{"report_id":"030ec963-292a-48b0-878b-01242e19eb51","version":6,"status":"done","tags":[],"date":"2026-03-04T16:41:46Z","url":{"schema":"https","addr":"refundgas-solana.xyz/","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":0,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"refundgas-solana.xyz/","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"title":"BetterClaimSOL - Recover Solana Rent with Ease","dom":{"size":40191,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (24035)","md5":"27293b3b941ff4cccc04e2d4ba4beff1","sha1":"cd6a40de7445db9f5f18abd7912db7a2a9bee575","sha256":"018c82be150448780f31d47868e69ea88450c00feec80168c5def2b1c61d39ba","sha512":"4ce0e4360774d344a8397da464e65b16088b6b1401ec5cfab599e0a0b51eb6bd1e36bf3e9d16a70a7ff1400e2c55d6508401516d58de400384c8e1b439be1148","ssdeep":"768:tFqPYChoy/LW0X6mc50tZD1fNPmsj/Vh8ip+CTkke9vzoCx:tFOhJ/56mc50hOvzoCx","tlshash":"a5033cf693843672b1038be6e657bad63116257bea2bcc0ce6fc91902f85d4cdca5d10","dom_hash":"domhash59c42c95873c27e4400b3b5e2ecd0a65","first_seen":"2026-03-04T16:41:50.584821Z","last_seen":"2026-03-04T16:41:50.584821Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"refundgas-solana.xyz/","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":0,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-08T16:41:46Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"refundgas-solana.xyz","ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-03-02","domain_rank":0,"first_seen":"2026-03-04T16:41:47.581879Z","last_seen":"2026-03-04T16:41:47.581879Z","alert_count":28,"request_count":14,"received_data":1216981,"sent_data":6539,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"PHP:8.3.19","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"refundgas-solana.xyz/","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"651ac366f9feddc4d14e2e8e8eaa6043","sha1":"5a0b8482475b42672b30a40b4aba691f81820c07","sha256":"359f53445f59a557670afab0d771881e00a57053d0e2b996b165938ea8ee6efd","sha512":"e32e479b0f04a5f87c9f3f692eac37056a13b5bfd5b090b1a245a2277eb61e1d2ffa227a04e514f568e64d072b8847f3d0395afb3a6d256ea1063c44e329aacb","ssdeep":"","tlshash":"a5c0227491f44c311abe00db32709640302024ae4553608682bccfcb22d8e844f04820","size":187,"data":"","first_seen":"2026-03-03T10:32:52.113198Z","last_seen":"2026-03-13T06:09:34.056246Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"629078d1ed0fb11110f56abc8ff98943","sha1":"5a3fb703d414ccc06ab74faf60c8c4c50e96ba8c","sha256":"c33e0ef6c8323435a822064a6d4519aeef0232b138891b0545502e458dc7f937","sha512":"eee866f9dfbe77192377df8713018f75004b0dbc0a9438d74e764bbc16f555a064c91717b2ccb4cb7c1a84b392495f79b09f3dadd11d8eb8c7fd98048ca0fc0d","ssdeep":"","tlshash":"a3c012597031656a418d7c6e0c4f048d7a368412610959c698ddc8507fb6f7846a084c","size":181,"data":"","first_seen":"2026-02-17T15:01:35.026544Z","last_seen":"2026-07-01T04:20:12.827343Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"297a907d4e5b4c2198915e66274d9c9a","sha1":"e0f98af49ab0f7a270e2d739436181f924449098","sha256":"0fdbc26d9d5bd7f6a4bc38acfb91fc663c57463d43a08447f1386b3354cd84de","sha512":"48487cbd59e60a259a5836fc0315243da500d617e94e06b3073f79bb834bd141c9e5cfb59c42a3c2086c920c21be5996e589d4658513cf31d95bfc5757a4a44e","ssdeep":"","tlshash":"1371bc3beb00173bdc8fb9fdced5b4c02e62497262496560691ce102b16cd7087bed88","size":3741,"data":"","first_seen":"2025-08-14T22:39:51.132287Z","last_seen":"2026-08-15T18:29:27.711588Z","times_seen":3242,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/XhjIRijk.php?s=%2Fipfs%2FDz18gwzuGzxm9