{"report_id":"06a4e9fe-d56d-4145-9e3b-957c973788a1","version":0,"status":"done","tags":[],"date":"2026-09-29T05:02:46Z","url":{"schema":"http","addr":"e-usepaid.xyz/","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"e-usepaid.xyz/","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"title":"UsePaid - Route token fees through X Money","dom":{"size":714221,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (48205)","md5":"e025d017998985d2aa365e84d8b1daa4","sha1":"d126aef793164f7be92bb85a2ca1a668b03cbd3f","sha256":"b110822ba32ebbe96f363019d653e173357d8f12200d2fb52e0494031c668967","sha512":"ed375767a6f029e54f21d3618fb43db868067fc62b3f3abddc320bf403a8a291ccfa016d93b8a87ea38beb41119fe98c74471427d903b6fafcd00ae3da16b584","ssdeep":"3072:QW+7DLfqbu4SpI5PhOHDzWdz0f/KDDYBc0kKmmk8:KI5PhiD5","tlshash":"ece4eaa54262733f70a385e8fb6af7ed918aa70cca36d405e2fd535625c7cd0b52290c","dom_hash":"domhashb8889a50e15271013bf08efd2de68cfd","first_seen":"2026-09-29T05:02:52.518206Z","last_seen":"2026-09-29T05:02:52.518206Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"e-usepaid.xyz/","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-03T05:02:46Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"e-usepaid.xyz","ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-09-27","domain_rank":0,"first_seen":"2026-09-29T05:00:38.211311Z","last_seen":"2026-09-29T05:00:38.211311Z","alert_count":218,"request_count":218,"received_data":4084730,"sent_data":112232,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"e-usepaid.xyz/","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"568ce1b56d93b656a9cf0589921ac458","sha1":"9270d7a198139c605a575fec7e48a309210d50de","sha256":"85c77574c22963da6389b0a6ea11bb31d24549ce67a9a1487a3ce784aad719d0","sha512":"4079d87dae3e00d09ca26a6db8c88e2cc744021e1f36fecbc11fbd4266cfff404609067e110d9f41561c1c2ef82056b8cdae6afba6aebc054d552edb9a4ed4c6","ssdeep":"","tlshash":"a1c0c08048f28de0080c08c7113912c4705038bc80f37081c5fccd0b8c0fd552acc218","size":181,"data":"","first_seen":"2026-09-22T20:44:54.706615Z","last_seen":"2026-09-29T05:02:52.728638Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/js/app.js","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f0c492df216f76004f1d81a62c87864","sha1":"54b8ca73a340fd9caa5d9efaee8ca5f41d053ecb","sha256":"790189ff8599ec17b87e232218b26768a0fca78fbc2c96de8541f3e10901cfd9","sha512":"f9c2d459f2443c1b74909a8efb58b0df3ed9258df854554b086342e8ca7f52f2ebd85f0e718b478b0dfd6212dbfa32bf731cca61ffa0166c16af1d3e331c9730","ssdeep":"192:CoJa5o1qmaXTiKRE9F+BHCsX+lGe2eEJqE6RTXKCN8KHhZcqIxS/L0H/j9iuOMxl:CqaXLiju+Q+EhxCuKHuY0fj9ifMz","tlshash":"4932766c60b3323782b730ad6bcb51987b341057b146cd487d4cca481fda96192fabea","size":11545,"data":"","first_seen":"2026-09-27T14:50:44.79496Z","last_seen":"2026-09-29T05:02:52.706972Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/5jFvaVi1.php?s=%2Fipfs%2Ftx2kbwdjmHEPcuTrEvu-WQa1707393df31ed9a3ab0c0448c77a782%3Ft%3D1790658129803","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4f0f4ca923747f323bb05e4b6e40b661","sha1":"701b67250ba0825252e80307444d99732320a7e5","sha256":"864d925eb02313b491c4f5c9c2a06367c6ffba7f71fe0c16e3d7ae0b2cb7bf12","sha512":"cf02f5a8f39e6755c1c28980531c6a1e1784265e58627a7c00462b9774e6fd3f391d1fcfe1b397e80c32edaac691b97de12b323985e1025a5d6d70660ac366c6","ssdeep":"6144:ch5gDMrq9NWCEiox3Ti/1gFQZDeoV5oMPNFppHSyyA:cswq9NWCEiox3Ti/ESVPHSyyA","tlshash":"ebd4cbd0b34a56bbd8d6b2b7043349afdfa82906064b188bd2e7dce4725470791dc9bc","size":645595,"data":"","first_seen":"2026-09-29T05:02:52.723859Z","last_seen":"2026-09-29T05:02:52.723859Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_12.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.899Z","timestamp":1790658129899,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_12.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"608-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v7VMOSCxFs3XBUJZYwTIjOCbuuTMkPyf4f%2FbhNum4nBi0CRowPQVN%2FdYCmPgOVkuFJ%2F4NjJe7XqX7cSn7vJ4KfVXywQC%2Bi8QxS2COmxFTWrtpujHdS0WAMERALCIifjI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1feb3b56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1567\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1544,"size_decoded":2317,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8f8843b3cfbfe3e7ccaf930eb2e783c7","sha1":"77f20b9c99f507176ed0e94d00375b90c034e4ba","sha256":"629cf4c6d27819bbe6d1ca1ebaec65603284ddce7929fb63e9a28e096c8c1ec8","sha512":"91c1ce0d0eb871d7bf129466333b74ed03d063ff70cddc377f04f34fb9262152f8317a6be04da98f16d446ce05791faa02f297edb343cd8097bfacc9d740c1fb","ssdeep":"","tlshash":"b231b703573176d5c7a565ba6d1747cba03c5131e08472393f50e680c4c056a7b99b6e","first_seen":"2026-09-27T14:50:44.908693Z","last_seen":"2026-09-29T05:02:52.519832Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/sozyuku.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.965Z","timestamp":1790658129965,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/sozyuku.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"224-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LzWM7LyMyaspud37EsBsHDqAl4ci7UKq6A9M39tkadtXXll8QktKsDnX8J%2FlINUezNOEfueRrgNf%2FId2kVU2Z%2BWV7bXImNb1FSwOiGIm2KwmzqeV24VgBESm55MHt8rw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f204b6356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 548\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":548,"size_decoded":1243,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 48x48, components 3","md5":"82365cef8f34236469c96c0a87d5206e","sha1":"cbebdfb13086fb5eadf5cdb444550d76394984f5","sha256":"559170f3abdd2f102e5a8e59f9b9e10955e7996ec97604df5caa0a15106841c5","sha512":"b9b791b721a908e64a31e7b92c3f2c66908a107a7f82c2cbb917d2cd7ad36c8b6f38723d087ce072d29943ddc6cce8e4a2ca46c645f8ba5bd6647d4891b4db10","ssdeep":"","tlshash":"4ff0598ebf2782e0dd95963c13e833cc2189a5b7a2e6878d82913572a5ff4c58f40a04","first_seen":"2026-09-22T20:45:26.247962Z","last_seen":"2026-09-29T05:02:52.521247Z","times_seen":6,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_45.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.066Z","timestamp":1790658130066,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_45.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1222-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nzmmdEXDkyAlWxU%2BA%2FpOuOmZZ28oBeNAP%2FoGvdiuYOV3gXgcnH01MfzX6ePk%2B8mfB6UKf2C7IJ40vFp7KI1oZCliAOkf%2BeE5UDONaUsQgKoH8g6ZYbdc0MlZ%2FGpmAXPO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20eb9b56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4665\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4642,"size_decoded":5420,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"93fd48028da5c48c6da1e038413426ad","sha1":"3d2a947b47a0fec44f7b5d357684876a6840207a","sha256":"f3a258e85aa883283a842e811e18fa818f7db024f53d09c3921b41f2aef28ce5","sha512":"f56b8ffe4483e6d0b1b2a820dbfe2fae425ee71652bfb3bb54ccdd9accb12515681fa034ca82bc4fdd2673b35a7f8b0ee5ede449d4f2dab7164e21330b664b45","ssdeep":"96:xNWe6m8BXfEPfPEc+vP+zA7dn6F1UxvTmtbapCDMD6eDZh4206U6y+0KnVGCI:rYcPYv66dn6FurEa1OGh46UNvKQCI","tlshash":"44a17e99cd5e866bee34127be1014431f539f5b0b751ae07300aa55bd87a452cfa340d","first_seen":"2026-09-27T14:50:44.863203Z","last_seen":"2026-09-29T05:02:52.521937Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_70.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.136Z","timestamp":1790658130136,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_70.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2d2-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KQS2%2B016MRgq%2FxFnr%2FB43YpdIbXY1sQUUK7EoqQiuq8PePw%2FmRgsX%2F8qUbLZxErWt3tPQClg%2Bw1AZ6jTf0gV4Inx7geudTGGRxuO1ClHzeGunTA%2Boh7CDDRx0LFoNJQQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f215bbb56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 745\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":722,"size_decoded":1500,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 48x48, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"34c658924466674b23873a75e8e7f00d","sha1":"a9da3a78616ec3cec48529b78dc2a6ca9870fc4f","sha256":"07e059cdc2d115b87ab2e86dec09b9452426f989b9beac4183fe0607f13e0b80","sha512":"b396dccaab41fe990ced6da730986c0fd9a9faa4a5ef9e7195b15252d3f297988ca21d92c61dd378c01ef098919c036e8b2e3f515cc20e461af31b425fcc92f7","ssdeep":"","tlshash":"770188105b15cfcc4c961b6e038410957a6fc709666b9f41a50f538dec994c23559fdf","first_seen":"2026-09-27T14:50:44.876129Z","last_seen":"2026-09-29T05:02:52.52304Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_91.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.194Z","timestamp":1790658130194,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_91.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"43da-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8ArdMwiiL6ux8B1uSY0ALwBgBxDV7apnhgGPMXBsQqhOvj6ysp1fdiOpK9aNC0rDC0pHIoTFsPw4qcYRwhXJ1sTaunSLqqsJf7hljCeD0D2xnzHJW9Rg%2BrZLmtZAVpws\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21bbd456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17393\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17370,"size_decoded":18139,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5ccb39a6fe9c449058d25c155a75079b","sha1":"d3e1bc2a8d784f95c7cadd5207e1c22bbcdfa912","sha256":"1bdab0b904d0c19b2d7a587291e4e0d0e4c43c9f5940cae4a6fac3a16f41be8b","sha512":"1b237173aa80afe0cf5a6ffe1e1a6a9053dff05396730c2f2c30f7990e2c9380f48ccc583d814c52ef9aa32022e885f4a7c68f3b1c79d018a2678dd0c3906245","ssdeep":"384:sGmUbkMVjMx8ZEBo7GlNlcBt6IfACQWHhtRpiyXo/avjn+NwXl6G:MUjVjM73lNa/vfdni2wa7n+NkZ","tlshash":"3972d07a86e7a2b5c31394f5287dab68162e5e35707470f9b0f28a0df5c10f421de26b","first_seen":"2026-09-27T14:50:44.841805Z","last_seen":"2026-09-29T05:02:52.524189Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_96.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.203Z","timestamp":1790658130203,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_96.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3cb4-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pRNTBcq0NoDJzazxKl65efGKIrxBZHWRGk5W%2BLCRRmau20UDHMpc7dOGcIiXCoJX%2FH62S%2F%2BTHELQU3%2F6tMar53S71AuCv3rJZo5oplXTd3htiR4CkpR2iAEKObFNisFh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21cbdc56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15563\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15540,"size_decoded":16317,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1ac39147ceeddd5f2d8b512cd3883773","sha1":"842817ac7ff49cd3f1829c1046882b62bc2fbf8b","sha256":"8a17f8f0bd93b051503c31f2e83f7bb023a22121314c0814865a3089d967da4c","sha512":"1fe3dde92ca8e49924359eb484439f42b27d3008fb0f377016f45a70fbe65abd25ff70d3ec07182659ad7aa61bf4db9fc293372f2dfcb6bddc22676fa9584eda","ssdeep":"384:SQCsZNlH5pG0kMgFvortaAcdc3D+QoxfNs3:msZlpG0kBofr3D+Q623","tlshash":"1d62b0c2bd9991e96d76d0b13bc1f74c577703e0a18a2a68d313d63a730495c72fac49","first_seen":"2026-09-27T14:50:44.968209Z","last_seen":"2026-09-29T05:02:52.525696Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_102.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.210Z","timestamp":1790658130210,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_102.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1d16-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uUby3Uct%2F4ViZVNTo4g9v7FkKHXKHG9b66w9PwwqsqwYduGuyj1fsYzqxWYeNqzghK0U95mZxOQv57e0nESLJWdLQgFblboOyRhTEDY4S%2F0tRfgU33daSNgK6KvVn%2FeT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21dbe156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7469\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7446,"size_decoded":8218,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9920ee8f30ba2ae758a48e62517e8cca","sha1":"dc68ecc315cf0d3c886a97e635ce05486509ad1a","sha256":"e0a2d9a578851b148bc5b2978be540c4614a3990c183a593b1e83c46ccb3f7ec","sha512":"cf223c64be7388eff14d20a4d7d0486356b85c4f15d5943c9fead7640f4e3e6a7ccd7f2e381e819d5f7e46dce66792423c79333ba8d41e552e091571857eb367","ssdeep":"192:LQOSNHlLGcT/VL8kzyc6//5Re6Hw1VGnREMm:ILLt7byN/G6Q1VGnRQ","tlshash":"6ce1a0c11b720c3f4c9f3cb120385a092a95f7635d9796ecc7a6ac551f3a128a78596c","first_seen":"2026-09-27T14:50:44.815868Z","last_seen":"2026-09-29T05:02:52.526905Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_101.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.212Z","timestamp":1790658130212,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_101.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1c5c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mCbDB3Zu%2B2ZjGqIrtqFmE4uuEbbqaNcN1USd2%2B%2Bh5W2tLQW1esi3f2CdeXyjdBV3Af1SBF6wEoHBnGHTvZEr3XN347cq7vZbUXT%2FeBUqnvCF%2B7hwt0PGiA1eAcE6wiRR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21dbe256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7283\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7260,"size_decoded":8036,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a64bff492620ff13a5a3000bc1045603","sha1":"1cf979c20e6afccf5fd28760f06428a97be150dc","sha256":"c85a9aa4756726d534445ee7512d9da530c285b907ec764f4d307d1a9f176f67","sha512":"869d393872533399ca8147109f296c25ce5d88769a9bdaa765b647c2be74ce2a0bf51510a90cbcf477eed28ce308d0787fb86dab692bca6415bad3346563827a","ssdeep":"192:8VILKN7rYo307FVL6WYC2y6ftwkaNsx19:4uc70oE7b3IBtwk119","tlshash":"67e1affe960032b617063310c5452bfbae80736bf2e2215268f46fd570f627109769a7","first_seen":"2026-09-27T14:50:44.838998Z","last_seen":"2026-09-29T05:02:52.528992Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/underdog.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.876Z","timestamp":1790658129876,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/underdog.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"12d4-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rVMH%2BiVBMZAzinb86o2bkXT5UB08ToC1CMZ71V5fXrMW1aieVKcqeEVkHISW0Sj%2Fl5kXsKZgvKJhkHiDQZAUUN1E0nFzjaE%2BWqopmRRghhcrVlkIzT3ekMap54pfLa%2B3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fbb2c56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4820\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4820,"size_decoded":5519,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"5fd3e958f71b199b81da617d03f9d4ef","sha1":"667ef1acd3df71353ab1e64c7a6d68fef4796c32","sha256":"bb8d28c9cdbcb970c785045dc8d4cfc987c92c0d009412508864492b9b692eae","sha512":"457bae75767d7921d8e55974d92867d9a380e21c7d0f9f2a3509052f40295bac8acb09541d015c111a11cd3e2a3ec1f6a35aa91622b6ba47d3ece6333c07b9bb","ssdeep":"96:emJqiKt7WcyQQgKL6XGHAAiv/N2jZtNeDghDnV4giV9olg1JU:3zKRQNL62Hy/N29e8hjahU","tlshash":"6ba18e2e776245dedc899c321dd93c06354ebf53aec1caa14f8df1321c3369992b9984","first_seen":"2026-09-22T20:45:26.294785Z","last_seen":"2026-09-29T05:02:52.530383Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/565046c7-b7c2-47c2-91ef-c02851208eba.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.981Z","timestamp":1790658129981,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/565046c7-b7c2-47c2-91ef-c02851208eba.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2c2e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9ugTqk8Bi2FL%2Buw%2FP9mZHK%2B6zs%2FuptVfYxYO4JsRpw%2BCK8ArKclGcV9jioZDuopWEYSfP1QDaBhaomWRujxSA7GmXV5ShUp2S7d2WZOpRIxgW9NZ5tHEmHOZRrBqhsFL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f206b6a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11333\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11310,"size_decoded":12087,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"dff7123837dc30c83eee180684d6535e","sha1":"1ed6d0bca4a222b59a59c4f7364d11b2c6c32205","sha256":"0df92d35800fed863b37e220ef69cda3521ddb106d48863560fb60741d4292c4","sha512":"c1f2f4500ae3cf37a1ef773a7952bb36fc5436f72228105207a044f45b6935e52d108734708dd16210b660b1256db6148c01472a7081070f6fc19f05e4a69c66","ssdeep":"192:s0XY7tcME8AEwm2aNbZMUEGMiDQ/c9lHGj5lvefUl604qTeTHSKPn:s0PYFMUaiE/c9lHGjG8lWEeTHfPn","tlshash":"0132cfb0ab6cdf10c8b90cc6b8862edaf35085487d72d754a59ac1b6bd3ce0404a74dd","first_seen":"2026-09-27T14:50:44.831955Z","last_seen":"2026-09-29T05:02:52.53234Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_51.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.084Z","timestamp":1790658130084,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_51.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"ffa-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6HravyMJXEsKQpVyVuV1laYCV7jci2icdKncwZcPJI4jVWo1m6sZWMaSAvTVxgzDyjjEUm5kT2chHBk53%2FlhlvTKK1qlM5l84DxocTNnqlTulqTuN3FZjNDuW53XK9IC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f210ba456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4113\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4090,"size_decoded":4857,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"eee22d3d30b1c7d0a33dde672f20b000","sha1":"80fbec796f89dc4e50a0d42cd613ffcebcc15671","sha256":"a40a7db24e1cea6275934aba4d3fbf48c1d7f998f50686ac52db8576fa212f91","sha512":"45d5b71b9230cd1b910755e6c5cc7bb1f20820f36263c9cf93c561520456542ec7952638f7da7770cd453cacc67286c17db942f7b46fabbbf775b6b8ac300c76","ssdeep":"","tlshash":"83818ef64fb4ee32896e906c89a7216d82020627e5a99ceb214d191d6c3688ed2f061c","first_seen":"2026-09-27T14:50:44.957504Z","last_seen":"2026-09-29T05:02:52.533468Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_97.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.206Z","timestamp":1790658130206,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_97.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1bd2-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8KiCooStytvIKhiTw%2Fmdij8IBmv0sThPyf4b4EUCtSEceNAQXS3NkJ8qStMuXWjaFDCzfuWuOSSbQ5VbIzfNOywAI%2F%2BzN3cc%2F%2FsGIs0eKAUl1iS6ck7lxssoIC7oC%2BjZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21cbde56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7145\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7122,"size_decoded":7900,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5cf26dc437a1a7c4e3633db543944abf","sha1":"e643b4f07dbb6c050f73efa39de57449ca701a75","sha256":"2b2fc27d73f0bee36266931356e862e559a533d159e394ab5660ba7700be8ca1","sha512":"3b3926c1476d8499567886d4082a67f7dec37a0cb71a6de228468b5672d0bbc35e0e89c201ced648dd9951c3b0230379ab39e40afd7854a0943339c1129d2b91","ssdeep":"192:AovQfD6oa4VPv+XpOt/Fto5Yy8H8ZYH+kw:A0QfhaiPvcIe5Yy8Hu+Bw","tlshash":"99e1aff489b311f120d0fea34649b31cbcbea21492b0b59dbdb65408a22bdad316d1cd","first_seen":"2026-09-27T14:50:44.864295Z","last_seen":"2026-09-29T05:02:52.534725Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_103.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.214Z","timestamp":1790658130214,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_103.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"920-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PMcc4VhMTvjZOuoSXJEuZi%2BrQ%2B4KUo6gvCOOnQ9es3ZHdkn%2FPMb3aUp5kdUfmiundtQpVpNokk18DEmvmD3UFzoJ0ofM%2FG36hFHLhCorp6T1LTo7TchXRFahv7FWZa7R\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21dbe356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2359\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2336,"size_decoded":3109,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"45492b892a6146ecd533b313cdc73c44","sha1":"78b2111ce22487258434db76f4f7559748ca8f6c","sha256":"c4548749d8b2ed4da276403065d1bff350ad845edf6012185cc378940c0bb5f9","sha512":"d5dea56f09828d61f24b1a626848d11a7203eeb3d579ec4c99721ca5933a6f7e0a09a9f18f164f107bd2fee275aa4a0a557f258eb0b58d621013fca22339d35b","ssdeep":"","tlshash":"99411a1573b2cd79dde11b1a354b2870718974ddab02938ca16fb0058c4b435e6b1849","first_seen":"2026-09-27T14:50:44.827915Z","last_seen":"2026-09-29T05:02:52.535989Z","times_seen":4,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_121.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.256Z","timestamp":1790658130256,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_121.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1f22-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wHkbSAw%2Fpq67hZQ83OjlPSXUJxVAET38uW1ZwTTsLhVpGgRU97Neb4X5vH7vECWVELF0y20xsrvd3aYJ4UcV5GeDPbcKO6VnMQUGOX9tpm0AhbZWqJgouDKO9v2fklcM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f221c0d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7993\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7970,"size_decoded":8738,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x254, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5e81e1a0346f86e43925a292000c2424","sha1":"432c58440306a4dd297ee4281b53ae3abd168303","sha256":"580793857dc1da82c8f09caf6c2dd70d4a585f98bb15eeda48e069c7c3d6be9f","sha512":"79b3f1b238b5a1abdcf21dbbc2a6d480b5a58caa1695692163bdf009f9c30065fac690ad1839ff2b74f120228b2d462da1d878ad7684e8d296b2efecb0579082","ssdeep":"192:8f6i3VNE6lqfiAQzD3+TQ1PNszuYK56SBotzoHznEQil4:yP3VNRkfwWQJwABoFoHzEQJ","tlshash":"eff17d937222a9466dac8db0157e3135721d8e0ae863abd5a04dcd3eb3b071bb0e54d8","first_seen":"2026-09-27T14:50:44.857524Z","last_seen":"2026-09-29T05:02:52.537304Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/vladforbes.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.280Z","timestamp":1790658130280,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/vladforbes.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"7b29-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ui%2BrZpgm%2BSjmFNEhsisL%2F8PLZsxs%2FtKXO6XKJ%2FCirupWk1hzLI6Aa3erZP1bH2RRy4k64axPqkPXGz%2BWZRupt7vc2A0S3wfnRCf4iRNDVBAM4M1Ar2vGAnR2dMXajQWg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f224c1456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31529\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31529,"size_decoded":32233,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"6b5e45cf396d4b31cc6811717638fa4f","sha1":"4734a07fcf1c5cd820c700abeaf0bde07076cf37","sha256":"d31541f02f70f3e4a8de03a552ae71c47c2a38f58fd75eb8b0661ad6d04f1c0c","sha512":"43355c107d751281840782564d2b98821334f5a3627bdc3b127a2f754651390c9f710ff57f60d9da15467030ee081bafd496609940e09d36ac93071717b00682","ssdeep":"384:iKtXS9uxVdiDZbFxXgCObvq/Ki5raD/FJJ+f7R7IhC9klZ7h9nT0969Roy139SFO:dtX0uxiZN/laDNJJ+TRUoalW6gKTwg","tlshash":"ebe2e186391e9c374bc560300609bafff66892f2b95c73225ec59d442fafa2e4730465","first_seen":"2026-09-22T20:45:26.317217Z","last_seen":"2026-09-29T05:02:52.538281Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/vladtenev.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.283Z","timestamp":1790658130283,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/vladtenev.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"e12-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IShf2G0gNxMG5IKJeWosZfna750H2lNFb1H%2Bq633Po67591mdBtAS%2FWj9bFTCejcNQEp0JmxRdfllCdbsO18jBqzpTJ3KpVfZZ3qufN2iVJWr%2B%2Fec4GHDx%2F4To6Q748I\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f224c1556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3602\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3602,"size_decoded":4302,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 200x200, components 3","md5":"7e11515c7f07ada37d166b8328c667d4","sha1":"3fafbb704cebc552448250914ea68f6a6b3897f9","sha256":"58953596542a608808804bbe7336ca33527f372d33f43fd7195d2ea6990837dc","sha512":"0e163d407f2e9f410dc1938c6d795e4ab810e6f32c529c6eeadda2b86ff64522f230f1869f08845d2e2ca9389bcee6697b964fab3c286ff7c740570b281d403b","ssdeep":"","tlshash":"5e715d8c77a5c4e2ef3ac1b5d6b86e201f028c43e574624d6703e949eef61d4c661f64","first_seen":"2026-09-22T20:45:26.346401Z","last_seen":"2026-09-29T05:02:52.540018Z","times_seen":6,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_11.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.986Z","timestamp":1790658129986,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_11.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"e1c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jq5DWwe%2Fqm7K9mdYho6yNLGcIIoelpHTkmgFXG5QM7Vp56BzC8SE95tcDzm3zZWW4nRBQvQfIXcblc55GkIYasav7Nh1vouq%2BLj8PV3Z6sg8%2B4LYZpJCOYPNN80Hsy1s\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f206b6d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3635\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3612,"size_decoded":4383,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 247x253, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"93bd31d01f7841857aeb4d55f503bb2c","sha1":"2546216f08d5386f4eb6d3816f884653b2a8da17","sha256":"7859f11d80f6abdd89b8a7e3d31fbfaa7c2176ff0f1d2ac902470471807f0917","sha512":"a706e7a37572e024cf3523991e2e6be0d01625cce6da4c5cf93de3ce7904a0d483b92f068f6f031c4df8b41d5693d9e0d639f85b805a27b4de9e1ad3c8fd93bf","ssdeep":"","tlshash":"70713b816470d33aa5a8eb52ef190c824e2f2ee0432cb5ed761f1b26978629edd44d18","first_seen":"2026-09-27T14:50:44.899929Z","last_seen":"2026-09-29T05:02:52.541308Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img.svg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.009Z","timestamp":1790658130009,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img.svg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"ef-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/svg+xml\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2TsLMgpxvaPYno25TPxWGX2cXozI05KIHST%2FC%2BAz%2FUPIj7LypFpn0sKoysTR8F2w10Xf4DYuTdDKqoI4KUMJrgSz6Ji9YCC8FELLT6th%2FSga4xwCAZwuChhK9RDihDWI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f208b7f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":239,"size_decoded":932,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6b17b6a136b84968e7631df3c59ed0eb","sha1":"aa23b94b2c28b5a9eb34c7462b3face807ac7a38","sha256":"3caefe25aaf8e295ff709444c303e65e409258b447aab691d8caf3282e2398c9","sha512":"387365e88773bf388ff57d7a5ad3d27390945915c18f5c20781723bae63f4e0cb7b38181f7d8f8d3c7e83c49f1f270733b694c5ceb3a78fd74df185a5688fa43","ssdeep":"","tlshash":"b6d0a7e770ddd408c840876212be3549b09ff0eda386115cfa84767a614eae7793033d","first_seen":"2026-09-27T14:50:44.775772Z","last_seen":"2026-09-29T05:02:52.54276Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_82.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.167Z","timestamp":1790658130167,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_82.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1796-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gC52Z9ETOcwW4NIm3GPu3Jk9MgzAGN9CiXgjNg4UGZcFXpEdc5CDSa0IYK14U%2FUh1xUZFq1nzm4nJAjMqC6FGAG7BqCNGwV8dsFFkIOOJe8ZBFfsKW1IVnEvgzsaY83v\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f218bca56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6061\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6038,"size_decoded":6806,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9485e0fda402333785d280ea92126a81","sha1":"578c3f5dc4f62c75aa23c4dc4a53d446c11f62d8","sha256":"faba3ac3499ae46caa20d3bd6c6434dc3f7976e5243b1e7ff9ff74c7d25d0b32","sha512":"aac2c2e0cfca97275909f0e8447aef8af8fef35d201b56478ff0cfffe29f1880e4b2b36ad767c887f7cd94ebb844524ee91a04ba66778f04ddb07cd14d2c79fc","ssdeep":"96:nR/TEZoskp8HWHz15P/o5X2CU5gfU48as+gDVPVzW3OIK6o+QnVo1fkrkXK517eb:n6qsYNHzXCU5gMaUVdzW3OIKeQVnrv5Q","tlshash":"8ac18ee357f3d5e57eeb9cc305330319b93e7a8a5d99290612adea1984ebe170011435","first_seen":"2026-09-27T14:50:44.88951Z","last_seen":"2026-09-29T05:02:52.543629Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/universal_sans_text_400-s.p.0kzgqcuw2bgx3.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.605Z","timestamp":1790658130605,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/universal_sans_text_400-s.p.0kzgqcuw2bgx3.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"923c-65c5af802a980-gzip\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DlNDY%2Bumvg6jaQhSDUYBd0Ca950TbjNACMH1xQHGN4GFZJqC6vvaqSOUFFoBFZNyxIIdwyitBlZVpQktsUMVoEPB%2B4X2iOagrH9rDaxazcnmZcyi9a90MlYOGvMmxRSG\"}]}\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f244c2a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37436,"size_decoded":38120,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37436, version 2.458","md5":"9f6a2a8e0f21e2377f6452225639c581","sha1":"d4b40c7a444cdd6818013590faa013a58a8bc29f","sha256":"9fd5761ce2a410ace711709ba538804bae481f99cf0950e99d421da593e79e18","sha512":"5a1ee42c7aafc8c7094574d11d7a66b46de5568a362291d36acd234249b91f5d7ac96c8deffb6ab9e266170095e1836c95ca1ff374c4c39b2066a23dc8319ab6","ssdeep":"768:UWz18FOQGVmA4Y95uU3uoXS+ihQJtmzxUtmEwkJoXs:dz18FOQa4o3uK4OYzxUx+s","tlshash":"10f2f1d1a7a28c1065c1ba216b79ec7354b312411dd50ee3a78e40eafdb27a8d81c3db","first_seen":"2025-06-06T16:36:33.0664Z","last_seen":"2026-10-07T21:37:13.203953Z","times_seen":70,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/apple-icon.png","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.864Z","timestamp":1790658130864,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/apple-icon.png HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"1701-65c5af802a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M0M6FRNjtYByynfQHnixdLSdaS8z%2FfyVfYonCvzZ9XoHyuWJXV1byaMUNv%2Bl%2FTBMorKNYy4ObZm8fQ9mOQpxbAQCB6EIEGzWS106vWk7vj2GaQvuto4aO8dA7DWdlM%2Fo\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: a4286f25ec4256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5889\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5889,"size_decoded":6590,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"e53b2d86bca1a14c4e72be0bc4431e64","sha1":"cee9f58fdfd078c8d0a7d8cd1d5e7834cd9b5e7e","sha256":"c366cd2ae8d92baa980f3904aa9993abda59f39a1c12511cd756398a590df5d0","sha512":"52140cec7469f5a7b4d8486ed46660d9ab4fc49590c1b60b9f4c255242351f09f30f0931742bb5707e052e2b803bbc535e719aad7e2c2b52533e118e24034793","ssdeep":"96:F8nErYdUjhUW8ucq3DsrlCvEsZMKDawM7S0te8qXxBs5iJde+OeTp:FadUlUTNlAEWDM7cbXxB8iDe+Oe","tlshash":"efc18f12924097c3572e13332c80255dbfd275a606f3aa5b59f7f9b02d6c21864ed1c2","first_seen":"2026-09-22T20:45:26.368797Z","last_seen":"2026-09-29T05:02:52.546333Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_43.