So front.to doesn't see to be changing the JS you upload (yet) but the js file at cookie-consent.org is interesting ( //cdn.front.to/libs/cookieconsent.min.js ) got google analytics in there, and of course could be changed to run whatever at any time... Maybe someone could use that to identify more about this shady actor?

un-minified js: https://gist.github.com/benmcnelly/8e56aa308bef72c7aa007b7c1...