The card below never leaves this page to a real server (the exfil hosts fail CORS) — but the MAIN-world sensor sees the outbound request as it's made and reports a card leaving to a third-party non-processor host. Watch /bdr. Reported as a proceed-able WARN — it never blocks the request.
Ships the card to collect.skimmer-cdn.192-168-1-16.nip.io — not this site, not a known processor. This is what an inline/neutral-CDN skimmer does; the static script-host check would miss it.
Posts the card to this page's own backend (/collect, same origin). A store charging on its own domain is normal → no false positive.
Sends a 16-digit order id that isn't a valid card (fails Luhn) to the third-party host. No PAN → no false positive.