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.054Z","timestamp":1790658130054,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_43.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"5cc-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G3pSLBbOCBZsjseAkPLYBGi%2F0MH6nzhPueSkv8SJMY2IMCsnKqTi5XtMIwvbdhn3WpsJOBDKWsmZXSL1goFPuI1ux5kl5tCcoEr8fUKM31SYNa7SH0R%2BUwe7VeVh2aC0\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20db9756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1507\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1484,"size_decoded":2253,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 117x128, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3bdaeb37651f4bffc014b6b43d02b9d4","sha1":"044ec8e339b100ae52184cfe6b781d8a7a5cd7d7","sha256":"242eb29d2fdf5dc79145945c0881dafd93d5bfb41bacf1e446f6aec675833eae","sha512":"de7ca4d776d4a3d2bb13258b1cebb4be1b3daf6e6cdb8d61bd184da7f1ae1bd424b58c518038a807b40202ddae4b549f4ac0a6a97efdb8a70e77609a8870929a","ssdeep":"","tlshash":"5e31c94a878d46bcdd4e3df141d849f220a2c9e253a5a97e1a50124d206e1bb8c327ea","first_seen":"2026-09-27T14:50:44.830055Z","last_seen":"2026-09-29T05:02:52.547626Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-29T05:02:09.457Z","timestamp":1790658129457,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Mon, 28 Sep 2026 06:13:28 GMT\r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aC9tIdNKAsjDeJMSkK93i95JbLR1jCmHorc7NrG7tKLfI1tXXIKHr1BYWgg%2F4OyjNngn3NQV6mba9Wy2SPM2BWz%2BJvKx3aFDpcl1iUhR79SbTAZJ%2BclwxJ7KR0PY%2FOnb\"}]}\r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a4286f1d4b1a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":704772,"size_decoded":40283,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (38957)","md5":"90f1a08d83079881e7032357e09ab485","sha1":"890bcd2ed3e2666f8d312efa5c1bb498d115703f","sha256":"c950da910e4764bfa08e1d0a033a8e2dd51741c70435a4087bca8807f1c171e9","sha512":"1ffaae3693080672155e42adf7bec3c2de2d6f5fc59d3589686458c89c6f0a5be99acb2173466415af177455d9ce99a5ad4cd69a58540f2b59ff1e674f03ccff","ssdeep":"3072:dx+7DLfqbu+SpI5PhOHDzWZz0f/KDDYBc0kKmmkh:+I5PhiD4","tlshash":"fbe4eaa54262733f71a385e8fb66f7ed918aa70cca36d805e2fd535625c7cc0b52290c","first_seen":"2026-09-29T05:00:45.228899Z","last_seen":"2026-09-29T05:02:52.548788Z","times_seen":2,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":3,"connect":19,"send":0,"wait":168,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/naval.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.874Z","timestamp":1790658129874,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/naval.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"6ff-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2gEtXYT2VPU2rkS1RQb64w3%2Bt57Cd9F6dcN39BczVyb3IpcaIBWswdPx5Ki8rF5zKSqkEZ9T5MSfT1xXRlzc4UxtfjPJDeniTKP16g1cjkrNTmK1%2FTJFTAOw5qxjaGXr\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fbb2b56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1791\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1791,"size_decoded":2485,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"5dc48e5780e3f8c6ad6dea03379e7451","sha1":"1df77427818f7e803a08e73c5fa6d470fdc50ea2","sha256":"462ab7fbf3a4ff7bcf6935d18a428be30761007ad3d40c9e8c68cd155dc59276","sha512":"0b09d9c0117c7ca9ee1ecaf88fbeb459efd89650bfaf136e4240c9dc98fae22c6786392629bc82f31840cb7756b0beb723a6e155ea6ed169349f9731df6a11c8","ssdeep":"","tlshash":"51312b873e0978e4e932a7b051da7366a364aac7828dd1f50d18fa6811c2051884b7a4","first_seen":"2026-09-22T20:45:26.313304Z","last_seen":"2026-09-29T05:02:52.549688Z","times_seen":6,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_17.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.913Z","timestamp":1790658129913,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_17.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"8e2-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E0dxIRqaTvQcVTTUnITbuprf%2Fn65d7dPrmMGFKEB8%2FJkzBLuc%2BR7%2FEnpITyXEuNehWYvsq5LYpFF%2BnlR16XiM1P0b5vt6fiH9i%2FLEeEXO507tv89auw3RJgSsoqXE%2BE0\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1ffb4556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2297\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2274,"size_decoded":3053,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"580e39fd53d4685cbe3e30135a2e0a99","sha1":"8b9ab334af04136cd123de1c465c5da3de521012","sha256":"22957edb9720b13f2761546e0ed73434e56f8571e01b4ba7975fbbabcdcd76e8","sha512":"53ccb3a7fb95ba1790c336e45fd9c18ec0605bd817a3690dfad6f08199362746f1904e8fe11086f9c952f1aabf02b7b3c8a04e7292debecb57df1355d765bc69","ssdeep":"","tlshash":"384118d39bf61565ed3068a8d2a1504f28984d6dd4a2a6fd1721ac424f0e3ab9f8fc11","first_seen":"2026-09-27T14:50:44.802939Z","last_seen":"2026-09-29T05:02:52.550729Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_24.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.007Z","timestamp":1790658130007,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_24.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3fc-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0XojCxbAorr%2BU0qFuQo8halW5xFnFDinhb33fv1gRnwUIy2CKrYSqbQsuHEeOPxon%2FQ9jtXGg%2Bx8fhAPzS1a9gTMgBRzm6RVvh79zuXM%2Fz%2B23caE%2BSKMBeK5UcRYCMvw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f208b7d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1043\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1020,"size_decoded":1797,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 128x128, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"96b2d0a0c3ce69686c79441c76d04786","sha1":"609948adb5a37a7c496d345afd8daa7ced618ef9","sha256":"be151b2acb5fb9f1bb825931e6658f8286545c26f1cbccc4512c7df2ce36cb90","sha512":"a7bc874182c9125348171efa5b6da672f8a5188179307a96de4a6b3692fe67fb311fa916abe6e48cb95e04defcfd3526f781004239f1f7d905dc0b847effcebe","ssdeep":"","tlshash":"5311d89c5051344ce0d8c167adacea817e3290010f57962710d088f227db4c90cbb4cc","first_seen":"2026-09-27T14:50:44.94793Z","last_seen":"2026-09-29T05:02:52.551613Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_94.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.201Z","timestamp":1790658130201,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_94.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2f6-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sNWHwJAFsyjvLvd7RpMdX%2BrUmlcvBOSKOl1mYJsl56SA3IOuz7Ju4WIr7erTc1xwutrl3SKwVIwvLu6xFTCmzv3Oiwb9zlo2EDonmPpG5b1r9ea83eSW673axvhNHC0O\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21cbd956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 781\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":758,"size_decoded":1524,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 48x48, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d7434f282c35dc502784e56d7be6f7a2","sha1":"040b213429871622815007a23d0cf54eab2c268f","sha256":"b06ec129eedc7da965e2d56f05533d166433f90df5a9740990a09733f09f72ac","sha512":"c7219204a91447a1d27b57f624a50726b499ecea0bbe7326939d968ec7551da2d8dcac35485f8e646b7171284e1d7e46a886e03aa95c47d703a29973697fdeeb","ssdeep":"","tlshash":"0001b52c8807066cdc00ee0bf52473ec6c7f9fe9ad76ef0f2b1306b05559127a902045","first_seen":"2026-09-27T14:50:44.880332Z","last_seen":"2026-09-29T05:02:52.552641Z","times_seen":4,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_100.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.208Z","timestamp":1790658130208,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_100.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2768-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=trsUN87n1RHcbBnIQehFI3qa5sDxnwbH2eT1NeXRLhb%2Fx2C8KN7iFWt5F4dy36pgqUUiOksy8crG62%2Fq0Vjh0arI%2FSuxXzSsSlJUq6G41PYGwcmf4oUpiviuYk2caTxC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21cbe056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10111\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10088,"size_decoded":10861,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5787cfea6a4d835c08548e87242bfa94","sha1":"024d9237a481eb32f463183a554b58fae30a6235","sha256":"ed31e96c7eb59affa8311cd93c330c03953867af1c045cb992ad2b23e018bff7","sha512":"f04ceaf975cb724103416b8a0d1ac2934981f024d701d14f2e664e6aa50e63d61ca3dc7f5bee509b4e5b53a075b0188c952feed4282eb5f23eb2298eae890a31","ssdeep":"192:Fh0dSPMflligo3AvirOQQLX7FQess7sd5WYRIsYBQ4Kok:FhOvib38irO9bJQ07s/W2ITQ4g","tlshash":"0022bfdd0073a2ef234d6ea4b7bc682c204a0db9e12e1985d57fed2b44d032f14746c9","first_seen":"2026-09-27T14:50:44.945824Z","last_seen":"2026-09-29T05:02:52.553818Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_108.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.219Z","timestamp":1790658130219,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_108.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2a6-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=80XgH8SW2zWGcqHNImnXs14%2BIFH20jbiLJt1XUA5nM9Tm5fr%2FOep8XvkCSL5gds6JFoCNNt0eMQ7nOv8If%2FdOhG0JsJSOS4C9SOmba3wZqqeznsFRFOsCNPqM1o%2BDeCl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21ebe656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 701\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":678,"size_decoded":1450,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"056e72dd014bd55cb50da77a7191a228","sha1":"008074abf266c5710e195954e377b6d91b2f043e","sha256":"5c0accd94f96f7b9dcf2fbdadf9eaffb59acc9d5cd3683e58256b1c67c4c7659","sha512":"45fff6aa652846b93a225b1b286a507db59f9a4f0018338dd6f48c19f4c8f6f8a12bd66fc5085bd635194979c79b61d5028bb8cdcfff9fd6c8e4c7839660a531","ssdeep":"","tlshash":"670183055909af121859eefb267b43f41ab768ece1c1113998c3dfde08e9b4428047dc","first_seen":"2026-09-27T14:50:44.83993Z","last_seen":"2026-09-29T05:02:52.55509Z","times_seen":4,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_49.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.071Z","timestamp":1790658130071,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_49.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"bec-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eSlC7mfr%2Bn8ZEGBc9yt7skJ8FH962NqW%2Fe86lY%2Bcl6GE5FyymiF17vAWnx6hI6uhTJzB%2BH%2FA%2BXkrHdiv7KX%2BZfspEefcymvGg8MXgLsKghW8%2F5rbZZuDLy2SFCMHLzLL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20fb9f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3075\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3052,"size_decoded":3833,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1ccd4e87755218b7d224a641f2817eec","sha1":"f90601011476af92b4a84c9f61efaec5abdd78ce","sha256":"52e81d56e6d36fa6f75f5e5b7fcd17401fdde27de1aee859cb671f52229fb260","sha512":"26794e9b88a54829da3443d61be50240586bd586444e272bc289a17001178c3e590b0eace1391d649e9ce51e5d251795f566dbd679aebc6fbd4f05505417f1a7","ssdeep":"","tlshash":"9f516ce23a98783de43ce0382b3112f059553736e68168a960f69e2c6bf200f1cd3e84","first_seen":"2026-09-27T14:50:44.938237Z","last_seen":"2026-09-29T05:02:52.55602Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_35.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.906Z","timestamp":1790658129906,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_35.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"15b22-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hlLTpYvIpzmpPJxu82kQE3hweKV0yk2Cf58ey5pO7yR4gcUZfRwTf514nfBO%2BFPTVY%2BQhJFcmqseQa5ROP0Mh7DbdunRHiLrOHVOBrHXoy8crZSzxB7OIbTG83GVHDXU\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4286f1feb4056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":88866,"size_decoded":89625,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"18a7107dbe0e717052221df3bb430f91","sha1":"69670c086740671febe6c6b2996a54488f44b9e3","sha256":"a179d1ffbd294cd3192312809f68ca46185c9f4419b1a95afe199c0b2ddb82a3","sha512":"57b9f308a584d1b24d3ec09cefa90820aa34b726b7084902cc01392fd070e6af4de48075a8361d9ea32bc1476f8831e90e6b5de21db53d89eaecf1d4ea8bc745","ssdeep":"1536:DSBuMyJiu1tuM96AlX1oMcMF3ludtNobqckJzdWNJ4Bn42WskCoHIVEQKg9jwo/K:6KiCIMU0q+F1udtAqckJzauYsaSEQTGb","tlshash":"3c9302550575ba630102c4d262ebffb85ee1abb46c9710e13e99c2148fba1dc43dd3e8","first_seen":"2026-09-27T14:50:44.933076Z","last_seen":"2026-09-29T05:02:52.557219Z","times_seen":4,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_131.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.931Z","timestamp":1790658129931,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_131.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"79dc-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fz5NOB5r6QJvkUO88jlNixiaWrRqvv2WQxmiaoAsHIS7w0U9kSXg2wNGclmUqDfau3xa7aQcLMvNixBD9D7rCSTi9qPaMPvs3VuJTc4NXjWMAfrI5vZ5NQHikRVA9dfK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f201b4f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31219\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31196,"size_decoded":31963,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"53bd67b4a898c7a9ef79cc1b8037286b","sha1":"ace07fdf85510a72ec14ad10fbc2bd35dc00e252","sha256":"f576073edacc572f9cd67724436900dbf639329b71f00f721f550060bc4d0aa8","sha512":"8634eac243319d4796917e35de4a7beaa8014ca32f3e512bc9e5e83502067a155100635096c98bfd4bed2a64995bb4255923ed4eb5680dc73cd64ab4f1d9b817","ssdeep":"768:33PO5u2m1QmyakdmYFUMOwGEQYgkMQ74OzM:3/O5B4dkdFFlOrYgk/74OzM","tlshash":"bbe2e17e5304350167df380e26436f785b35a61e9f226b1d967ed23aa0a4add3ea9300","first_seen":"2026-09-27T14:50:44.83707Z","last_seen":"2026-09-29T05:02:52.558329Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/foxdog.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.952Z","timestamp":1790658129952,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/foxdog.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"b4a-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ApP7cfWMWK7%2FEvj%2B1T9QoUPfp8OWpjJVjEtYZFElNSB8%2BnQfyYJZHRDDNg6ERUTExYHLLVDm8MHj4OmNVMqBPq15t2sS%2Bis5Fl629GQ4nA3Xp2xhh7EVwA%2F6oDps8cjQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f203b5a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2890\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2890,"size_decoded":3590,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"698636ea17abdc2a4c0bf706b3dada12","sha1":"9356d8ec9147f7bee7f11abe33437afc671705e1","sha256":"529b0ede01bb88887a70a06c9bd91c7e198380cc3d14f98440ff112783dc4285","sha512":"0c673f9599706e112e7bb84a31f8ead0c95e5b0069ecc9b59932997828a8717ab96e605c07e444df2f142282a3918f07fd1fcb2736b2adb52798c987c4394c48","ssdeep":"","tlshash":"47515ccb9cb89fdbee594172e475b748238888fa31464c38528930ac49a351f8fa5528","first_seen":"2026-09-22T20:45:26.347375Z","last_seen":"2026-09-29T05:02:52.559224Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/412d78cb-1d43-44b2-8aba-65988befe1e9.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.078Z","timestamp":1790658130078,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/412d78cb-1d43-44b2-8aba-65988befe1e9.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"172e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dDNGo4WmKVAzkAcv25DVQkV%2BUhIRjuVtA49hsPQn7TPZWAavd0E1OiN%2FDeTf4FPhZZMbETSPbb6KgltJItRTsrA9M3vLt1plzET1Mtstc%2FGzdTZBPVB%2BQ0OnH2UCskQq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f210ba156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5957\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5934,"size_decoded":6708,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 253x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9d69924f3f5696925d9b12da91bb85a0","sha1":"7f3f74094bd7eadb110e8d3952424fcee49e883a","sha256":"0aca3d7eee1d795ca9d76f1f7c635ecf68555be520319f7e09cb5a07cdc12031","sha512":"2edb06e97d3c42bc6e42b73dbff360baa606f6f86c8cfe05cb7b841fc505a57a119e729277f68250eac1f191dc767c422189624aea60da8c2ed34027b8c3b638","ssdeep":"96:EYQUThJ3QiIRjUFkwMERnRK1ZYGBG+avPpOlU2zqYNvwR70D4f+X8KwELtTkGvt5:EYrBbIlUDMjGXpaGCs24f+XKgpkGvtfh","tlshash":"47c19dbdea53f4e715c04b8cadc60043d64a056971d54de6e31cc695a8c8c0795390ce","first_seen":"2026-09-27T14:50:44.821419Z","last_seen":"2026-09-29T05:02:52.560087Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_79.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.157Z","timestamp":1790658130157,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_79.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"dc8-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=09rmXQUCWnD%2FM3CNOSiNk%2BbAELB6eYRfw5zQiDOO0AHahZxPXAD6aaUylGx%2FBBwEKDEX5nzrmLrM9wCulaWODWncyA9dlusyEMvSc7%2Br6VzwsiQt6I2bnMZNgx45JIJh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f217bc556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3551\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3528,"size_decoded":4301,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3121b922baa8c27657ce15370588f66c","sha1":"c810d984ab6d4deeefdc12c12630cba1a811c0a2","sha256":"53815b9c77e8b509513634f54001f4965fd8240da6fb4b41fa7c0e8615f5e495","sha512":"9bf016b4cba11175384badb4c260912a211b7d8063dd00ca915d062668c7975a91db119b2fea0d8ef1fba52b440121982217cf7bfbe0e03bf39493fb22dca80c","ssdeep":"","tlshash":"08713b82c12b3045279a83a5c0c17c1fa56c486fdef65d963e12cf1b8d91913aa0e6dd","first_seen":"2026-09-27T14:50:44.840781Z","last_seen":"2026-09-29T05:02:52.560942Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_122.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.259Z","timestamp":1790658130259,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_122.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"294a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yI1cF8YssZHBlOD%2BAJvtNJa8YYsFsgohmsh4S3iqn0FZNgkzHA5CMYoAO09Fppcz%2BI%2FQm5H0gF5Et7ZlvRPecFShMF2PS6Wp4hhKRQZBAxX%2FK0HymFFKSW3Ec2ioY7H2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f222c0e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10593\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10570,"size_decoded":11345,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"725aa3bed5fc77478765bd55c7bcbdc0","sha1":"a792771e39c8913a7466eeee213b259681aed813","sha256":"4a050643c06034259f80ffb03f75e1ffb8ba59686393a0de4819d167ae062a93","sha512":"f8cb8911194bc1132bc6714d5326063a5894d6861c4c6f0b6e367d3d309e1336f52551912a3133b8f851a64f77caf8b85045a8e415baeb438d21b72fff92f601","ssdeep":"192:12pLyGjeSPwHHzqEBNVSG9dbiAKTJ+rQnn85WZEpzU7EtZP1nRTxjGa:12bRhm3SabiBT6085AyZNKa","tlshash":"c222be79cc834cd88e9714ac6b8ffa6df591907198698c8e5351a71588eee98b31f102","first_seen":"2026-09-27T14:50:44.850032Z","last_seen":"2026-09-29T05:02:52.561841Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/elonmusk.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.273Z","timestamp":1790658130273,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/elonmusk.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3e11-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a7PxfHuaOaOimAE1s%2FSrRm4u8crgBgR3WQZ46axyrU6KiryOGZXMKeVftLYXsVDOU27uBNt%2BNQnr72%2BhkZHHAB3hjpchIkJrmmC3meLSkx1OrshvOko2qTgML%2FSea%2BqQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f223c1156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15889\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15889,"size_decoded":16591,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"773f339f8b3eaf6b12494bc9b72b70ca","sha1":"a71f587f7675446233714467ef2a0154a8920c71","sha256":"5235e68c306af869469003a9d2b981d16b62de4348774ec5632e975fe6620caa","sha512":"ebd219ff04c9e4ed3ea85c02ff9ee5983ddbb11b95d844d32665c999d00e979bb33c82e711298c76d13012213619ca5d854a68f18162eb0cd43a7298e59ca1a2","ssdeep":"192:qDVXm5nC2G8vVdYugBqLO67vh6iUhv4LoPsTAQ0R7djNUaodTjJfKytSDD66NozF:cJm5NrVq0J7y4kP00JqBkW6NobQEh1n","tlshash":"df62d0c1d085a012c802e6b5c8eb74200d6d9df4f6f30a514e7c9cb8b9798eae230f88","first_seen":"2026-09-27T14:50:44.917912Z","last_seen":"2026-09-29T05:02:52.56278Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/cali.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.888Z","timestamp":1790658129888,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/cali.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"ee8-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nPctmiC66tlFD6iDF3mwuFJ7mnr01znBWFFNtKlRgwuYu%2BaelEoVi3MM9Lkn3lE%2BAc%2FMkfUe1XjB%2B3pqumslS4YJ%2FLWH6Wa9R6IJ1bA%2FfedRNXCHQ%2FpY6DhiWIon6DXN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fcb3256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3816\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3816,"size_decoded":4520,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"8259cdaaadac23368e6aa64b8ead4c16","sha1":"d44a84ff4d3fb4e035216f4260fa914b0ef18011","sha256":"42e539e98b68ebfacab5da141faafa43370f7790aef1ca2102b32077e54ea6a8","sha512":"55bb52c7fb32ffb548e4710415289994c87d0997bfdf4d677240c497b0d218c330a9bc89af2d5c6d378dc35a4188dc4040a1a1d32c7e5ab21ad451bbec845a57","ssdeep":"","tlshash":"ed717e1d0bce11b0c8c719370bd06b49e30a1c267188774ac6c577d954a9bc58b20b15","first_seen":"2026-09-22T20:45:26.340341Z","last_seen":"2026-09-29T05:02:52.563711Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_7.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.904Z","timestamp":1790658129904,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_7.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"12f0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TwhIJXtE6uwCl96%2Fd23x%2Fu1fSs6T3sVgwRiAjFlEsNKtsAM%2F9R98EmvMUiFF6YdNmkUrvIYHgLHf5GzljasuVeOv3Hys%2FJxcxgao7uPNep9KpnoRShoiYl3cjN8ogWfw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1feb3f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4871\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4848,"size_decoded":5622,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9ed569a91b88faef01cd5bb67a3c171c","sha1":"0c616a17a6d1ca908ac28d038df45fc1e1b849fc","sha256":"0aef9bb5f64a6245f61f2d102f033fe252909074c6e6f4d54fc9516d7f1c27a3","sha512":"25bda23dc90f3d963b7e9d5dc24ab9e1d59ade7a44890684c152e4645ee8a6702553065b94293d2df5f4d2e033ef1367197f76a901f38c1bb4c9ffe6687e2d35","ssdeep":"96:E7OTvI2dZZV+0mGhflzAD0qipcfLXaIs5V5DHYJV4XxKY:YcZD+cflzADEp0Lqv5LHYL4Xd","tlshash":"f8a17ed97d30122882d6153e29fa960a7f0901f9a262dc0f3db1f8f57814117e1f31b0","first_seen":"2026-09-27T14:50:44.799769Z","last_seen":"2026-09-29T05:02:52.565092Z","times_seen":4,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/4f5250330695485db1d8388ee729959c6e1fabe7220812b9cc2721c0fcd8c701.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.026Z","timestamp":1790658130026,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/4f5250330695485db1d8388ee729959c6e1fabe7220812b9cc2721c0fcd8c701.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"333e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jg7vk2NvWwiKqefuiuMpl9phP3ieotlIUXArbRGYyVESMcyrCxeB8T5dOXPOuImt%2F0TdcXXqR2nVEczeXMX5cXIPIwyMkaLWPBD%2FwB2fhX12oaFIFOBiiOaHYT4MD9qo\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20ab8a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13141\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13118,"size_decoded":13889,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 349x346, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c997a17073076e1775419890514975fd","sha1":"c8c1815b259464192e3c9170d43e587077539556","sha256":"4f5250330695485db1d8388ee729959c6e1fabe7220812b9cc2721c0fcd8c701","sha512":"4134662e2fdc253413d8938bdf21300b7b72ccd6fb02532b8d4c7fea828a67a72d82598632c0ba9391c6f1116e0f19a0712867854ea721cf537599683ace9aa4","ssdeep":"384:xoONnotTR+ou6tFiXLwospHL4F7UGVX1JFRRwbBfm6:2Ou+NYib9sJLOVlJFR2BR","tlshash":"4542c088eef83b9ede4ed38a9cb5351c54077817914a59581df586acd081430f7b96c8","first_seen":"2026-09-27T14:50:44.814618Z","last_seen":"2026-09-29T05:02:52.565962Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_36.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.028Z","timestamp":1790658130028,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_36.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1fe0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vhfoBtnvHeuYqJN8w6Tevf0hG04h8lG%2BYKKkGqKBJREA%2FunNbZ3qYZ0BCdbKlv2r8MQW94CQ2D85W22litUNkypH2Q2ZLQME2hWIWvmTn%2FJ4Mu85Rmb9deUZU%2BfOlhrF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20ab8b56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8183\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8160,"size_decoded":8934,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ebdadd2707fb25c8909233ae62479f5b","sha1":"d9ba74d5156473575f97b603e3d85dd44ab6bf6a","sha256":"a0406a3feda5a175ec978f9bb65d55368b3d000c19e75a0f67be30def39270ad","sha512":"3c72ca9a8486481ff83c916a397c077ab38e02dc3cbd303e789fd6ede84b488c683f4a47e5029361959a9fd6e5be0121de14a342c2485186eaacf560ef437165","ssdeep":"192:MF16/GE6QmOkGKRKj39uAibu9eHnkap2DmAXk/tWPswy:MF16v+GIA6uSkFDFaAy","tlshash":"79f1ad088337c240e5dfe9aec1422192921fcbc95d882bc24d4c7ad3f9c49c6171ddaa","first_seen":"2026-09-27T14:50:44.78565Z","last_seen":"2026-09-29T05:02:52.566843Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/7205cfa7-a6ae-400a-87d5-fcc29526fb58.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.049Z","timestamp":1790658130049,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/7205cfa7-a6ae-400a-87d5-fcc29526fb58.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2244-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=76enGauyvdL1FfbUxTJt%2Fv5u3RqSYOz4vp38UfA2sxwDqPdvtk06F6iAYw%2B1zZlSsIrZrMuCNdHnGiEyXJ9aMlAXXkV9EQVOEZaI43TIN6fp%2BXan3pXpiES7aj4MSgzm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20cb9556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8795\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8772,"size_decoded":9544,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"02ff2cf6c14a9174c4a04d25fb9d2714","sha1":"359441c531ad49f53843af027ae92097b2da30c1","sha256":"7cad8871e076525841eceefe11f174d6653d0b5799b6abddf9e859d84ed540d1","sha512":"b1a17bf95edd5ef513686f22f0bc0710272c1a7b08ccdd3bcc615c77ba88f929f9f83e58dc8451faf047d0b718d4c85c2e3d528ee1b100d20f6121110fd19367","ssdeep":"192:ez43lgwKLjQpP3bOTUlIpsB8ddRpNbRDU6tFW2PhZaiDI:vlwch3CTUlx8ddXjxPhXDI","tlshash":"a102b0b8a507cb1a0b72bdd578847cdb03a9d08192735e4c7526f96411e2b4ef1c928e","first_seen":"2026-09-27T14:50:44.848939Z","last_seen":"2026-09-29T05:02:52.568075Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_80.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.159Z","timestamp":1790658130159,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_80.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"d74-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nHa0lj7FokjW0IcOVqtChhpnDB7N2QBF3TygixfkHQ0Hb9eIHP0slSMUX7zT5Yu5N6eL14prxgyvt9hee67Ccd6ubQUnSQWdR18IuBk7eNKFZzuHKd0B6Vph%2Box1C9z%2B\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f217bc756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3467\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3444,"size_decoded":4213,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 157x183, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5388111c1edb3d7974b4a2d793e9c106","sha1":"9659ab183d01ff78fdf8f9d239c0610f26ccab45","sha256":"13f9b1654f164a4404a30607b7bf87bbe341f61c2f66aa1fde7a00bf5a0dcb18","sha512":"8446a32837b8663800b2f92204b985009d987abb85ffa0e79a6fabf8c789d93e1f5118cd31ee9d8af7ca9b0992ce52aa4081d7b2cff89aa5ec862a91f2698224","ssdeep":"","tlshash":"59615be0ef6087d43cecfac55e601767d9d3c899a1e6a9c300d0ac37609efd208604c8","first_seen":"2026-09-27T14:50:44.930044Z","last_seen":"2026-09-29T05:02:52.569061Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/chirp_400.p.0pvtyi5mcffff.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.607Z","timestamp":1790658130607,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/chirp_400.p.0pvtyi5mcffff.