urlscan.io logo urlscan.io
SecurityTrails logo

bush-9afc.state-zip.workers.dev Open in urlscan Pro
172.67.184.121  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://bush-9afc.state-zip.workers.dev/
Effective URL: https://bush-9afc.state-zip.workers.dev/
Submission Tags: @phish_report
Submission: On August 25 via api from FI — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 1 countries across 5 domains to perform 37 HTTP transactions. The main IP is 172.67.184.121, located in United States and belongs to CLOUDFLARENET, US. The main domain is bush-9afc.state-zip.workers.dev.
TLS certificate: Issued by WE1 on July 15th 2024. Valid for: 3 months.
This is the only time bush-9afc.state-zip.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ourtime.com (Online)

Domain & IP information

IP Address AS Autonomous System
4 172.67.184.121 13335 (CLOUDFLAR...)
25 199.36.158.100 54113 (FASTLY)
2 199.232.192.193 54113 (FASTLY)
1 142.251.221.3 15169 (GOOGLE)
2 142.251.220.238 15169 (GOOGLE)
37 6
4    172.67.184.121 (United States)

ASN13335 (CLOUDFLARENET, US)
bush-9afc.state-zip.workers.dev
25    199.36.158.100 (United States)

ASN54113 (FASTLY, US)
likeacharmsto.web.app
astgnuring.web.app
2    199.232.192.193 (United States)

ASN54113 (FASTLY, US)
i.imgur.com
1    142.251.221.3 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: mnl08s02-in-f3.1e100.net
www.gstatic.com
2    142.251.220.238 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: mnl08s01-in-f14.1e100.net
www.google-analytics.com
Apex Domain
Subdomains		 Transfer
25 web.app
likeacharmsto.web.app
astgnuring.web.app
230 KB
4 workers.dev
bush-9afc.state-zip.workers.dev
215 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 104
21 KB
2 imgur.com
i.imgur.com — Cisco Umbrella Rank: 7108
294 B
1 gstatic.com
www.gstatic.com
7 KB
37 5
Domain Requested by
24 likeacharmsto.web.app bush-9afc.state-zip.workers.dev
likeacharmsto.web.app
4 bush-9afc.state-zip.workers.dev bush-9afc.state-zip.workers.dev
2 www.google-analytics.com likeacharmsto.web.app
2 i.imgur.com bush-9afc.state-zip.workers.dev
1 www.gstatic.com bush-9afc.state-zip.workers.dev
1 astgnuring.web.app bush-9afc.state-zip.workers.dev
37 6

This site contains links to these domains. Also see Links.

Domain
www.ourtime.com
www.peoplemedia.com
Subject Issuer Validity Valid
state-zip.workers.dev
WE1		 2024-07-15 -
2024-10-13		 3 months crt.sh
web.app
WR4		 2024-07-26 -
2024-10-24		 3 months crt.sh
*.imgur.com
Sectigo RSA Domain Validation Secure Server CA		 2024-02-15 -
2025-02-14		 a year crt.sh
*.gstatic.com
WR2		 2024-07-30 -
2024-10-22		 3 months crt.sh
*.google-analytics.com
WR2		 2024-07-30 -
2024-10-22		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://bush-9afc.state-zip.workers.dev/
Frame ID: C371149DA6AE05AC56E7513BCCA4A679
Requests: 37 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://bush-9afc.state-zip.workers.dev/ HTTP 307
    https://bush-9afc.state-zip.workers.dev/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /firebasejs/([\d.]+)/firebase
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • moment(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

37
Requests

92 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

6
IPs

1
Countries

473 kB
Transfer

1916 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://bush-9afc.state-zip.workers.dev/ HTTP 307
    https://bush-9afc.state-zip.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

37 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
bush-9afc.state-zip.workers.dev/
Redirect Chain
  • http://bush-9afc.state-zip.workers.dev/
  • https://bush-9afc.state-zip.workers.dev/
224 KB
54 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bush-9afc.state-zip.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.184.121 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b443e3b69c21de93a06ce2dca807ba81a74bf383eadb4d89a77d4c0d65cd5b55