J8lEkk95Q180f5b5bf61bc8808bcbaf69f6ff97d1%3Ft%3D1772642480310","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"037754815a4772b01be1cf2cdcf050ad","sha1":"53d5b60c8d37f73a5f99dbb90dc2fd6d98a847a4","sha256":"f00670eee0748674720117e2f3df1f6b84d8d0dbbeefb89d2590dbc2b7fee9f4","sha512":"c0eec8807636012fe5ca51ca0565fa987a3edbb4f5c53bcd873c512547d4ce89cf3ac1964738c758a618bd788d116e270c1b4d15b888fdbe07b970511e4055d1","ssdeep":"6144:fh5gDYJjJJhOb1ntpwro5gxPoGeDtGXsdnrZtF6VHp3JTa:nsY9XhOb1tpDWPQdnrr","tlshash":"b2d4aac8873a967b44a013a7053792bfbfca0d7da24f8c607ac09cd2da6571e92f455c","size":610109,"data":"","first_seen":"2026-03-04T16:41:50.600333Z","last_seen":"2026-03-04T16:41:50.600333Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"refundgas-solana.xyz/walletconnect.webp","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.327Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /walletconnect.webp HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"a0e-69a502f0-f4ece8758b248af0;;;\"\r\naccept-ranges: bytes\r\ncontent-length: 2574\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]}],"data":{"size":2574,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"77b68f40c0125aab69674410142c857b","sha1":"a5118bcb21b387561370aa2605a7f4c4b00d604e","sha256":"d21960739e0d04ad65d6346a74a0137b48b42349a24894d72e04385294a933e9","sha512":"31e930d08a1d232eb33b1a50fe90795677c4a652d88acce6fd7f8f9a92a9fe9162a26e76e699dcfa06308feff4a346bee23bc470b22b181571abad7209cbee8e","ssdeep":"","tlshash":"a5515c8950309015e3e4707628bc234f1d4bbaf54e6b5c60b21062b5130e6ef8c6a22a","first_seen":"2026-03-04T16:41:50.587084Z","last_seen":"2026-03-17T08:15:59.327944Z","times_seen":3,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/css2.css","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /css2.css HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/index-DHRbWdbY.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Mar 2026 03:24:31 GMT\r\netag: \"840-69a502ef-dc6ef30fad6857f2;br\"\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 299\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2112,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"94008a89c8d6024db3d861cb7ba4a4f4","sha1":"51705aa43b6b5fe174beb82b06c56178246906ec","sha256":"0a0b13c690f1a1ed9e59cf520667bb9f3d3cee7e8ea89318a03f40ba9b9cf05b","sha512":"e54628d0a2daf050618534f61b4283e15f80ba17123dab3289050740e501a76d9dff62026199c6e2c7df929a7e2d7e3c56b0e22d47a4877dfcd71176264467e0","ssdeep":"","tlshash":"41418b80087ba504d7931cc122ce7e32ee2db19064459d346ffe1498fc5bd59a3b2b4d","first_seen":"2025-01-25T17:56:03.203401Z","last_seen":"2026-08-12T06:32:07.815116Z","times_seen":903,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/XhjIRijk.php?s=%2Fjmpd%2F","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:22.453Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"POST /XhjIRijk.php?s=%2Fjmpd%2F HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://refundgas-solana.xyz/\r\ncontent-type: application/json\r\nContent-Length: 1432\r\nOrigin: https://refundgas-solana.