mbtydvbc.paperform.co Open in urlscan Pro
108.138.128.126  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://support.uat.cbb.nextbank.cloud/ Page URL
2. https://mbtydvbc.paperform.co/?environment=uat%20cbb Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ support.uat.cbb.nextbank.cloud/	1 KB 865 B	663ms 508ms	Document text/html	2600:9000:24f0:6000:1f:41da:28c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://support.uat.cbb.nextbank.cloud/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:24f0:6000:1f:41da:28c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 accept-language en-US,en;q=0.9 Response headers content-encoding gzip content-type text/html date Wed, 23 Aug 2023 09:36:15 GMT etag W/"8bab485acd88ca603009efb339a7b83e" last-modified Tue, 14 Jul 2020 13:33:48 GMT server AmazonS3 vary Accept-Encoding via 1.1 2301ef513d768666e30ce282b9045098.cloudfront.net (CloudFront) x-amz-cf-id fB4bYRPyJynP6ds-EzwXlmbU_6wV_MYzoz3Bb8fpX1_AFoQCbr0ULw== x-amz-cf-pop JFK50-P3 x-cache Miss from cloudfront
GET H2	200	Primary Request / Show response mbtydvbc.paperform.co/	39 KB 11 KB	242ms 139ms	Document text/html	108.138.128.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://mbtydvbc.paperform.co/?environment=uat%20cbb Requested by Host: support.uat.cbb.nextbank.cloud URL: https://support.uat.cbb.nextbank.cloud/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.128.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-128-126.jfk50.r.cloudfront.net Software nginx / Resource Hash 5681b164f73ddf4d09a1f93cb93919a07e36f2655592d8af32582bc870773108 Request headers Referer https://support.uat.cbb.nextbank.cloud/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 accept-language en-US,en;q=0.9 Response headers cache-control no-cache, private content-encoding gzip content-type text/html; charset=UTF-8 date Wed, 23 Aug 2023 09:36:15 GMT server nginx vary Accept-Encoding via 1.1 6d9771d39a0475d92b50bdd9caae11c2.cloudfront.net (CloudFront) x-amz-cf-id T_rgHChG-1NDqn4SjpoGkd5-jtGbzxu8iG2Ao1v35yl55U6FXbN4Tg== x-amz-cf-pop JFK50-P4 x-cache Miss from cloudfront
GET H2	200	formcb59df15652f3649cd74.styles.css duube1y6ojsji.cloudfront.net/	158 KB 25 KB	110ms 29ms	Stylesheet text/css	2600:9000:26fa:e000:e:f359:cf80:21
General Check archive.org Show headers Download Go to Full URL https://duube1y6ojsji.cloudfront.net/formcb59df15652f3649cd74.styles.css Requested by Host: mbtydvbc.paperform.co URL: https://mbtydvbc.paperform.co/?environment=uat%20cbb Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26fa:e000:e:f359:cf80:21 , United States, ASN (), Reverse DNS Software AmazonS3 / Resource Hash c436881eaab5504e9f93e2105071a8c44a44f9afe50edec7653c37866a1195c5 Request headers accept-language en-US,en;q=0.9 Referer https://mbtydvbc.paperform.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Sun, 20 Aug 2023 08:59:38 GMT content-encoding gzip via 1.1 86f58a7ba760944d1efd0f2fe2242e1e.cloudfront.net (CloudFront) last-modified Sun, 20 Aug 2023 08:46:08 GMT server AmazonS3 x-amz-cf-pop JFK52-P1 age 261398 etag W/"85a49057428a57d1ca6924d12f644ca3" x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/css; charset=UTF-8 cache-control max-age=31536000 x-amz-cf-id kh4Usj_Dj8WD2X-RbIWok5BbHE6Chh0QcJ9sPZxslZ0goxrOKDsBAQ==
GET H2	200	css fonts.googleapis.com/	2 KB 837 B	101ms 40ms	Stylesheet text/css	2607:f8b0:4006:809::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:300,400,700 Requested by Host: mbtydvbc.paperform.co URL: https://mbtydvbc.paperform.co/?environment=uat%20cbb Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:809::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 4ea2880bbb5055eb6493499d243a86911663924955d78ac35d672a5a0e9995ae Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://mbtydvbc.paperform.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Wed, 23 Aug 2023 09:36:15 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 23 Aug 2023 09:10:43 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 23 Aug 2023 09:36:15 GMT
GET H2	200	cb59df15652f3649cd74.form.min.js Show response duube1y6ojsji.cloudfront.net/	1 MB 329 KB	131ms 51ms	Script application/javascript	2600:9000:26fa:e000:e:f359:cf80:21
