[SethKinast]

Submitted by user `walz` 2 hours ago.

The site pulls in an analytics script from the domain `route.run`.

Going to route.run redirects to routeshuffle.com.

routeshuffle.com/about :

   Made by a teenager
   
   I'm Riley Walz, a distance runner from New York. I made Routeshuffle to help
   with my summer training in high school.

Not only is the credit card form not actually hosted by Stripe even though it says it is, this isn't from an "experimental product studio in New York", it's a random teenager from New York that just slurped up your credit card info.

[thealchemistdev]

No form validation, either.

It's good that it doesn't actually send sensitive data. The request zeros out the credit card and CVC code before the POST.

Otherwise, this kid would have opened himself up to a world of hurt.

[Frondo]

This should be the top comment.