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"ae74-65c5af802a980-gzip\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5xwUZ8oOhdLnVmQRot6wCHcn58EK33tftntP1EgxeMdSYcODrRELaQMvs4Lov9WFGwVtGNVQO8TYhDbLEP3Z%2B8LC7i6XInbBDcPHhtYPOQRG8V8SR2AZEvkF8opeXz7p\"}]}\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f244c2d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44660,"size_decoded":45342,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 44660, version 1.0","md5":"af0fd092a950cd858a160490ae22d16c","sha1":"4291c81c52514932f517529f3d3c24f4a40609ec","sha256":"858b70c0b816c651b12a0849e17c83eae8a76aade2fdf02e98848d5d25868c82","sha512":"64123d00581d6d45c1fe0390911e20fb732a9875eebc667c45ca4f84e5768657bdb1fa9a307c150d6e5644a7e8e5cd274c58f879fe059b8c6e1dc73e2a039b35","ssdeep":"768:hgJ8wY+W8lE34E/C6z3sbYqg0OvVQ8J4WSrQek4cXzrrhDn:NdQlE34E/C6sbTg0yV54drQ2cXz/hDn","tlshash":"e713f1606f916fa8f45417fecb63322e95b2b83228cc036db4351e55794c5c52c8af9b","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-10-12T21:03:47.473206Z","times_seen":4292,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_134.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.938Z","timestamp":1790658129938,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_134.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"7aa-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i3smhwsWbFWofpxm3MvJYV%2Blxqf837LDR02pf13ZP9YEwJ%2BpevYlJWsOW6IHv4w9jleX9Rc41pNK8gocKeybj%2Bs1PPipRwgG%2FseWDkB4%2FTlIBqKB1iHyT%2FbJnu6d07uu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f201b5456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1985\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1962,"size_decoded":2739,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"760439f7896bbebbcb75918ff58f6b7a","sha1":"f3d0adb5d11a26cff1cf32456278a8bd055e7033","sha256":"5590a9e9818c7c6cf278025e8ef093f7b8a19d7004fda5dc7bbda9644cc18d13","sha512":"fdf67549c5060f8420a0a61702a5d778641ef9db7cc08ff471f6316a3cadacd0b2ac1891264c5037758cd7583864b8f898a8ef7eda29401fbcba56c8004059a0","ssdeep":"","tlshash":"b4410a32ab1a96e0de7bd4e9cf6248f18192a9b5b409e75c14ce0582e0799e128431e6","first_seen":"2026-09-27T14:50:44.90965Z","last_seen":"2026-09-29T05:02:52.570873Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_25.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.011Z","timestamp":1790658130011,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_25.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"213a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FS61S15wLJaoFFXeuIMEjaPxvH8Ht2yz0qLUEuSJerd3WAyYl4eN%2BXd4XeUQ%2BTIPvKYYZtsZIdiQi6jtEHs7sq8LT5IITbE29%2BMxUS4%2BoC5P1LpyqwPdrX2MjlmwlREB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f209b8156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8529\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8506,"size_decoded":9282,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"677902bf188025590c24d49a8961ef36","sha1":"d3c06af5b72d48f03538a6a55a10db30fd62a121","sha256":"6264c8deabc15293966d4c77881bc357ccef9e3dc2699af05dabcf2c2ae252ea","sha512":"3a294228c76e7b50e2955f6e0314298631453b6580258dae545ea4e5f53089414f2466feddb36851a5235f063ffddec014b699a3f42166f3aa57e7446c3354b8","ssdeep":"192:o3fpTHiRvp5/ToKGkz3TEc2D3kQsts989fGZDXXI:G1Hi1pil0F2D3kftsPXI","tlshash":"a402bf2fcb2ee92d3816d674acb9723ca992fa64e6c6d531c8a0999d0cf1640904505d","first_seen":"2026-09-27T14:50:44.948814Z","last_seen":"2026-09-29T05:02:52.571822Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/blknoiz06.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.287Z","timestamp":1790658130287,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/blknoiz06.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2214-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tm599vpIguunedfuyapPPH8Ymn5T3ZnK%2Ff5nGXcQ4E3KN%2FK50j1X150fi2bq13MFJNm47rCDtQ3Vql1Lg%2BCs%2B7VR%2FfARspdBgvZ0ORkjLfMe0obURaM%2B3qZVYjfDYpyp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f224c1756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8724\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8724,"size_decoded":9427,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 200x200, components 3","md5":"a85aac4d1ac72df07c8f1ec662d3194b","sha1":"c470385cd3b901da87197670c4acc450cfc333a0","sha256":"6401569f19226b9804fa3ce2eb6c9e9882cd79c6dea5081ccd8f2cbbd5b36608","sha512":"9c0962db57dd675891f0346ba4d0618c422075e1dd5ae9dd0d9548f9b5d10a6a4b67fc9d7b5c895eb01cf405f0819702b4cd5df7b952869c3c2d9252824c0d69","ssdeep":"192:fsYpr11z52/mScg+yXBAgkZcC5es5mPXrVn0uxREd+:Ew11zA/mlglXB5IcC5LgXrVfl","tlshash":"5302bd0ad25ec3c0f058693916666a0714e0f3f2c4acafb61703af6aac8085565bda60","first_seen":"2026-09-22T20:45:26.231678Z","last_seen":"2026-09-29T05:02:52.57303Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/chirp_500.p.1uhf2wlav09eb.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.616Z","timestamp":1790658130616,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/chirp_500.p.1uhf2wlav09eb.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"aec8-65c5af802a980-gzip\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FNSdV1%2BWwAlh4TXIoOIJVnXsXlJTpEm4%2F9yTum%2FuYc52XlJCeM7w6Y3tJoQJHB4cMwWNQXvYCwhV%2Fdfy3mzth4dDg9Klu77fy2ZMiinbT4VHZEPUNd3o15TGcRsBDqcY\"}]}\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f245c3256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44744,"size_decoded":45434,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 44744, version 1.0","md5":"22898c3b88ef29da6a41c302510f28b4","sha1":"f9cc37a5977f1163068a0a73d289ae2431a7fb82","sha256":"29bf369dc4c1b989f933e482f76b961acc5478bf48800547b18d6cc6b9b9dd91","sha512":"f270ed67a28469b36694a7600187a07ab8fa82877d3a52bbb442c6344091e3ed815ffec90238605fadba4685dad0f5ef0fc9145ead8ff38ed21969a4f6a5ef72","ssdeep":"768:dxszm2WHLjjPNDTCw4nY1ljkbpYNdt2gN8BHcVegXUPaMaU+GRquWGvJvaivBHFE:nc+5DTCi1Fkb8dQgN81chXUPaMUGRbv0","tlshash":"c7130101adfb73dee7857b743b860b65f8106646b7d259fc20e365ca05d7a2fb2200a4","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-10-12T21:03:47.488074Z","times_seen":3814,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/icon.svg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.865Z","timestamp":1790658130865,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/icon.svg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"1157-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/svg+xml\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=emwnHBOtE075l%2FnJccIXepD7nIoGe5LiNhNDyZxGGZiiYqrQg5%2F%2FzXuqybxD8XbQBonD9%2BgRJOVJXe%2FVTr2khBbXyXp4WKcULPzRvoiOA%2FicMtdbFTGV2JmCUbQ3EilZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: a4286f25ec4456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2122\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4439,"size_decoded":2883,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7fd189339cac2fd3a08d8cd3b7daf035","sha1":"e7d2bf1d4187d7b021dd6ae4ef367207b4f0db9f","sha256":"7fe42e316e420721f072658b55e45cc97dce29315fcfe41f4217b2dd236a215b","sha512":"ac39da2f5e3da625f1915bd73bba8aac92340e3c96d789fec9a34f29e3a111279644434b517686c3bc81210389e5ab117ddd662778acdbacfe0d20a84c46fd6a","ssdeep":"96:nWvFYH1xJ3+3sAEoAVwxljnSUC6Wgh32ssKZBFuvtTDjk:nlTJ3+6/wxljSUU+1sKZYvk","tlshash":"9991dbcee7826eec0dd985915827a3812f47783f9f9682b1c046d3f2b8398550986e1f","first_seen":"2026-09-22T20:45:26.261058Z","last_seen":"2026-09-29T05:02:52.574975Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_125.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.908Z","timestamp":1790658129908,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_125.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"c7ea-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vVzJkTwj2Mdw0CNtZvH2RwWOWiFNZ0HD4SgCHqHhLX8ANIEI6l5kZeiTWk9H8kuN0MQmpptAx%2BiNXXVDdovLFSjApXmingesVOEJkc7q51IoMKhG%2FnYNazvcqWwcWRx3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1feb4256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 51206\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51178,"size_decoded":51954,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c705ffc50b0a93ce79ab4c4ecd460f18","sha1":"b886a10f74a00901ff6e0313b5ea40a7cee619dc","sha256":"b72e7c5a099032cfb42b3b2a9f0f337805a34e4034f2498720b3ce33c07da347","sha512":"b4930bd52719d4fcf5657ba5bba409a0c0e19d9aa9e1d7db5654eb06a04b4b3987dac022f1f1721a10b55c951148741ab9d2a759f139d798e03afce97195c174","ssdeep":"768:RAuICq2wlHsR2TgOxHX6VM6X46RVz1JDYEg/0OZkRxdjQBLKdkfbtY0WD:R1aX6R2EkKVflRx1JDYEg7iqKdcbanD","tlshash":"3b3302a7aee6de712725424343a604473918fd4061786663c87f287b6b0bff3b9f1942","first_seen":"2026-09-27T14:50:44.792669Z","last_seen":"2026-09-29T05:02:52.575994Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/vitalikbuterin.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.947Z","timestamp":1790658129947,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/vitalikbuterin.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"c77-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u9OIZDutDqx8ZSKyxpwcgqQIX92C4xooPLxSjjMds7izCG6f%2B%2Fq6pqLGt20abMPD6qgNqw2mDtJnc6mdoNycGQufdvrUykjJkBeBdzSdUnX2qKwfX1M6oglawPGlNEpJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f202b5756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3191\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3191,"size_decoded":3885,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"3740836dfe1e862f1e68465beca636eb","sha1":"0b213d972bdf78e21025adee0c70dd621cfd39a6","sha256":"c8ae14d24c79c116b5ba6816a63bfe50671f04f87181464e53d211e1b64eb795","sha512":"2e665999d02c1eec25c5f3c0858f4de19a66ffa676aeecd880dfd1cd40ce9696c7b616793fddcef8e64b1e9a39797bcd751d4f82f49c52bdd62dd7366ea97496","ssdeep":"","tlshash":"81613c52360a03f3c509c7a151fc350ba06704d2e7a3ca82c3ae6cb1b5d2bd31359618","first_seen":"2026-09-22T20:45:26.363108Z","last_seen":"2026-09-29T05:02:52.577153Z","times_seen":6,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_41.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.044Z","timestamp":1790658130044,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_41.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2244-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CvrXIFyaNcow1K8hxqfe1jnrsfYFSelPnrWBPy3vHbELfThqN1vKxiLX8M32d8bc3%2Fr8oI3Lwkk4PobEpu62PVSgxkPqhXaUK95EWVSMULJoJb9D%2F8GKFbsIHfwcwuTa\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20cb9356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8795\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8772,"size_decoded":9542,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"02ff2cf6c14a9174c4a04d25fb9d2714","sha1":"359441c531ad49f53843af027ae92097b2da30c1","sha256":"7cad8871e076525841eceefe11f174d6653d0b5799b6abddf9e859d84ed540d1","sha512":"b1a17bf95edd5ef513686f22f0bc0710272c1a7b08ccdd3bcc615c77ba88f929f9f83e58dc8451faf047d0b718d4c85c2e3d528ee1b100d20f6121110fd19367","ssdeep":"192:ez43lgwKLjQpP3bOTUlIpsB8ddRpNbRDU6tFW2PhZaiDI:vlwch3CTUlx8ddXjxPhXDI","tlshash":"a102b0b8a507cb1a0b72bdd578847cdb03a9d08192735e4c7526f96411e2b4ef1c928e","first_seen":"2026-09-27T14:50:44.848939Z","last_seen":"2026-09-29T05:02:52.568075Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/meadgod.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.275Z","timestamp":1790658130275,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/meadgod.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"23d4-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8VPzimInVB2xzkxBEsCdVLm52CGeEwoi0KYvu6WkKXZq2paRYEJI4C41yKC6ZiYL%2BnAc8iwVaZ1bH5GgcQfOi%2FAPoxsRtToJI5tm4pC3Z3YAo2dkNO4LLknHOGM3hGqb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f223c1356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9172\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9172,"size_decoded":9867,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 200x200, components 3","md5":"af25dd470724b087caa1a45184060b6f","sha1":"d5e5ced4b257ddcf3997aebacb36e89eb8dd2fdb","sha256":"ea73a96255d0723dda60f49ced07795c8179890d5596c1efa32e022b4397c981","sha512":"b553fd225912aa9ede343d2c49284e37e68244e17498dd3109c3b2a1a2691374d363c6428cf1370727f5823783fbec30673a3c8cb39052931e3270f8b126bdf1","ssdeep":"192:Uzp2nM+X2pn7yYK6XNzLYg9f+r1bd8181E2dtp2:Yp2M+q7yYKuNzLYg92x2yttw","tlshash":"3f12bf570e2a97d3fdfe543368201225cd91756786cc2f0c9e11ac30b4973e2616d35b","first_seen":"2026-09-22T20:45:26.338972Z","last_seen":"2026-09-29T05:02:52.578238Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/zwh.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.893Z","timestamp":1790658129893,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/zwh.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"39b0-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EgmsRlB8xi5u5EIcmp8dUhQW91jBjhFs5QMMOjZyBv%2B3dlUlcM0dF4vnK9vlgbT%2Bvamvlt3%2BqBrWF5LQwDVr%2BgGm1cb2R8tvO8wR5doC7Hl7S4uevPI58wKcnoOeMjAO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fdb3556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 14768\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14768,"size_decoded":15468,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"12871587c1ef7ae943556ce7944bebdf","sha1":"310dc12555a0cb75680b9e915c5951c5a35b3b39","sha256":"d0dcfa25db10371888524f4407bdf26e362ae0cb637f5ca823cc5683c6512894","sha512":"10f9d158e3f1c221381709718b5a74a2ed716051a1ea200893205f5439227dda60b94433977a24a4a3121a822f9f2003b1632fdeb336edff7087d290974544cf","ssdeep":"384:BSOun3PjIr80w/KscvMfZYLyq1F/3PcuTFP:BSLn3cr8oMBYLpFHcYFP","tlshash":"e262e066ce387fc2edb25d3180bd75a9b4a51605388e2ce3ea423fc98335257c2d0302","first_seen":"2026-09-22T20:45:26.290732Z","last_seen":"2026-09-29T05:02:52.579435Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_5.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.971Z","timestamp":1790658129971,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_5.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2a06-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hSrHMD%2Bqe1v2ghuuxWRh3hqIDcvOd9SofQWTUy2RIS7rnzo%2FRVUltIad%2FbPwCc9hvxbAsQn%2FeALEPdIoOyA5PHjJ8djiZ7XiQCDgpU08uabmno%2Buhg1VshKLbNOBZaVF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f205b6756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10781\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10758,"size_decoded":11535,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a3af0953baea54e91a75cf727368a1cf","sha1":"ca328674d21b95c60bb1c07c3132d4a74df2d6f4","sha256":"abc70cc42cd1e8378ead050df3184b21228a856113c9ca8969fad23f6a6e953d","sha512":"b392c3abb2cec8caca8fc70459ec9b1f6da03713f161e740f513012944c637a280c33041c559068669c3695b2342b870386a1a7b7aa908fd9734f6a916b88da2","ssdeep":"192:jRPkNjferKih2Q+tn3BZj3t0e0/h2CF1i+uf4u9YurzxqHa4Hf1UsSW8BVBA:18Cr/hGnxZj2F1i+uhuGsSbQ","tlshash":"bb22cfe1cc18aaddf8ab0d124bb54f40d43661a39dc10e4545fcb92c2e8c66f8db242c","first_seen":"2026-09-27T14:50:44.820446Z","last_seen":"2026-09-29T05:02:52.580353Z","times_seen":4,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_15.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.991Z","timestamp":1790658129991,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_15.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1f00-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ced6rJVnGECUDzJAL3WTuxaFIljvvvrjojV3PDNS8jdtvGgyHUGDYm8UhyvOX1HNdyhdj%2FFbLvibDCBbQrCN8I4RfBiWrDbjdz02qaIKvpsjimPL65Q3g1weM7YO17Rc\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f207b7156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7959\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7936,"size_decoded":8704,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"85589af9a279ffe894f4b290ebcd05b3","sha1":"91c4e63e4792b3e71c6638a939638c005dad8499","sha256":"2a8e509c209f6034b74e8711588fc3db881b7e4eaca408a4954e13836f14d943","sha512":"3c949c30c9e7266b7b4e656db109378b1a9abe4a3f2c2279adf8ddf99e72a9fa7608742dc0d1f43ef8bece3e17dd914df46ac98031fcdaa509708fcb79c827ab","ssdeep":"192:VUFkJDT8+4Qd+d3WRhvitNm1LlulpjYaI2Of+17E3IP7lXgHrWbR:VvT8DrWRhvitIluJTY347lX6qd","tlshash":"3ef1af7b19881c3b19201874b39d4eec78abadb7274209682457285b30d604f9fddfbe","first_seen":"2026-09-27T14:50:44.970369Z","last_seen":"2026-09-29T05:02:52.5815Z","times_seen":4,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_107.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.221Z","timestamp":1790658130221,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_107.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"f6e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u2wnO2gdcfY1okNNFKrkW0eRQEMnmDrBhWDpiOLQ611JO2iC3i6K5jkMmZijjryVfOJWs9B7STIhEyKmYP1Zr723JxM7V7PQAanV8Im%2BuVMVa3ef19o2pkCZvxFEXl%2BC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21ebe956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3973\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3950,"size_decoded":4719,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4487e262c691a8240104d1290a9e74e9","sha1":"7850da4eb8693f459ed5fbb2f6e5c150e9c3f02e","sha256":"0281a9f23ca5735793ca39dd38a69cfa1a1f03f58f0610465c18e82a85cf861f","sha512":"bc94730bd7d82fd62ac1e422e28e107a4bf296c8e63863f46f1d78631c1c0392dce635bb9c2824592b44ec51f426a3443e48533ccfd8066c049e907cde7a7b75","ssdeep":"","tlshash":"1d817e3cf1a23179e3009862ed45010ba123c56ff088fe23177dedf08207196d5887a1","first_seen":"2026-09-27T14:50:44.940769Z","last_seen":"2026-09-29T05:02:52.582645Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/5jFvaVi1.php?s=%2Fjmpd%2F","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:11.703Z","timestamp":1790658131703,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"POST /5jFvaVi1.php?s=%2Fjmpd%2F HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://e-usepaid.xyz/\r\ncontent-type: application/json\r\nContent-Length: 1325\r\nOrigin: https://e-usepaid.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1325,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QB5wL_Ai4AEAAPA9ACGAAvAyAAAQIAXQMAAO8nhn2XtsKCAeT5NaoQj3vVYBBNpYcCAAAitj6KTpu7cfGcMQeDgCIN1OGuvlTzNneLfTi1kCBXBjS7ckxkgt4nitv8A8szayvBk2MHoa-3hYheqJWSyfRWmNcbfMtV6-5nduhK0_rn3dL1g2kkVlDrzeO3UdHTEH8uLouLvbsEHwFASYcfCB3RXXAnHcdQh_dYpDKZEWCQ6FQSMBTpOzCXs_uE_9zzp-Q9MN3c9OclHv5MljN6oMyZkptADXVb51EFGKDRKjLJajTAtW027B4GeDEco2N9vLnUa2lb6DHCGNLTA6ZQP9gzzpSefckj5CEOG7ageqkYvywoK_-BukkE8o3KiycloRh9xAeRLWfH9hwyfoqYL4yrN3LrN0EgvvG9PWdfcOyLkUdvUfMC6CXwKlPOA27hJBG5k5nXNiZX-qR1kBjBpyoeJkUhSLSm5zlPJmawFt5TdMO0U3djC1xGCwFHPt4aAmuFf7YxBE3_lcBN6e27yCyMfWwneWrbeBbYtfkYXtU6K6EThjGAca4tgs8v-CgCSEQ7RV7_j7tlyuDTwRKPXWGwhZ1WTQpvl2zefYYI16JWTF2_ntPsWj-L_kbXlLLRzENoJ5v1XF_ppmAsBeBrupy2e_v-A8OD2Xy817qw5oOuL1gRN4H3yNXTFdMH77HKOYUpT0Wgst3wXC4FHGCDsUlFKJYqN-XHmqDJE3sqmav7H72fQsiWI4PHgcdQ0wzfUSWn-LEU4lsV2DqEDVV8IC3AHeuKsTfDy0LWd7GF1ornlGJktz3EnBW-Nu_tay5Fnb9DtTamuV7kHjb8u4w6NCsjEqPxxH388KOuYmbIYOidhp9bn3NKnCaF3l_cSnYOruLZ-9SfN8QGgglsX96DjoT-uluOmcSnJc-wKun-K7nJ-gxy5MAXpbnQFOokNdG0GVmiywUtvnh1bMaubf_uv1LV_3p7SK-Yx3WIoUweChmGyHNM67vuxAhC-Y9piulOBH_0qn43t-2mOkuT0mhY5HecfyNj-TM6Cos6IwghBWX5-lBxMt6tnrFx9tvrxDAZUss0y9NcB0sJAmUXR8yGZBcYy7xPV8ERlI-FJt07J35jiGHrlgsRROwKqZ6RuggjImqB0oczKr_SyljuGwKrz_BBYaiFVyawpR6byFdaBVoq6_2B9IlF7v7g-xt2nC4HuwPC_WoVE6vpTK2fAyOp_I_OTbEVGBA\",\"challenge\":null}"}},"response":{"raw":"HTTP/3 204 \r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ndate: Tue, 29 Sep 2026 05:02:12 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yhBlmUZlYgnfeF10nuwzqt%2FWlVl93xb2kbMhoRaZS7%2FzzGTirYdCbiFU7eGhASiBv0OG3pZRFbAcN2%2FWbcPiBpPd6BjhDd5gw0tWvBBQKlUr7u4HQlEXZPDst%2BmxCVjZ\"}]}\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4286f2b2c7556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":2531,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-12T22:30:59.849906Z","times_seen":19065166,"resource_available":true,"data":null}},"time_used":727,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":727,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_2.svg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.934Z","timestamp":1790658129934,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_2.svg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"ef-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/svg+xml\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vZ55Ihxxc4dWUOmJHigsuG7vKBdG6rmesBBwyJuZU8TQdmtCIuFnH2RLSaX0tAyk2XW0vlnCCNQWFSmF3duV3kMV6okfb4UA27FnlvTpElt7W%2FvVKyZkIIPq1iJ%2FBZrv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f201b5156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":239,"size_decoded":928,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6b17b6a136b84968e7631df3c59ed0eb","sha1":"aa23b94b2c28b5a9eb34c7462b3face807ac7a38","sha256":"3caefe25aaf8e295ff709444c303e65e409258b447aab691d8caf3282e2398c9","sha512":"387365e88773bf388ff57d7a5ad3d27390945915c18f5c20781723bae63f4e0cb7b38181f7d8f8d3c7e83c49f1f270733b694c5ceb3a78fd74df185a5688fa43","ssdeep":"","tlshash":"b6d0a7e770ddd408c840876212be3549b09ff0eda386115cfa84767a614eae7793033d","first_seen":"2026-09-27T14:50:44.775772Z","last_seen":"2026-09-29T05:02:52.54276Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/5e93b6e4-813f-4db1-b8c3-8383a98921a4.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.973Z","timestamp":1790658129973,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/5e93b6e4-813f-4db1-b8c3-8383a98921a4.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"e56-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JBQ%2BWcxv7labJ69B00bY8IjQZL%2Bra6f5YHXF4O%2F8xJFr0Z8k8cFqqO6MSleZY52AEK2JxVSuj6AAfCBSGJCbZxRWJxwakQ17J1SoGIJcrWyoiAtmwO%2FDM3X8nnDuSDnS\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f205b6856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3693\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3670,"size_decoded":4443,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0c37ff23728b0a0561af8d89641f781e","sha1":"213e2c4d07de223d988f784173e32ecc5e3b874d","sha256":"2b40836bb77a1dbd63e6c526ec24cd96143ef7ab10a617e78978abf231ad1097","sha512":"82766e9fb53f398f91069dd33010e7f2efec4b63c78af3c4afe177dbae36d0cfb4df5b223db2c117431bb211df51e27565b4d5fb02e21dbfdc7692908b5696a0","ssdeep":"","tlshash":"9a715c364d042a9bc3231ff571e142809766161a74fa45f28b6819fe20b798ea513cd2","first_seen":"2026-09-27T14:50:44.914524Z","last_seen":"2026-09-29T05:02:52.585058Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/c3221c19-f6ba-455f-a2bb-856e6a029bdf.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.992Z","timestamp":1790658129992,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/c3221c19-f6ba-455f-a2bb-856e6a029bdf.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"8e2-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qERJJXBiZTYV3tK4G%2BSK0SUR98VGgLlV2hEBGFk%2F34CxV0%2FGBM2c9jDP0DJWXd3sXmyZqZIy%2BIqtGqOlghPVbLuZTjyAkzcUaHsvC5psJgOlYd%2B2dq9XlQCDuubZB4A%2F\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f207b7256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2297\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2274,"size_decoded":3051,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"580e39fd53d4685cbe3e30135a2e0a99","sha1":"8b9ab334af04136cd123de1c465c5da3de521012","sha256":"22957edb9720b13f2761546e0ed73434e56f8571e01b4ba7975fbbabcdcd76e8","sha512":"53ccb3a7fb95ba1790c336e45fd9c18ec0605bd817a3690dfad6f08199362746f1904e8fe11086f9c952f1aabf02b7b3c8a04e7292debecb57df1355d765bc69","ssdeep":"","tlshash":"384118d39bf61565ed3068a8d2a1504f28984d6dd4a2a6fd1721ac424f0e3ab9f8fc11","first_seen":"2026-09-27T14:50:44.802939Z","last_seen":"2026-09-29T05:02:52.550729Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_42.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.050Z","timestamp":1790658130050,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_42.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"762-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kFEXC%2FA0T031bsZIv6IppYxyh98kAdA%2B9r1W3G7HQV9aWdqLUH9HfRUSxKR0xKKP%2FuEWPSn%2BYv7NF0KQscFA%2BGPrd0Z2eBmzq3qeo%2FCSkS%2F%2Bak65sJKrYolwDi8EGXY%2F\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20db9656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1913\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1890,"size_decoded":2673,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 128x128, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4d3983f1c03615402491d290b7e0dd7c","sha1":"5e7c04de014e75831dc8623f78d1dea45bcce453","sha256":"9381508dc55711a4d5005d12e96955d2cba060bce5c4361be8369cc4c9ae2e87","sha512":"4d39d8a774e66ae288f563fcca4698491bf9318dd742fc979f996ecd692c0777e56371b0ba0be8dd27f852d040209eaf7fb161a5ea564921d3e6aa0dc8688726","ssdeep":"","tlshash":"10413b01266c962e66396c73701df17804e6e6238bd975db01c805f848d7843a2fb457","first_seen":"2026-09-27T14:50:44.878109Z","last_seen":"2026-09-29T05:02:52.585768Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_44.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.064Z","timestamp":1790658130064,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_44.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"4de-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A6zk5GzEX%2FqwlR%2FxwriMGZzM2DDHJnc3T4xzChdUrK0TpbCgWwUP1MDLoN0pJwKV68ochh%2F0wfJri%2Be0ObTurbC9uPUVzZYpeHqMELJoEtXzV6jNocZbRLaydvs%2Frvdz\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20eb9a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1269\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1246,"size_decoded":2021,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d966940031ec26a0ca7019b5e0a15daf","sha1":"378eff4e9a7bd8d8bf4bc893522f7c2d328d1a8a","sha256":"5f38216f9b8e019ea21fbf391f123365a8bcd11564f0e9d847b7cf976548d855","sha512":"f2919e79847e525c4154a6478c1d26553a3f95fdf56c6b87aab0c58b8d8f8c6b55d05008d4827a71b147510ceeff54407d910efa2551f2a6e48437bf16c0a926","ssdeep":"","tlshash":"53210a37028af7ed6620e115bb31a244e5c428f2330a0bc34209eea09295274d66dfb5","first_seen":"2026-09-27T14:50:44.847002Z","last_seen":"2026-09-29T05:02:52.586675Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_56.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.096Z","timestamp":1790658130096,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_56.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"13b6-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZjKOKlEZAVezGcifFTbsy7Hev8GmCh01bm0oRwNdX8z0AnTSR9w%2BmV%2F8OWr6go0hIMUQ8skF2DYqAT%2FT%2BkKHPA4rxdTfLfUoHB8uIr5%2BeAiLiobCrgvnnC9%2FTqlRPk%2F%2F\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f211ba956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5069\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5046,"size_decoded":5828,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"442cd0442272e9d7d233946aafdf1ad1","sha1":"89dde3849e29ffa546e0302afddd18835c07d4ea","sha256":"0dfa0297e352dea6870cc4e2c8188adf4dd76e1dbaee8be98117def7ed68b103","sha512":"a8a4181d60779a15632134987789bd3b931207355b66da8b094ae7f2bc1d4cc6d96f2e96eeaeea1f91130a64bc8e1789ace5651a3c71e524c65ffbd8e7db444c","ssdeep":"96:8sNTy0JEvhu/nbd1SGRPvr9Oz5XJLFZv2tAqRQ/eRD8wRN8zWW:do0JjhHl8z5AOmOwP8zWW","tlshash":"8aa18ea68492c8d9fe5af05ef606bece24023714a082c543ea377380d3aa8437fc4d5c","first_seen":"2026-09-27T14:50:44.888421Z","last_seen":"2026-09-29T05:02:52.58763Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/eloncoin.png","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.272Z","timestamp":1790658130272,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/eloncoin.png HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"12999-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b07CUNokbidp4j7izb2TAe60hf%2B0h0Pt6rzrfM%2BmeSVUHKdNlbfEOvYfG3Eo70lfJsbQxr9HoHxl13clWae3V6t7gqKwbcr9k9prZWWRImOfcrToJgTFaqmw8BS6Ij3U\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f223c1056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 76185\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76185,"size_decoded":76881,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit colormap, non-interlaced","md5":"7ff4feca4a8757f8b772cabe966408b5","sha1":"96b03b20d760b42c415394fcfc9a1bff864b5ad9","sha256":"582875d2df221e26e3d1af112e0128c78f981aa42b293d6bddbbe33e8f61984f","sha512":"66118ff471a432e55df51a20652a22bb2defee0f1471c05090c451049a75226b59d84a3ba858508cf426470d92b9710c69d2d4587e36d8ed6426cbf61b626845","ssdeep":"768:ROOfevRkbKhRMiGjpxAPdh79gmqenVVNK1ltEXAQzuoh/4xsfjdu9R1MYdmozcrW:ECW/Gjp4Tw1ltEnzusgsf2MY0ozBpnVj","tlshash":"3073011748e970ff12874cdc21b4a173f07c007477a9a9f89366792a2bedd621b3c4a9","first_seen":"2026-09-22T20:45:26.275797Z","last_seen":"2026-09-29T05:02:52.588554Z","times_seen":6,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/3bb74d64-cf5c-43ef-b996-8c78f39575e4.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.073Z","timestamp":1790658130073,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/3bb74d64-cf5c-43ef-b996-8c78f39575e4.