x545f function| _0x1295 function| _0xeee000 function| _0x268f function| _0x3047 function| _0x1f0043 function| _0x22c9 function| _0x1fde function| _0x1795 function| _0x29e93a function| _0x7a88 function| _0x4bc7e5 function| _0x3a27 function| _0x30cd function| _0x190c function| _0x3a87 function| _0x1d0364 function| _0x3d31 function| _0x5d52 function| _0x24bb function| _0x49a2 function| _0xa305 function| _0x192e function| _0x284e08 function| _0x2314 function| _0x51a2 function| _0x32ff55 function| _0x255c function| _0x5ba1 function| _0x52bd function| _0x351afc function| _0x226ee6 function| _0x5610 function| _0x4f4e function| _0x226b function| _0x15e2d1 function| _0x4eb7 function| _0x5249 function| _0x4ee4 function| Popper object| bootstrap function| llLL6y4Ca56nC1o2nfu6se6iii function| llll6y4ca56nc1o2nfu6se6lli function| LLlL6y4Ca56nC1o2nfu6se6iii string| j5_AZjW string| IYxEAS object| njVdy_ function| oHhDe2 object| v4y2FeM number| bzmuqXf object| YFAHcC string| VDVKc6 string| ui_Fk6X string| AGgTFdR string| JCHzjY string| bl7mPg string| DPtDgy string| icuLhqN string| ax5VIe string| E5yeI0 string| GB1tTX string| iYEO1w string| H4klFu string| rLxukT string| lDAW10v string| tjqSOUy string| sXJVYyV string| vgsfF0 string| bgXQwiF string| SeChNi string| NRfOfj string| D5Qp728 string| HlAxs3h string| I1Oyrd string| fR0cQa string| B_RUUD string| tDvkmGl string| _h5nXA string| EkwGSiR string| vyTlW2 string| cwz9KW string| fEIQbR0 string| qExT2kA string| UwGA0h string| OLBwarG string| hfNzNs string| OVgQB3 string| rfdnnCy string| qLF0Qn string| ovwR5XV string| CYmUne string| AClIPfR string| dy6zmv string| MFZap1 string| cwXePG2 string| FAeYOB string| RLdyX1U string| OgsUhVi string| hnLBPkW string| U3qyyP string| Yqrblz string| ZNJkwmD string| wjdIfh4 string| P7FA7Ay string| jxAMUmT string| FeGw9aA string| xAbcGg string| wF7GSR string| IomLqp string| fFcHjl string| v42dWSH string| TYEJa5l string| AXv8TL string| QjD3ui string| QzMl6k string| b4vafVr string| xRBsuqI string| cUUZD8c string| rKGe7NG string| Zs5gal string| DwZXKQB string| eb9S5wz string| RM6T7Y string| ykWYp4u string| EYFkAua string| SDvnMxd string| vjnRtrK string| ZwglNl string| ZLNjT2R string| dSb6c0 string| D_XQY9t string| Rgw8Hb4 string| Nevuxl1 string| KVG2nN string| G6UMHc string| KMBz0m object| HMf7yJ object| w34Bdr8 object| XwttWRm object| eGYzNw function| byht3qe function| r9ie21n function| ZK1Gx11 function| tlF1D2K function| liii6y4ca56nc1o2nfu6se6iiii function| lllll6y4ca56nc1o2nfu6se6llll function| bWZ4Ud function| hC0ecx function| GRr_37g function| ZmZmdD function| llii6y4ca56nc1o2nfu6se6iiii

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.image.similarpng.com/	1970-01-20 17:25:36	Name: __cf_bm Value: QWiQ0xv6FrihebqMbNEiKlr5l5RDOdCj8CefRpacUC8-1704335096-1-Aa7IOw9twZUVfdolhLnJWfIQWjl74khc8X6SxaFZiqmvel/LVCNckk0QlHzj6kHCRHnpeuPng4TlI0bKphE+1Ac=

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://kit.fontawesome.com/585b051251.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	error	URL: blob:https://on-clouds-a96f.oifadccrsi.workers.dev/4d184310-463f-473c-ae7a-e52faa570303 Message: Mixed Content: The page at 'blob:https://on-clouds-a96f.oifadccrsi.workers.dev/4d184310-463f-473c-ae7a-e52faa570303' was loaded over HTTPS, but requested an insecure script 'http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
encrypted-tbn0.gstatic.com
fonts.googleapis.com
image.similarpng.com
img2.pngdownload.id
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
on-clouds-a96f.oifadccrsi.workers.dev
www.pinclipart.com
ajax.googleapis.com

173.208.137.67
2606:4700:3032::ac43:b6a2
2606:4700:3035::ac43:db15
2606:4700:4400::6812:2844
2606:4700::6811:180e
2606:4700::6812:acf
2606:4700::6812:dc0
2606:4700:e0::ac40:6b17
2607:f8b0:4006:80e::200e
2607:f8b0:4006:816::200a
2607:f8b0:4006:822::200a
2a04:4e42:200::649
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
2b5e34b465ea48aa40348054e373b5cc8d72a04452cabaa1d54c1a3d0cab54a1
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
62e17b9e51a3809fea218fe0adb3f56532bcf912d12946314bba8d58d22623ac
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
94f584a17bcf5868513c7e0b8a7085df161aac6fc6deef8907d1579ed8312899
990e62cf9f4a4c76ea6406df72453e97d8fb439b77ca975f08d1d727acfdb071
a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
ac9ca3052e8894414df2ca5f150f03ea086e07899634a98c9452ae73a86ac9b0
ad5f1ca3a94cebd89d45b7cf6a963a535bf28144862cffa3a41a31540f7a409f
b71c6fdcba7d71316e3457b3149b87bbfec8333313fd06730614c970e5857f2c
c11e0dff418ff81f05a64998df774bf601715aeac44341959b918c34b41d3251
e4aaea8bc5be7cc2e82bd23355aa9a29b5f8c58a234293e188b90d589e9033db
e6e8d049eae71adc7885cd270fb033e975af9ead0ca3535a40debdd00a78e502
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f278759a7bacecd4acecee9386bd0937cd0da327967de61c48381c8fe9a1963b
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda