urlscan.io logo urlscan.io
SecurityTrails logo

square-smoke-4c62.4tjwj7mx.workers.dev Open in urlscan Pro
2606:4700:3030::ac43:cbf4  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Effective URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Submission: On June 27 via api from BY — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 2 domains to perform 30 HTTP transactions. The main IP is 2606:4700:3030::ac43:cbf4, located in United States and belongs to CLOUDFLARENET, US. The main domain is square-smoke-4c62.4tjwj7mx.workers.dev.
TLS certificate: Issued by WE1 on June 16th 2024. Valid for: 3 months.
This is the only time square-smoke-4c62.4tjwj7mx.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ourtime.com (Online)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
3 172.67.203.244 13335 (CLOUDFLAR...)
23 172.67.209.83 13335 (CLOUDFLAR...)
1 184.24.77.157 20940 (AKAMAI-ASN1)
30 5
Domain Requested by
23 api.rename-service0.workers.dev square-smoke-4c62.4tjwj7mx.workers.dev
api.rename-service0.workers.dev
4 square-smoke-4c62.4tjwj7mx.workers.dev api.rename-service0.workers.dev
1 pmi.peoplemedia.com api.rename-service0.workers.dev
30 3
Subject Issuer Validity Valid
4tjwj7mx.workers.dev
WE1		 2024-06-16 -
2024-09-14		 3 months crt.sh
rename-service0.workers.dev
GTS CA 1P5		 2024-06-04 -
2024-09-02		 3 months crt.sh
wildcardsan.match.com
DigiCert TLS RSA SHA256 2020 CA1		 2024-06-25 -
2025-06-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Frame ID: 92EF774D0F81F02406424D2FFA9EAC6E
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/ HTTP 307
    https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • moment(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

30
Requests

93 %
HTTPS

25 %
IPv6

2
Domains

3
Subdomains

5
IPs

2
Countries

1961 kB
Transfer

4760 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/ HTTP 307
    https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Redirect Chain
  • http://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
  • https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
1 MB
585 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cbf4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc10d818a637f41c2289284ddcf4888a86b74f1298d6bd585ada640b6b304203

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
89a3eb072f771c3e-FRA
content-encoding
br
content-type
text/html
date
Thu, 27 Jun 2024 08:03:00 GMT
link
</test.css>; rel=preload; as=style
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JjjA4C%2BEXEdeJaN9I7vqXqWYPcOCs22YnoGCmJEtsBVb2pKzpkWvE8WD1X7Lm44jMc9N9WKfJsYmtttrXYIC6fikFD23s6DL55jZQBAgktqqay1M%2FJ0QOvm%2FpYaPXvPCujZF4fsB6O8FQ0f9R1cQigTlMBlPGPg0gBzx11Xl%2F9SudZP07g%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Non-Authoritative-Reason
HSTS
test.css
square-smoke-4c62.4tjwj7mx.workers.dev/ 		20 B
462 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://square-smoke-4c62.4tjwj7mx.workers.dev/test.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.203.244 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5de625c36355cce7c1d5408826a0b21abfb49fb6c0e1f16c945a6f2aef38200c