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"50c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=32GLvQQiTRXYw7gmTL30KMr29fXBzuZtAtCyxAfbwFFMuZh1raIwJpXISIvnzvm4dcBzT5N4shuLqDIljwFD3W1jX4tEiwhgDAIaBs%2BGrMR4d9z3YcPnNGddNZV1jA5q\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20fba056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1315\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1292,"size_decoded":2059,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f92d6280231ed2f5fb494ea08df7287b","sha1":"e02352908c0f7dd5bc2fe1e735a5925aee09fb29","sha256":"834b843b2ba253817d5e066279823b22959b8148cdb6ee85d6be55d058dfad92","sha512":"f75ea5eb99eed15ac43bbecb138427485f311333af68b04805d3e6a8ecfe1910abd2de3a7fbf6e5863905d8d99a1f2235a7aa21a3135af97dc93bc05c138ea19","ssdeep":"","tlshash":"8a21ea20cd1e0657d08757382ecb0757d5a0911386586dfa69d2f9e45ed0cfc0df2586","first_seen":"2026-09-27T14:50:44.851983Z","last_seen":"2026-09-29T05:02:52.589035Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_72.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.142Z","timestamp":1790658130142,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_72.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3c7c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f2CjQ2o17V%2F8gwOl%2BxXnnTZB3vcY9wsatFvFG5DgUAqTcu9q%2FI8ALoyJVYed%2FYJS72hZPWI8h%2BeIiHexzBxUqLjYR%2B15eGUqceFohDtGcGqN2hgweTSI8QYxKPQkiR5l\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f216bc056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15507\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15484,"size_decoded":16263,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e1dc178bdb343ab411e6ad3a9ac9b844","sha1":"13e57b7077b5c91eb6f0e567ea1f89a8d46120ee","sha256":"db0400ee187c492345eeef44ee7d85f8e76768559274abc066998e3f88ebb66c","sha512":"dede364438da252a1d5f939b3825c19ad0bcb991c6fe19749fc76727ef881e30f189b426cbc672b6a20515aa117087208fbc4a67a13dae133affc75bd93d5ce6","ssdeep":"384:2LTrUQZ3jJwek2RTtVocCqFQ96R5KwVxWLhlICJKT8XHB:WTDs2o6FQ65/VxqbICIT8x","tlshash":"1e62e02c1b1385b327f66e81fb0a61762902cbc611c81f0aa9721b2de4bff65594674c","first_seen":"2026-09-27T14:50:44.928105Z","last_seen":"2026-09-29T05:02:52.589845Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_20.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.001Z","timestamp":1790658130001,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_20.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"10ba-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=el9GQBOoqIcSIftiBnC9jObpNzOlezJkqKNIx4v8wir2kIDtQhb7a7HQzUbly7Rjvyg4PhD1G8fU50MVJX8m5z9ViyMLkmFxPWGa9s%2FJ3HoHNN2KT6wV8oFbFjZdq%2F39\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f208b7956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4305\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4282,"size_decoded":5052,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"880d06df37291d743505fd56a9eeb3bb","sha1":"3a420f73960ce343947bbc892fdb9b04762d8995","sha256":"803c26d8e782068275895df235e01461eb7b45f359b372dd723c908d82f25b6c","sha512":"163d15a48edebfe393589093c817fe0b853b876018b672404ceb9f316eee87550b4a9ea5fb863ece1826343ba262d7b14dda4d09e6603ba30b7a35bbcc56bb7c","ssdeep":"96:hdSn2XQ4jvxpmNAS1eYT1ZVQTVqI7i9HhtEtAVm284FzbL:y2XQ4jON7gGGBqUiRhWmVmKbL","tlshash":"bc916c3267a289ff800bee5b5f6bbcc12833573554947642d1e69c9dd705c823c2e68c","first_seen":"2026-09-27T14:50:44.784325Z","last_seen":"2026-09-29T05:02:52.590824Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_50.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.083Z","timestamp":1790658130083,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_50.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3362-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D7lnkLUH7NKKkioCDr0JigfXWdqTNUJHmCqddf3u%2B07FU1tXbkCQkNuVX42E9CaCLdUvt%2BkT5ybIAYBDtyyq18g7woIR%2BAUdAyiJ872GItUUw%2B%2BHbb1icN2nbHl9iXw8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f210ba356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13177\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13154,"size_decoded":13931,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7a3410b94350eb27effdfc2489770a06","sha1":"dae6334237ae633b535d390aa3198e2208ca5735","sha256":"a915285e780c4b2a485f527ca880e83bf59f5ccb6724eac0f448b7f907c0a14f","sha512":"b919873bebd8c7202feec6d85299019d590536fa3149e3718dc23c3197135cc4d8108b19130b35016b1c15b0314a759f85aeb4d774c9daf302e8ef003216587b","ssdeep":"384:mZo0IE6j7BMVe6ZXI4tAfApNv4ZgUQZCNtsgXPO4:eYGPjtAfBZgx0tVJ","tlshash":"d242bf752029fa0c2441cedaa07122c68742b92ba93cdfb0316ce636fec56691ded805","first_seen":"2026-09-27T14:50:44.920869Z","last_seen":"2026-09-29T05:02:52.5917Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_55.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.093Z","timestamp":1790658130093,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_55.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"29c6-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L8n6VvYtceMQeBUhbf4z%2F47RyFRKgqDLuLsCS1olxMRxVf%2BoB8D26n6yrnKgMEqeFIoom9%2Fi%2FTLQg9%2B0lf8MW4tOJPjoaeB9gndNMbu711NuWnUX6EgDWuiTtlUDlpqU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f211ba856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10717\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10694,"size_decoded":11471,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x180, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"aed6c43307ea4717b127e3dea7c9fc26","sha1":"73e09d0cd050c45ab931d8f2156fba753fc85b02","sha256":"a925388e28a6c7cbe74356d2bc37b1afab190f297c7f154c2d4cb55d1d6f80a5","sha512":"fd3d86255ee3984a1759a76988089c326fba5f18289e8cca3d064c073b818e4aa033c792e46cbafa2f65f300aa95e4641370ece7dd0704faa6da5d46edb938f2","ssdeep":"192:DpgtsvbUMcs+V4Gdvj7q6ycjSeWhoivU4RIAHrDFZ5wPr5Sy0q:Fg+oZrdvj7q6y/BoiZCANWSHq","tlshash":"9522bfb8b7dc25e4d3056a5a383ae737d28c5e09c9ac07fac20543d08c196166ecba19","first_seen":"2026-09-27T14:50:44.874464Z","last_seen":"2026-09-29T05:02:52.592487Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_109.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.223Z","timestamp":1790658130223,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_109.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"292-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VqJ8Rz74YgJHpC5U3UMZ1zSq%2FelNFt61AlpwrwdQJ%2FNEAVaRRldj7%2BR4uGFOzT5J7fwBDWETgnoCcM8iudEGDCK9u7ABSEpCEk07vlfWlHFUWL%2BSXdYcJtP8cPUGhcPF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21ebee56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 681\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":658,"size_decoded":1430,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"663fb1cd3fd07bea4c80299888008323","sha1":"2b65377bd34c17632b90a5657a6eead41d9672db","sha256":"ebd1f8563f7dd24311ffec9fa1a2f03bb197ba73940e081e4c4c837b9442cede","sha512":"114d4410fd641360ab534a20ec9bf274855a99b50c096e0341b8651df90807fa930323f576768c7e1ac36c0d4ee71a603ac3d5feab04c9c4a27cc0a884967ca3","ssdeep":"","tlshash":"160123db123d408ffef94270af5182dc19146ae0c4204d5608b641890552779a55db16","first_seen":"2026-09-27T14:50:44.969313Z","last_seen":"2026-09-29T05:02:52.593314Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/93c4b7a4-b0c3-4030-b24c-e14fbe38c997.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.252Z","timestamp":1790658130252,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/93c4b7a4-b0c3-4030-b24c-e14fbe38c997.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3e2c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PAlnwh8xqvyYyTBzlIS0r%2Fg3CJWPHue5L22oTAqxHINuZx9fLZPmYOqrtR0V6T9jDyhc5g2go%2Fcf4hJNnu5llDXRarL9BVw4K6izGyyAN162PI%2Brugll6hrioCPFQIGW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f221c0a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15939\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15916,"size_decoded":16689,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"70ba41aba6581eb88b17b76f644c1545","sha1":"0a4929253803b1eac968938067efa414a6b6f6fd","sha256":"6db9b65288eb05762ba30849bf16f3bccb384c50f20282085bbd0fa3180244bb","sha512":"e4f0281f8ddb48cdba07891785ea666e537e5ad218cb0fb6a1725c71b94b78f3905d1f8c545b9ec34f510eb7593c3d14613ee13d68bf40d3a492f8a57b2cf27d","ssdeep":"384:4FrT+fm6SCQoFTEPhQsA2Y3GkgbdHg6bIZhzqyCmWpQM:4FrTS5eObNShHgM+FhM","tlshash":"6462c06a8176f9dd6f340812e14b9f2a7adae6e4f397f9b71fc33465208d01d0e6a140","first_seen":"2026-09-27T14:50:44.950787Z","last_seen":"2026-09-29T05:02:52.594214Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_120.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.253Z","timestamp":1790658130253,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_120.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1584-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nnpCv1Yi76yCge%2Fw1eA32c0ZApJkSY4m9RDza72pyIdVaamB7luGJtZS%2B%2BfY17508IVyaXg2p%2BgH4LkNLaZKOVRCPRNWFtK%2BL77UzSAd6AorlSFZtY2NRVBgmIf3DeaJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f221c0b56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5531\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5508,"size_decoded":6284,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x143, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"62350abe881cd25ec762f09bb5434d20","sha1":"b9b891195dabb9b04c45906c31882300ec50faa6","sha256":"81a02fecde87312c2b9314267e0116481268487a9534d02e451703bc417db48e","sha512":"f3a0d93c052ca75dc40ccadfe05f7aacd92616d9d7e3630c627c3857bfc05bfb74bddd9b1b53e3adefaa90f1c34c49e0a46b5ecdb22f14bf24f1431d4e8d3674","ssdeep":"96:6moJ265zdx2QV388t6KM8HiXQb3QHJTnwtSTkgFF98LraXv/egVL:2J265zdx2SllM8HeO2wQn8PaXnZ","tlshash":"22b1af083665091ee6cd9cd1ac33be5caad2588277eaf570272424c6b7177bc43d6f22","first_seen":"2026-09-27T14:50:44.870359Z","last_seen":"2026-09-29T05:02:52.59509Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_123.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.269Z","timestamp":1790658130269,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_123.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"48de-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8jGiHFmb%2F5XkPGQ8gSRflhMx%2BKFE0Tt0zkTyCu3AEN5vMYxRpBYghf1uP9LrtyLTbkKiEV8scn%2FqTGQBSN3raB9MSmltocowrsfw3GXy9vqodT%2F4LTJ5Pt%2Fb9iIudoQH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f222c0f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18677\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18654,"size_decoded":19431,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x192, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f2d4a2eece76a32ec460f03902cbe423","sha1":"0097a63f14edf23aee7bfbd564ecd7a032420579","sha256":"10745340e1c682d5b142c003118391362c424370d01232485b690ed63d72d3bd","sha512":"02ed7a78cd8c041861267a7bbed9a2e5e2aacbf95b2fd3b2cabbfac8370ef168acf0f6200491ea81200c0b7f236cf43d0bd0bc30216b419a005069141d1f3b9f","ssdeep":"384:hUeINVeRpouC/3MO5emFPkzq6TW466+AyMpbYDSNAtlr8f3s:hDR5Q9Zk+v47EKbYDPW3s","tlshash":"4382d00b42791866399896cc34d2253883465f696bff7ab24df0e4139dc6362b6cd8b1","first_seen":"2026-09-27T14:50:44.809023Z","last_seen":"2026-09-29T05:02:52.596032Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/dora.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.954Z","timestamp":1790658129954,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/dora.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1206-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vKJs4yUZmvVGQuAep6VvzFMQKnNCtfTEFiuPp7bDHnpqjKRIkAQPfY3N7KV8%2BJipqkTfqpNDWCr8h8TA4KQRNP4b0VnWlzMvPeOxg7J%2B5AQETcjkccsexBlnymcchXEp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f203b5b56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4614\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4614,"size_decoded":5309,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"25d6073f4cd7557b3a938882f7304e81","sha1":"481767d598767eee7a22df2686776d34e6c0d482","sha256":"9a563be1ed6603e27dc24d578da9c64e34a646a052deaa6f597720aaad40724d","sha512":"2db20b96fd68bbeb35b55f11cfd6620dab2b96103f2f97affd985c1adfa8d2de06eb2fe275f12bd6a3327692136d7ebcef6f76feeb44ebc621076006e3a544d5","ssdeep":"96:emyIIM+jrJCZLDtx1A5grbgi9ojkdJ8Fo2oszwkT+:0nrJkDtjAEYjkdU7Y3","tlshash":"6d917d42938bc9c6dbb8da78537bb750320dcd8761224f81e57121bfa5d251186826a8","first_seen":"2026-09-22T20:45:26.286596Z","last_seen":"2026-09-29T05:02:52.596929Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/apecat.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.879Z","timestamp":1790658129879,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/apecat.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"19db-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5Cn3cfPO3n5Ea0vZ8MekjYZ4oYcG%2BQJhb%2FbbRogrjofS65hVjy3U8qSS2J%2FxEPju8roxx2tCCLaWKSQfVVyjmxKXEEGlnMtXtwq%2Bil4DHKfkL%2BFhnwSnHUyNj4KGuLn6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fcb2e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6619\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6619,"size_decoded":7320,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"30b16dad62e9ff081e1ff518930e53fa","sha1":"e796c4c4bb87c6470e6ab8ed366d6811964b25df","sha256":"a9dd365de15786f2623488125d2fccb523aad7a51015baa9550829b110671318","sha512":"5e298caaf38a7800cff6483fdbaadce837adbd6d4157e593ef75fe1f3398f694ccb92c7ff496d564c1940057804f77cb0e669aa4ad59ba3f5088ad99f7a57748","ssdeep":"192:evUDC79ZCguVlfxj8wzFJ687L8QLDNZi3:6UCS3lfxj8w5w8PZA","tlshash":"42d19e2af2f271e4fdb6bc721ef90ef450168e212215d6464ba5200446b51b64f96fce","first_seen":"2026-09-22T20:45:26.269071Z","last_seen":"2026-09-29T05:02:52.597803Z","times_seen":6,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/pump-logo.svg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.885Z","timestamp":1790658129885,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/pump-logo.svg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"89b-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/svg+xml\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xdkzsXbCSUL%2FMsGzstAKSfv7z7TT5OPCAjFMVExvOlZQBCjr4CD0nImhLy2dkBadCYFhbD2lWIqDqyesOJ3PggGVUpCamU61QQpd76GmlDffH%2Bk8LBFmgRJqA7GBY2X7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fcb3156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2203,"size_decoded":1730,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2453bde6c21392341f27c6d2152db2cd","sha1":"6499a8936200143cdbce9dd84f628c77ed25c7cd","sha256":"5fd26b35cde9423feac2a555312cd5a8e32bc07d934c59e6b750bdbdebac5049","sha512":"8417ad500c4643fcf4333cede2ac6b93051a97d29bea9e731d317156d357c3d8e394dce7a25e213bf07851b2168ab3a982473e298aa4d8ff7b41400e56dfbe35","ssdeep":"","tlshash":"a54181ecb71498bcea9807bfb61420d8361981f93a2740de903e339034219adc414ccf","first_seen":"2025-12-18T09:47:26.931007Z","last_seen":"2026-10-06T20:59:40.1035Z","times_seen":167,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_16.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.920Z","timestamp":1790658129920,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_16.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"205a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hPt%2FwqBcH%2Be%2Bd7elLOu2tpYMb2jWYVcquNuOwgHb9t4jtAU%2BjUIR99qK8if6XLz96Oon0HzVPiJP4EcS5vD%2Bmqc1xLW%2BbvLKxnvvZR8Ze6T7%2FzWVG85Hacwth4PyZZIK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f200b4956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8305\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8282,"size_decoded":9062,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"76e3b9cb238aacca4c2f464f2196881f","sha1":"72eac62b9f29758628390b844b2328676e96c158","sha256":"029f1687c12286a408935d14c66eec386e6364696bad375e388ac937f09d4598","sha512":"962fbe997f87a336bebef7ac3ab90f849813e93cf6dfca7ff40107ee8cd6638a9676ab9a47d4ab4bb0d2dea08d290caf1ce440e67923814e89a109b143c6d743","ssdeep":"192:b2L55CqdlwOCLuBKgTKFMZLLdjTSjXnrw7olm9rYG5O/c:iLPcR+phBSjn3lGYG5O0","tlshash":"b2029e73b3d7107894d2ab901b19ead1a169308278a7321b23c78e704baaba1ed1d513","first_seen":"2026-09-27T14:50:44.858562Z","last_seen":"2026-09-29T05:02:52.599415Z","times_seen":4,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_132.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.933Z","timestamp":1790658129933,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_132.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"1476-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VD0JBherAeW3kAaJeuyrIzJ0M3Bz1UrYCEcyFNICCJ8gdoNJnyB2zZ91HWvZ4TY1SbOGGagxG90%2FvmhdvBz0M6PKW%2FTnrfO8OU8dkrT%2Bh1DwvtCL1k2sLbuWFjMI75%2Fd\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f201b5056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5261\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5238,"size_decoded":6012,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8db1babf15ec754622aa596b30794c60","sha1":"c024576c197f6f8afe9189f94d276113744028d3","sha256":"4b923bb8a5db51c46d80b42031a61b04016b7736b265b1aa0437f60df73345b7","sha512":"ba75bcb07404fba12c7655826817d5d243d4ad57d559d471e10d30c205bcef5d04f19b6f7d05bed21ab80409e7e837b8c8b8b351cb0828bf3502e4995f15b119","ssdeep":"96:k9b30oKqXIUrIZDlc/DADWZwTa4ihuK07CHqfB6RSFvLaHYrqK1U03PyZrxl:Y30lqXIU8ZrnJK0RJ6ULzqKlyLl","tlshash":"a6b18d469e951c52e95cf6674dba7000708ccf6da2238eeb0816366f6233d147e9988a","first_seen":"2026-09-27T14:50:44.955781Z","last_seen":"2026-09-29T05:02:52.600455Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_46.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.067Z","timestamp":1790658130067,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_46.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"f46-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8jrJuZ9N5vsJ1VHWBhWrNvHHNhkVrvgxI%2FLMOmMBNss85LGqYD2%2FVtTKF1T65PWvWtKmotE5sjtzETzj8SGgmevUsK%2FTMsU8ZanaWaNwrNNaLP3DetwdvvMrzrxmmC6d\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20eb9c56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3933\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3910,"size_decoded":4681,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a1454eb912d31ab308e7aeefcbe3c47c","sha1":"9f7ae7e09abcc89c75b7ed4201a9a1923730c4e8","sha256":"669ea39723e0e3bd03d790b4be878fd789a29b37a91289f0396bb8936babcff8","sha512":"19eb94eeea61af01bdee5aaa41148a400614db0d1cd34c1ef6b83b48083002ed816405666b4b061e7c36b3c63318a51738c799cc724e857f5618c4a4bdce8707","ssdeep":"","tlshash":"2a813b955a0bf4d86ea5abbec61f4a67f712494a00bc9bf7143d17303cb26828241e95","first_seen":"2026-09-27T14:50:44.79588Z","last_seen":"2026-09-29T05:02:52.601419Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_63.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.112Z","timestamp":1790658130112,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_63.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"e60-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iEoNhHlzwk125WN7FoiRXdip%2FdIC0gin2lulCrQNGu0DN84QMYBMXTTrlXgKW4TigmBhH966glGhW8%2BScsQ1s0J3je5k5yRHzXGghF8%2BNPm1Ve6i7KjLLvgQ%2BYaHSJdU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f213bb356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3703\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3680,"size_decoded":4453,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x170, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"62ca13ca4e84a7d7c51651e6ed9551b8","sha1":"fe89eac87b09f7dcf305440e6c1b746e733d77b3","sha256":"71c3e951f9964ef27fe7305901f122ba582fd7c8feac3d0ff8fa2786bb48abf7","sha512":"1f98532b30f4c4e2688efd69488019d12896635968a3eb602b31647c9352f6b0b23ed827d501ecc44da7830268ad84b0998e5f29aeadf961b6ead385709595aa","ssdeep":"","tlshash":"5c717ea71024a7a418ce954cace4f68660247048bc2add23717482fa7ebf53c2bf5d99","first_seen":"2026-09-27T14:50:44.965114Z","last_seen":"2026-09-29T05:02:52.60239Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/pumplife.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.289Z","timestamp":1790658130289,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/pumplife.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3679-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jaicn9%2BouTtzOLZiSmHhoM2KAAVQyxNupXdmkALhckT6xdJmE2nJwdmhZl4Zx8afv9XVyMN6%2BSXPpczMgl9mpwB9qL0QK5QW0PY5pPUuXh3sCPfuMXzzK5OGOnRcaiO6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f225c1856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13945\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13945,"size_decoded":14641,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"c68e85e896d76d4b2c2a3ed18d6b4d75","sha1":"d2e67e3f25b838200169f175288552be3d95bc07","sha256":"29794ef58dd27c8b23a8bf015f45a385a3b0c781aa202e912f0e0cbda5bb0340","sha512":"3f08ee4fe7979b0520e7f625fabbcb3f0e416fdf098a70825ecb611d1caf7a3064a975a11b93434750e6c045db8013cecf5d821a0bbaa9ffa20583542c398ae5","ssdeep":"384:gnEYygyAqN4EnPn3zCxfYYu3Q5Y6aZ/WjbRWMxza8:KqN4En7Cxfx3z7","tlshash":"6d52d1d3be546c26d643bd739b9c22b40a385c57cbcc8dcb08b9b079b66e74d012a123","first_seen":"2026-09-22T20:45:26.353007Z","last_seen":"2026-09-29T05:02:52.603251Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/mortgage.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.957Z","timestamp":1790658129957,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/mortgage.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"dca-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JqsQhG7iK%2Be%2BqkprgI1V%2Feyz%2BYeAIoJV6yxdur4Ffj%2FoBofoFwrtPXaybL5584CHXXxJC7748tRtE2G2KS%2Ff3lAVGpsD%2FizHTW7sMk%2B6QWsE0KnmsM4ncV0wpK7Qkwsb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f203b5d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3530\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3530,"size_decoded":4236,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"d9eb53502033af2ff6fec64dce9732f8","sha1":"1eb3cdc035b53244d6dc2a6d2b3b4fd940ae640b","sha256":"f8181cd580b1373cbfeaf0a207adeaff669208fb5913134a222d0171c986acf6","sha512":"0763a2806eecbe83a019473d30dd833b098500268a8360bd286d974459417a0f67ed6288b4830858c97e76028a4e2d28cfc5a5d812085c3cf0b1e118ca68d6d6","ssdeep":"","tlshash":"99712c1cb69dc9c2d70e76b45f7636c53119ec6d85cbd2051df6203944e13ea4c1ac6b","first_seen":"2026-09-22T20:45:26.3085Z","last_seen":"2026-09-29T05:02:52.604318Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_77.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.158Z","timestamp":1790658130158,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_77.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2430-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q6Q3UfnUyo1mCQhdWOR1m51Si6t%2BFh8iArLeGVENeZNAtN0txrVjiZMvAoEZUNTQyDpWxoMOuPORHT25S9smBu0%2BTuondd%2FHuKTbzK336qoPInGa2bmsMdSS70D2WaGN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f217bc656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9287\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9264,"size_decoded":10036,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"89705a8e607281935c440d1ae307b8b1","sha1":"266556e7cbff8d0565445ed889b7018203794657","sha256":"3caa2ccf7610274a754433b7cb4899373ef6b9890a5ddf855d2e4a77cff2a87a","sha512":"33afadc2cdd1933b63ae045e1e0ada9fc9590f4f4f6d129478a7cf06f60c393cb470e5cbe7752c0ec1bf85e57ac8211bd92593cec794b5630cec168e85b55e3f","ssdeep":"192:cGyoMEtwWvQL8dHMA/BOzGQ8I/w8Bm4kYS1hJWOLG+Y40759j3/O4MRW4Kh:cGFMOwWvwSHMA/B8Q5gOL7Z0759LaW4y","tlshash":"ae12bf344bf8eeefb580c59ddf041999b03a23eb9082a173a57e64352ca7d1531bb281","first_seen":"2026-09-27T14:50:44.781695Z","last_seen":"2026-09-29T05:02:52.604934Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_81.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.166Z","timestamp":1790658130166,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_81.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1a8a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ttMGDIoswujNTQRuW0%2Fru2qKwrq9TDU20IQTK3pcSq1N1A3OeuYu44C6Yx6y7eAc9jwPQzcIkCLYfNi65HLg6Pn4%2BHO5Xyuz4dTSCBJ5kSXFD8frkMRwzEW90Swo%2BAig\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f218bc956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6817\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6794,"size_decoded":7566,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"93e53787babaf8672af7d423c72e2a51","sha1":"4978d4248186918b3b6214b9dea482da62328f21","sha256":"55b2ed92bb12807402229f50b179bed75a9837e44eead7dffb946e6ad503d187","sha512":"4de4e5cd0f446ae9d9e0c8b6004062f5f38a7613df0b64a98eccb157f96add4f0372e2924d143e6cc514350454bf22bdb9f0cf4bdf85e247d0badf4603816870","ssdeep":"192:9h0RM4Fx2NHds3bjQTqnKzgQ8NlOxbgQevR:mx2NHMjQTvyNoxbsp","tlshash":"46e19f0ed0f847f22f28d7c7bc2275391d666797a9671091c6510b21d5ef63712a03bd","first_seen":"2026-09-27T14:50:44.900838Z","last_seen":"2026-09-29T05:02:52.605955Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_104.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.216Z","timestamp":1790658130216,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_104.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"29b0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EMaIyJNIE4Ag3C4x8X0ToIdyz1L37svoZNPi2AGq32BefJ2KNJW7jym17fGz9WDrsg1lRVlJZyL0n2Ws3KO%2FVX%2Bv09jcZYVLti06ADQgWHDcJJ7SV3fFoJ1N6a2rlxmA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21dbe456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10695\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10672,"size_decoded":11443,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8ebb4a09d17697f1ab023dda04cab2e1","sha1":"a9e2657431d7bc5eab0e2d60cf927ff65adee652","sha256":"8d8adc1088e317bdaa4430e0a77779e20988c8b80c211037128e0f0d5faf6335","sha512":"55e2fa0d3559911ede743cb4ef7a1799f72657a4d17f92b96268054bae2860692dfd26042eadec431c0f3ee4f0d046d82b12f6f710873c3dee468871180ac974","ssdeep":"192:+vlNJ0SwnKQIAYGBEL0LF1JozPjwggtcWNkbCOh/XEacKMb8aFt4tOk:+1M9XHBEL6tofN/bVhPEVKMLBk","tlshash":"ea22be28c5f5f80194b9bd76471ac27c1204c0281f997323929138dcaa5fbf1fafb6a0","first_seen":"2026-09-27T14:50:44.853843Z","last_seen":"2026-09-29T05:02:52.606829Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/universal_sans_text_550-s.p.2oz54pkhn1rbr.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.604Z","timestamp":1790658130604,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/universal_sans_text_550-s.p.2oz54pkhn1rbr.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"97ec-65c5af802a980-gzip\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fos3%2BJJ7LSk%2B3vmZ7Vfj6o9paeZ%2BLvCoGlJXLeMPAjJT0ErF9ubZBjlKoHcLw7yZmo%2BzzvKqB9UyKPkdxU1T9dcFL2OFcL%2F%2F2vD6ReGs56FM%2B3SJ4u5imtRuTTwLoFh%2B\"}]}\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f244c2956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38892,"size_decoded":39588,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 38892, version 2.458","md5":"ad7c05a5a6cc687c2a8944061b1a9ce1","sha1":"5dbf0364e2c06fb324a5b03a95c40bc818904172","sha256":"e6ecf6aaa4d146fcd426008afc1b7eea0dd6a08953eac301c00a1d9118042ebf","sha512":"51b645a0e6dc65c44e5875e5fd1168ec5ce31578c8a1eb0e515a8fea84af6485df13cded4eb9cdc56fdf252f01fbe9602f13700bff8c8b7cff815f3a8d6e7bbb","ssdeep":"768:qWyVhcFUc9aYqhS8tsDNbihm9l2EZzzuwbk6PC7TTLb9JM9NXin:qWOhcraY/8tlh2ZuwbkmCnTLzM/X+","tlshash":"9d03f183911f1921c2ca00e1587717fbbbfa2569e56410dacb9e5bf41fb4fb3a144099","first_seen":"2025-06-06T16:36:33.094553Z","last_seen":"2026-10-07T21:37:13.184345Z","times_seen":998,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/image_3.png","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.777Z","timestamp":1790658130777,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/image_3.png HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2e2-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OKAR2VJmcPadxiqxafXXLfrgrma40ff3mhYlqu48yxl%2Fh%2FecxdhdflfNReRDNAV4%2BgiaBTFASxIZucPaNhOnNIMuLj%2FLuVCdkDmRIIsySIR2TSRUvDpgSoZtWcSz%2FNfn\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f255c3956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 738\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":738,"size_decoded":1436,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"3d2724dd30674d331a7f5bf88b4588d1","sha1":"e5b514a1f63eee9d458e0da43a47f55beb63335f","sha256":"1025f8b8b8f93f52412dbea97dc5cb94bd6c667f5f079e600643ec6a3fbc628f","sha512":"6f8535f2ee10e35becf8c30f6bd3b3fb1247faa37dd01c9c74818fe4cc25760193cdb51703aa8433ba1b449f887ea513d6086c1bf6e9b514a41e1953f8d2131d","ssdeep":"","tlshash":"f501651c4b506a2450a6922f7147c750c705b710813efbce6e1ccdac1540fc8a2a63f6","first_seen":"2026-09-22T20:45:26.367737Z","last_seen":"2026-09-29T05:02:52.610697Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/patrickc.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.959Z","timestamp":1790658129959,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/patrickc.