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1432,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QBtAIAAygAEgDcAu4CKAASAxIAAQACOgMAAO8nhn2XtsKCAV0dUSLB8_f49Hi1WGsCAABb07LIUWp4025jpRjZYGIIxqfCGPBF9LheKIT9323s7zd529MoSdcFUGdZ8KSjnTZbH0D7tj9e5xQJ0XiamZHT_2a3wBk_uw_j752y8FojHzO4FnlLNVmWr6-aYKuSCHP9Q6FrMDpOXz7YeJBJnttYl25VNCyDTV0rajBXGGN_FrqiO_ZYDapLXOP_2Xjg7fMWz2DMU8Vl4lQRYxPVKdjE8EvXULF6Hgy5O7Qt1ykVh7pDDAxBs6p952b3Wqey_J1VQ-qcNMv5nzAACfMMNaAyLopsrpYRYUMb9emjDI2qpQVGpwHOteMzw6l7p8mcfaiRf6S15zNowelk5D1gEfvXUPoMgQAr297KxzNjdat8PW4dewUEDdZ1BvBQhYip0Mhvtz1QjIhrISY082SRJLGnRSGWZwNeIRYZIw5-8OAV5Mtv3wFnA31RZVlVUIwdqmZ7z2PlfsRMsm_AMz99xMBFQ7hRZdT2tWyVFnj0xDdM2YWbZ1VbVElT6KyV74kc3jCH5bLN-ofy6FvwuOwiCHJMLKqHlNQmG8jgH_khI8JZJudBHoc4QMaIVCh2edot5GwkOyvB30brkmvkfRVoBnWvQblyZbqt8JYDOimrW93FUeshg6cRpj0N6_UoAPlHVxADc2NEbl_fvKhpdUIvBGSitWLP9BYZoSxk4CNUPN_hYPl9DilPuDod6ezhv8mJZAJCejRFEacT8jzCk4cLIifgHbdFzTM1RFVEK9EhU78s2K2gxFibEO5XnwDkxPo9rt7cM7-NX4kuU05DT2bpZ1tsIH4dWarlQ4vAhYcImAL1KqeNqe5axwqaYNwC4t8C3Ru529UcEBH429e8WJfDrGadfYzefN6NoTvmFcMT327mRvDT_mnu1PVFeH2EDkKmaYMKMuue_3hQLLTkzpOUorOiiYSzwDndPr8eq2B3SURE_N39wC0Qi3N5rDuj2SxZlO7e1nt7rllPgLi6Y9IQ-sB_MIAYTEt-GlDaBcxt53gjX_RsNRSXqOmbXSBzkFl2Xj0jsFZ23C05gx_WgoOFCIC4SQLpI7zxKrnDYgeArHbnbsPCm0G7vSK3hiMkPeU3n2jYtlvXSImA24d8mSZVPmplKcIJ2v3qzA1go_N1VQqgieoQ\",\"challenge\":\"eyJpZCI6ImJBQWM0UGxBM3NER1QzN0owUFNjMUEiLCJub25jZSI6MjQwLCJoYXNoIjoiMDBiYzI1YTdhMTdlMzJlODM2ZDY4ZWI2ZTE1YmY5MDA3MzdjMGU0OWFjYmFjMzUxOTAxNzllNmJhZjU3ZTg1OCJ9\"}"}},"response":{"raw":"HTTP/3 204 No Content\r\nx-powered-by: PHP/8.3.19\r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Wed, 04 Mar 2026 16:41:23 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP:8.3.19","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-19T16:45:02.382125Z","times_seen":17976324,"resource_available":true,"data":null}},"time_used":875,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":875,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/enkrypt.webp","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.328Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /enkrypt.webp HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 02 Mar 2026 03:24:31 GMT\r\netag: \"6fc-69a502ef-ab0a12881f250b9f;;;\"\r\naccept-ranges: bytes\r\ncontent-length: 1788\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]}],"data":{"size":1788,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ae8a6bdfb7707815453d76354873c0e8","sha1":"82a75089f84c51559bc63b4748a496e24bfb5057","sha256":"a698f5cbdef3dbf9a9ce2f025acab5d886750a10352aefe35f55d268e6aa086c","sha512":"bd18f0b7aabe2541518fec327d125e33e822be10bb42062ae6d4d8594ed0256c7b7b0683b0bb360403ccf2a05ab6f696d49662867efcd4ef7de1598d72694d3f","ssdeep":"","tlshash":"e8312b2751f44e48c4a01df1698c81ff9957e750285d0951e82f36e15015846fed7e42","first_seen":"2026-03-04T16:41:50.590102Z","last_seen":"2026-03-17T08:15:59.323432Z","times_seen":3,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/solflare.webp","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /solflare.webp HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"c1e-69a502f0-5695a4cdabc41fd3;;;\"\r\naccept-ranges: bytes\r\ncontent-length: 3102\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]}],"data":{"size":3102,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"34a72064a77c75cb90ca56d68ff68ea0","sha1":"094307bf52680860cd9ea40ac442d558fc9a1b87","sha256":"55d2b43e1dac359773b2d06d4d2fe4e1f562476f67305347f821925783d29650","sha512":"04aa91499bfe7c5efae695bd64d689f3982fa0bc080ad56047b2ad725a101f97002c9e2c1b01628e2e2fd6589dbd35cabe7acf26cb48c8679e669966b4651b62","ssdeep":"","tlshash":"9a512b75a7310aebd087e2fc0874c65425b94ae5c9b26d26d7d1ec152c098e6f63b027","first_seen":"2026-03-04T16:41:50.591435Z","last_seen":"2026-03-17T08:15:59.322692Z","times_seen":3,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/Prototype.ttf","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /Prototype.ttf HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/index-DHRbWdbY.