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Cz54wFDbHGhFh6lODLcnlWLqiHeR3ZdhrcmrXJfrUSXLcfnlRf23%2BGMsRk3fXuSqpRLkgtoBiiwN0vO5vZgM%2FZDVjSIC2MIjZrTrW8m9Efp3EKLkmMasqxRplnIgP%2FGI2FewjiRd0Ol%2FDJUiHiE5u8pfNcTp48MIw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cf-ray
89a3eb0798d25d91-FRA
alt-svc
h3=":443"; ma=86400
content-length
20
otSDKStub.js
api.rename-service0.workers.dev/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/otSDKStub.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11b947e74a7ba8f1d433b84ab7a719799ec0662a9035a8b4a2ab4d7d1eb2d681
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
54060
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"otSDKStub.3b2ba3d591.js"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ry7BFJnEuuhDaEmAtwN65TUesvCGbsl2QnaMe1UkqcH4Wwz3Pu7zQJNO68KfXlD3GhzEg2le1qme71Nklmro0qbWUijc3nUrofELpIagoc7r39OVRKtWyuOc5m4TiOoG7xjA1EeC2XpJYZUc45x6e2cf"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c488ed0-FRA
js
api.rename-service0.workers.dev/ 		94 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/js?id=UA-1817027-45
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cfb61c5b4464a49bf1a1867ab3c06ad790468ab0d6b3dec415a5929b20dac85
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
110696
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"js.28fa744248"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aOjn8VURhcQR4q0%2B3wUMwNbRKOss9lipamn%2BI%2FBUcYq7EW07IOnQ%2FHRb1SwSTvMJrr8izeAPMxAYeLs6Xaosy6zhI6l4pEymdtyVG4zJ8PRykcgO%2FBmaGqIrPbTIDSYyXLcKog%2B%2BkamHqe%2F8dNRfEX%2B9"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c3e8ed0-FRA
css
api.rename-service0.workers.dev/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/css?family=PT+Sans:400
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb39af57479f04518b464a917a20921f9f25739ec733cba0e5f1d5b7315a4a57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
147832
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"css.1da7928062"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X8vt3zfN4Sc6amp9TxVTYrinkenRCOEPb5AnOMe6MseSYEdf%2FMiGdZJmlWwfrlMES782BVwKNTPPR%2BpI5ANKf3I0E1XImhq23T5%2FnU7Z2SQK2igYdfs%2B7s43CmMGyDEOflfH2nEMKwbATuQtxeNiN7UV"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c9b8ed0-FRA
css
api.rename-service0.workers.dev/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/css?family=PT+Sans:700
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb39af57479f04518b464a917a20921f9f25739ec733cba0e5f1d5b7315a4a57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
147832
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"css.1da7928062"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=byl27cyVWw7IMDPjEIhac0PMmS8PPI%2F6814xMkWOkP6qr%2FGkRm95jSWdYtO3hnRRMN2V5JjeSpE1Yr9o8G9jtY7F7VKWYvg17WrTXdvDmFCzn%2FS1tFzf4qs%2Bha7YLueRCHKhT2aJfQXKKlppBajG07dK"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c958ed0-FRA
css
api.rename-service0.workers.dev/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/css?family=PT+Sans:400italic
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb39af57479f04518b464a917a20921f9f25739ec733cba0e5f1d5b7315a4a57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
147832
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"css.1da7928062"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gQTe1n4PV2QKl%2BukcvLo4rwc1DmnMJL6cVeab6lW9telHlmiYh3UnuC84t4OjcVGB74M3tLX7ZIXd%2BVvnKSQDXVZya4xuPay6ZYNBmiFo2U5XQiZ9D6zIykTEhEFdyjKGeKc7xAUGMf9%2Fn2ztBm31ulU"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c588ed0-FRA
css
api.rename-service0.workers.dev/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/css?family=PT+Sans:700italic
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb39af57479f04518b464a917a20921f9f25739ec733cba0e5f1d5b7315a4a57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
147832
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"css.1da7928062"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JQCZz7TfbhUKEV%2F7qk9UhJv8T0O1CQ1Y5jsgkEnLe9CnERtgZAQQRAvmiWKnY4%2BLtaXaIzm6jGS69rSnXTPJ763mp3mUGXGZX9zBzbBGldqi102xaZ3%2FZUL1gd3Nvi4U70QoMHbn%2BctXue4aw05BPa%2Bb"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c5d8ed0-FRA
font-1.2.css
api.rename-service0.workers.dev/ 		2 KB
776 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/font-1.2.css
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cdc08c78d317a7163dcdd852e85319c477d5272897a250d28e562f699f9d6e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
147832
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"font-1.2.c193dd3ef6.css"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b9EJOqdhq5HesTcCifW58Z2tjP%2FrDNcrL7aAn6Mlar9YcWgaE%2F%2BiJ5rxydQPf6n8ueSUqHUf61DYEcwf%2BFgWqGiOPeunIOQlNjBAcYl1VYV90FLeJMtYbeMY0B4MkyIzCdz8NU%2BZEWxuThRIlzNDv5PF"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c528ed0-FRA
redesign_fonts.css
api.rename-service0.workers.dev/ 		5 KB
938 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/redesign_fonts.css
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc15754d44e7ee5a41927be3ef6b902cae28014d57ae6f591eb576f221bd237c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
147832