General Check archive.org Show headers Download Go to Full URL https://duube1y6ojsji.cloudfront.net/cb59df15652f3649cd74.form.min.js Requested by Host: mbtydvbc.paperform.co URL: https://mbtydvbc.paperform.co/?environment=uat%20cbb Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26fa:e000:e:f359:cf80:21 , United States, ASN (), Reverse DNS Software AmazonS3 / Resource Hash d88363fa3192796056c365dcaa27007d7a6aa4e9eb1669e1a389d607b161e033 Request headers accept-language en-US,en;q=0.9 Referer https://mbtydvbc.paperform.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Sun, 20 Aug 2023 08:59:38 GMT content-encoding gzip via 1.1 86f58a7ba760944d1efd0f2fe2242e1e.cloudfront.net (CloudFront) last-modified Sun, 20 Aug 2023 08:48:51 GMT server AmazonS3 x-amz-cf-pop JFK52-P1 age 261398 etag W/"2e719b8684bda6ab9d05d6a6f726822a" x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=UTF-8 cache-control max-age=31536000 x-amz-cf-id zijS4sFgogpgWYApOH53CBQ5-_Xpc2HSlqsDzg0cwkjtZqzEyxR0CA==
GET H2	200	css fonts.googleapis.com/	5 KB 729 B	42ms 41ms	Stylesheet text/css	2607:f8b0:4006:809::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Montserrat:regular,bold,700,400%7CLato:300,bold Requested by Host: duube1y6ojsji.cloudfront.net URL: https://duube1y6ojsji.cloudfront.net/cb59df15652f3649cd74.form.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:809::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash acbe042d1f44f95c667833817b30b7f9f6d61af9c6a1eb536196ab99ff2a9b08 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://mbtydvbc.paperform.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Wed, 23 Aug 2023 09:36:15 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 23 Aug 2023 09:36:15 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 23 Aug 2023 09:36:15 GMT
GET H2	200	S6u9w4BMUTPHh7USSwiPGQ.woff2 fonts.gstatic.com/s/lato/v24/	23 KB 23 KB	85ms 24ms	Font font/woff2	2607:f8b0:4006:821::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:300,400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:821::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 115f6a626ca115d4ad5581b59275327e0e860b30330a52b0f785561332dd2429 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://mbtydvbc.paperform.co accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Sat, 19 Aug 2023 03:32:12 GMT x-content-type-options nosniff age 367443 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23236 x-xss-protection 0 last-modified Tue, 02 May 2023 15:08:26 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 18 Aug 2024 03:32:12 GMT
GET H2	200	S6uyw4BMUTPHjx4wXg.woff2 fonts.gstatic.com/s/lato/v24/	23 KB 23 KB	120ms 59ms	Font font/woff2	2607:f8b0:4006:821::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:300,400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:821::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://mbtydvbc.paperform.co accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 17 Aug 2023 13:27:27 GMT x-content-type-options nosniff age 504528 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23580 x-xss-protection 0 last-modified Tue, 02 May 2023 15:17:22 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 16 Aug 2024 13:27:27 GMT
GET H2	200	S6u9w4BMUTPHh6UVSwiPGQ.woff2 fonts.gstatic.com/s/lato/v24/	23 KB 23 KB	107ms 47ms	Font font/woff2	2607:f8b0:4006:821::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:300,400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:821::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://mbtydvbc.paperform.co accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Sat, 19 Aug 2023 03:58:27 GMT x-content-type-options nosniff age 365868 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23040 x-xss-protection 0 last-modified Tue, 02 May 2023 15:07:25 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 18 Aug 2024 03:58:27 GMT
GET H2	200	nextbank_software_logo_final_2018.png img.paperform.co/fetch/w_400,f_auto/https://s3.amazonaws.com/pf-upload-01/u-63282/1/2020-05-28/x503uyd/	30 KB 30 KB	133ms 35ms	Image image/png	18.173.219.107