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
8b8761a4a826689c-SYD
content-encoding
br
content-type
text/html;charset=UTF-8
date
Sun, 25 Aug 2024 00:14:21 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oa4nwALIO0LvLjHTNqSHQfOAuB6YZBndDvK%2F1Bpm%2Frt9zYrxHvYApbaWM%2B2EuTJibT0o5IUPp7cn1sPymHLzqizWZ66Tf%2FAh%2F90q9zPyW3otleXsBfQKMbjZ%2BS6NRKIATIkQ6m8qr%2BX60VSQimlUILRA"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://bush-9afc.state-zip.workers.dev/
Non-Authoritative-Reason
HSTS
analytics.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		48 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/analytics.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594281,VS0,VE1
etag
"e4478670f4fdafb5d213a38fcc7709c2d7f5a3a1580c6fab93775314a652efc9-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
17511
x-served-by
cache-syd10160-SYD
fbevents.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		92 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/fbevents.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ba6856b3aa462b18c9f5fc3b0d553eca0fe0f03d5ff668ba7d465394c85896b1
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594280,VS0,VE1
etag
"510e96a54df71459b4249b11040c5060d6d8de714d6c7549057d56e9debea948-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
20017
x-served-by
cache-syd10160-SYD
recaptcha__en.js
bush-9afc.state-zip.workers.dev/ 		224 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bush-9afc.state-zip.workers.dev/recaptcha__en.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.184.121 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b443e3b69c21de93a06ce2dca807ba81a74bf383eadb4d89a77d4c0d65cd5b55

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Sun, 25 Aug 2024 00:14:21 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aK9KsXtyJE5ve9R5Wc9XXI%2FMpso8a%2Faw9FDnvJfU0LkXYaHRBmLK%2BM75y7MHSFAJKSvqrZQexY50I3h54JRYZNWbzDfv9pAsSJs81603217khzLjveqFm2TImuk7llIznKDGSdD15L7t6tU0%2BesHsDGC"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
8b8761a6faea689c-SYD
alt-svc
h3=":443"; ma=86400
otSDKStub.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		17 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1dd4c3f1ea5b28ca04d4f2391197c4b57ef93d2d79ca0656bf6c5d588408e325
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594444,VS0,VE1
etag
"da8761e6709e533ef986fff57413f518f0fd514a6be49a3b0640f1ceb669130b-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
5112
x-served-by
cache-syd10160-SYD
css-3.css
bush-9afc.state-zip.workers.dev/ 		224 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bush-9afc.state-zip.workers.dev/css-3.css
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.184.121 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b443e3b69c21de93a06ce2dca807ba81a74bf383eadb4d89a77d4c0d65cd5b55