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"redesign_fonts.ab1e65f9f5.css"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VFXep0o78GtgrPm%2FlBnhyRV0iVB5u6JmBuVf9HKjbaHX9OlzVUo3orBUmsqkYmC2LImOQZcwW8c08EzRlLODB9mL5j6HCfsxAE2S2iEwVc4y7nmb%2FFPuRH497vZXZ0TbL8A4%2FrUSMfFjVDKW4GPNwFIA"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c5b8ed0-FRA
base_external.css
api.rename-service0.workers.dev/ 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/base_external.css
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
891410621746b2ff6d1e4830eb0d819521c9b01e9e213257fcd4d2f554ff1a61
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
71255
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"base_external.4e102eeb51.css"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xgypClGWkYLena2Nh0uPdu5uhTJYvw2yIikybucUbtvV7ux4ww1XN%2FCc%2B6GETq8UDSur1U76n4bTRfFTUuSH334GN5%2FFWNRKc2sBvbbyYoDKsYPOdo%2FfTTjDQ1aJn%2FCEBgR0lZyaBMxnO5%2Bl%2FTs7HsXe"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c4e8ed0-FRA
166.css
api.rename-service0.workers.dev/ 		428 B
737 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/166.css
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c98d3a9b8c08a5813b773e49994d1ada4cb43a72f655c71b8efa33dbacc3f60
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
147832
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"166.32916c6d57.css"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a%2F3LcyG0ulk8DmCdUmgaC3bCZXG3%2B%2BIUsmYKZBREUcX0mmgVTgvIHswBapVaw1ZKCF%2BaewgdUPBPN%2F9p71Ek%2FvF%2ByM2f5Amo58JGHnz3CaCu%2FW8rXlohbkaU3zAmXLBexCkEFIWauh6PwwVRBH4vOWJM"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c678ed0-FRA
theme.css
api.rename-service0.workers.dev/ 		37 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/theme.css
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92023afd6feb8f5fe2ab0b2622ddae9e26d5027996df15fe0b33714c7f3dba37
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
54059
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"theme.5cf2c65f5e.css"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Jjr1VbgeOmIM50GGOPtlC7Vc3IoRjGP9M61BCcd4Vwtb88LJhcFalmcacpJbVe2qIEQiblRXY5%2BAsnlXH%2FmGKYGVQz5w%2BQJEnuPY2D9GpUGPybhF4TkRdvy30dMTilbHUQE3pSnF2DmRzKUnZd7xgFN"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c638ed0-FRA
jquery-3.5.1.min.js
api.rename-service0.workers.dev/ 		87 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/jquery-3.5.1.min.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
110696
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"jquery-3.5.1.min.76bb118f46.js"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CxqK%2FYdfiMnnQ2m1JF6gP29RbCwQ04V5SbH%2Bx0IUqU7Tew0xVEqjlYyddjsEaTH9S05xhSau3fYpEGjO6%2FmuNLz%2FzHG%2FPpbcsp8cLivbZjpAEptcPDWvEz8uFstm8dmIH195tKk0HkPjxNdHwz6x6yZD"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c758ed0-FRA
jquery-migrate-3.3.1.min.js
api.rename-service0.workers.dev/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/jquery-migrate-3.3.1.min.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
90a8d6a27a26f746b4b263102f4fe120e956d99e3789325aafc7d6b7ca0ff0e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
90785
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"jquery-migrate-3.3.1.min.4a9b3d1a73.js"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KgLYwOJgc4jabsrobctFju4XMRavAr7nRvlIF4XZeYvKZC7a%2F3sjMqNiCULha6nHmjX04IBD8GrRSbASIZv5dl9N1ovGUSPOP3IKwYA52muR1xXuAiImHdBkwXH4SWBfDTB27mqaZOn3f0WbcYuki2fo"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c6b8ed0-FRA
moment.min.js
api.rename-service0.workers.dev/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/moment.min.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a52005e60e92f39a0744fe733d45496ad3769634edbbbc74df1267f9639f522
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"moment.min.7f22d534a7.js"
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hNrsoBkSvuZZMQL72WJqp54WIhSrjj1DE2heZlYasSv3rn7h3x%2FGTRwVIAdYnkSeZW24rpLsTFpkyEdQKBB1wSeF7ZUi2JN6wq8VM8sursic4fRnmhURrvH6xdlcSq5Dp0kPm5w9m1LlV0Hjv6ELEWr7"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
feature-policy
none
cf-ray
89a3eb263c708ed0-FRA
polyfill.js
api.rename-service0.workers.dev/ 		463 B
805 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/polyfill.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb914e7633fd51b038e6c95387bc17049a9ae895d212d96268d446289f760792
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
85927
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"polyfill.40ba72c090.js"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j3LSjMlH7BgmW1VR4Dt5XYw5K0gIJa0%2Fap3vWFeyim1YXKd4W3Th3vUJoZmWyKt2BOvKqYFOG4uqq6tAaZ4E%2F1cXzzi2dxNioh9%2ByPSCwXeys3VYUfwa%2FbKUS5d2rQ60WmWYIuFMXt7pBaAX72EbH2UF"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c798ed0-FRA
url-search-params-polyfill.js
api.rename-service0.workers.dev/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/url-search-params-polyfill.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9472d39218e91315437ed9cd40f68d2b5fc5013e7916ecb3867325410a8b5c54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
85927
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"url-search-params-polyfill.7be843fc3f.js"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QlVBGzbZ3%2FHkxBm1Odx2ybmdmMV7iEe7z04sYIKufsTOvSrmn%2F353nOXwvjDMM4CNGIjk7rX%2BIn4AoxEmxktfCq%2F%2Bkx4aD%2Bxe13u%2BxD5DPGNHiEzOqVRtdQFayYdKupYkObGsKzeG9Fi6p9VMjYAsg%2BM"}],"group":"cf-nel","max_age":604800}
