attacker frame — gravatar.com.* origin

Attacker frame (served by a Cloudflare Worker Custom Domain).
Origin: ? — hostname begins with gravatar.com. (the attacker simply controls a subdomain with that literal prefix).