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Sun, 25 Aug 2024 00:14:21 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YDvE0cgzwCKzyDvdqpvjmOKcwBBpUG9C%2B4yaeMBr8L6IsyI6jftmlPffKWT4BYQaRTtcgNwVSZ%2BbOLdS3oZ6fD%2FBOgs437zX8q7ChGUwqXf4yGYIXbLgiEmdgY%2FDG8W%2BYkK%2FPBo6zggLM1Rg6tu3iX1G"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
8b8761a6faed689c-SYD
alt-svc
h3=":443"; ma=86400
css-1.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		1 KB
457 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/css-1.css
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0c470ec509df884415fa015b9bd291d995af7c4bf2f8008ab902ebcecb0ca81f
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.593515,VS0,VE1
etag
"51a8399e5330ed608b6709135576cc151a2cb8179134f5128d4713e58111a238-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
342
x-served-by
cache-syd10160-SYD
css-2.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		1 KB
461 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/css-2.css
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2d94290210c3c745a81025a463cf7c9b5f771df81f59bdc86b72ecb9bf93e09d
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.593002,VS0,VE2
etag
"7c8d976efab571ad6864257eef3c436d04c7c82ebf345605073c891e193b3d20-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
349
x-served-by
cache-syd10160-SYD
css.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		1 KB
573 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/css.css
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
27772d7166e861333a7feeda5314296740c74a4e54b89b34eae9ca5da82510ac
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.593468,VS0,VE301
etag
"c509c66c2896b8ee63e43dc7778babd921be4e05bd22ddd0a77ada267b0185e1-br"
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
346
x-served-by
cache-syd10160-SYD
font-1.2.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		1 KB
324 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/font-1.2.css
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
29bb230665449654db3e588310185005192a1ebcc76ea0ee4c56465d0179775f
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.593459,VS0,VE1
etag
"7175d253300d9b48e7363d2b9abbc229307c2a34420a5e0fe44d45ca9a2cfdd1-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
212
x-served-by
cache-syd10160-SYD
redesign_fonts.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		4 KB
469 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/redesign_fonts.css
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fca102a234de9df526bd266625c7de1d8bbeb0edd2b643905e9fedcdbd6e517a
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.592992,VS0,VE1
etag
"9ea2ed0dc291bbba7d85e73b7b4a642b7b78d022d00b59bf8f96d631d5e3ea4e-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
357
x-served-by
cache-syd10160-SYD
base_external.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		29 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/base_external.css
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e32c82396f4d0755b4c8172bf295bc8ac4445c113184dcb468aadc56e25cd009
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.593496,VS0,VE1
etag
"361fddaf0cdf7cb608c6245ca9d1eb154e57b395e92271fac53f884e9ff4ad0e-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
4671
x-served-by
cache-syd10160-SYD
theme.css
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		38 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/theme.css
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
355f6fe361163e85cd574394db481689266987fe3f9f2a56bdf60137d88251ce
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
2
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.593524,VS0,VE0
etag
"bc28fb1be67a69894658747550d8ebb9da649d153006156610e491eba64d9a7c-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
6153
x-served-by
cache-syd10160-SYD
jquery-3.5.1.min.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		87 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/jquery-3.5.1.min.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594320,VS0,VE1
etag
"b9cf792daa968d7a06449227ae703eefca8874c6760e918ecb3de59514bd08dd-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
27960
x-served-by
cache-syd10160-SYD
jquery-migrate-3.3.1.min.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/jquery-migrate-3.3.1.min.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
90a8d6a27a26f746b4b263102f4fe120e956d99e3789325aafc7d6b7ca0ff0e4
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594311,VS0,VE1
etag
"ed5def0860e4697ece4a0419bc95d221d57f444a0a2265a32805080589b296f6-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
3567
x-served-by
cache-syd10160-SYD
moment.min.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/moment.min.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
5a52005e60e92f39a0744fe733d45496ad3769634edbbbc74df1267f9639f522
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594347,VS0,VE1
etag
"5574f2d89349968c81cea5fb015d51650ecc6539088d45b780906e64d9afeeea-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
5955
x-served-by
cache-syd10160-SYD
polyfill.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		141 B
357 B 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/polyfill.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4ee389219cbe96c6146afcbb2d57eea6ed70da6b2116eaf171f87d28672e3c04
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594392,VS0,VE1
etag
"0a9063c9ffffa453cf3f270ed7398293c9d1a11db3ce537d12dbd6dfa6c26c83-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
114
x-served-by
cache-syd10160-SYD
url-search-params-polyfill.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/url-search-params-polyfill.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9472d39218e91315437ed9cd40f68d2b5fc5013e7916ecb3867325410a8b5c54
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594361,VS0,VE1
etag
"5e7c1ff44e0609d909877d1adc66c4ee0234b7e20b0461baed82ed5af44c3076-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1234
x-served-by
cache-syd10160-SYD
peoplemedia.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		74 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/peoplemedia.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e5e7f3c39357e9c0bcb5cdfdf90c5393857c32a2a1485210f87156fe95c1d246
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594425,VS0,VE1
etag
"987e53f048549cac8472e603b3228e69b5a8d732f29331bb39224637560a5219-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
15815
x-served-by
cache-syd10160-SYD
menu.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		3 KB
900 B 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/menu.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b9d7d8d050d62818c532f2229d1d5a807c5d33ffa949918b6d9452578d117e32
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594612,VS0,VE1
etag
"b68cb152ca715d188f77153bc3c086bb3b6556aff46a00ee81e395fb74282073-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
788
x-served-by
cache-syd10160-SYD
loggerv2.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		9 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/loggerv2.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
58597e3384d340cc06c55b25a5f2e997fd023e54ef38d1821c260a6e66114435
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594516,VS0,VE1
etag
"ad23c9b437a34dce86ceb0804e814e0f7df6b1e4ae9bccd6c6e28c64f65c61c5-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1334
x-served-by
cache-syd10160-SYD
stacktrace-min-0.3.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/stacktrace-min-0.3.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f40c7802fed53bf864c2bb1ed8ae01f70866eb8ec379dbac518053427d904fd0
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.593432,VS0,VE2
etag
"0485880e8e2b423cb5dec18c82b31c6a24512109a2b5d10457483aeddd622111-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1557
x-served-by
cache-syd10160-SYD
consent.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/consent.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c6f35072a2c354165a1c2b864a65c342745b7e82b13a09d512cf40ea6c04d187
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.594466,VS0,VE1
etag
"f20dda9855d4bc5daa0de61489f21d091477b5b904220afc77c2a43bfde6070a-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1494
x-served-by
cache-syd10160-SYD
login-form.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		2 KB
821 B 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/login-form.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d1a092bd21afd962b015db932f417201459fd3c3904faaffecc3ecdbb3b27b79
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.593482,VS0,VE1
etag
"1b838dc98f5e7e218c1793b91e2c52cbbb01765fb078ce876049bdac8a549fd5-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
686
x-served-by
cache-syd10160-SYD
otBannerSdk.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		356 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otBannerSdk.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.637945,VS0,VE1
etag
"1ad2ac0413b135d36a407bdf4c3da9e452548cd2e6db6c8431722667e6931b25-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
60173
x-served-by
cache-syd10160-SYD
js.js
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		89 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/js.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
95f7d8a9e89ac8086ab4532580b224aa1139fb15ddf750d16340328fb1a3ffce
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.637919,VS0,VE1
etag
"4f64d3134afef18a85a7d0a9dfdb50eec3c814f9d48c56ff9d9c5031ab422acd-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
31024
x-served-by
cache-syd10160-SYD
countries.js
astgnuring.web.app/BWnTXc9zMBbpYMIou3RytaurkaDPGExIjhNzDFFgOlcWaed4/ 		54 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://astgnuring.web.app/BWnTXc9zMBbpYMIou3RytaurkaDPGExIjhNzDFFgOlcWaed4/countries.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
40f83d55d1eb3244af67ef893b4694ebc15a9c09f27a4401a69a9b2aa7c5dc2f
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Sun, 09 May 2021 16:21:17 GMT
x-timer
S1724544862.593409,VS0,VE2
etag
"2d866980b5568ccc8f499617d8b55814a79fb26650646d363036d78fe29a3c05-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
23173
x-served-by
cache-syd10121-SYD
logo_v2.png
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/logo_v2.png
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
7248b8c4a08b8a45d4add928a459a98f12d61c02f5a7886f14bec7084e8ffdcb
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-cache-hits
0
strict-transport-security
max-age=31556926; includeSubDomains; preload
date
Sun, 25 Aug 2024 00:14:21 GMT
last-modified
Tue, 01 Jun 2021 11:46:12 GMT
x-timer
S1724544862.650422,VS0,VE1
etag
"e811cee4c2fb0127064833fa4b56d761ba26a805bffd6dadf67f48a61c984b46"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
image/png
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1737
x-served-by
cache-syd10162-SYD
tHUexsj.png
i.imgur.com/ 		0
52 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/tHUexsj.png
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.192.193 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-served-by
cache-bfi-kbfi7400044-BFI
date
Sun, 25 Aug 2024 00:14:22 GMT
strict-transport-security
max-age=300
server
cat factory 1.0
x-timer
S1724544862.013057,VS0,VE0
x-cache
MISS
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
Z4repaS.gif
i.imgur.com/ 		0
242 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/Z4repaS.gif
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.192.193 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