feature-policy
none
cf-ray
89a3eb263c7e8ed0-FRA
peoplemedia.js
api.rename-service0.workers.dev/ 		81 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/peoplemedia.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
87516298ac370a2f6a78d186a041a5c619163681386709ba009634244dc97f74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"peoplemedia.1b2176ec4d.js"
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x0HypHKY8dHeDANmv%2BEgnja7Cj1O1guaBZ6CiKwadk0X%2BPbDr1XPQN3ayI%2Fy6U6OjUP2pZyGYDL%2FHQea84Eu%2BbyQuVhcb7Af8X7%2FshysAJ7iGVdTsGTgLJI5fr3lM2eT3fL0oRVsnI01quT2aPshMtSu"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
feature-policy
none
cf-ray
89a3eb263c6e8ed0-FRA
menu.js
api.rename-service0.workers.dev/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/menu.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9d7d8d050d62818c532f2229d1d5a807c5d33ffa949918b6d9452578d117e32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"menu.4a62090702.js"
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eHKrtId65sBjJoXBLR7%2FSDRmyCBv%2FlQUMcE7J87YLYH97fDZ%2FGWolTKakXb5Whf%2B%2FbThGvV1FnCQ9%2Fv2NtnXQxsUOaec91RUTiPOcw9jTNEmX6ybc5TPmLAVlbgA%2BvGnZo5ZY4tVW%2FXhC1FszAJdHDBK"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
feature-policy
none
cf-ray
89a3eb263c7c8ed0-FRA
loggerv2.js
api.rename-service0.workers.dev/ 		9 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/loggerv2.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58597e3384d340cc06c55b25a5f2e997fd023e54ef38d1821c260a6e66114435
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"loggerv2.11e5fbedca.js"
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CIz5jToN2uQGkKzpNLS%2FOv5xka7LMr4JwXxNPkC2KZlnNufRzCuEyMOQY5mvZYoQynhtqCGUzkuG%2BgABA7T6vdlZuBDbZwhqHi%2FMTgWEaVyPpD3%2Bp6GGVCqOzg8SHAsu84O5A83fF%2Bx%2B6n33pCuuQ8Dj"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
feature-policy
none
cf-ray
89a3eb263c808ed0-FRA
stacktrace-min-0.3.js
api.rename-service0.workers.dev/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/stacktrace-min-0.3.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f40c7802fed53bf864c2bb1ed8ae01f70866eb8ec379dbac518053427d904fd0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"stacktrace-min-0.3.6e619c868c.js"
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SqiHd%2F9S9z43bJklKbYR23auWoHV%2BFdDvfUjGkOpRPznGvJWWL61nael8I5gSlN4BDTvUL%2B4bnYD74XMmOJflx0HaWqMs5YZqesXKpmm%2B9zqNHZz7cho6wl2WiMUb1ap5xMamNjBgDxv3Dos3%2FvTXIml"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
feature-policy
none
cf-ray
89a3eb263c838ed0-FRA
consent.js
api.rename-service0.workers.dev/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/consent.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a87b735aa054867f4e2126e93228d82a22bde1123914ad2133e83c23e1bbc059
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
W/"consent.cb730c5f71.js"
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c92sem4LCSB1zla003d1mUZlqWVBTTOS%2Fx%2B3rXWOibek%2BtqJa23p6f2yiSQHJMsaE6nIfCQwDVmlpBJ9DOErwxdsqc0YqXFXSznUsVAKPsiFWTyX%2FXuDA1sDZoy8y%2Bn7GOiris6AualzW5WBEONBRfZJ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
feature-policy
none
cf-ray
89a3eb263c8a8ed0-FRA
-login-form.js
api.rename-service0.workers.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/-login-form.js
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CIqLXYhkTaVY82OkSblsYJrbT1aG4zAlgm2d29csB3QFzzKWailtmuJMtEY%2B4AUvammUiq5Tfcbb1Sb%2BDDsDs6fgHiVkDiHXlm9K2Ag1bibdVUx6UBifERM9ZUqgmnhS8hcmuHVQAiRTPRW0W5F%2F93Nu"}],"group":"cf-nel","max_age":604800}
cf-ray
89a3eb263c8f8ed0-FRA
alt-svc
h3=":443"; ma=86400
content-length
1228
heagregauwe.png
api.rename-service0.workers.dev/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.rename-service0.workers.dev/heagregauwe.png
Requested by
Host: square-smoke-4c62.4tjwj7mx.workers.dev
URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7248b8c4a08b8a45d4add928a459a98f12d61c02f5a7886f14bec7084e8ffdcb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
1737
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
server
cloudflare
etag
"heagregauwe.b2def557d4.png"
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IWZvV6PF1b9RDTL8Q96%2BFfMFmMcCdsC6p6WW3WU1Xdl%2Bzkq4%2BHTx%2BFwc6hohhJdXDepjWCVICedbazBDv4HIjB9plquZjmpt6i%2Bq9WkGzxmJd8xmwlW7NWib5DpuYfvNSyoNfU%2BvRG45SS%2B6zGla1pT2"}],"group":"cf-nel","max_age":604800}
content-type
image/png
vary
Accept-Encoding
feature-policy
none
accept-ranges
bytes
cf-ray
89a3eb26bd1c8ed0-FRA
.json
api.rename-service0.workers.dev/otSDKStub.js/consent// 		0
0
gilroy-regular.otf
api.rename-service0.workers.dev/gilroy/ 		0
0
lottie_5.7.12.min.js
pmi.peoplemedia.com/pmicontent/scripts/ 		261 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pmi.peoplemedia.com/pmicontent/scripts/lottie_5.7.12.min.js
Requested by
Host: api.rename-service0.workers.dev
URL: https://api.rename-service0.workers.dev/peoplemedia.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.24.77.157 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-24-77-157.deploy.static.akamaitechnologies.com
Software
/ ASP.NET
Resource Hash
4a05e858c919465ee86c06519bce8a74705055c7f6c81d6fb614e35c717c7627