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: application/x-font-ttf\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"7398-69a502f0-11d4f1bea3405432;br\"\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 17680\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]}],"data":{"size":29592,"size_decoded":0,"mime_type":"application/x-font-ttf","magic":"TrueType Font data, 13 tables, 1st \"OS/2\", 14 names, Macintosh, Copyright 2001, free for personal use, freely distributed with Prototype.txtPrototypeRegularMGBF","md5":"0483b4eeaaefc7b81986e43702c7900d","sha1":"25549e8487a577bb916e2785b2f6cdb8d685a133","sha256":"ce7f544cfc3f02953f79d065bcd16c8cc0eb041f76fc987ae6adcc3b21005774","sha512":"84e26077475fbcf610f11d288e5feb774e7f781d08be07de2f5db84328fc827583cb9812d477c04227c1a5404683cd8d5c200722b72d30d188fa5ea70e74ed5e","ssdeep":"768:DvlGMc4MyMqHZTGaEsaR65U8MEalJF1l6WQzRJJL8BrPWkr:DwTUHZTG3T6W8MEalD1JrPWkr","tlshash":"97d25b4cc372ef05e35631ba4d488a9487f0b62c75faf79f6e4adb6758016e109c468c","first_seen":"2023-04-13T20:04:06Z","last_seen":"2026-05-29T19:54:54.196341Z","times_seen":71,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/logo-512x512.png","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /logo-512x512.png HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"5af6d-69a502f0-878e2c2859d3605c;;;\"\r\naccept-ranges: bytes\r\ncontent-length: 372589\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":372589,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"bc99f604ddeb777e1a5bfbf869ff6bce","sha1":"7cc41432e02b1f672b629de3b0ba70379a724b1e","sha256":"dae5d4663029a8e29995da433a97a2a43939200510ec6fd135b4168c3683fb0a","sha512":"d063f1f0987f954bfc23f7a528b4542250647c6853401b8de29b02c96902f08718b2c8ac515b79e6d79e89305d3d9f7a78d145a31d6bd7565c810ac4dbc41380","ssdeep":"6144:9TvwE8qLSjdXnM8TIvUryTDn55YCrzzZJD4e3vzUidGtcAuH0/EvxkQ0WMYKT:RvZ8pjR1TIs2Tz55YCrzzZJD/3bdkhuk","tlshash":"0c8423b182c22174db2fe51b77269f8a15b3011dc345899ebabc0ecfbd72693146af14","first_seen":"2026-03-04T16:41:50.594137Z","last_seen":"2026-03-04T16:41:50.594137Z","times_seen":1,"resource_available":false,"data":null}},"time_used":417,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":318,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/logo-192x192.png","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.788Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /logo-192x192.png HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"d8ec-69a502f0-3da4b533989c1a6;;;\"\r\naccept-ranges: bytes\r\ncontent-length: 55532\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]}],"data":{"size":55532,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"30bfc55993a9303e0e66d876e924abaf","sha1":"81864b4c69e2c2920bd55a06c1a9cde1be367a24","sha256":"6ede5421a66a0070c4d640b17caf2b1ecdbf41e217759dedf26cd79d35e51c4b","sha512":"de32c954ff4af1c71f9ef0d7ef4ca507275885bceec5d9b513f90f792e4f378554ebd7d7efd3e280434b52fd3d5698839513c9bbe76c44f82b3685713be7f6f7","ssdeep":"1536:7TtNWmc2KFfFYPnT33hJJ+DlWaHuAHKR7uBN3r:7TmFmPThj+Q2HSgRr","tlshash":"e74302cf5cb087fd7d518525467eb32c0b46cbab8ba6409bd116e9ce4b18199f3b1a30","first_seen":"2026-03-04T16:41:50.595408Z","last_seen":"2026-03-04T16:41:50.595408Z","times_seen":1,"resource_available":false,"data":null}},"time_used":430,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":242,"receive":188,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-04T16:41:19.650Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"9c0b-69a502f0-3bb68693bef7ac65;br\"\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 