x-served-by
cache-bfi-kbfi7400044-BFI
date
Sun, 25 Aug 2024 00:14:22 GMT
strict-transport-security
max-age=300
server
cat factory 1.0
x-timer
S1724544862.012965,VS0,VE0
x-cache
MISS
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
firebase-app.js
www.gstatic.com/firebasejs/8.0.2/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/firebasejs/8.0.2/firebase-app.js
Requested by
Host: bush-9afc.state-zip.workers.dev
URL: https://bush-9afc.state-zip.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.221.3 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
mnl08s02-in-f3.1e100.net
Software
sffe /
Resource Hash
c9466a6d400491fb07de2dd7fbd8aa9f73e6ccb352ed868f17bf1453177b564d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 23 Aug 2024 20:05:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
101315
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6546
x-xss-protection
0
last-modified
Fri, 13 Nov 2020 00:33:12 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="firebase-js"
vary
Accept-Encoding
report-to
{"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 23 Aug 2025 20:05:46 GMT
acefe4aa-b70a-45d7-8ba8-ec49053046cf.json
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js/consent/acefe4aa-b70a-45d7-8ba8-ec49053046cf/ 		0
0
gilroy-regular.otf
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		0
0
gilroy-bold.otf
likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/ 		0
0
collect
www.google-analytics.com/j/ 		1 B
217 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1009568804&t=pageview&_s=1&dl=https%3A%2F%2Fbush-9afc.state-zip.workers.dev%2F&ul=en-au&de=UTF-8&dt=OurTime%20-%20Confirm%20Your%20Identity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAUABEAAAAC~&jid=1348919132&gjid=94667220&cid=1759855869.1724544862&tid=UA-1817027-45&_gid=1186540663.1724544862&_r=1&gtm=2ou5q1&z=294990083
Requested by
Host: likeacharmsto.web.app
URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.220.238 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
mnl08s01-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 25 Aug 2024 00:14:22 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://bush-9afc.state-zip.workers.dev
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: likeacharmsto.web.app
URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/js.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.220.238 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
mnl08s01-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 24 Aug 2024 23:12:23 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
3719
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Sun, 25 Aug 2024 01:12:23 GMT
favicon.ico
bush-9afc.state-zip.workers.dev/ 		224 KB
54 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://bush-9afc.state-zip.workers.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.184.121 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b443e3b69c21de93a06ce2dca807ba81a74bf383eadb4d89a77d4c0d65cd5b55