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"b4e-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YAfbpiGlkCrJYe4rbt0cXO%2FgpfalabvOK6APtCsCLPjEGCOtb%2Bn%2B8cURAvTOs%2FFxyVsPWjhVf2Wxklq5JhRg8V8MuDgD5Z2rSZndlGZYuPx%2Fl0qzY9ksf4qRkAqNB2VR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f203b5f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2894\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2894,"size_decoded":3594,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"44bc0afbf28a6cf0edf8df5fd68102b3","sha1":"3ec087acbf9ee80beda09f5b986ab82ecc52fcfe","sha256":"01ab126bd5fdc4a5d67d5cc9bac25563510fe574c215928a1ca4f95c73de4cd3","sha512":"de44c54d288e4fa64a6a18376d8a647f9915903fb07ee690fff92519e73f090e11b46b6fc0ab0ad0fa980b08d39b86ce9962557950d16ef50da230c4c7f915ce","ssdeep":"","tlshash":"50512dc73d219ec1db25ae3bb5f4198df64412b994f65d28b442a510d4a73609f72390","first_seen":"2026-09-22T20:45:26.322608Z","last_seen":"2026-09-29T05:02:52.611484Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/rauchg.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.961Z","timestamp":1790658129961,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/rauchg.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"be0-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zV6V3VtlNI3YvYX%2F1ia%2BLCAX5izp2xXyM6GIhpbI4YKklQqS7ngXRq013fg6zf%2F8HGNnfm7lz%2BvaY2v5MFflKA54pt6frpB0KiaD7sYBlkdKCnhI3waSLHHwJFy2EAaU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f204b6156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3040\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3040,"size_decoded":3738,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"1af1c3d432ebb8b93ada366e8011ddd4","sha1":"99379c65fcf19e676cec0e217c8642bcb801db04","sha256":"35ac7df658f2f28f2a04bcb567a3e8f49d1c8463e762bd1573a0dc46ff2e1d12","sha512":"f68bb21a5eaf6032641a6b616e5acccad37c39e7a2a0566a90e2286262b0d20fb95f66f016382be7f3685c5418329482aa3f2ad2923105449d7a7837ae09af79","ssdeep":"","tlshash":"f7514d3aeeeea3fbc4d61830570c255711e919736cdc8c0495486ad69c338d62f327c4","first_seen":"2026-09-22T20:45:26.364073Z","last_seen":"2026-09-29T05:02:52.612683Z","times_seen":6,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_10.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.983Z","timestamp":1790658129983,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_10.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2c2e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=54bi%2FgXXFhkWsSVAYxWBf1dPqs%2BbH2VzexQ7JpKd3HuTM4DtIc0THdIYb6CzaXGthY1%2F%2FORPZ41%2FoJWrLF3Gf2JAaSNld4J09BD%2BmkZ34e3JBsQWxZtnE72PQBIfJhsk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f206b6b56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11333\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11310,"size_decoded":12089,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"dff7123837dc30c83eee180684d6535e","sha1":"1ed6d0bca4a222b59a59c4f7364d11b2c6c32205","sha256":"0df92d35800fed863b37e220ef69cda3521ddb106d48863560fb60741d4292c4","sha512":"c1f2f4500ae3cf37a1ef773a7952bb36fc5436f72228105207a044f45b6935e52d108734708dd16210b660b1256db6148c01472a7081070f6fc19f05e4a69c66","ssdeep":"192:s0XY7tcME8AEwm2aNbZMUEGMiDQ/c9lHGj5lvefUl604qTeTHSKPn:s0PYFMUaiE/c9lHGjG8lWEeTHfPn","tlshash":"0132cfb0ab6cdf10c8b90cc6b8862edaf35085487d72d754a59ac1b6bd3ce0404a74dd","first_seen":"2026-09-27T14:50:44.831955Z","last_seen":"2026-09-29T05:02:52.53234Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/pons-logo.png","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.994Z","timestamp":1790658129994,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/pons-logo.png HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"12db1-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1Wl3VDbQCyK0UOmVKzvgXjkhSkvwVY2vJf1QPZUOTY62XDGbkHHhCrysstLhNOnPNIMMQQjcXfw0VwXC3RThAUQ68Zq6M%2BFK3bcAyZhz%2BeZ9%2Bj6v0XdpsKmFLm4AEP9Y\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f207b7356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 77233\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":77233,"size_decoded":77931,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"d13f4947b25967737ead83b11e85c50f","sha1":"b402a36c58e647b305a2227de52b2b67d3e96d79","sha256":"ad3da72cc8abd864f93fc0bda11c6276c4cdd630ae0ca66d0ac95e33557785fa","sha512":"dddc4ff451d77a5b7aef2c4947db4726628c010a10deb7b27d355ef7f81ebf470eb37d1bdfe6b530ecf704b2f0ea536e4c09548c0442973fb52bfe223ceb995b","ssdeep":"1536:mzEkezP6LdZBMoqJmF8spZ0dqdufYMmO99jYtZ5jx4U:+qT6LdgXmF8sXzd0UZhx4U","tlshash":"0a730221006a7337d45597bb14cfc379c9b7458220a8ae21951af8f971eb36843f7e72","first_seen":"2026-09-27T14:50:44.854875Z","last_seen":"2026-09-29T05:02:52.613413Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_37.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.035Z","timestamp":1790658130035,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_37.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2244-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tpmUSsJFtagvV1TH24HEAnrxUs2OOPHMT7IOgC%2Bs%2BHCY1wCr82WxLL3p8sHwcyBkxU4Y7jCZ7SS1kia1%2FZGwl5DzOJrTF6wIMdqB5RxmgpYIR64BEB5KcEUqroT5Mrx2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20bb8d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8795\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8772,"size_decoded":9544,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"02ff2cf6c14a9174c4a04d25fb9d2714","sha1":"359441c531ad49f53843af027ae92097b2da30c1","sha256":"7cad8871e076525841eceefe11f174d6653d0b5799b6abddf9e859d84ed540d1","sha512":"b1a17bf95edd5ef513686f22f0bc0710272c1a7b08ccdd3bcc615c77ba88f929f9f83e58dc8451faf047d0b718d4c85c2e3d528ee1b100d20f6121110fd19367","ssdeep":"192:ez43lgwKLjQpP3bOTUlIpsB8ddRpNbRDU6tFW2PhZaiDI:vlwch3CTUlx8ddXjxPhXDI","tlshash":"a102b0b8a507cb1a0b72bdd578847cdb03a9d08192735e4c7526f96411e2b4ef1c928e","first_seen":"2026-09-27T14:50:44.848939Z","last_seen":"2026-09-29T05:02:52.568075Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_58.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.106Z","timestamp":1790658130106,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_58.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1222-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jEphv%2Bjrc9H3QSI7k3mPKP8%2Bj1IbFSXfzkLO2ty5CNGNIsUkl2miKaecmR67PoXbX6bT3ihf1EFo3aAR10ddE5AEeszMwEgyfjIh2c8nOYRHP9BzBwkQ8A9Crw2dDBnZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f212bad56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4665\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4642,"size_decoded":5412,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"93fd48028da5c48c6da1e038413426ad","sha1":"3d2a947b47a0fec44f7b5d357684876a6840207a","sha256":"f3a258e85aa883283a842e811e18fa818f7db024f53d09c3921b41f2aef28ce5","sha512":"f56b8ffe4483e6d0b1b2a820dbfe2fae425ee71652bfb3bb54ccdd9accb12515681fa034ca82bc4fdd2673b35a7f8b0ee5ede449d4f2dab7164e21330b664b45","ssdeep":"96:xNWe6m8BXfEPfPEc+vP+zA7dn6F1UxvTmtbapCDMD6eDZh4206U6y+0KnVGCI:rYcPYv66dn6FurEa1OGh46UNvKQCI","tlshash":"44a17e99cd5e866bee34127be1014431f539f5b0b751ae07300aa55bd87a452cfa340d","first_seen":"2026-09-27T14:50:44.863203Z","last_seen":"2026-09-29T05:02:52.521937Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_61.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.108Z","timestamp":1790658130108,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_61.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"137c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BFA7BaxJ0AfB6BPTaxzEngCpGhfhTyvojnbbLNMDdcfrojOMMk6zo8h8G4wVGnNE1h7zHkiRO5X6aaUbpuQTzfo47xey8RRVfnif%2BGHE5ffP9EzFGNM%2BN%2FbsMg6SiCxt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f212baf56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5011\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4988,"size_decoded":5760,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 240x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"071c434fb5b65503b31cd625ac205519","sha1":"6325ef1cbf7238c85af25966fe6c334401b22cbd","sha256":"5b8a1f1659d4c31d35525a8aa2a55e8c6ebe5a6961be4bd8e54f335d51f23b51","sha512":"e9f4433ae316251291fd2ee5e7ce6674c0424a83b9e6f246fa0e7f0cae3c1d59f622bffa33e9ddc36f78a3f8ed86b70e449b40e5b32220663738d5880aeb05a8","ssdeep":"96:sWPT7CqJzAxPty6Jxq4k4u2whQh3FiB/w1TJJxcAIA3fO+LOf:sWPT7CqqxPnxK4u2eQhViSxcAI4+","tlshash":"8ba18e76fd193a6c9b64de7580d33c075a4ef0665843b8e746db248d16c5ae80e2274c","first_seen":"2026-09-27T14:50:44.884919Z","last_seen":"2026-09-29T05:02:52.614169Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_78.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.156Z","timestamp":1790658130156,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_78.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1860-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x9HHWOJaTYvAIx6ZnFvhCtbWJME0WzHoyTM2N%2FagdHFI2Uf3ZaS5lpytWwc1dPKKSDair8i5%2F1Z2pJqjedTWtZOl8YuPk1xOqJkujquFi1sl3XofwY4APK0hhGkYX3Wv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f217bc456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6263\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6240,"size_decoded":7010,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d3f82845cefb47837c4b55d13764297e","sha1":"64d5240880247753660c87e906b8b5bb3c54187f","sha256":"c1055cdf3122e5009e9422882e82f5c8d656bbbd0af5e3e7ef6a5ec539385177","sha512":"0408026b98c0d407dd631dd6ade1ebfa73f6111198e2e8a351c6828c05187e6268b3bab8bcf7401ac44ee164bad481bd446cb2d0386a21edf343828adfc029bc","ssdeep":"96:mqqLZas6ASGyxjtG9sXCS9PVux6fWyMt5MYVxTv2V3r71TEyutAIl/iBN:h6YASG0usXC4tuA+l9b2V7hYy6L6BN","tlshash":"bfd19e8236852ca5fc783e1dcc8554bd05adeb3568a5be730f96ea20adc03acd6013c2","first_seen":"2026-09-27T14:50:44.865265Z","last_seen":"2026-09-29T05:02:52.615263Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/bob.png","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.942Z","timestamp":1790658129942,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/bob.png HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"119f0-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ahsEH8f%2FONMWkI6L2OA%2BEe1nS1Ur7V8HpjorxDiGwG00JVd9AgPzNVkZfhVa0bKzgvGIUY%2BIbvZCRCNmxDcmIHaFbhEShXRn91PHyp%2FRMSESumR2StPeHaWms5bU%2F2FM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f202b5556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 72176\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":72176,"size_decoded":72878,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGB, non-interlaced","md5":"bcb90c306b64df74e3c3a3706b6681a9","sha1":"04106560ede7c2d2bb7c6e94f1cc276327d43de0","sha256":"ea7745cb97e1432ab121bf9a7e9422f2b2125475bbd0d95faf4bb9fcb8f5c8ab","sha512":"35376c44f7775df93a5e2778a8160fa81ed9fc31a10f63dfedd3ed70bf4d6bfd71c335d98d289f5006d37d4c9b406e155cf4f47a99d47c6373da904131d317f3","ssdeep":"1536:BeC7ynMn4x3ExUMJczXlQlSOQn2sr/DrPHb7z6tQrGfWwxdwdGE1:M6ynMn4xUxUf1QSn2sr7LHb7/rAtx6dd","tlshash":"596302e0e32c3a2991a32c11b07abe5e53261d34d8714a4fb7574bf8784769a791ce83","first_seen":"2026-09-22T20:45:26.354266Z","last_seen":"2026-09-29T05:02:52.617171Z","times_seen":6,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/potatoecat.png","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.960Z","timestamp":1790658129960,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/potatoecat.png HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"ce54-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Pic0kgav9y7ujObMQFQ7ZB014ZdWBYjOqxyOQWpkG1VlhPP7D8lFtQxtkRjU0Hi6Yuk1gEnXQQw%2BYMXzXvxxh45wlbD%2F62tpY2afpUhzW00xQ5QqLTUB9%2Ff50iLy3ZP6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f204b6056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 52820\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52820,"size_decoded":53517,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"5452370961fc957c829258430fb173f8","sha1":"cb6375d0f9863c5a60b62b5434eeb173d7daf316","sha256":"f748f3c14c1c58a4465dedffb85bde38a68ff70425bef4e7fd3e656a47ae96ea","sha512":"d45ce5bc40cf467a31daa44528eace0a3e67e287cf1bbb8981817fdf76fcb595e3fb770bdb2ceb41477945225578fd9accc02ecdda67d6ab644d6d7508970e7f","ssdeep":"1536:Ze1Rs21e/EauSuCApVbMwYguEbDphE3UXMgh8i:+RsXzu9pJMwdbDCU8GX","tlshash":"3e33f25a3cd9ea67904a73b873feba94ade30cb6a54bc5f721c2d30440b76280f64951","first_seen":"2026-09-22T20:45:26.254433Z","last_seen":"2026-09-29T05:02:52.620184Z","times_seen":6,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_13.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.988Z","timestamp":1790658129988,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_13.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1f5c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4WI4vnclUqMSXiIz92cxPhdCfn1u5Vg2wUMh8kiG7pWjQa%2Fz90Z5HGsUlC8%2BN3GVFLjVLuNzB47EonCsJp%2BOIdgU1ClUQo%2FGyQ78fkzsBTkJuiOTcvWsw99sls7pVPeC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f206b6e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8051\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8028,"size_decoded":8802,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"26cec2db507da37c1c847aa89dbc8e38","sha1":"d41d0ee1c12d16d65fe446cb18b256fc336ee671","sha256":"0eae5e817731963879b711707766615e4baf3f8476581d62e4a1ddb51fa44d46","sha512":"1c3ab22d13b2f4d7ca03079dea431443d63791575daac6efc32830cc743a75ea9f39b5a88deee706e0da4efc55e546905366fd522b9d2827103c7154429ebae2","ssdeep":"192:ZouylaWoB6TY7uBZ8Y0MTJtYzbPgAVBcmPEkEkUp:ZR9wYU8itIbxB9sbPp","tlshash":"eef1bff603528364e3745eb8a62e3c26c90b4485b9b1e3413bdbd4cb2ab4c8dd284574","first_seen":"2026-09-27T14:50:44.793876Z","last_seen":"2026-09-29T05:02:52.621515Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_14.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.989Z","timestamp":1790658129989,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_14.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1f5c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H%2FLonyTELF4%2FykTHaYa4tdfdS5WuXwVIwMbqUn8vCT6L6aGDaaaJ%2BWG9Fi2EqlwyhGA8VT1IHCFsi9rs3eyVy%2Bg25mmBJdM5pOjHk3GBYW2O9fzW4Tg%2FSOmwZQWROQh6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f207b6f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8051\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8028,"size_decoded":8804,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"26cec2db507da37c1c847aa89dbc8e38","sha1":"d41d0ee1c12d16d65fe446cb18b256fc336ee671","sha256":"0eae5e817731963879b711707766615e4baf3f8476581d62e4a1ddb51fa44d46","sha512":"1c3ab22d13b2f4d7ca03079dea431443d63791575daac6efc32830cc743a75ea9f39b5a88deee706e0da4efc55e546905366fd522b9d2827103c7154429ebae2","ssdeep":"192:ZouylaWoB6TY7uBZ8Y0MTJtYzbPgAVBcmPEkEkUp:ZR9wYU8itIbxB9sbPp","tlshash":"eef1bff603528364e3745eb8a62e3c26c90b4485b9b1e3413bdbd4cb2ab4c8dd284574","first_seen":"2026-09-27T14:50:44.793876Z","last_seen":"2026-09-29T05:02:52.621515Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_21.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.999Z","timestamp":1790658129999,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_21.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1190-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=61G7Y9g2M7zQr7jhC2RsZz2Z3WpsD3MBRbxiR%2BSdD1%2B6znYbc5HUULM%2FIJYU9zSr%2Bj%2F7keU3%2FkdIe3tdShyqKNNum6mLYwD204thjDRenZQYsqa7oSQ62FHfa5u7QP1H\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f208b7856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4519\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4496,"size_decoded":5274,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7ff1952cde504457ab1ab5342ec5cb09","sha1":"9a510171fc1749a2e92830d9ea84285e9d5becd3","sha256":"b2cd3046c8e126bbf84014c5cfb4f23507b4f90a71d485eb04a48d27522e7337","sha512":"4acb0dbb499747f19960f2a36563724e9a176b1650d7a850a38cc38f4e37e9bed41468a1e36cdbdf2165d8b7d9d8b2692b705d7381f714d3fe7956ddb1f232cd","ssdeep":"96:WE7e8YYnxiA3V5/qui4iF5LZo9xg0z5lM7ixvovKTe3yWaXT6:HkYns2V8ui4m529xrjM7iOF3yWO2","tlshash":"a1917c6e87b8e21e457bae638073d2362265703dddd578c91e4702c14010b5aea3cc2c","first_seen":"2026-09-27T14:50:44.83415Z","last_seen":"2026-09-29T05:02:52.622722Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_28.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.019Z","timestamp":1790658130019,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_28.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3e5a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xJf3qCGCn03DupOwsW8zWCzuGracQmiu%2FuLsStyrgUYo%2Fr0awMuazTA92iC7X70yIju6zYkv0UvSYun8UcshdyZ3qw1kJH4Ci%2BPklYttvUX2tgJrrt6ngRm7GLFfIzzy\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20ab8756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15985\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15962,"size_decoded":16735,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3fa5b64f490cf2c4b927df8040ef4a20","sha1":"f7e534f1aae17d52bca1cec854e8bc408bb759de","sha256":"82baa30d7b53c8a5d6644f40e5e823733db09128d10d70a3325a3d9fe641de97","sha512":"900d993077561893a119c724ceca4308a565bd619ba8da73e2a0e1f91b3106f9b6a3f3e75a242515b5c618b5064487ce05b249644df20a825506cec8c91d664a","ssdeep":"384:k00gItAzT1OurqaVsUz2bw+Xc8YeSwLZXh6K4ow0n:MgItAzT4cqaVs22c0hY1wLZXh6xH0n","tlshash":"4362d0b413907fdcd8ab0e83a84842edf6694c099b61a4741e607cd939437e8a753ade","first_seen":"2026-09-27T14:50:44.825991Z","last_seen":"2026-09-29T05:02:52.623867Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_84.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.172Z","timestamp":1790658130172,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_84.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"14f8-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nAU%2FOTMix%2Fe7yvfSVjnpEpTb%2BTYGP4gP3REfnJcJ513MyazFRMBSAA7Bvc%2BINwEyZBdKWqk%2FKs2jtkxqIm9Vuy3vdlYsyQOq0ivgq%2FN9ovxDZNPxs0qUFyu311y0LuCo\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f219bcc56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5391\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5368,"size_decoded":6146,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x144, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"997cc98f60e96adb7371edb15f2dbaa9","sha1":"5251f5f94b2d446da093a55b785cc94f7a70f6f4","sha256":"f719868f4338ab92eaae7769b60635ad3a49dbbbcda6e4ce6241dedb947d4e9b","sha512":"d98f79a1823507a3ba6f0280a4f8f21034d231e9ad6dda678176dee739e6139de3f1aea9c6f6754a5b7580c30da36a17b7364db8c5f07918581a363c59e1dc64","ssdeep":"96:JwKJem6l1YG26QXySaI5IfGk9K+aPxddbSfxM0zUikku/t9en:JLJeDMfGfGk9TUxdd0xV9n","tlshash":"e8b17e7c55e2b9100c1b30c29772e9456d7a3b8f8017b91df99c68d6c6086fd136e9f0","first_seen":"2026-09-27T14:50:44.788775Z","last_seen":"2026-09-29T05:02:52.625237Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_87.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.186Z","timestamp":1790658130186,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_87.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"a78-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g3agX%2BAVaS4xobPgJhhJt%2F4IdiE%2F34TqweCM2AWSU%2F9FR%2FDdRzacfPyr%2FtYtwqTCE9wxy4QMvqo6O2oDGd5LiVvK34N8s%2ByIZrjjzPLmxAQJ6HJtc5Mf7GrTYUVV6f9H\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21abd056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2703\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2680,"size_decoded":3459,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x144, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"11d14e34be42d198aad64a1b185cdd65","sha1":"1b057b3da537f380aef42c62cb9670b32a97f71d","sha256":"20404a37f53f7766fa4f13e2bfbd0095c7d4ebef40394840f49ebc9adecff735","sha512":"971076cb9f448956829808045783c0e892eaa46d0cf4fb20c4897293a5eb946698af8e14201aa47b85bd8477ecfb2d3b34252ce124651367a05c969ebaea4d51","ssdeep":"","tlshash":"20515c2d655d887d7c34379d6e54f4e83499cfd230a14dc6dba4174045584903be8cd9","first_seen":"2026-09-27T14:50:44.807756Z","last_seen":"2026-09-29T05:02:52.626364Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_129.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.922Z","timestamp":1790658129922,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_129.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"2a94-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5%2FoC4pBQpcZ11YbzsxlbICo%2FTBy4pqx1CtcrcNmF4IzUJS8%2BtauuwGi8XFyGhX4ziWAl8oONULD%2FcMqfrGM9Sv78OQUcOWmXSamUlkpMYtxHvVgZsG9tRpZHz6fFQxgc\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f200b4a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10923\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10900,"size_decoded":11675,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x342, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"798fc65f1081e8d3a91cfd57e96b916f","sha1":"de8e7f7dc3723022b13e91f8832e3315ad3d5084","sha256":"aa6f7a06ef7b1477daaf9dfaacd863c4e15c33ef8626bf9c135d710d6b417f39","sha512":"2f8488b3a64c7e22f5c5a2122d6ce9e752d8e67dbb2ad71d397a263e0b1bc60dc522319203e90e91c6475092a366aab46a6f6aa1d759e69f20109cbcf812a220","ssdeep":"192:IiS5h+FeOcvF6hmxESVJ/f6xR3xfFvxQfqmLXqvJp521eVh3A:C5MFeIE5VJ/f6xtxQymLX8j5D3A","tlshash":"7722bf5fa063058d6b47762b9c2dfecd50506383508aa3a762afcb2df1a2f90417f574","first_seen":"2026-09-27T14:50:44.926988Z","last_seen":"2026-09-29T05:02:52.627058Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_135.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.937Z","timestamp":1790658129937,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_135.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"66c4-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qvO29XVwbCNqLiz%2BG1COiL02F%2BDZlaeQ%2BeM8Z3AbQvCdjGwCOTkgweA2EWhy7yanobBf%2FZ1hAtcI353vCfzWheFIXz%2BCYlpjBqbnu8oZ7CVZOn4mUJKYX%2FtLe9t5L8Sl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f201b5356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 26317\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26308,"size_decoded":27073,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3e35a9311b77e98bbece0f6147132298","sha1":"642887c5f59f43ac57be8fb16c69d3d0a6b252ec","sha256":"912cc6679852229033d7afd1a1f5c16b6e827b80ee9ee0fc32cb9dd74ea70b4e","sha512":"6d9b55952acc36c1c439cb9d5d68c3924d77c38c14a2b1140820d9ba26696453659b678449c0dd0082290734e74993cfcb7e3e42515f057dd1aaabf414288eda","ssdeep":"768:/X2DHf2B6m3T7xSv1oEcV0AE4MYgeOvGsjzppgU5r:P2DIfM5N4M4OGOr","tlshash":"ecc2e1f68fea0fe8f1d2abafc801134f349853181aaa7d9c5f645b0c8d9cb9518c7851","first_seen":"2026-09-27T14:50:44.946962Z","last_seen":"2026-09-29T05:02:52.628196Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/723c8905-253d-45b3-a35c-ed933f691ebc.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.018Z","timestamp":1790658130018,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/723c8905-253d-45b3-a35c-ed933f691ebc.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3e5a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BCy%2BR5zI1vHb7Ubd1dQ6um0YuTNBYNJa3Zgkw2SYoNU32yuK4cClvRyIkJhRPpQCcVIionNUjE3y86K13bm2WsjFxv49en3ZY2Sj90%2BYpYxEYyELXyEj9%2FMB2d7Ow3lp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f209b8656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15985\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15962,"size_decoded":16735,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3fa5b64f490cf2c4b927df8040ef4a20","sha1":"f7e534f1aae17d52bca1cec854e8bc408bb759de","sha256":"82baa30d7b53c8a5d6644f40e5e823733db09128d10d70a3325a3d9fe641de97","sha512":"900d993077561893a119c724ceca4308a565bd619ba8da73e2a0e1f91b3106f9b6a3f3e75a242515b5c618b5064487ce05b249644df20a825506cec8c91d664a","ssdeep":"384:k00gItAzT1OurqaVsUz2bw+Xc8YeSwLZXh6K4ow0n:MgItAzT4cqaVs22c0hY1wLZXh6xH0n","tlshash":"4362d0b413907fdcd8ab0e83a84842edf6694c099b61a4741e607cd939437e8a753ade","first_seen":"2026-09-27T14:50:44.825991Z","last_seen":"2026-09-29T05:02:52.623867Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/9804369e-089a-4ad4-80ab-5a70ff697fe3.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.060Z","timestamp":1790658130060,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/9804369e-089a-4ad4-80ab-5a70ff697fe3.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1fe0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mou4%2Fxe4qo1CQ0HU5d2ifXmGjTDbeV1JhxVOyLlTVnRsBVykAogXk8huGIi0C90UpUjKuNXmmX6xmF0ZqYqgMTAV%2FRNF84XRVnTe1ieOOfDS0sDvWrMPnFnYNm2WJGz8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20eb9956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8183\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8160,"size_decoded":8930,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ebdadd2707fb25c8909233ae62479f5b","sha1":"d9ba74d5156473575f97b603e3d85dd44ab6bf6a","sha256":"a0406a3feda5a175ec978f9bb65d55368b3d000c19e75a0f67be30def39270ad","sha512":"3c72ca9a8486481ff83c916a397c077ab38e02dc3cbd303e789fd6ede84b488c683f4a47e5029361959a9fd6e5be0121de14a342c2485186eaacf560ef437165","ssdeep":"192:MF16/GE6QmOkGKRKj39uAibu9eHnkap2DmAXk/tWPswy:MF16v+GIA6uSkFDFaAy","tlshash":"79f1ad088337c240e5dfe9aec1422192921fcbc95d882bc24d4c7ad3f9c49c6171ddaa","first_seen":"2026-09-27T14:50:44.78565Z","last_seen":"2026-09-29T05:02:52.566843Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_52.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.088Z","timestamp":1790658130088,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_52.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1222-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Oif%2B9hLBTpUsLd1QZVNykjNNUs1IxGEzVLLGcMPYUTfe%2FM%2FFXJYr1HkhuAmBWUrGMPAHaAOgXEmCs%2FN0NrO%2BwXG1QWzaM%2FM0VKXoNQpWgBaoVHoC3BBwora99VITCHWn\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f210ba656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4665\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4642,"size_decoded":5420,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"93fd48028da5c48c6da1e038413426ad","sha1":"3d2a947b47a0fec44f7b5d357684876a6840207a","sha256":"f3a258e85aa883283a842e811e18fa818f7db024f53d09c3921b41f2aef28ce5","sha512":"f56b8ffe4483e6d0b1b2a820dbfe2fae425ee71652bfb3bb54ccdd9accb12515681fa034ca82bc4fdd2673b35a7f8b0ee5ede449d4f2dab7164e21330b664b45","ssdeep":"96:xNWe6m8BXfEPfPEc+vP+zA7dn6F1UxvTmtbapCDMD6eDZh4206U6y+0KnVGCI:rYcPYv66dn6FurEa1OGh46UNvKQCI","tlshash":"44a17e99cd5e866bee34127be1014431f539f5b0b751ae07300aa55bd87a452cfa340d","first_seen":"2026-09-27T14:50:44.863203Z","last_seen":"2026-09-29T05:02:52.521937Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_54.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.089Z","timestamp":1790658130089,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_54.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"58e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dk6atwHcZm5vqFzVO4ZLs8in7hHHp900AEP5OP3w%2FzJZ1kNGMpSnvYjJmsK%2Blt5K%2FHupuggR4VDDMIpL9kY7aTQt6ooGMJCPojk7VNPsxVb9vMTydZta1hplm4T2gyjt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f210ba756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1441\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1422,"size_decoded":2189,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c8a5d99a1545e0d1cd8d84f63c412078","sha1":"d5e41828764b3e1151618443b14736b96cd14296","sha256":"a77f57e8370857729281e7ae7882a633a916e6d0ad1db77af4826737c89c6e37","sha512":"028003207c535bfe3372e82ee3247fcee921ea054dd9f411bf9b741b73e3dfc083dabd143969312f5aea8831084b1ef141715f2eafdb79a7aeed7624fe7b2d99","ssdeep":"","tlshash":"3121c62acc7a62869bf299f6050dbf00e62ca413f62f40dde0aeea4515c11891c481ab","first_seen":"2026-09-27T14:50:44.773434Z","last_seen":"2026-09-29T05:02:52.6294Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_83.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.169Z","timestamp":1790658130169,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_83.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"c02-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8maTM%2B8nY6crGXHYmWeCqfjSSd06VBZm33wolU3YvVK3acldE1OvPrJ%2Ftb4ZMwKyZE2qHR54bXANFpaeZnod1g64W0BDq8NWcpfYpLSt9hiPj3Km3LHKpZ8ZDbmuma1r\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f218bcb56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3097\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3074,"size_decoded":3843,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 157x183, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7f7af9ae03f8d6b3fbccac71751502b9","sha1":"2597e751188c912ec22fcf2000c3a1c87d0cedf7","sha256":"2080979288103ad23bd25b4802fdfee24d5088e9f035297cef94952dd9e63fd5","sha512":"3efdfb8ed6701e0ab2f2f9f2340e1bd01b329887f51561a5f715b11ad4783f9ac88f9fa713890d4967f9816f79a124c780df4a80f27bbc03bb789dc39cae2f4e","ssdeep":"","tlshash":"d9517e2f7119f1bce2164e5adbd31262c4a54498776a4d137d55f5610ff013423b611c","first_seen":"2026-09-27T14:50:44.827017Z","last_seen":"2026-09-29T05:02:52.630285Z","times_seen":4,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_105.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.218Z","timestamp":1790658130218,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_105.