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 27 Jun 2024 08:03:05 GMT
Content-Encoding
gzip
Last-Modified
Tue, 06 Feb 2024 17:30:12 GMT
ETag
"0ea7c232259da1:0"
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
66695
Loader.json
square-smoke-4c62.4tjwj7mx.workers.dev/content/animations/purple/ 		1 MB
584 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://square-smoke-4c62.4tjwj7mx.workers.dev/content/animations/purple/Loader.json
Requested by
Host: api.rename-service0.workers.dev
URL: https://api.rename-service0.workers.dev/jquery-3.5.1.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.203.244 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc10d818a637f41c2289284ddcf4888a86b74f1298d6bd585ada640b6b304203

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
X-Requested-With
XMLHttpRequest
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:05 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wn2rTnKLEnnrf2V2pGAiulinHu%2B%2F0JmB9oH4ABoFwHG3lX%2B5m92gAom%2BMIUYCKXkDkJ7RyG4YdOyDQFXQKeF6fJkncd%2FmiS1%2FW0Nm0dExBSlcPdIfjSWKOkPNhrWgKuemZ3uiAsRyoml6BB2jleh69GqsR%2FPMRLy4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
89a3eb282ddd5d91-FRA
link
</test.css>; rel=preload; as=style
alt-svc
h3=":443"; ma=86400
favicon.ico
square-smoke-4c62.4tjwj7mx.workers.dev/ 		1 MB
584 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://square-smoke-4c62.4tjwj7mx.workers.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.203.244 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc10d818a637f41c2289284ddcf4888a86b74f1298d6bd585ada640b6b304203