Request headers

Referer
https://bush-9afc.state-zip.workers.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Sun, 25 Aug 2024 00:14:22 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lUrcyJGrggH1gzq41A%2FJWR7gqqXSq1CCyBRyquWlG6GzwlrdoTjSWMWjk1k1tBKQreTkLhAYlC7A5l86JbK1wwJDXsLEfTQqC4NIp2QDMEp5gnr5YbrblysndiDfIqGrjaORNRs5NXP2roxxayGw5KZ6"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
8b8761b07c65689c-SYD
alt-svc
h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
likeacharmsto.web.app
URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js/consent/acefe4aa-b70a-45d7-8ba8-ec49053046cf/acefe4aa-b70a-45d7-8ba8-ec49053046cf.json
Domain
likeacharmsto.web.app
URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-regular.otf
Domain
likeacharmsto.web.app
URL
https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-bold.otf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ourtime.com (Online)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| a0_0x5101 function| a0_0x3736a0 function| a0_0x410c function| a0_0x10c399 function| a0_0x3172b9 function| a0_0x4b1863 function| a0_0xfca8b3 object| OneTrustStub string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer function| OptanonWrapper object| _gaq object| google_tag_data function| ga object| gaplugins function| jQuery function| $jq function| moment object| PeopleMediaConfig object| PeopleMedia function| uaMatch object| matched object| browser object| PeopleMediaMenu function| printStackTrace function| gtag object| Adomik object| country_arr object| s_a function| populateStates function| populateCountries object| firebase object| google_tag_manager string| GoogleAnalyticsObject object| gaGlobal object| gaData

3 Cookies

Domain/Path Name / Value
.state-zip.workers.dev/ Name: _ga
Value: GA1.3.1759855869.1724544862
.state-zip.workers.dev/ Name: _gid
Value: GA1.3.1186540663.1724544862
.state-zip.workers.dev/ Name: _gat_gtag_UA_1817027_45
Value: 1