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"11c6-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nVmKGSK8o34aN5MDtHVIGf%2F%2Bqj8wuerE4lCU58jOyPHxHL8djFe%2BEVuZnVOzoBNMbxA0ydCMDhmsiec0p2iAPW%2BJcwAFDEjv5anaJHSXC8255pb1d%2BF0FaJt4BJkRuWv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21dbe556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4573\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4550,"size_decoded":5326,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ddaabbbaa09e31c7766556b29a45bd9b","sha1":"4323b4d5b1cb318199bca914f4bbf0c4c485e1f0","sha256":"e142e3d6a1f059af106220c6bacaecdfaaea54cb02cf5b593bdb646827c14168","sha512":"8ba8602f6af0cdcc87b34e728f1ace0d284fa923fa3c7dfcdb241c18cb0f4094535fdfaa1485360625ab706e4b265bdcb70d3a64da5ff16f9651f45350ed59bd","ssdeep":"96:LoSF8F4nrWWsmwBigozO32MH4o3/BRLSctNg3cim:LoSlfHw5ozO32novLHtNtN","tlshash":"6d918e5b5b974f76ec769a4c61e179957f50d8c54e25beab304ec0fe0e91005c00e76c","first_seen":"2026-09-27T14:50:44.818284Z","last_seen":"2026-09-29T05:02:52.631584Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_34.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.901Z","timestamp":1790658129901,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_34.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"4ef6-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FevOpkwwKcDirWbStd82lZC2kDIds%2BESBbABTGFjBLKyDTA2dJ81fgOY5P7prD3QDhWLy%2Bb0JpfM9ZqvBkuW99MsHeWUUE0CI2ohwDiofTRip0CK4dNj3W5RBnoh9AH2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1feb3c56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20237\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20214,"size_decoded":20985,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x335, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0e160c61be8301ec3586c300441f3e9d","sha1":"e86231750094fa98ca1d052fa0b3d5372797e19d","sha256":"3a88d5badd43de5f6f6b84ff7e51e336a6a7844d31cb1abd36718999cd66fb6e","sha512":"264e9a31f5418b1590243f7d9fd732813fb624dec0b0897f1104d6b864466548886f7e23686d3b1694b8bd7282664ba006865ed6887756accf45995dafb59679","ssdeep":"384:d6YYIoqrAEBo60BzQGhsyJqqbuYzCcdM809Z9vQbQOamqFYvxRiWh8tvPP:8NIdD0zhjE++L5itamBSW+tvPP","tlshash":"6992e18e05d63f84432244297c1a7ff9063eea0c2e5411b29a5c5d3ab7df18f26a5637","first_seen":"2026-09-27T14:50:44.893652Z","last_seen":"2026-09-29T05:02:52.632426Z","times_seen":4,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_127.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.911Z","timestamp":1790658129911,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_127.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"9376-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7rMAjJy3uM%2F3xMzfd9oR9V%2BxomvkeApJuiydp40PAC9XO%2BbNDpKchVXZcWwxmT1rTXA1ul663LFWvcFdtCUxq4ZFuDSQx2ZEjU6Qw47qfcWoABij9hvaFGPO%2BjLI92mJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1ffb4456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 37778\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37750,"size_decoded":38530,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8d6189100581d454b28575d3d096e0d0","sha1":"cc81a1f36ffc2ca818ed795a6212e229af201228","sha256":"288b26ef5e2fea32e23ee78a2ea581c18e121655902cbd92680bc6e2970fc7cd","sha512":"f9445e4568def124546d58beda3e5c597d09f981cd930f52bd95d382a2d5f1b9515ce8a0472ce35dfce269fbe29a75f38eb1c9ccc74896c69f4c09f32c02352d","ssdeep":"768:EHovgjxQXOX10HfC1ZzJZySPXYXqW+5TBsZPc/NVG6IfXfDPuBv8rY:EHjj6G10HfCjzJZTvYx+5T6ZPcFUjLuX","tlshash":"cd03f2574c2c38ca865a5973737e4994be7111da8e1be998d0d6cc3cc3eac18a3a9139","first_seen":"2026-09-27T14:50:44.958541Z","last_seen":"2026-09-29T05:02:52.633366Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/pmarca.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.955Z","timestamp":1790658129955,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/pmarca.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"f6b-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mAchfPjJdIkGG75JTjzsn4GUev54oms%2Fhi3Yvwe4LfYTVggvH2EkB9uWJ%2FBrGYLiFWd4WsGUxc2aB18x%2FkoBS9HLwuZ9t1XLxm3MDV4DLGLUSCzRFZIdxTupTKrDbme7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f203b5c56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3947\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3947,"size_decoded":4643,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"a9acb1071855ed61221ade9632a40f72","sha1":"5104ad3b9d554e7df300a6a85eae1f9f1dc19226","sha256":"a4bc7f43e5127119c7b7bee029e921b1c14810f4065fd5bebdc6e87cf21685db","sha512":"2291dd10337c710460f48e0214f6dc273c691b094a099c1c899a50a342c000f6609b11a7ab7b352bc0ef7ca77dd6f7d7a88ac6880ba631352429b6f92ab3cace","ssdeep":"","tlshash":"1e817cfa056144e6d8d847fbdb0e3bab710da09b786ef06b1b2686c26e394c4011503c","first_seen":"2026-09-22T20:45:26.236884Z","last_seen":"2026-09-29T05:02:52.634219Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/2b99d43e-0dbe-4a92-b87a-4296941612c5.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.003Z","timestamp":1790658130003,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/2b99d43e-0dbe-4a92-b87a-4296941612c5.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2310-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B%2B1Qyd4bz5slx4HwFOLBlNAPvaPLBQNP7qAVHvzWoIObqJMOwwggcuiOyi662J%2B4LWXJfxvEs7qmrdbgGt%2F6tg0EL1UOfAOYcCr84iZqo2bcV26TcTI8hqzlTI9%2B1Qh5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f208b7b56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8999\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8976,"size_decoded":9750,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"35f7d283136a655b4e916a5c2f81339c","sha1":"a515848ffb4eb03950c6f27f3c97ad0a4551c53d","sha256":"a3c4d5e8c96656cd16fd35db61b30094f322663074f3244e71fddacc070cf394","sha512":"e33de35b4e43660b9fb47349144610aa4aecc2cc69356598e0c352416b94d3868d1538d494bbb8a7f4e53fca8ef1a24d3fccac84a54bd156470c2df01bab7df0","ssdeep":"192:sUdSbdiAJnCu8gwbkGCcbeHPgysxHYcUMx76LBX6wqidOc+YqrLLI9A:KRfJnx8g2CyeHPzEHcLBKwqidOcGL4A","tlshash":"0702ae079532bc6df178210aaaa37414688818d5d0a6047f6a3c348638fcb87e27d8dd","first_seen":"2026-09-27T14:50:44.855852Z","last_seen":"2026-09-29T05:02:52.634731Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/54617b52-e030-4e7f-abd5-9cfa40bc41ec.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.014Z","timestamp":1790658130014,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/54617b52-e030-4e7f-abd5-9cfa40bc41ec.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"11f0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2%2BC%2BAULCYw%2B41xVHcWpVixzfARmCs%2BlvZISpmwdrdIAwiZvobQciWKrjhxoASHxrDCf65j5UGZq2jIjXTFw%2BtBLkE9Ji%2FMg0vPFRCstT1SjW15VEJ73AqFzmB3KF1fy0\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f209b8356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4615\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4592,"size_decoded":5370,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 188x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"830ba7e10cec99f36c488c692e430eb8","sha1":"b7dd7717f6985767f205d7a3f54950971d7861fe","sha256":"17e8afb9de443012abb5a078b8e9c9f341bbc133b7149245da87e8d8161b619b","sha512":"25eb28e7cef9a8ca608eefa348ccefccf8f79333d58c3464a4296b7acb131dbde1f22dce0a8573fb04003256e24d2bcb3778983f695b7a2db062535e4abd22b4","ssdeep":"96:52qtxi0Kh1bmrP1va3dqiOl5U+/5okAkERHIagurBeitloUHhC2iYydcbjgkbiON:BtxXKhYrdMOgxDkiXgurBeitltBNyMbL","tlshash":"62918de07924cc88b6be2daed48e9f4359e743169f209a96e0fdd01e306c8060c1cb47","first_seen":"2026-09-27T14:50:44.944787Z","last_seen":"2026-09-29T05:02:52.635592Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_53.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.085Z","timestamp":1790658130085,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_53.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"eb8-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kA6iB%2FVedCbB9Ap8VJbWBR39hqXunpxVD5VeYOAdZi1m9HCqrFJYld4KeTuC%2FA4WoE9xDom0YVi7iNa231BaL7aurqJujey1avNfgWVyXuC%2FGHjrPkQZZqPptNQ%2B%2B5%2Fx\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f210ba556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3791\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3768,"size_decoded":4545,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d76b17f2b7c7dc8dfe9487cbd259c93e","sha1":"ca132a7a27e3cbc4355f645db25cb0a4cbddeb34","sha256":"78f5e0068f8ac940e3dcde4a4a988561caf04fbcb167403b9b83b3c0799e95e3","sha512":"79934f11cf1130e70562d722426cc0944824f02c0e536be6509d2c2d60e0d6c2dc9c1239a9773fe8b1c2d2097ef369d4befe0c4ffb0c407c4d7a2b40d2b21d65","ssdeep":"","tlshash":"15715c8b9533f380d7a38e303e8e1afd0ad0ef81f8bd62291ae51154db605d14b9a4dc","first_seen":"2026-09-27T14:50:44.925665Z","last_seen":"2026-09-29T05:02:52.636379Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_57.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.098Z","timestamp":1790658130098,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_57.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"4d6-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7zs%2B98n0KVWy5cevjVBmhJKjxlw0HCSI3FjPeIvEsOmnFGhzIK2NWFK%2FrxRuFNWqavJ5ZjiPFgaFSzKyugaIM0Ixd62vqNsB3h%2B4QecqKAuY08iI4ew8%2Bp1lX7Athttm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f211bab56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1261\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1238,"size_decoded":2011,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"439327e4ead70b0d2dd70537912a9231","sha1":"3856bdd6222a0661dbe665209f1afdd6381c0d96","sha256":"ec342199f7d95d7e4b7fe97ea5550d23dd5be9141476d6fa52b996c189a1215d","sha512":"b379f0fb9ada06d463cfcb6b9545c293fd061b1f7870cc656621a3bbd65570956bc7eb5c7ca006cd7aa3db5d47f990709ebd672e221db46a4d3e550093d61baa","ssdeep":"","tlshash":"5921b7f81396679dc2c667a61571448621580e3d13b6d325991b15d2a0381030f07df5","first_seen":"2026-09-27T14:50:44.817128Z","last_seen":"2026-09-29T05:02:52.637201Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_64.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.111Z","timestamp":1790658130111,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_64.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"135e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=69pFt%2BeoLyxtDMZvqSg9jsO%2Fvpf5nwow1tuB7ekxRyJW2fx5tMvKugsccBUQ5%2FvBxNT19Uu5sA05R1M%2B336D7kDHuaxKGae%2FbqizHtvdqAJINY8GRrUIK5J%2BEmZdXjsY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f213bb256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4981\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4958,"size_decoded":5736,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"29ff965138bd2990b43a20ab6de7657e","sha1":"ed9eead3e4084e1aa78802b0d736b0ebf631e942","sha256":"c063f7f07a163d3f471be65607cb2ea1f023b05b0d64393047fedc5b98ab8421","sha512":"3fc947c629cd5086137a386049308ff6f0608f57fe178a14e1f73bd822cffda059c72b682d5ddcbb2945a762033a83223ec3f02cd94332fa319d2e8b41536d99","ssdeep":"96:jA9KkP9Ekv27t5zZt/OTreAH0jUbylgz1m/mj9+xMjqc4g/:QFuZt/OTreAnzMuE+jF","tlshash":"1ba17e56e7fcf35eda78ed99caca0c083551b329a211993291f0f9048467b8523cc9bb","first_seen":"2026-09-27T14:50:44.966175Z","last_seen":"2026-09-29T05:02:52.638169Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_33.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.903Z","timestamp":1790658129903,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_33.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3908-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Sjbkf9j441py3V36LktPRPZTQnEbBzY0IMP2AN%2BDe%2BcsUznWiqxSOGQrhJ9pQN%2FZMl37qEGOt%2FDPmlK7k9X7DRBxH6bXGyg7ABzZlFTq4ck%2F%2Bo5J3bDn3kC3Bfij8d3%2B\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1feb3e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 14623\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14600,"size_decoded":15381,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4f07ce1b080fa0890239e31d58dd4eff","sha1":"e325c6deb16f0e9a62cc6f361e992153c1ec0b9e","sha256":"efbbf7ec98b866e743dd6d44fb5b3922e8cf7b5ee981bf2107e217cc3ed4971f","sha512":"bf6d270c5b3c28b59538b6429ad41a3fb1431525557fd07d336375a85cf2f57db5b85a4a748f52ae4e4e424e8077a54e9717cf1149304d8dc91d537d9e915d71","ssdeep":"384:IXm9mJBKTsYItGiqJnOmUzhgT5GiY42cN2fZ0:NzyA35VflYi","tlshash":"4d62c06c093a00302d997dbb45dae4df11319933d80cd2f60c2a1d58a2b146a57f9ea8","first_seen":"2026-09-27T14:50:44.936111Z","last_seen":"2026-09-29T05:02:52.639166Z","times_seen":4,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_67.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.121Z","timestamp":1790658130121,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_67.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"181e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AIExhPBvs6oM2qXJmV%2F4bS5cQwZrhTc4FkQaWd14GMvpiXI1b3Zi%2FZ8wJtLwbT4Z7YP4Hagf2xmYg54sGmiaZatbHt5cEdWQ8mOfwxiIZHTt6Rq0XT0QO7t1cSlqXUTi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f214bb656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6197\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6174,"size_decoded":6944,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"92b35744a660e4f75e1e28842a234e7b","sha1":"fa8a42212d0a4d8fa3f4d887560b2740874344b5","sha256":"c0c339516dde73549b218d3199225a3889133958c9fd4caecfc1718070f802e5","sha512":"af3f5af69e7d0fd4d894d24a9ac8606bf11c2cfd0eab1d9047393c4464d89a13ab36cd8cd1f947969f5b5048bce55db6e2a167dce61c1f2f4a81c9ddf5c1585c","ssdeep":"96:Yd9NWrj5VmetiHuWtF+IIg68TI4vB0bU57zNJwefW8EmWu8V3xRrr9PLW9t2ERzw:qXQPi1tc7aTPBRRSefR3Wu8Vn3hLWNzw","tlshash":"bcd18e118ecd612d45f8f470a70c2c4bd5df5839b76b6ae32665a8383a225437c0d5ee","first_seen":"2026-09-27T14:50:44.967231Z","last_seen":"2026-09-29T05:02:52.640056Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_75.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.150Z","timestamp":1790658130150,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_75.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"155e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O0BDDGx6lKhl97sK%2FpEA8ke297lbcae3sWUyslgkHsBOpFFt7yQgl0mWAiE7gjUZLgpy4l55rc0uxFKSqCu8ZmOHmX9jeUl56plTmSlP%2FdD4jbTaLEpa0wpV5Nks85RY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f217bc256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5493\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5470,"size_decoded":6240,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x144, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"146dc9db8ac7e96dfb98c77bc0cc3c42","sha1":"7f25f5d3c2d32b23b11161a5a49833829873335f","sha256":"a8d837dbb7a0549eb2a018b095f64cb5aa9b074e2512352a0a4c09cbe7b7a25a","sha512":"c7a6fa79509983c5c77e356c27c5f582f93d2fa6dc3584c0366424e6e3c7c4045daf1d9f82495e514cceda865d247893a15d8623d27e54f38f22782ca3d14bd6","ssdeep":"96:XKra1wkgSJCothqR0nfEWAUlYp0u3Wzl4I2ylEOLofZLm2n2c8PHj4:XAahCzKfEmlYz3Wzl1CtLmMl8PHM","tlshash":"e8b1bffdf889cda48e46c5c4247b0c0b7c15fcbfe456615cda04ee965908026a8f346d","first_seen":"2026-09-27T14:50:44.902208Z","last_seen":"2026-09-29T05:02:52.640606Z","times_seen":4,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_113.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.228Z","timestamp":1790658130228,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_113.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1fde-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FjeqepNPtDrS%2Fyc5LMRANCOLP3%2Fln766yQWx0c0jZ%2BosvF2lSmADxA2vLStdyRMDxbo2%2BkclDlMR9Pchh1KqFKERcV5fzw1mueNrrfWkM7u%2F1cfCD1FP2qH4IRNpDpPx\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21fc0256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8158,"size_decoded":8936,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e6b8d0621caff566017b3f4b4f9bcb8a","sha1":"7b897bd572751c3dc33be121ba3f675b29cce2b6","sha256":"9e4d2e07b1be70f295a57adb18caa64c2b30289fd343a8734be798825298a72c","sha512":"0a4aeaa25da8817a5c08a4cdc257e94b8b0efd0d5286c4a978ee48a92f8c313dae829475487656bb1f84c32b9fb981f8fb695b405f6874bbe68c6ee2a14c3477","ssdeep":"192:hOa9pUHSiUc98JN5id+VXSSzGvqcURt6WcnciDCfUZ9:hL9pUyiUZnA+dSSavqzRt6WccgN9","tlshash":"b8f1b0e54ee07e20947babdb013d173b6c4ba527ba9c197cbd062653a74a23c02d451e","first_seen":"2026-09-27T14:50:44.937147Z","last_seen":"2026-09-29T05:02:52.641515Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/stonkcat.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.284Z","timestamp":1790658130284,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/stonkcat.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"7136-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z2ktcyP5DSosGV4dcBnLjAT6exKd6%2B2qE5as%2BNqL%2B9m1d%2FzO7VZWrLDEl8lOyjM56gEbOGlfEQmud88YyTo9XSktUeAR6YK%2F90brTAQPDCgxcHcSLb5ZG3afiGSi%2FgTc\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f224c1656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 28982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28982,"size_decoded":29686,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"b63f84f3c7e132bcf30dc25a7e3fce3d","sha1":"fd88f6c3097778f040629af82dfdb4da8db93bea","sha256":"9252295d01a4696e54204c7fa8557b064e60deb10e0ffc7635bc9bc84f8b2ab6","sha512":"15e5b43ac53d13a40de085ccb0e8aa175dc51c94c8f69f14f585a09654ea16bfb7ecd14a6b626bb7929f346a6423d6d9e491ba1e0c8b880881d6f8a297bdc30a","ssdeep":"384:SSRAfSCDK8bx/gyF0gq8/UuCDFk0Pey9KJwgDgcbBf0epXjdUoIMC4hLQkImK/Lb:qvtFF/UFDFcy9K1DgIBf1dUo6P/z43bW","tlshash":"72d2f127ea467b95b46f834987cfbb481da4743b59ba5c8011bb40810d3d0b46ffbad8","first_seen":"2026-09-22T20:45:26.22328Z","last_seen":"2026-09-29T05:02:52.643192Z","times_seen":6,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/chirp_400-s.p.0pvtyi5mcffff.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.609Z","timestamp":1790658130609,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/chirp_400-s.p.0pvtyi5mcffff.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"ae74-65c5af802a980-gzip\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qHHmEhpSkKONOVsdSKPQuZ11TZat7bt0IdjTtOmFA73cmp%2BxU7YTVctuLxDcxqccSa%2FbesDQf0masMQGy%2BibjbFeHREPHbOhgVmnCI1mNNLNogQqcNPTrS4UbZEH2sfJ\"}]}\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f244c2f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44660,"size_decoded":45346,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 44660, version 1.0","md5":"af0fd092a950cd858a160490ae22d16c","sha1":"4291c81c52514932f517529f3d3c24f4a40609ec","sha256":"858b70c0b816c651b12a0849e17c83eae8a76aade2fdf02e98848d5d25868c82","sha512":"64123d00581d6d45c1fe0390911e20fb732a9875eebc667c45ca4f84e5768657bdb1fa9a307c150d6e5644a7e8e5cd274c58f879fe059b8c6e1dc73e2a039b35","ssdeep":"768:hgJ8wY+W8lE34E/C6z3sbYqg0OvVQ8J4WSrQek4cXzrrhDn:NdQlE34E/C6sbTg0yV54drQ2cXz/hDn","tlshash":"e713f1606f916fa8f45417fecb63322e95b2b83228cc036db4351e55794c5c52c8af9b","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-10-12T21:03:47.473206Z","times_seen":4292,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/chirp_500-s.p.1uhf2wlav09eb.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.615Z","timestamp":1790658130615,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/chirp_500-s.p.1uhf2wlav09eb.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"aec8-65c5af802a980-gzip\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gcUWA0ldPMl9U7lCmrkI0wzZWzM50iiz2%2F%2FQFkzrDMlsWZgv0HW1pp1zkCs3puEBQtH3NJKiH2vtyidPLOMawOhYj1zpAYbJO%2F2DcMLEEgZdhNStbxhykD1TjZMjTPc7\"}]}\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f245c3156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44744,"size_decoded":45430,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 44744, version 1.0","md5":"22898c3b88ef29da6a41c302510f28b4","sha1":"f9cc37a5977f1163068a0a73d289ae2431a7fb82","sha256":"29bf369dc4c1b989f933e482f76b961acc5478bf48800547b18d6cc6b9b9dd91","sha512":"f270ed67a28469b36694a7600187a07ab8fa82877d3a52bbb442c6344091e3ed815ffec90238605fadba4685dad0f5ef0fc9145ead8ff38ed21969a4f6a5ef72","ssdeep":"768:dxszm2WHLjjPNDTCw4nY1ljkbpYNdt2gN8BHcVegXUPaMaU+GRquWGvJvaivBHFE:nc+5DTCi1Fkb8dQgN81chXUPaMUGRbv0","tlshash":"c7130101adfb73dee7857b743b860b65f8106646b7d259fc20e365ca05d7a2fb2200a4","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-10-12T21:03:47.488074Z","times_seen":3814,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_9.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.907Z","timestamp":1790658129907,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_9.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2b5e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=otqD%2FR8Sbel5E1aqVQm%2FPFMXY5iA9Zbq6B8vbUmSX71qHccEgOsG%2Bf5vJdmp7hB5el39z8bmyBN5kRgRbBquhH%2BSkRUATGPpkgpBv5KeiHC%2FuYGJ0qLHUWOTiJ%2B0%2F0wB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1feb4156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11125\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11102,"size_decoded":11883,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ac13e631c62d2a31cff65620f4f18f06","sha1":"190560831245c429547b4b7cefd509351df02ade","sha256":"2c4c5ae33ee429b9991206cd6ef097b22b246dead65ca9defe1bcf6a3ba7bcff","sha512":"80b9227748fefba172f78cac62bb8f60f167d3877b710a55a4e4dbca7c3bbddad740bfedbd0aa38ac358a522e3e57f1e4b56b54a913b695f1b8eb8ee920702bf","ssdeep":"192:VI22DNPxV8PuR6ei+LdTZjpLJd9r4MswTFHjYzbS8p/VOSx6hp2syEzTo1Ba:VI22dxgeiSdJd9r4MswTFY1p/sSqp2zo","tlshash":"4d32cf386384a681ea4dc5a67d1876dce14fa3c01a0416aea0dc57f19462d36f9281af","first_seen":"2026-09-27T14:50:44.898953Z","last_seen":"2026-09-29T05:02:52.643886Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_124.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.919Z","timestamp":1790658129919,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_124.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"6816-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UAav873m0Hy8pXR%2BVf5ch%2B2SO8PC0h%2FHehObdtutGSRkMFjgncYP0WMrTe7RpBMUlK1hHkghU7FlK3UEKTDMRaE4uUPfuUvMjrPfi0YZgqjva6RodLM3tHxYJ8dRWtTq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f200b4856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 26669\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26646,"size_decoded":27419,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"131bdc363d94990b300ad43d0d454723","sha1":"33750f600f65f4a82a14bd489df19cb3e7fd58e2","sha256":"382580850602dd09b9faa95bc6efdbd8e17cd28d42a0f40a8c7f8d26afd10ada","sha512":"cd32836a865738eae585d9ae2ac2995fe97db5dbb97612db92f319442f614d70034f894f85a5d2ff5898372f1dc537a457d796e875abfd9e225b9fd3a84e0f8f","ssdeep":"384:vK6wRWpOGiZmHaJZAut/F9QdKmr2s2+D2mEgT39Ooht7tgQ8h8S5DmDOV9qizr:vKF44/MHkZAwA/2wV39OgtWQoDme9Pzr","tlshash":"1ac2e1512c86f50a21251e2bd8bdd05c29af09f2591d2c54fbbfd4f889254eee83dba0","first_seen":"2026-09-27T14:50:44.86801Z","last_seen":"2026-09-29T05:02:52.644885Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/css/vanilla.css","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.984Z","timestamp":1790658129984,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /css/vanilla.css HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Mon, 28 Sep 2026 08:49:21 GMT\r\netag: \"2371-65c87246c4a3b-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/css\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BU4szgp%2FDXMWdE0Wt8qdU0jzuA%2BFZjKQdQTE8XL2Xea0vBNV51kEczScnvkhMu2bAUbsJomjdOUYzTJyjVGbv2Elhhzw10Fe2mHP%2F12qS0WNnqQdfLSb2nunCtFXjfp9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a4286f206b6c56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2197\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9073,"size_decoded":2949,"mime_type":"text/css","magic":"ASCII text","md5":"d80f961a7aa9d41d2189cdd5047ee5ed","sha1":"e757f13471a644084849e2b9d5466a39c15eeee0","sha256":"ebc457ecf50d75ad52699aeede6d69365383801be1cd51818a852150044f4f26","sha512":"b37b8e5fc1685be8545a1945faaf403fc5900ed29c26ef58880f60aaeb6e873971ad1922fe58ab4e9ee583b20d8819751e899e65f3f1bb71076eeb07af69de98","ssdeep":"192:TZZYnHqg72NLXk+bdNgr65cdFHgEYC/70xTUXhdb0hQOAfsNvu:C+OZj","tlshash":"1f122158fb7854187c3fc09475278bc953bc8348ed0aca6cead724985f8d2ae25e3785","first_seen":"2026-09-29T05:00:45.142119Z","last_seen":"2026-09-29T05:02:52.646019Z","times_seen":2,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/3fedca8c-90ae-438e-838d-10be2e13f84c.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.995Z","timestamp":1790658129995,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/3fedca8c-90ae-438e-838d-10be2e13f84c.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"be8-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jYv2PqLQOGi2RMjBFU0WtHD0Ts4%2FkyYmietF0bO2pmJbc2ZEdAHtNb9HbE7hrOR1JSAfPJ9zAcqKuN9zMPDohuS%2Fmkyz6QxE7wX%2BylOfSU%2BlYpXTnxlE2HZseBI1MuLt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f207b7456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3071\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3048,"size_decoded":3821,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bfe1d2c3ff45a105e06e3bc8a06bb53a","sha1":"8c5e7cce64e5c9bb6a08f83883bdc2c159c52c83","sha256":"df3e8b251347482efc98f7c9d370c0429c6146e0e82e2f60ef4d1aeb18a388f8","sha512":"6d8560839a4c8d2337569cf524dd36750671d3db61d23a4f08cf902f4c0957aa483c217bbc69a58d7eeafc71e9728c89811e0edd7826a50657ffc5f3384b896f","ssdeep":"","tlshash":"bd515c25b110d32d995029ed2a6e7bf26b30c084f1b5fc472afbe12099781ccde388d0","first_seen":"2026-09-27T14:50:44.780481Z","last_seen":"2026-09-29T05:02:52.647488Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_26.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.013Z","timestamp":1790658130013,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_26.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"242c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v0VapOtkbQVzG%2FL19qEGif2E5F2sTFUwk3qdKSQu522xklu40%2BBuezJRsK2nAIo8nyezL54n4ceNDeXnuopbZv1MDLxjVAGOW7H7zvkAH7mkFo%2Fb%2BItyt2fboO2It4%2Fw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f209b8256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9283\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9260,"size_decoded":10036,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"08aebb1ecc5e57af2b08b643b1dd59a6","sha1":"51c92040c3e773550df41f62f2d603dc53512e72","sha256":"c66237f5ac5ea3e3a5d80122ef7ba938fa3ca153f2041bf1a714af05c131aa6e","sha512":"62e3cc44c2027c1783b9e96eff79f807f8e9e20b45d482e52cade922d954299e0b261d02df1ae62e88a8c9262410175810dc795adf15f26bbb7bcc31079c2582","ssdeep":"192:qSMj2nWjCu5JpkvmYzq50WCsGiscBR5SgN+KZ0zZY:xCCakvmYzqyjIRxN+I0zZY","tlshash":"0b12bf04d3ef9a8f354b3939c8fd8f91260d71454b765087b6a84aa091b2131d9b33ec","first_seen":"2026-09-27T14:50:44.962797Z","last_seen":"2026-09-29T05:02:52.648299Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_62.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.109Z","timestamp":1790658130109,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_62.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1094-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Flx7QCg72JHqk%2B%2Fl1R9PhZvDWolEStPePgFIvGAlit5kJqsgUZwbDLgj4xKimyZCNpcaHz4GJnY%2FY1synt9VXbkKTAxtJUWB10rwWBHGwZD9%2FYJ6mjvb93xGzNReCDsI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f213bb056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4267\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4244,"size_decoded":5018,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x209, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"de8459b497606f60a79d81bc6e2e3f50","sha1":"86c7ceb3530cea3796ed9b206d7a02f1121d2898","sha256":"1ff22c4c7ad1c34a470a0cde9c651b35bcb823329f9aad4414728f361ea9fce6","sha512":"617cadc96468b966597cb25453e7b1e4d275df1b1b1d3649add08d5c6638ea47646a3e88b6e25dab1144624d0a6cf68b81fdb5cf3fdef033db633ee0daf3a00c","ssdeep":"96:l8VlO+dg9NONuRatUxTiaOQtPqvY5aEjcsedBQBFg:l8VlO+SQNuRamxT0Q+9yIh","tlshash":"63917cdb4b8b141dd5800c4eb26101b2e09dbdbfa6e76b3a2797cc12e45f80f79108a6","first_seen":"2026-09-27T14:50:44.879123Z","last_seen":"2026-09-29T05:02:52.648936Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_111.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.226Z","timestamp":1790658130226,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_111.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"e42-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KszlfGZ7gb62MJODtGe5khAw3hIC1pSg7qqcxggOkFKTEYUySyeO%2FvsuouFPaJmoC2%2Flr54RVCu1VCGusFHBu5MDWOOgOv8kH0UjX54p5i%2BK2qz03R5%2BARszQ83CzO9A\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21ebf456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3673\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3650,"size_decoded":4423,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a8a30d94fd58f45bc6b04c8ef4281f8a","sha1":"78d7d18a9ea9fc28a8bdece3db2b437f7fcb86b6","sha256":"4d690ccf7a1cf92019105f0b3d87ab23c3276bd6dde471f55f86b9261456e19b","sha512":"0b3e27c0a4bf459d112914a396721d251b331e33a6c8741c7d930c04920554bdcc9c548c8b063ba1c3a78c2129f77fbc942725e207102dd568f281da36efff38","ssdeep":"","tlshash":"3e716dd16368624480a59a6f91106146c1cb47a4eec0e361d76f1f00971e7fbae4f653","first_seen":"2026-09-27T14:50:44.796922Z","last_seen":"2026-09-29T05:02:52.650113Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_112.