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 08:03:06 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yC5eIygRmEWOUynVcIu80z0UK8XBePO%2BBb0NstDZAJSrgD%2F7fdbblnX8BhnIuLImiEyeZ86V18gO9zgJ8J%2Fz1jjvilUKb76dWvo3Zvj85J22aivalvZTxVy9XgqesB6H6MWLuEYcPV92hrJNdaF%2F1fUNb0Bsxg%2Bc0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
89a3eb2aa85b5d91-FRA
link
</test.css>; rel=preload; as=style
alt-svc
h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
api.rename-service0.workers.dev
URL
https://api.rename-service0.workers.dev/otSDKStub.js/consent//.json
Domain
api.rename-service0.workers.dev
URL
https://api.rename-service0.workers.dev/gilroy/gilroy-regular.otf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ourtime.com (Online)

41 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| a0_0x962e function| a0_0x31e722 object| a0_0x2c4f function| a0_0x2103 function| a0_0x46fd4d function| a0_0x2276 function| a0_0x3cd2c8 function| a0_0x354a08 function| a0_0x5df3d3 function| a0_0x383f42 function| _0x45a450 object| a0_0x1b21 function| a0_0x81a9 function| a0_0x41fc69 function| _0x4920d2 object| OneTrustStub string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer function| OptanonWrapper object| _gaq object| google_tag_manager undefined| $ function| jQuery function| $jq function| moment object| PeopleMediaConfig object| PeopleMedia function| uaMatch object| matched object| browser object| PeopleMediaMenu function| printStackTrace object| lottie object| bodymovin string| hu object| gy object| ft

