It's an order page but obviously you have to enter your mail address and password to unlock the order details.

Well, that's not really what it does, but there's some script loaded from jsdelivr.net and a .ge domain that receives the payload that gets sent there.

Now I'm wondering if I should take the time to report the repository/script to jsdelivr and contact the NIC of the .ge domain to get it taken offline. Maybe that's just a waste of time.

Did anybody of you have any luck with reporting things like these?

(Maybe I should rather send requests with fake data to that endpoint and see what it does and open a cold one in that time... :-D)