12055\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":39947,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (24035)","md5":"271c02a6bf548234c731db242b6500d7","sha1":"d96c76ee874e33f9b02ceaa5c40d8a2fa0dfb229","sha256":"fc2316fa54731a6d705d84deba202cbe4d7749c9b2c2fb80919227b50f76760d","sha512":"5d8494d9cba20a92b33b25c046038ad9227ca42645c005d068c48e14581fe6adea38bdc3ad87a9458951195100857f9392cfbe8d9514209364d1319999c6376e","ssdeep":"768:fmChoy/LW0X6mc50tZD1fNPmsj/Vh8ip+CTkke9vzoCx:f1hJ/56mc50hOvzoCx","tlshash":"53033cf683843672b1038be6e657bad63116257bea2bcc0ce6fca1901f85d4cdca5d14","first_seen":"2026-03-04T16:41:50.596588Z","last_seen":"2026-03-04T16:41:50.596588Z","times_seen":1,"resource_available":false,"data":null}},"time_used":801,"timings":{"blocked":314,"dns":105,"connect":99,"send":0,"wait":156,"receive":14,"ssl":109},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/phantom.webp","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.324Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /phantom.webp HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"918-69a502f0-f4203afdd749a01c;;;\"\r\naccept-ranges: bytes\r\ncontent-length: 2328\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2328,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4d69768480a967410f4e5a4be4a9d1c5","sha1":"33016d89ec3e6f4119bc31dea27e0d767570e245","sha256":"2ac27349c18888e8c97ca48945dc8cd0021d3ee89f4ffa680047ede09e6c6c5e","sha512":"47d8013c9a7a7b32cc623ec7f0f68f624e688f36fb384787472260a0f5c0b40b68ee1a60aacf0287e1606e8e64be9bb966d209de1a310baa21ea179305a27a20","ssdeep":"","tlshash":"f2411806f1ea27b0b1e39ae610493aa4481738cd8f14af533a200c94d7edc643ac7659","first_seen":"2026-03-04T16:41:50.59774Z","last_seen":"2026-03-17T08:15:59.327168Z","times_seen":3,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/coin98.webp","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /coin98.webp HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"41c2-69a502f0-544b16b1692e31fd;;;\"\r\naccept-ranges: bytes\r\ncontent-length: 16834\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]}],"data":{"size":16834,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"66ef08d2245e2d8d00f2dacc1b50a77e","sha1":"d04b01af175a41e7b7b5fca65dbc060cb4bfebdb","sha256":"7d17ff9ea14cbe73ccd1ffa3e503826a39698cc9cbf3d79c9fe90a48c15d20a0","sha512":"bf22d8da5bea00f48d8497b54aa9770df09a6a2cb7a4da45cc15dc6de706045ca0b18d9d6ccca888f02b96b002739b1253b09851ec66a0e1f387fc94a0bb5a42","ssdeep":"384:Xx6Cnob7IIpDIbSmMeR9z9WS5irPWM8DbegkoY:Xx4AIC8YQVrHykoY","tlshash":"4972c0323dbcc0fc0654a67ca97dc7cb1c05cba00d655d287e2839e2c99c9eba875247","first_seen":"2026-03-04T16:41:50.598897Z","last_seen":"2026-03-17T08:15:59.321909Z","times_seen":3,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/XhjIRijk.php?s=%2Fipfs%2FDz18gwzuGzxm9J8lEkk95Q180f5b5bf61bc8808bcbaf69f6ff97d1%3Ft%3D1772642480310","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.335Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /XhjIRijk.php?s=%2Fipfs%2FDz18gwzuGzxm9J8lEkk95Q180f5b5bf61bc8808bcbaf69f6ff97d1%3Ft%3D1772642480310 HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nx-powered-by: PHP/8.3.19\r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Wed, 04 Mar 2026 16:41:21 