General Check archive.org Show headers Download Go to Show image Full URL https://img.paperform.co/fetch/w_400,f_auto/https://s3.amazonaws.com/pf-upload-01/u-63282/1/2020-05-28/x503uyd/nextbank_software_logo_final_2018.png Requested by Host: mbtydvbc.paperform.co URL: https://mbtydvbc.paperform.co/?environment=uat%20cbb Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.173.219.107 , United States, ASN (), Reverse DNS server-18-173-219-107.jfk52.r.cloudfront.net Software / Resource Hash 285f9ab52c3a2459c5d45a6ea8e187a3b9eb85ea98d125a293f47afc04aa98d2 Request headers accept-language en-US,en;q=0.9 Referer https://mbtydvbc.paperform.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Tue, 22 Aug 2023 10:09:51 GMT via 1.1 1f388679bb0ce4d64f0beb74575c14c6.cloudfront.net (CloudFront), 1.1 6d137176634825df2648120ac1bcc782.cloudfront.net (CloudFront) x-amz-cf-pop IAD55-P5, JFK52-P1 age 84384 x-amzn-trace-id Root=1-64e4896f-1758a02952ce8e7e0a9ece3e;Sampled=0;lineage=37514458:0 x-amzn-requestid afd29c49-a27f-4224-9840-c77a6ec8a739 x-cache Hit from cloudfront content-type image/png cache-control public, max-age=864000 x-amz-apigw-id KDppcFR9oAMFUdg= content-length 30341 x-amz-cf-id Yw6_f4L95WWGsyiS2BwQujV3PiaufAYVQUJ7wKRfgZUJEzS5dlk0sA==
GET H2	200	JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 fonts.gstatic.com/s/montserrat/v25/	30 KB 30 KB	25ms 24ms	Font font/woff2	2607:f8b0:4006:821::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Montserrat:regular,bold,700,400%7CLato:300,bold Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:821::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://mbtydvbc.paperform.co accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Wed, 16 Aug 2023 20:15:45 GMT x-content-type-options nosniff age 566430 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30928 x-xss-protection 0 last-modified Mon, 11 Jul 2022 18:57:39 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 15 Aug 2024 20:15:45 GMT
PUT H2	200	event Show response mbtydvbc.paperform.co/api/v1/form/5ed01260e4014137ae1d7c01/	1 B 356 B	111ms 111ms	Fetch text/html	108.138.128.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://mbtydvbc.paperform.co/api/v1/form/5ed01260e4014137ae1d7c01/event Requested by Host: duube1y6ojsji.cloudfront.net URL: https://duube1y6ojsji.cloudfront.net/cb59df15652f3649cd74.form.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.128.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-128-126.jfk50.r.cloudfront.net Software nginx / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Request headers x-paperform-visitorid e96d30a2784ac86fff6c3ed03f614876 x-xsrf-token x-csrf-token accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 content-type application/json accept application/json Referer https://mbtydvbc.paperform.co/?environment=uat%20cbb Response headers date Wed, 23 Aug 2023 09:36:15 GMT content-encoding gzip via 1.1 6d9771d39a0475d92b50bdd9caae11c2.cloudfront.net (CloudFront) server nginx x-amz-cf-pop JFK50-P4 vary Accept-Encoding x-ratelimit-remaining 59 content-type text/html; charset=UTF-8 x-cache Miss from cloudfront cache-control no-cache, private x-ratelimit-limit 60 x-amz-cf-id tXyUj8Z_J878ingVer7P4iiw3GuSq1tCTkmo3RY9Qsf1NrF5SEKAFg==

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| _tzs object| _state boolean| _edit number| _inj number| _is_ppradmin string| _ppradmin_user string| _user object| _ff object| _usage_limits object| _permissions object| _app object| _user_files_bucket_config object| _translation object| webpackJsonp object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill function| text object| _initialForm function| _cancelScrollOut object| React object| ReactDOM object| liveStore string| _activeColorCheckout string| _paperform_grecaptcha_sitekey object| analytics

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

duube1y6ojsji.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
img.paperform.co
mbtydvbc.paperform.co
support.uat.cbb.nextbank.cloud
108.138.128.126
18.173.219.107
2600:9000:24f0:6000:1f:41da:28c0:93a1
2600:9000:26fa:e000:e:f359:cf80:21
2607:f8b0:4006:809::200a
2607:f8b0:4006:821::2003
115f6a626ca115d4ad5581b59275327e0e860b30330a52b0f785561332dd2429
285f9ab52c3a2459c5d45a6ea8e187a3b9eb85ea98d125a293f47afc04aa98d2
4ea2880bbb5055eb6493499d243a86911663924955d78ac35d672a5a0e9995ae
5681b164f73ddf4d09a1f93cb93919a07e36f2655592d8af32582bc870773108
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
acbe042d1f44f95c667833817b30b7f9f6d61af9c6a1eb536196ab99ff2a9b08
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
c436881eaab5504e9f93e2105071a8c44a44f9afe50edec7653c37866a1195c5
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
d88363fa3192796056c365dcaa27007d7a6aa4e9eb1669e1a389d607b161e033