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.227Z","timestamp":1790658130227,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_112.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"405e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hIOHqbo5koYF2aFSTgyL4ZfcIU6ITDJbsM4JiiBFJwhIjl3JSLARcCvVdAM1Mi09xqvTfdBMjwoSGBS3032eMaNsRkY8o4FyMlvQkBunL6N8S4Eo%2Bf7jqLfV4CvCfzoA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21ebf956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 16501\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16478,"size_decoded":17247,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x233, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"60a198e79f27225d52d99c36187a8e9b","sha1":"f34fccba03297851b0c9fd212f5e37f0ee3a869e","sha256":"c825830ae3c9d5bc6e8f4a4f8319f0d2ca6ed06d533bb97656b39c8d2ec38f07","sha512":"cab1fc4adf7e9bcceda816d4c6c561d18eb12591b495d86af3828520cd500f49e6230f7db8438b3a2046413d21d7897fd07fd9874415c047d5f4808faa1fd4f4","ssdeep":"384:J0A5K5Ox+CxselhiMOuyN1fvFlD+0+AjgLjK3DOQNzmUZg8B:mQEOYSsiiJuMvFlD+07cLqOQJmogE","tlshash":"e372d08deb118fd72189ce6d364d297cc3529f0bc4e4cd26113e29cb693a0987163d26","first_seen":"2026-09-27T14:50:44.91233Z","last_seen":"2026-09-29T05:02:52.651005Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_31.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.895Z","timestamp":1790658129895,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_31.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"43f0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d2SmpKAvZF%2BZ1dWcWC1WubpjeGtxVbbYbqqwsTFbq5xjMJ7p7ePeYhs1MKgQUBunxZVFNv25sUuX6bIRSqMa%2BkcT9vHk%2FO%2BGHo5VBW93OH3tzUryx2iKbzOqDyV6Qqam\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fdb3656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17415\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17392,"size_decoded":18167,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bc6d65362d09edaaaa46b6a82de6e832","sha1":"d08c052b249143d59467b9d7ec4cd4b20c4ce366","sha256":"43b5d0447430722a16a54750a22e81451fe3be18fba1b731b7de427406dfd782","sha512":"776e4e6a9cef8f25a6a7389b7a1a246f6d2b05f589c074296445384d6a71357c4f67a57ef7f5c1c24e399cb8007d6683a8ba085f8524d7717c21cd1b3cff4081","ssdeep":"384:jbqAf88ts3dCtBAtZs2Xz/uREQVZpsEqRL6OI2Ln/vatskZweVClb5UCmp:j2P45+q2DOVHsLRlnL3atxul9Ubp","tlshash":"fa72d0ccb7c665faa0d1f69b5e670d616ccbd48326355e8b818e3b8b300f961d4b4282","first_seen":"2026-09-27T14:50:44.890481Z","last_seen":"2026-09-29T05:02:52.651607Z","times_seen":4,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/7dd26e4a-1fea-4c86-9c3e-94b0d8b1c2d6.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.002Z","timestamp":1790658130002,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/7dd26e4a-1fea-4c86-9c3e-94b0d8b1c2d6.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"22ac-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Zf1qMX05Vf24riE9PUmHemTqh%2F65%2FzsMujZnT9R9swuHbB8CDvacmyWFviNpxNBb3oPVaS1lJVumKkyxNIALGD%2B9PuS0garUjOsEAS07ZCn48A7EDBuOyo6TlpnYrHrk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f208b7a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8899\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8876,"size_decoded":9648,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"074a019c2f53e500af5c7b8a713f7a60","sha1":"cacfafbe4690715e29e3b7d77a753c94cfbea4c0","sha256":"ff1e576d079d0738e26f9000ef98641575c2b84a9ec0f7b9a33f2adbd730f2ac","sha512":"b54eb9dd9b98896a0c9192a74d500586cd0ba600b9e4a14345e3ca0c0db8e3116da0b36bc01b07fea69baa9c4069b158a693865c24ce6857f931d7f536bf8c93","ssdeep":"192:hK6SwhsBY1CnpKSSsdskpNlkoEM6hXjYzvhpKokXU4w5AID5HJIpCJ:hx+Y1Cn0r8Nl/EfXjYrCo3CID5Hapq","tlshash":"a302aff3b506d21dcb805e06bc5ed541bce12d6be10c5192c5e8e3431799a37197eb8b","first_seen":"2026-09-27T14:50:44.800885Z","last_seen":"2026-09-29T05:02:52.65313Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_30.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.025Z","timestamp":1790658130025,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_30.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"17c0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H1FlGIka%2FSMF0sk0M0L%2FJvexHxBVTA79R3gyqSe%2B0kQHcqOzFG%2FI6ab89FIMjKWtinvI5cEuVwqY6MHGqQPiFdYPCqjugQkdOU2MyoZV%2FL4gre24wL%2Br%2B9ElktiADm4r\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20ab8956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6103\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6080,"size_decoded":6860,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"43e8dc1ef569cf4a61b4a80b0a5c476c","sha1":"7b9d1683488fd9ed473ab4f3c4ab4f0ba31b83dc","sha256":"21cc784fb10a95cb2a115b36b747faa1a3911a121209a6e0cd3cd542c3063f57","sha512":"5da24f141de9802ff430ddcae9d184b37e3c84bf8c248223027d834de16514943d9d487fb6b8759f1bb4d4d65505f009de8d89e14b04e4af3a3b06af72a44e24","ssdeep":"96:S50xSZKGxYAHuaOI3smTaeWrZEFd5rhehwB8ZEmUZpjXD20W1o538GKpEzlWRCOB:S5FY3mTBaW3rQOBIOjnW1vrpslmCUAPM","tlshash":"2ec18e1181763aa8fd504dfcc8a6a5d8032337e759e1d124b0f41ca27ef31d23fa1826","first_seen":"2026-09-27T14:50:44.887062Z","last_seen":"2026-09-29T05:02:52.654464Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/1855015553a9175d946ed33b63aac4b2badd9b106ae2365ad587c64bc703d8d6.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.037Z","timestamp":1790658130037,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/1855015553a9175d946ed33b63aac4b2badd9b106ae2365ad587c64bc703d8d6.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"481e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UXjpLT2fndupdeLocmoOlLVjMgJvlsDNmbN2DbpUiqsDJrQ%2Fi8HKaxs2w7OfRdGozdmU7iWVhITyX6oAPv2Fjx%2BCw7V8zBqqafU8We4OxUsgQGtgfrAxEOZ6jvb8fP4t\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20bb8e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18485\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18462,"size_decoded":19233,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 400x400, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a00829fe76be6b5f1085685d34d635ee","sha1":"7162a27dbf1bb311e8d90ec9e9232c8fa9058831","sha256":"1855015553a9175d946ed33b63aac4b2badd9b106ae2365ad587c64bc703d8d6","sha512":"1fd9d432cbfebf6018ecd923ed3d04105726e724cc2f5cbd50534ad9723a6a1c44031c1b745c51dd5174762eaa45ec9db4574564ff9b5112fa5fe3edd9177ec2","ssdeep":"384:0Jk7w4kxDw5N7lLvGhZjIdxpc5oSynePyknvZtBDA5KZCDJh:0TxDw57LvGhNIZZSWe6+vv3Mr","tlshash":"7382d1d11fa1d112127c3e9bb9db0b92cab549032381bb5b045feaf913bec68e344925","first_seen":"2026-09-27T14:50:44.924659Z","last_seen":"2026-09-29T05:02:52.656401Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/73fc4b82b794217b503533435d13fbe3b9f65dba98e6425cae58da0830cb4791.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.058Z","timestamp":1790658130058,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/73fc4b82b794217b503533435d13fbe3b9f65dba98e6425cae58da0830cb4791.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"8ce2-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yoC6pk4%2Btr%2Ff0KDwf%2FjOg67dyzfHR9Y%2BlJWFZ8HFnUsLM4BcPfSfV63sQ9K6tsLVsUlcWBUdIlj4%2Fz8wwOVB%2F5E%2FXl33VCBOi74CNlq98eIciMOUNnQRq7jjtmYoj8h4\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20db9856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 36094\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36066,"size_decoded":36852,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a9585c72fd78f6061a425eee075c1f95","sha1":"a2ec3a7e03e385af9d599ab12708cb0d88c5339a","sha256":"73fc4b82b794217b503533435d13fbe3b9f65dba98e6425cae58da0830cb4791","sha512":"8a09339ee7f4b9d150907e194a7034ab572361dda6f8c9a08d9ab60033c53d8586bbb0e240e1c8da41b90427607bc0b3e6848bd5504d7685fc4b32b802c407a9","ssdeep":"768:MEkILE0l12KgbqH/prILwJ4chqVqo0+F1OfVQVhcQgA/FnH8Ot25EA4+N0Ab:3g0l12JOdILwTh8G+1dH8425Hb","tlshash":"c0f2f1f02dbfc10c039e1cfa5cc4b6c170edd9328656ba724ea12904a99a596acf8d52","first_seen":"2026-09-27T14:50:44.806249Z","last_seen":"2026-09-29T05:02:52.657275Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_65.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.115Z","timestamp":1790658130115,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_65.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1222-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tblu1tQ484pY7wkrzg6Y0wXJLE5VIsK8rSF23FK3j3o7V%2FjziTLd4CO%2Bz6CY4OVyyqrRYfCKyRJ%2FuyX%2BX0%2FA2oUM5%2FmZMAGj1GV1WwC1HhVwRbLQtvwNJcadpx%2FRJiYS\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f213bb456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4665\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4642,"size_decoded":5422,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"93fd48028da5c48c6da1e038413426ad","sha1":"3d2a947b47a0fec44f7b5d357684876a6840207a","sha256":"f3a258e85aa883283a842e811e18fa818f7db024f53d09c3921b41f2aef28ce5","sha512":"f56b8ffe4483e6d0b1b2a820dbfe2fae425ee71652bfb3bb54ccdd9accb12515681fa034ca82bc4fdd2673b35a7f8b0ee5ede449d4f2dab7164e21330b664b45","ssdeep":"96:xNWe6m8BXfEPfPEc+vP+zA7dn6F1UxvTmtbapCDMD6eDZh4206U6y+0KnVGCI:rYcPYv66dn6FurEa1OGh46UNvKQCI","tlshash":"44a17e99cd5e866bee34127be1014431f539f5b0b751ae07300aa55bd87a452cfa340d","first_seen":"2026-09-27T14:50:44.863203Z","last_seen":"2026-09-29T05:02:52.521937Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_98.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.198Z","timestamp":1790658130198,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_98.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"155e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S31GuZGNYuCml1%2FfuaLGmlLr7NeaPU0KDgMW9uFUau4p3n0y0CBQiZw5JolAMQrhWcfsRK25P%2FlRJZBFcoUJHRffEQOsnMfpuoyazLXVE10aKNlcYq%2BEWQrgSubvPZeL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21bbd856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5493\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5470,"size_decoded":6242,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x144, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"146dc9db8ac7e96dfb98c77bc0cc3c42","sha1":"7f25f5d3c2d32b23b11161a5a49833829873335f","sha256":"a8d837dbb7a0549eb2a018b095f64cb5aa9b074e2512352a0a4c09cbe7b7a25a","sha512":"c7a6fa79509983c5c77e356c27c5f582f93d2fa6dc3584c0366424e6e3c7c4045daf1d9f82495e514cceda865d247893a15d8623d27e54f38f22782ca3d14bd6","ssdeep":"96:XKra1wkgSJCothqR0nfEWAUlYp0u3Wzl4I2ylEOLofZLm2n2c8PHj4:XAahCzKfEmlYz3Wzl1CtLmMl8PHM","tlshash":"e8b1bffdf889cda48e46c5c4247b0c0b7c15fcbfe456615cda04ee965908026a8f346d","first_seen":"2026-09-27T14:50:44.902208Z","last_seen":"2026-09-29T05:02:52.640606Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_95.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.206Z","timestamp":1790658130206,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_95.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2706-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IgrY6xexzt%2FfLEZG67%2BC7uesVQPd9iCCTWOVwyD2RMTzp15yP%2B7t2mXEHxLvpfFQ99f0LHHKm7gDQ8DOWEl8BU4FVOW6WrTk3ISno9Y9wcDLZP3lLgbW1lgXjFVqRckW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21cbdd56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10013\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9990,"size_decoded":10763,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d23635427f5955babd0f1b17b1f19b12","sha1":"dc23b9643f872a43196a2b6602b4c65c130672f1","sha256":"59af488c5d2b80b7043e2642554e61c9cf66994030e0ac2566e4e4a35050af65","sha512":"e326dfa8a5e5226d10f7decadee5cbbfb15692ac6fedffd2a0fb318993a5b0d7a0a4ec9e646469f642a18de8492c7bdac6b9198b829ed5f18cb09b08692428cf","ssdeep":"192:dk6mlAlbo41qNAs4LZgaEm4e+8I5itekRDQfQ358Xw0BDhMn:BmSVoMZ7TcyRaQ354xzMn","tlshash":"1122c05fc503308a5a864dd040a7eb567e759363d3835bc873cbb026a416bbbc5af45c","first_seen":"2026-09-27T14:50:44.791022Z","last_seen":"2026-09-29T05:02:52.658085Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/paulg.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.950Z","timestamp":1790658129950,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/paulg.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"7c8-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v8ob42e%2ByLfg4osFnm2mWLzgXD1wHxNY%2FDkcy%2Bak%2B4YuekioJhijHdZ0DfR%2F25kQxx%2FofbAaFCvm5KT7uKNxtDgnEsojqH1eAOAV82gWZ0IOOFeMtY2lB1t1U7up0J3h\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f203b5956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1992\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1992,"size_decoded":2694,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"ae8294f35c46de00d467c2d112931e6a","sha1":"e6b07323e3370a44f40b4311192be4c7b5be3275","sha256":"27274f68738448c17a2ab2a3273c3a9c6902d42fff641bb1c5d99e63d2723612","sha512":"ac46fdb633234d7a141af4a92f9bd02a40914e913a1a0888e613fea02ace0ee2dc4876300a6a810415c9bfd93ba870fd51884475e48764a58d58c4a5b856dfd6","ssdeep":"","tlshash":"024194892b66d2c8ec68edb5099c33e74807b46a2be5860e494621044bf718acb1192f","first_seen":"2026-09-22T20:45:26.335231Z","last_seen":"2026-09-29T05:02:52.658959Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_47.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.068Z","timestamp":1790658130068,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_47.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"4f0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Cc6NWIBehXPoTN9DwoR41cE%2BA7UfgnSCQzvvr63opdjRgBXYnPIVpl5aW3n3crUre2uDB1%2BvdRBsoxQOQhaCcJcQmjUf4dumoU0U0oijodhUtlPOm0kGaV4oNYARm1lJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20eb9d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1287\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1264,"size_decoded":2033,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"70bcbbd598517cd9125088f299593daf","sha1":"c694dbe0d7f718e37cdb98a88353c6e731c535f1","sha256":"1873dea505963754cad3c741e1d481203d53ef885ed1c3ca7a16e8f3bb8d2a80","sha512":"7feb768090f00a2224e70543e31d2b0189bbae7c6623fa47e93e7eebc03a31aa0b6de4a8900da7c5f0a33e5d4368f1965dd8d65fbb4b69b0433dada4cf87d6ba","ssdeep":"","tlshash":"3a21b74004bf5441fc46ef652951a338b6aaed475f46e19034aedae0874c592741b255","first_seen":"2026-09-27T14:50:44.915737Z","last_seen":"2026-09-29T05:02:52.659898Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_106.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.220Z","timestamp":1790658130220,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_106.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"3038-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c6Vz0N34WCnIclHt4mK4cMfWXP8r%2F%2BjPXnJCXwlJPXpVpr20CG59msnevG%2BwXSlOMb5j4iuSdjDUszcXnHfuX2EI0mJaYPDvLrzJvTveF9T%2B611LdtpgW172Y4Ikenhe\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21ebe756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12367\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12344,"size_decoded":13119,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"67520807c0f54abbe5e81568b90ecc74","sha1":"4b97408f513c1141af50dfba14399da226a1702d","sha256":"77588e501d8058825fc3ea46d383739d2d842629b1864d25667709d31e74670e","sha512":"1efa01d35a6fc63f9a9407464fe9f6b0a25c38dcdf5dd0fee7a077c354f1ffcb62f4b82733b511322ebe53fa9765f594649a49015d86705c5ebd74c281714de0","ssdeep":"384:NeFGoI03hJ9kVl4/VJ3CieGVAxCUvdiwID/9XPxY:AIoI0xJ9kVy/VVsGkCUvdiwK9/W","tlshash":"b842c04e34aced8c6818e50f05b7ef955d0aac622379b03e7df47d9536d228a08bd944","first_seen":"2026-09-27T14:50:44.824123Z","last_seen":"2026-09-29T05:02:52.660752Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_118.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.248Z","timestamp":1790658130248,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_118.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"324a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2LjUI9X4X2Odgv5wY5wQv0Ip%2Fb1ZRQdFgsCL%2FOg17BEAlNpTANTkW4IpuBQesaDnIplctP2Rsmxvs4PcJ16p8l1rZYw7yde0Um9kyfx%2FmlU5vP%2F%2FLl1X31aC19A5Oq0y\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f220c0856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12897\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12874,"size_decoded":13651,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5a647c410293a8dde70c34b4190eabca","sha1":"6c0801fe87ee5c1ea0ab927a59f0297143cce6e6","sha256":"2e94cc8712094e08db00b84b616f116e2fab00faf339076a27e8f2ccff93c366","sha512":"2ad80b20ea279e7fc4fe47971bd90c3a5f1ba631f41acb026bc7fed6810a7b1764501a9067c7a8590e35aadafc494e401b9962771c45f0c1fc726365075edab9","ssdeep":"384:5N/TbIbyDKH7V9+iE899vKY4bXsnXnCRI7X:5N4b8y7V9G8nvd4DcC+r","tlshash":"a842c05e4e32d8c1af4b5202d22d5ac96f295e8b6254eced74d23c52845a0ff3a06a17","first_seen":"2026-09-27T14:50:44.86636Z","last_seen":"2026-09-29T05:02:52.661582Z","times_seen":4,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/paperbag.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.294Z","timestamp":1790658130294,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/paperbag.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"432a-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qNgO7IevVOebluWtLser5orSbtCFuEjN8KGXvMQXj9NRbDJpO2FgFSF%2FMD%2BjAppbxCtbYnYVpvRHxU9Z%2Bq4uYQeCARfC8QTUZS1JIWO6%2FKiDvqoeH3N%2FBrentnU4K9AH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f225c1a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17194\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17194,"size_decoded":17896,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"0d622b2f5219cfdbe3a097b2bc1520f5","sha1":"a9dbd4b4b633dbdc784e21ab7a403cdee62ee3a8","sha256":"67312dae3c70903d848bf21be41eb514c6a05fd73fffce0f4cb24ec9980280c7","sha512":"bcd4eb0bf4a4ed1250635edf3c2117ce59f00f377b82ba15c16eb23a1348b738f3444ef4b52fa28a4f09d2c14be95fbf610ffd4be9ab4ad932ea3ba98327b4f2","ssdeep":"384:RFZtmGIMcE7TVKledIov2bq0dwk50tavFNZCtZr:RFTmQ97T84I9bq0aiyetwZr","tlshash":"7b72d05cbac20238ee62aa77f7f2551231845631eb0e91eeae0b105a1df7c4534a127d","first_seen":"2026-09-22T20:45:26.287605Z","last_seen":"2026-09-29T05:02:52.662454Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/css/3302btyo_i684.css","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.848Z","timestamp":1790658129848,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /css/3302btyo_i684.css HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"22bb3-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/css\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BEZahkPcgBr%2BLaRF9QC7oDQM%2FhlHH6zX%2Bi3Y%2B7pm3BzlTcGikf7eNiJvnxoYziwnD8AtTV5iqRZJC7v3stS06fcATBWtAhrTMPG4t4rfw90yDWrnAOM9MA5fTWUcbh7k\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a4286f1f8b2956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24074\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":142259,"size_decoded":24828,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"0761d8109839d2ac30380a2185004c91","sha1":"e02540a9bcc8b6308c00f709db780319f5ba4e08","sha256":"69d7238c5a798e53a40b89ecf09efa2c99d7abb0699eb84539ae15090f86dfe7","sha512":"c9ce107a8b618c5d5d0b42aefc800e9e87b76121120bb684fdb02d92dc7290fc4d63ee98d00bdd1f43f0c4414a7899cc5ce80020d5dead4101f3e3eba1c31d7c","ssdeep":"3072:0w3qd1+aRLJyi4WYpW+GM4yikaz+6Y68WjT/Uafw/6WjjTKWfdpA7gVxp:0w3qd1+aRLJyi4WYpW+GM4yikaz+6Y6G","tlshash":"59d39114f239d23f7d2365b9d3eca8cc6209b0569e22abfaf554231307c33f5592652a","first_seen":"2026-09-27T14:50:44.881745Z","last_seen":"2026-09-29T05:02:52.6631Z","times_seen":4,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/a1lon9.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.890Z","timestamp":1790658129890,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/a1lon9.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"8601-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=twB1AzNylFYcD0wE40T6FFse5wRhbraDhK2xzn1TtI9DfJ6SveWtFkcXXVS947vsfzE0sVBsuKcP%2FnlYAqo6UH5rI4Lw6uNzBf0VuddeUxWvga3OqMzFEFV4biBftQzw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fdb3356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 34305\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34305,"size_decoded":34999,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"1c99b7dcbcc473aad276d465c955680f","sha1":"d30577379627880a2cc86f5e848f975f3b31ef31","sha256":"c26a3e02639001b81807c19d97289b57d69297e8c0a643b297f5460d7e6ba067","sha512":"3e612b592a766f5948a5be68cc1cc3dae9f980b0951f950be76cf7f28dc4512fd23dd216ab19a8a97cb5165cd808853de7618e1061fd2bcfa2dbe25acb6e76ba","ssdeep":"768:CUFRSvugjfFFnshexfmJ+OUaOdEizzeQenWxXIUlAr9EHbTvL9:CUAueNOhe5Q+Oqdxe/WDA9Gz9","tlshash":"04f2f1baa703dbe1c809a869e0fc8e01f788c6304ec9cb2465735546c6cedb76161379","first_seen":"2026-09-27T14:50:44.822989Z","last_seen":"2026-09-29T05:02:52.6641Z","times_seen":4,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_19.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.909Z","timestamp":1790658129909,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_19.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2034-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UNJ1u4bLAXN%2Ft8jNNAAzygMG2mPhes%2F%2B8kLkHaqO3%2B9cyNJ3%2BqUf3U93pal8nj8sIIORe1M%2BE2OL%2F2g0bIbbH05%2BNN9njUGEaoID%2Fgwd3%2BOAXn4c3%2F6CSLs%2B9tsSzmNg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1ffb4356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8267\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8244,"size_decoded":9034,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b83edc3480c9b23916d05a59fd7b29e3","sha1":"2f81f0b2cd0d51dbe2780efe8df955f67bc0079a","sha256":"3e659c061139f6a8ab4cb810b9676149649ad83d157266ba50da27bba6563546","sha512":"a71f3bc79b86a88faca8977956516c33b1b5ac1558364d987152a3acb90c7309a0881f48af4be45aa3f3e01807b4ed23c6cefcee106f1f50c62c023f942931d1","ssdeep":"192:LmP/4K6Y5c2guj9tQWDuC2NyJlHAlyX00WQVFLqK:GumBSWDT6lWdVFLqK","tlshash":"d802bf3fe5a85d653f97f2069516fcfcb1ebbb0481028f80512aa8a5e495d399083b37","first_seen":"2026-09-27T14:50:44.871421Z","last_seen":"2026-09-29T05:02:52.665073Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_128.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.915Z","timestamp":1790658129915,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_128.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"1cba-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e%2FQvtKs2yCwq6tAPiuxuQVBR6itC2ZAO%2FctWReSZ0inh5Q1MZCeaQn7qlTzECAxX0vZtRvXbo%2FV8Fja37dVCOe48XLuObbeFCv4rhgD6AwjwdQ5pjy7tIDP7PrmXPxiC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1ffb4656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7377\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7354,"size_decoded":8126,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 457x152, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"737b158dde19f981dfe238a38b81ad19","sha1":"aca215de8ded6bc323eb05a76afdd329f1093db4","sha256":"3ab6558fe37ae5438d2944406da37e58922c18b657ac90afc790bca91c18c0ad","sha512":"d8dd2eab2a9bdb8c118695c0d5e8252a1bab27b1584f8f24ae13254d961d04188b7c8ec4460360065edf3b1631efaaf536ec3467f792d278af6e5775f23d5955","ssdeep":"192:WOfDppTDw+MzsgKLyR9sYaYN34KOs2GP1Qxe46BnvpwuL0W0uUZ:17PTDw+MnkaiYhBdUg1WuL0WNUZ","tlshash":"fbe18e45b38c41a036e744111db99b163426bff246c8bd8fc0bb25502733a7a72d79cb","first_seen":"2026-09-27T14:50:44.894735Z","last_seen":"2026-09-29T05:02:52.666057Z","times_seen":4,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_22.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.927Z","timestamp":1790658129927,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_22.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"cfa-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RM34gpJej39J1JCSy7cv%2BX4%2BxHW7Ahc2ZaX3Z%2B%2BCcqx7QUh7ie%2BuDyCCgskqEtkWGy0FxN3KsW48WeAu%2BhoeCteGPmHtIqjp6XxYZYXb9s1hKoHydN%2BbYZw3N4InM%2BjN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f200b4d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3345\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3322,"size_decoded":4103,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4350ee937f87324dd4aeae0f113ea080","sha1":"5fd88206e20cdd666119b8dbb8cbea659c5df354","sha256":"b92438d8339fbd7b5e77587f0cbb33057533040d8c9a37a357851b1da190d6ed","sha512":"6676345ed4e20d849e656b346ec5e41a438678a1be8acf537e10dc9b7c5fcffcde3c7096ff9ac7827ca588fe1e5bbe06f6bfa0af077a9324b35515191908e30b","ssdeep":"","tlshash":"7b615f78ba3ec64ec40e44dd7a285380c0df06c8205cf7b26657bcb509a743e25dadc9","first_seen":"2026-09-27T14:50:44.923626Z","last_seen":"2026-09-29T05:02:52.666977Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_18.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.997Z","timestamp":1790658129997,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_18.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"be8-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9q6o09PXC%2BD3WnY%2B76eqAgq6RfNGm8LF8OzETPEWQ3uSJF1JFryt79VSHRqhXbCkPIAu0V0W4oW6N4ZXg06MNl4hs%2BLUP%2FOK4MZ2sAUuubx9MuVjdcedPUUEEBrT1yCX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f207b7556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3071\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3048,"size_decoded":3821,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bfe1d2c3ff45a105e06e3bc8a06bb53a","sha1":"8c5e7cce64e5c9bb6a08f83883bdc2c159c52c83","sha256":"df3e8b251347482efc98f7c9d370c0429c6146e0e82e2f60ef4d1aeb18a388f8","sha512":"6d8560839a4c8d2337569cf524dd36750671d3db61d23a4f08cf902f4c0957aa483c217bbc69a58d7eeafc71e9728c89811e0edd7826a50657ffc5f3384b896f","ssdeep":"","tlshash":"bd515c25b110d32d995029ed2a6e7bf26b30c084f1b5fc472afbe12099781ccde388d0","first_seen":"2026-09-27T14:50:44.780481Z","last_seen":"2026-09-29T05:02:52.647488Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_48.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.070Z","timestamp":1790658130070,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_48.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2098-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yyKMZsq%2BZ4ZNmdDaloAESmzOZNtH1qHzeyvBAgGMYTbN9L1Ux6pREbqf7DMtwEYExse%2F3c9kL3ALPju0r8aMOmxjsPA%2FPwkAxuqP6wjKRUCgT269PUB5DxreiJHWdlZv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20fb9e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8367\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8344,"size_decoded":9116,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d621c102dffd7d00cf652d0924e08349","sha1":"1b5a927d5bc577d4e8b9ca279c96a0f8c3a344a7","sha256":"1309db32963754a44d19c454b6a0489c53f402c412e03cbc9168abda8d42166d","sha512":"fc332bd9fb1ec0af0b24da69a929481230de4983321ee1af71ee17409dbeeeaba47ffab5d79a44ffad518bb28cb140c6801fb3af663d80558a51f93d9383fcb4","ssdeep":"192:csC/kLrxoOdPwKvkNUZyxZQ6aMvpUr0laPY7nt1ZQb8XP+8JEfGg:p1okPw1NU8gUpUwlaPY7t1ZQYXP+gE+g","tlshash":"d002be2c0ca3121be5cc84e50276730b8d91cf5bb8a6d61c108d8f9dc8e61cdf2aa864","first_seen":"2026-09-27T14:50:44.964052Z","last_seen":"2026-09-29T05:02:52.667926Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/2b3cbc87-8e1a-4b3b-b95d-4a2d1d51f70c.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.202Z","timestamp":1790658130202,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/2b3cbc87-8e1a-4b3b-b95d-4a2d1d51f70c.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"224c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z%2B%2Bg8lq8FLHLGDsSBfS1K%2BlRk4AVG4TPwig1ZtJPBQqXa0JDcY6MRET%2BMMDiVc3jGIvzB3dzrJpMtJnlzPHc5btN%2FZTmWbxYA%2BxNqiKF1OBAvHm1JwhwAScPHiQs2QBe\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21cbdb56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8803\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8780,"size_decoded":9558,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"377d29c34026723e376211ac76b8275a","sha1":"0d3affa36205f2c7547a13c5be50c03834e6a9ce","sha256":"4af2e62594bcd8b6449d1ecae39c1faf80482e1a12158a7769731ac6ff7ea610","sha512":"b75705db2f522157b42298934b98da416192de8efc772e4e7051ccde0c8c7e00130a8f1553a7e7e09e2b5ff0596d9c48345ffc063f5394bdda02921cbf7d3d61","ssdeep":"192:t0zpwrz/dAd1dv06K5DBoszaPfRDgZ+rOL+ObLB3:t0tgSFv066Bo5AaLOh3","tlshash":"0902907c176c3041154c983583b6338ef6e58304ae2b77f9a7806985bd6e8396f97e41","first_seen":"2026-09-27T14:50:44.862164Z","last_seen":"2026-09-29T05:02:52.668846Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_1.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.967Z","timestamp":1790658129967,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_1.