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP:8.3.19","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]}],"data":{"size":610109,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"037754815a4772b01be1cf2cdcf050ad","sha1":"53d5b60c8d37f73a5f99dbb90dc2fd6d98a847a4","sha256":"f00670eee0748674720117e2f3df1f6b84d8d0dbbeefb89d2590dbc2b7fee9f4","sha512":"c0eec8807636012fe5ca51ca0565fa987a3edbb4f5c53bcd873c512547d4ce89cf3ac1964738c758a618bd788d116e270c1b4d15b888fdbe07b970511e4055d1","ssdeep":"6144:fh5gDYJjJJhOb1ntpwro5gxPoGeDtGXsdnrZtF6VHp3JTa:nsY9XhOb1tpDWPQdnrr","tlshash":"b2d4aac8873a967b44a013a7053792bfbfca0d7da24f8c607ac09cd2da6571e92f455c","first_seen":"2026-03-04T16:41:50.600333Z","last_seen":"2026-03-04T16:41:50.600333Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1349,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1323,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/index-DHRbWdbY.css","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.322Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /index-DHRbWdbY.css HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"11bfb-69a502f0-50f3b04975798f9e;br\"\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 13649\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":72699,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"6ab3b20ff7805a84856cf280c639aea1","sha1":"a56da9682be5f8ca07a5a0346c75a51dc652997c","sha256":"fd87ae6fbc5a48ec7afea2dfab4e08fffb5aca089960c75ac17a13b3a7910af1","sha512":"a6511241ccb03c5a5712bd0c6f637f987ad4d719c40c08f7af8d4d3e3841acdc3ed2938bbde33e89a447ffb268d38cd960888d46839a68cebf2aa81dcac9fba9","ssdeep":"1536:hSxy8xyfvvmuU4RMBeR21XKIMnoW00SJCYmT:Sy8xyfprRMBeRWXKIMoW4+T","tlshash":"8463c8a0e361d53ffc27a5bda3dcf84ca11ca482de2717edfa41a21592c36f20966714","first_seen":"2026-03-04T16:41:50.60138Z","last_seen":"2026-03-04T16:41:50.60138Z","times_seen":1,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refundgas-solana.xyz/solana_icon.svg","fqdn":"refundgas-solana.xyz","domain":"refundgas-solana.xyz","tld":"xyz"},"ip":{"addr":"82.29.199.184","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refundgas-solana.xyz/","date":"2026-03-04T16:41:20.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"refundgas-solana.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 02:31:49 GMT","end":"Sun, 31 May 2026 02:31:48 GMT"},"fingerprint":{"sha1":"91:C4:32:B1:AD:C1:D9:26:18:B8:8A:A6:36:E8:DD:11:52:1D:DA:A3","sha256":"F0:EC:2B:F4:C7:CB:89:97:1B:A6:60:47:AB:CD:9F:09:C2:1B:BA:30:8B:EC:06:00:6C:4B:B7:0A:82:73:86:D1"}}},"request":{"raw":"GET /solana_icon.svg HTTP/1.1\r\nHost: refundgas-solana.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://refundgas-solana.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 11 Mar 2026 16:41:20 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 02 Mar 2026 03:24:32 GMT\r\netag: \"66a-69a502f0-cb8264e1a43133e1;br\"\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 544\r\ndate: Wed, 04 Mar 2026 16:41:20 GMT\r\nserver: LiteSpeed\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1642,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f8276e97e7de8ab89562f744b29a80f7","sha1":"74afa59b283be8e0fa20d50d51e574f71ccef45c","sha256":"92818433473d8e847fc60b9e1eae67bf58871de8f79be7a1ffd42c72d26e9a42","sha512":"8f3d1191bcbdde5a8c268402cb71d6240ebbb473e90b965c999b74f4cf7344c4bc625f9f8d5902b43c6d7a7a00d9462129fb2a045b58421b8d612ce9f06db4ff","ssdeep":"","tlshash":"d331c015e51b58abf55ac15ccee10d2533ec42ab9062e2e0a1b17a2ef5acce1405f3da","first_seen":"2024-08-19T23:28:20.357917Z","last_seen":"2026-03-17T08:15:59.314863Z","times_seen":25,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"refundgas-solana.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}