29 Console Messages

Source Level URL
Text
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/jquery-migrate-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/moment.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/polyfill.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/url-search-params-polyfill.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/peoplemedia.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/menu.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/loggerv2.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/stacktrace-min-0.3.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/consent.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/login-form.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://astgnuring.web.app/BWnTXc9zMBbpYMIou3RytaurkaDPGExIjhNzDFFgOlcWaed4/countries.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
Mixed Content: The page at 'https://bush-9afc.state-zip.workers.dev/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/tHUexsj.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
Mixed Content: The page at 'https://bush-9afc.state-zip.workers.dev/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Z4repaS.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
javascript warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.gstatic.com/firebasejs/8.0.2/firebase-app.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript error URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
Access to XMLHttpRequest at 'https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js/consent/acefe4aa-b70a-45d7-8ba8-ec49053046cf/acefe4aa-b70a-45d7-8ba8-ec49053046cf.json' from origin 'https://bush-9afc.state-zip.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/otSDKStub.js/consent/acefe4aa-b70a-45d7-8ba8-ec49053046cf/acefe4aa-b70a-45d7-8ba8-ec49053046cf.json
Message:
Failed to load resource: net::ERR_FAILED
security warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
Mixed Content: The page at 'https://bush-9afc.state-zip.workers.dev/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/tHUexsj.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://bush-9afc.state-zip.workers.dev/(Line 3)
Message:
Mixed Content: The page at 'https://bush-9afc.state-zip.workers.dev/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Z4repaS.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
intervention info URL: https://bush-9afc.state-zip.workers.dev/(Line 4)
Message:
Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-regular.otf
intervention info URL: https://bush-9afc.state-zip.workers.dev/(Line 4)
Message:
Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-bold.otf
javascript error URL: https://bush-9afc.state-zip.workers.dev/
Message:
Access to font at 'https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-regular.otf' from origin 'https://bush-9afc.state-zip.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-regular.otf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://bush-9afc.state-zip.workers.dev/
Message:
Access to font at 'https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-bold.otf' from origin 'https://bush-9afc.state-zip.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://likeacharmsto.web.app/nHAuv3Y6VG9tYqNeJxPGUZCk9rqrB/gilroy-bold.otf
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://i.imgur.com/Z4repaS.gif
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://i.imgur.com/tHUexsj.png
Message:
Failed to load resource: the server responded with a status of 429 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

astgnuring.web.app
bush-9afc.state-zip.workers.dev
i.imgur.com
likeacharmsto.web.app
www.google-analytics.com
www.gstatic.com
likeacharmsto.web.app
142.251.220.238
142.251.221.3
172.67.184.121
199.232.192.193
199.36.158.100
0c470ec509df884415fa015b9bd291d995af7c4bf2f8008ab902ebcecb0ca81f
1dd4c3f1ea5b28ca04d4f2391197c4b57ef93d2d79ca0656bf6c5d588408e325
27772d7166e861333a7feeda5314296740c74a4e54b89b34eae9ca5da82510ac
29bb230665449654db3e588310185005192a1ebcc76ea0ee4c56465d0179775f
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2d94290210c3c745a81025a463cf7c9b5f771df81f59bdc86b72ecb9bf93e09d
355f6fe361163e85cd574394db481689266987fe3f9f2a56bdf60137d88251ce
40f83d55d1eb3244af67ef893b4694ebc15a9c09f27a4401a69a9b2aa7c5dc2f
4ee389219cbe96c6146afcbb2d57eea6ed70da6b2116eaf171f87d28672e3c04
58597e3384d340cc06c55b25a5f2e997fd023e54ef38d1821c260a6e66114435
5a52005e60e92f39a0744fe733d45496ad3769634edbbbc74df1267f9639f522
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7248b8c4a08b8a45d4add928a459a98f12d61c02f5a7886f14bec7084e8ffdcb
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
90a8d6a27a26f746b4b263102f4fe120e956d99e3789325aafc7d6b7ca0ff0e4
9472d39218e91315437ed9cd40f68d2b5fc5013e7916ecb3867325410a8b5c54
95f7d8a9e89ac8086ab4532580b224aa1139fb15ddf750d16340328fb1a3ffce
b443e3b69c21de93a06ce2dca807ba81a74bf383eadb4d89a77d4c0d65cd5b55
b9d7d8d050d62818c532f2229d1d5a807c5d33ffa949918b6d9452578d117e32
ba6856b3aa462b18c9f5fc3b0d553eca0fe0f03d5ff668ba7d465394c85896b1
c6f35072a2c354165a1c2b864a65c342745b7e82b13a09d512cf40ea6c04d187
c9466a6d400491fb07de2dd7fbd8aa9f73e6ccb352ed868f17bf1453177b564d
d1a092bd21afd962b015db932f417201459fd3c3904faaffecc3ecdbb3b27b79
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e32c82396f4d0755b4c8172bf295bc8ac4445c113184dcb468aadc56e25cd009
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5e7f3c39357e9c0bcb5cdfdf90c5393857c32a2a1485210f87156fe95c1d246
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b
f40c7802fed53bf864c2bb1ed8ae01f70866eb8ec379dbac518053427d904fd0
fca102a234de9df526bd266625c7de1d8bbeb0edd2b643905e9fedcdbd6e517a