0 Cookies

20 Console Messages

Source Level URL
Text
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/otSDKStub.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/otSDKStub.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/js?id=UA-1817027-45, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/jquery-migrate-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/moment.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/polyfill.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/url-search-params-polyfill.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/peoplemedia.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/menu.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/loggerv2.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/stacktrace-min-0.3.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/consent.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/-login-form.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://api.rename-service0.workers.dev/-login-form.js
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript error URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Message:
Access to XMLHttpRequest at 'https://api.rename-service0.workers.dev/otSDKStub.js/consent//.json' from origin 'https://square-smoke-4c62.4tjwj7mx.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://api.rename-service0.workers.dev/otSDKStub.js/consent//.json
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Message:
Access to font at 'https://api.rename-service0.workers.dev/gilroy/gilroy-regular.otf' from origin 'https://square-smoke-4c62.4tjwj7mx.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://api.rename-service0.workers.dev/gilroy/gilroy-regular.otf
Message:
Failed to load resource: net::ERR_FAILED
javascript warning URL: https://square-smoke-4c62.4tjwj7mx.workers.dev/v3/security/
Message:
The resource https://square-smoke-4c62.4tjwj7mx.workers.dev/test.css was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.rename-service0.workers.dev
pmi.peoplemedia.com
square-smoke-4c62.4tjwj7mx.workers.dev
api.rename-service0.workers.dev
172.67.203.244
172.67.209.83
184.24.77.157
2606:4700:3030::ac43:cbf4
0c98d3a9b8c08a5813b773e49994d1ada4cb43a72f655c71b8efa33dbacc3f60
11b947e74a7ba8f1d433b84ab7a719799ec0662a9035a8b4a2ab4d7d1eb2d681
2cdc08c78d317a7163dcdd852e85319c477d5272897a250d28e562f699f9d6e4
2cfb61c5b4464a49bf1a1867ab3c06ad790468ab0d6b3dec415a5929b20dac85
4a05e858c919465ee86c06519bce8a74705055c7f6c81d6fb614e35c717c7627
58597e3384d340cc06c55b25a5f2e997fd023e54ef38d1821c260a6e66114435
5a52005e60e92f39a0744fe733d45496ad3769634edbbbc74df1267f9639f522
5de625c36355cce7c1d5408826a0b21abfb49fb6c0e1f16c945a6f2aef38200c
7248b8c4a08b8a45d4add928a459a98f12d61c02f5a7886f14bec7084e8ffdcb
87516298ac370a2f6a78d186a041a5c619163681386709ba009634244dc97f74
891410621746b2ff6d1e4830eb0d819521c9b01e9e213257fcd4d2f554ff1a61
90a8d6a27a26f746b4b263102f4fe120e956d99e3789325aafc7d6b7ca0ff0e4
92023afd6feb8f5fe2ab0b2622ddae9e26d5027996df15fe0b33714c7f3dba37
9472d39218e91315437ed9cd40f68d2b5fc5013e7916ecb3867325410a8b5c54
a87b735aa054867f4e2126e93228d82a22bde1123914ad2133e83c23e1bbc059
b9d7d8d050d62818c532f2229d1d5a807c5d33ffa949918b6d9452578d117e32
cb914e7633fd51b038e6c95387bc17049a9ae895d212d96268d446289f760792
cc15754d44e7ee5a41927be3ef6b902cae28014d57ae6f591eb576f221bd237c
dc10d818a637f41c2289284ddcf4888a86b74f1298d6bd585ada640b6b304203
eb39af57479f04518b464a917a20921f9f25739ec733cba0e5f1d5b7315a4a57
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b
f40c7802fed53bf864c2bb1ed8ae01f70866eb8ec379dbac518053427d904fd0