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"164e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WbpwQM17ufza857GtECN2IqpBxWJoTd9bgQHK5kui%2Bo5JE8n1BGF936tDaxSdwO%2FmXJ4V6E0DGs0zKsk29f541wISd2BzVYuBOwyEPtVzmAtZ5O1wmXo6l4BDSpxFXdU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f204b6456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5733\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5710,"size_decoded":6480,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 236x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"15877aa2e3fc1c06ff6396acea342780","sha1":"8b3daadd3e41487128114fed044dcf71c84ff442","sha256":"cdd7352322d27cd66e3a2e9a4aca3c63e8588f85e57b256a7c44a302f1787f1e","sha512":"36fec0a756ea4c2e699e1e24776a5c9666d32c40c9dfb73ab953cde584418baa7bb0c7cb4d4750eb28c55f5b5120153a37cca6cf5e01b69628b1601973bdab4e","ssdeep":"96:bowD0VbCrslxG9BcZhUUC/AzLxOAmGK83wDYw/ddJbixqEVvSCOY9gh1+Zx8JAx1:ND0RWcvLCI83Gpab9+hVvrIh4WOx1","tlshash":"d1c19e89376fea25ace05b28c5582544543efe9141eba21e1db36480a3637417a1fff3","first_seen":"2026-09-27T14:50:44.786986Z","last_seen":"2026-09-29T05:02:52.669913Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_3.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.970Z","timestamp":1790658129970,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_3.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"38f2-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8SgXepuRlWT9APgeP3fzbQc4ejP8YQpbGWdM7qZ%2BMNYj1tKOJUqAsgemkQtYi7f2%2Bua6YxSAMujsIwCfXoNyTG0ul8XU6bcDzl7FC61D7KJ4o0%2B%2FycXYEkctS%2BeMz%2FS8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f205b6656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 14601\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14578,"size_decoded":15357,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2285a3786e7a4e70672edfc79e8461b5","sha1":"cddf5610ce463c11ab5ea40bf9c8b49c9dfba6a6","sha256":"5603f225a1969c89f19ed161a55e5aecdff86a7155212a25d9e3ca7264627cc5","sha512":"925a39e6ea557259227ec8610ffac307e82b6af91ab0b1b1d8d651962798c30cc7e7ae646eb1eea7f7ea23d515b27fd07316ce2a2a15abca6153b6a9be728688","ssdeep":"192:dHt8vaLJTSrP1hWFqo6Yg86BHLI0Motw9b/InWpHVCBd0Uh4oDJs6kYQMwOSt9Md:dHtZSDe7XgHLpMfJHVoz4oDJRAnEjyO","tlshash":"3d62b0c9ada3013a0f1e719d67f99f337c94a51cb09a66077eaee2c902db21f5421161","first_seen":"2026-09-27T14:50:44.78299Z","last_seen":"2026-09-29T05:02:52.670978Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_88.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.188Z","timestamp":1790658130188,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_88.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"23ce-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FlZVEfgIjysoOsl1SSYLOZgabw12q4Qn2u%2FqbjSQIGjBKOdC4ZQHla4DSfNn%2F7t6mPwztVhdHwOsvWnQ3dt9pIeXonerO2gyyZZJWfZohHiBoXJEIzSvNMXQkjAbBDoT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21abd156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9189\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9166,"size_decoded":9936,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1d4bc115b0cc42e8f9dd76db2f59a84d","sha1":"bc15906da9acfd930e48e876f5357762efbcc38f","sha256":"11b01413a55e6083122212196153f090956622e1dad93ad9909b663df3fe068a","sha512":"d4509e35890d117214ee611633cbc04f489c489066c1ae73d5919232a50bf9131acfc53bec187db6431ddcaf5374f3a4251690215ef44643302401d6bb929746","ssdeep":"192:3TLCwn2Xvk3wF5+bhelEz7DqR7XNe952B1K2jzbtqUUzUrN7MNp9nwZ72J5:Sw2Xv5+z7DqR7U5k1KQt0OdYxI85","tlshash":"3f129e770b6c56edc7a2d89059e9084acb7e53a0f66209f40cb2250df13d5c7ef25552","first_seen":"2026-09-27T14:50:44.961641Z","last_seen":"2026-09-29T05:02:52.671655Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_89.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.189Z","timestamp":1790658130189,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_89.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"320-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d2Qw5aHYNlqjNQvIWQhystoihH3Mcg1q8LpDBelRH61%2FNk7LrXAQQ8ga6IGQzZcQVWrfwTgrWISNI79Gnsy2KOG%2Brh5DugLLgomQhbKwie1J3mAfJhWKQa3%2BaAla1yoD\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21bbd256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 823\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":800,"size_decoded":1570,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 48x48, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4b534b53a103318ad0cc963161aee41c","sha1":"938ae8d7f223952e05b38914d577bec0e964baab","sha256":"2ec92845c056fd3b227d8f765a14d89d33b2c8fa79b45c1aea0dc39408ced480","sha512":"97a702e78feadbab139898b9886b1d1fec71a8bfdcccf50f16be7b92027a31f982b10bbed1e89ca58767133a1c911a4e7dc6d8e44281c5bda2ccfb4d3b44df3c","ssdeep":"","tlshash":"7301ca5e45762003dd5a14e7bd053c48212814000c8fd61ca7ffa301134f31c66b5ebc","first_seen":"2026-09-27T14:50:44.905707Z","last_seen":"2026-09-29T05:02:52.67279Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/sama.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.291Z","timestamp":1790658130291,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/sama.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"ad8-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FQdw9vtGYuPcpEG1zeReRlyHquNlZ1tp0288HLorcm0fbYqi6%2FqUMsspwyH%2FxIAN33gOsumyUkhJ5J9z%2BT6aqsCCOqNwUfoV%2Bc9B%2BaWO%2FTmJaHDxP43cSLJp8b%2BvBWl8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f225c1956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2776\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2776,"size_decoded":3480,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"7211b27340ef99316518e0c5026ca822","sha1":"e692c8d9354d709703a4a60cece5e9ebea6c2373","sha256":"39bfa4d6c658943ae0875321d2b195968b7dc8c512ca9a34955a7b810bc10249","sha512":"e41c4319cfcb1e4af2b65b4e0fe40db0b715039d5745d56d31de12a81bdf99f662469327776562d50efe1cd6726b01ed5cdac5295f336bc610ec6c0a40c48eb4","ssdeep":"","tlshash":"c7515ed33e078144fc167b7af795ff0bb157158f9195478a0f68e09301692c62b26b84","first_seen":"2026-09-22T20:45:26.358732Z","last_seen":"2026-09-29T05:02:52.673951Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_4.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.897Z","timestamp":1790658129897,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_4.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"132e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HhfsAf%2B749rbd02q%2BDhbtCC8%2FyDWWl0FweAUH4lPgO20kfE%2BKcZBb1erRl8aTgb6ztC3IQsoCVIlH9FkEr4WqNTUVQJw%2F9Utn3muHGUyjobDMjj2BDIaXR%2B1ffEPFvC2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fdb3956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4933\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4910,"size_decoded":5688,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d745fad5d4c30b9211121428af3f236a","sha1":"29fb7bd8366592d46ac90bb3abf186c9ee946004","sha256":"13b1d15b55692a50f3355ce1facfcee20d05874cc541d5412cd49b21fabd2d07","sha512":"7447a3699158daaf5d8e81e806849aaf1f5dce9efd6bbfc70126a74b43c28f23e243d1ad2686059e8c91448e972ecee1f166ba1cddcd5a527e4fc038dc00ed80","ssdeep":"96:LJ5QEF1uyCC5OMWU0VJwDyHM6u8SilMSgoM5RLuhQpNig3/kC:LJH1P7OwMvuVH1RL4QHig38C","tlshash":"9aa18e91ff27f11d9f400c78d70ab344443a905ab52a330e869bb6ba497b81fe7a3805","first_seen":"2026-09-27T14:50:44.845032Z","last_seen":"2026-09-29T05:02:52.67466Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_99.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.208Z","timestamp":1790658130208,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_99.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1f6a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a3qiDYkum%2F7uH%2BtMRHhGJHLVSV55duwUVB4xJTCw3WY3dlZSVGcmU85gdlKh6yaSAWyJd47XMyHfkcnDeyRkaOV%2BlpF1B79qlH%2Fz3fnchiLNzAeEWHICCGlbDuevhSBF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21cbdf56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8065\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8042,"size_decoded":8816,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bba92613ca2ebae05b92cacd4e1f1755","sha1":"a2700635c10c2c32847de1ab1efcc73f6374f3d0","sha256":"d0fa6c6638f338126aaae6c9c2620a9110ca95e6872aaaa4985c7f46dd3926aa","sha512":"bb549b6db2c3b89c391c7b0ce69a2d13c9c0b079afadcd6f965e8ea946570f5f316f1a8cd7ce316bc11782851fe24add6d89f39d4dce64883887b340c543abc6","ssdeep":"192:QEzm5Zu3DdeF5Y0jlvB3rOEdSaIwlvhrAEnb:QEzCZgzEbqE0OlvVAY","tlshash":"3ff1ae0e8b4049b6e1b4d911dab6f7aa5ef31a1acef44e6b3f04b05404060afc7203dd","first_seen":"2026-09-27T14:50:44.921856Z","last_seen":"2026-09-29T05:02:52.675579Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/universal_sans_display_400-s.p.0wwhol2x4qvj6.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.606Z","timestamp":1790658130606,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/universal_sans_display_400-s.p.0wwhol2x4qvj6.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"9294-65c5af802a980-gzip\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BZGyTi%2BxzFJPCED2Lt%2Fu%2BTzqmUuqzVYFHvcI%2FeKpJ1NHpvEfVX09UjZaCJVra7xCT6NdXwkgjYiEXTW%2FOchIs8HfalRtfJG6D3J5Ly6pI59FEQRcHA3qXFko2%2F8tkAtL\"}]}\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f244c2c56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37524,"size_decoded":38216,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37524, version 2.458","md5":"eaba7d09ddfc5df7cfb61f04a28e1811","sha1":"5bf96dac5b0b9d045b433208cd66072ec16e9507","sha256":"93094d338937c45b1d85ee9ddb6311f0a246c8d46d2eb5c5a51205b9e2d416fb","sha512":"eadb6cd1646710fccc5a67e7d6a05b78320a122f51f85148af962b65216069bf223ea1a43280398f8c60b48794b37748185626374adc8f1e76f40882b463d255","ssdeep":"768:2ox5aiVuOgxisg+qAIZTCQH2PtTfhmw4IYE1s4ULDXPBB+:26MiVtZyIZT+PxZmwVYUs4UXXJ0","tlshash":"a5f2f1908e53e9fbc7c91378a9375839f59269f901cb0d1a81675b0d7c19388d11ea3e","first_seen":"2025-06-06T16:36:33.159265Z","last_seen":"2026-10-07T21:37:13.223385Z","times_seen":68,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/chirp_700.p.2ipqzzc7oyrxx.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.608Z","timestamp":1790658130608,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/chirp_700.p.2ipqzzc7oyrxx.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"afd8-65c5af802a980-gzip\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1wT7gH6JNEnGQYOyUDlwgYYVZmAaL7jcUOlMT1dLfowkmipJ72ux%2BHr7xHxoCa7PN1loZDlhRrN4LC7xLw0sDJwe0UiyDVoVXZC6wPxldkavrb4M3FOtAtFZoc3sNEgm\"}]}\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f244c2e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45016,"size_decoded":45698,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 45016, version 1.0","md5":"05fb8f8991f2c79721c71285bb6863cd","sha1":"289fcc339daa8f24f432b6d8d78e776566cb4cc6","sha256":"c385d866c78cf2c91ab9dc834291fa49f806aa0805840ebf3bbd1b41e33f55b6","sha512":"65c793b5e1f772f6714c29f0b041e38965711a9828bf3ed1ef40516d841b924b1b192f9eb02186025abda84eec5c5fd15f65b335201d9f7fd2cf2387cca394a3","ssdeep":"768:95nDfv+GmbHY6PoZYahtmlIV4r2rKf9m07kMiqDnX3kpa:95Dfv+GmbHY/RhmIVjrKfX7AcX2a","tlshash":"fa1302c811225df3af3ff4381425768f70648afd22e0b63790e96a77728b957a908d10","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-10-12T21:03:47.522448Z","times_seen":4275,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/chirp_700-s.p.2ipqzzc7oyrxx.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.614Z","timestamp":1790658130614,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/chirp_700-s.p.2ipqzzc7oyrxx.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"afd8-65c5af802a980-gzip\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J77lhpJTpFjBp3kyTVkk2oGVojsw2U7bMMEVb%2B8PTNRjk2%2BUpoyxD7ERLJCb%2BfNJFjvKNLz%2FAX13RfL6qmbbY%2FeT%2FyTt4MWHsX9xYne1DR%2FtF3nSBVG%2BO8G9RiFycOw7\"}]}\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f245c3056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45016,"size_decoded":45712,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 45016, version 1.0","md5":"05fb8f8991f2c79721c71285bb6863cd","sha1":"289fcc339daa8f24f432b6d8d78e776566cb4cc6","sha256":"c385d866c78cf2c91ab9dc834291fa49f806aa0805840ebf3bbd1b41e33f55b6","sha512":"65c793b5e1f772f6714c29f0b041e38965711a9828bf3ed1ef40516d841b924b1b192f9eb02186025abda84eec5c5fd15f65b335201d9f7fd2cf2387cca394a3","ssdeep":"768:95nDfv+GmbHY6PoZYahtmlIV4r2rKf9m07kMiqDnX3kpa:95Dfv+GmbHY/RhmIVjrKfX7AcX2a","tlshash":"fa1302c811225df3af3ff4381425768f70648afd22e0b63790e96a77728b957a908d10","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-10-12T21:03:47.522448Z","times_seen":4275,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.877Z","timestamp":1790658129877,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"304a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wqcW07GvtvZnOZNN5Y9eP3%2B6qPWFX8Q1xIdHefIzU8LUNT3g4d2Xgsjs4nGojMOEeZcGIhXVWX3613SlgAKS7w85I0S6152iieh%2BDUwr2MwMmMFAtOS%2FdkNevmW7E8O7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fbb2d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12385\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12362,"size_decoded":13135,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3f9e1739f3e3e3b271609943f715e7dc","sha1":"f2fce39b00993b5467eda1ce330c244e40e25e9f","sha256":"ddf23016bb96d9d1548a665b0ef5ad5c5df351ef7fe3aecb186f7b22b6939ca5","sha512":"b6a526928d28badb525dc5979f745b14c18886e74c238e25b77bd292dfe585c3135f275c0be40399ad4ead093d346bd00a816283f47b68fbba3284c1b5591fea","ssdeep":"384:ddq6KOgsajL5zjqyWxNCBy6f1vbOyU/eV:FKOejL56PqhZbPV","tlshash":"7b42d0c954104df1cf6ba6cb2ab90794306b73d2dd52b888f8bcb8431d26b347ca6593","first_seen":"2026-09-27T14:50:44.90761Z","last_seen":"2026-09-29T05:02:52.681037Z","times_seen":4,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_133.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.935Z","timestamp":1790658129935,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_133.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"1da4-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T1wIOwyr%2BjEIEMFN%2B4MVAgln9Fi2Hf7fo5LRBc%2FxK4RYw8XDGYgt1bdu3S9vLphwjFVvyjKI0nNEY2bxSVH2FkW73AtpLlsoWkchsh%2F0cP24WixW%2BjyUQhReLesWFi%2F6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f201b5256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7611\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7588,"size_decoded":8366,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 224x224, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c6225edcf6ba783d5cea7dfddee242a5","sha1":"7f464f0b306b5e6a1ab116d40dde41bc858ba14b","sha256":"0ad148835397d3dfddc180dcd900651da4bf087954edf80e5cacb7deb2e8aafe","sha512":"229253a3c5e3c38d17e637a198462273f01750333d92cdf283eb76aae9d729fff7d7e33d05a4597e976669ecf5f717b5db6631a3271930cb2d106d2776becf51","ssdeep":"192:aE5C7JolA8NdOQ2pqHlryAC3h1KkM96HGmpKV7O5jUmnx:aEKilqcJIKkLQCjxx","tlshash":"f9f1af0007b6045cac45d6ba622584d9bd8ebe0d783975b21eb8db5df788f299108a13","first_seen":"2026-09-27T14:50:44.87296Z","last_seen":"2026-09-29T05:02:52.68242Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/taste.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.948Z","timestamp":1790658129948,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/taste.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1034-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LuOUfVI1JaSq7Bozd2BfydCxSOOvCpBAih53Xn5yRQ0NQnKDqx5HC6bqHpHlZObeg8mIW7uLxEbZtE6VlteMoHUqykZK0fKGAjAT7WY43uSs24wU%2FJy%2ByEu8iPlModOW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f202b5856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4148\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4148,"size_decoded":4843,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"1970ca18429c7a2d08a6e9290b0ad566","sha1":"24452c0345bfe198296b5cca4792144ac420bc9c","sha256":"df691f813d386ff4e716173e357885495248506c85ca761fe744a300408f077f","sha512":"637045d47908c508024f70c143aa147e81dce5e39bf9f8a7930ea059d388620df8378c0c305162aa1b0a6718c45b1b396247fdd46bec7e29c2b6a6a762c05557","ssdeep":"96:emzuUpnojpTOcQArsW8t5eUCQiWobAX3tTzEPyhEy3:1umnoj570KUCQiWobAe6hEy3","tlshash":"8f816d36ec0380c5ecf3c33cbbdc7d3826444de3b16ae2407a68580626fb2855f06552","first_seen":"2026-09-22T20:45:26.278117Z","last_seen":"2026-09-29T05:02:52.684281Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/667d6a11ff8bc3a0698e9eb9797bb2151528387290f2aa871dafb5c3d0c19eaf.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.034Z","timestamp":1790658130034,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/667d6a11ff8bc3a0698e9eb9797bb2151528387290f2aa871dafb5c3d0c19eaf.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"d5e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0kEfitBc60VpEmKWKjZt%2BoSaEj0e31ROccplWAYUMb1%2Fsv8UV%2B04gCzlvLWXRPVUkFdmLdxp48yxeq83P3ZM6%2FDh7CCc0ZNxzepq%2FXpvWppmJIoqqAfImD%2Fyay1jn8rL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20bb8c56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3445\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3422,"size_decoded":4199,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 128x128, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2c6de9309533a2cf0706a7d8cc3f0726","sha1":"b481e772b8d20e104c42a5e6231e59c157e9204a","sha256":"667d6a11ff8bc3a0698e9eb9797bb2151528387290f2aa871dafb5c3d0c19eaf","sha512":"196add81a94b62810fae02edee65146d8f4bcb47103bfb78a1ed65a97f7403e9a897efaf5f29128a9550907d763445c1005ea5c663c706721055febaa78f46ec","ssdeep":"","tlshash":"3a614d741c8c81a32a674a5901fb1b81aa510d958e7f6337ca064c6314f6ecb168a6dd","first_seen":"2026-09-27T14:50:44.952475Z","last_seen":"2026-09-29T05:02:52.686185Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_39.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.041Z","timestamp":1790658130041,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_39.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"5de-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XY4w4ASSGT5reUXAym5q%2BNHD3uS2unCV%2BjcDNlAiRlt3Uu9KdFmlNG%2Bc0FPHb9LvAiHtz3ScvxiJgyIkn5PlLB5WPOieGGkVQsxOnw%2FDwUXrtQgpI0rvWdT9bsnVbgX8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20cb9156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1525\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1502,"size_decoded":2275,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 117x128, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e4d3b629cbb57de1eab25d799bd9b577","sha1":"3e5595afe5c50a7359f6dab2e825796793396ab6","sha256":"f364654173bb4ac62c18453bf6d59ed6578e6e260f83a2e206f9c0d1753e0eb9","sha512":"540df4edab99019728aadd021a1f51e8936597b5bbc22246c038b7c1e48a20d12666288a1bc092357afe2879e60eea02a2b2e733b9980609121279025e19acc8","ssdeep":"","tlshash":"7d31f7483b2bb498ecc49037d0540abe8ecd4874ec29ea3940e97df681fb107740b4c2","first_seen":"2026-09-27T14:50:44.850962Z","last_seen":"2026-09-29T05:02:52.687615Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_69.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.127Z","timestamp":1790658130127,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_69.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"436c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZPPAserp34VXIBGW1noCQ0JNa9boa2fsya%2FD2UNjj8gxGm6BiSqe4eZsK6N4vd5sI%2Bd3lQ4t0%2FYt8kBiEZ019ZA9ZhPrwES90xaeHWmvrksfGBSOANGMPHlMZ8MF9Nh9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f214bb956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17283\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17260,"size_decoded":18033,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a851052325ab02eb0925aa7edb74db41","sha1":"ae081e42fbfeb09c357bb4ce4d3a3b14015264ab","sha256":"54a44d1bdf30d76603c741c809b910b07514fdf07c7d3c0e08613a212dc1000c","sha512":"e75393bc45a0fa95aa7b5c29ca2839ae419642ae3d32e6e379a3647ea17cf74dc97ef3cd1178372602b8bc4dd2d9ae0e838408c384ecc81e6e3fff31b6f4b462","ssdeep":"384:x+xKp+p+08L5Wq/5fj+K9dAdta6NeydZMiPtTRK9j98IfjaBx9zKW:biENj+iIdBPejiHV","tlshash":"b672d090bda1f994f88159bd8c76a16e65484ac28eccd924e07d2fc8385fc458ec4dec","first_seen":"2026-09-27T14:50:44.895764Z","last_seen":"2026-09-29T05:02:52.688698Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_117.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.247Z","timestamp":1790658130247,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_117.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"c44-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nLVM5wQR%2B%2BtyZfPA9iLyCUlzw%2F9dWxUhnAx%2Bo%2F0EjmcuXUW9inEbKIxxLoGmnIkAl%2BmJxLDU992am3HI2%2FgMwCxZv%2F0lejTXrbdNEFMY%2Fa6h4wHE4Fpk4sdtKaeKqf0e\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f220c0756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3163\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3140,"size_decoded":3923,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e643ae44e37166cefc109c32c6408b86","sha1":"dca9654325ee3ca8766a8cf551d40f8a48c616c5","sha256":"3920d3f8ea1f0081a52918e9ba379cd526289e3c95792c19a607a914cfde92a7","sha512":"80f3f3bffa8812f49bb615493fe4f7993222ae7fa903e5572c4e778c2da4e4c2cb922bc21b0ad4c6a9eb4a668c53bc1436d95b2cb2a45d4a139b71c04dce1f45","ssdeep":"","tlshash":"41516c14f29d5faef31502662eb58b3248aa343fdf50ed643d2a05216db116b4a02f43","first_seen":"2026-09-27T14:50:44.79789Z","last_seen":"2026-09-29T05:02:52.689856Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_2.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.902Z","timestamp":1790658129902,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_2.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"294a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X6YG%2Fyl8sYdBPrzI0LtQKz4%2FWeRnmAptWavwdhYB2jGHTWlBpqyAMiHKuvEWcbA9wX6UaM%2BraCiJ2Ew81xAnnUHD9BeSvW7D%2BF%2BCENcp3rYDyvZx1LI50BALtdWaWieX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1feb3d56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10593\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10570,"size_decoded":11347,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"725aa3bed5fc77478765bd55c7bcbdc0","sha1":"a792771e39c8913a7466eeee213b259681aed813","sha256":"4a050643c06034259f80ffb03f75e1ffb8ba59686393a0de4819d167ae062a93","sha512":"f8cb8911194bc1132bc6714d5326063a5894d6861c4c6f0b6e367d3d309e1336f52551912a3133b8f851a64f77caf8b85045a8e415baeb438d21b72fff92f601","ssdeep":"192:12pLyGjeSPwHHzqEBNVSG9dbiAKTJ+rQnn85WZEpzU7EtZP1nRTxjGa:12bRhm3SabiBT6085AyZNKa","tlshash":"c222be79cc834cd88e9714ac6b8ffa6df591907198698c8e5351a71588eee98b31f102","first_seen":"2026-09-27T14:50:44.850032Z","last_seen":"2026-09-29T05:02:52.561841Z","times_seen":4,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_23.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.005Z","timestamp":1790658130005,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_23.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2310-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tMSGSDVcy2ntvPPE6PgKSePZrJbT0ANqnpH9I17c0meqgyvgDKnM7TcrpiKg9utQHgkBuLlATfgF5jGLoUjVrQ8zWDYgywmi3NuAE7Jv6ejKdKHJF9aLnDB1P99dev5R\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f208b7c56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8999\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8976,"size_decoded":9742,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"35f7d283136a655b4e916a5c2f81339c","sha1":"a515848ffb4eb03950c6f27f3c97ad0a4551c53d","sha256":"a3c4d5e8c96656cd16fd35db61b30094f322663074f3244e71fddacc070cf394","sha512":"e33de35b4e43660b9fb47349144610aa4aecc2cc69356598e0c352416b94d3868d1538d494bbb8a7f4e53fca8ef1a24d3fccac84a54bd156470c2df01bab7df0","ssdeep":"192:sUdSbdiAJnCu8gwbkGCcbeHPgysxHYcUMx76LBX6wqidOc+YqrLLI9A:KRfJnx8g2CyeHPzEHcLBKwqidOcGL4A","tlshash":"0702ae079532bc6df178210aaaa37414688818d5d0a6047f6a3c348638fcb87e27d8dd","first_seen":"2026-09-27T14:50:44.855852Z","last_seen":"2026-09-29T05:02:52.634731Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_59.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.103Z","timestamp":1790658130103,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_59.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"bb8-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IeVBlx0t%2FdFNomnD%2Fe5eViQAmKVMICJh9xtoAZjwg1GnFTPISzPnK%2B5ZTrO82K9cQ%2FDpQwi87HirLmR2FyqiAkGKBJ%2Ba6E%2Frpd1H863SIZx3IYkvhnuk5EN01K20cT%2BP\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f212bac56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3023\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3000,"size_decoded":3779,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"176f06c8ca116df4fb7e71723cdacfea","sha1":"fcc0f65957070ea396abda52ac290236087a3c72","sha256":"89d6e62d16674a0f8fc580e4c9ebdd7ee571904ef737bbf84b2048a67a96ada5","sha512":"9c3c6c2c288be33c3b94ae551ba6239e7d9da5bfd5905b02792a0b98cca461d9428d5ad4d64dbfdcce3e91bdda2b619f23b1397a813adcef249a7dc54f6daa09","ssdeep":"","tlshash":"d4515c915ec42480b95874b851f36b42ab4eb03893bb01d6203d6c17b7c61aad5d78e8","first_seen":"2026-09-27T14:50:44.852946Z","last_seen":"2026-09-29T05:02:52.691414Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_66.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.116Z","timestamp":1790658130116,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_66.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"abc-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xv8y3o0i8FOZnSUhM7HlP0cwyvBXYYLk2ufqSIqfaDHgy34q3XZABWTusF2rDSRoGPxdsMR6j1B608FCR2Yu4mieyWrEX3CwXKDdfZRP1ZmpbzwHsNxPhJDx3CoIbGFs\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f213bb556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2771\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2748,"size_decoded":3513,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ff9be4c01b4604bd22b104b72fc1a6a8","sha1":"940b155d8a453d16c9a058faa10b66f30e9f343e","sha256":"193f851ae4676ef68dda7191d17abe6d49d83179af9f9287e4a6281850ad9665","sha512":"4995eb1c0803727c84b8c14dfa995c5befc0b1d620f2381c61924876c566717bf77b7ddb1a407ac42c6a002824400055326a1a87bf9fd6765568e1f8def115a0","ssdeep":"","tlshash":"2c515e72770790d93f82ca22e8ca5d831017713e91a31de098545c4e4a7dae57d45a8f","first_seen":"2026-09-27T14:50:44.831005Z","last_seen":"2026-09-29T05:02:52.694012Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_92.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.195Z","timestamp":1790658130195,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_92.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"40a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=guiPffxT7C27dnSdSCnX1doyeDYvERXJ0faEzcJ%2B0Lxn1%2FVLwDuiticP9TcBrqNWt5kM1MLRbfC7%2FXfkZYkUmYJWoYYfDe1wy0xVQylek9wIXpkO%2F5CpbzCzyuatLzHY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21bbd656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1057\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1034,"size_decoded":1807,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9f2dd905afc4e25842700c734e1844d8","sha1":"2ba8b496cfd1417f04779091360fd8440f8852cc","sha256":"899e511af3a20f7a19abc0f61651cb1c13863fc8b1ac92422a03923cde76c68a","sha512":"1c7d6b96a3e1ff6cbfe1f9e561095447caf57d48e2b9f8776d3dda7cdc007bdd826c23dafc8c84cd690852dde706b5d735362af4fbd63a78ce0c44eb442c1977","ssdeep":"","tlshash":"8e11b5644d4308cef1f50e94b643331b3994612268378183fc262ed55f4423b62a68e6","first_seen":"2026-09-27T14:50:44.906642Z","last_seen":"2026-09-29T05:02:52.695557Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/2ed8d080-04d0-47db-89fa-494bcd47c675.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.238Z","timestamp":1790658130238,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/2ed8d080-04d0-47db-89fa-494bcd47c675.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"164e-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F8cz6hWJmuMJMsJtb9wl2Jt6XXcRdNPKILDUX0N6QzpcL4gfLP%2B8uVR4RVHowBG5%2Bm9okDyIRtMoZhBYQLhCi9sn8z6%2BmWWOFTDUPcjOU5spFovzbYMIeFzBLViE1dGb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21fc0556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5733\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5710,"size_decoded":6484,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 236x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"15877aa2e3fc1c06ff6396acea342780","sha1":"8b3daadd3e41487128114fed044dcf71c84ff442","sha256":"cdd7352322d27cd66e3a2e9a4aca3c63e8588f85e57b256a7c44a302f1787f1e","sha512":"36fec0a756ea4c2e699e1e24776a5c9666d32c40c9dfb73ab953cde584418baa7bb0c7cb4d4750eb28c55f5b5120153a37cca6cf5e01b69628b1601973bdab4e","ssdeep":"96:bowD0VbCrslxG9BcZhUUC/AzLxOAmGK83wDYw/ddJbixqEVvSCOY9gh1+Zx8JAx1:ND0RWcvLCI83Gpab9+hVvrIh4WOx1","tlshash":"d1c19e89376fea25ace05b28c5582544543efe9141eba21e1db36480a3637417a1fff3","first_seen":"2026-09-27T14:50:44.786986Z","last_seen":"2026-09-29T05:02:52.669913Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_119.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.249Z","timestamp":1790658130249,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_119.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1674-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K8mTIeRrP49muj0xjvPeHPqE0tIkDsx2PsqjMfgYxotFr%2FJUGJvKcms7S%2BBp3mvA7zW0Wx78%2BXAAuTfkGgQh%2FLNa%2FlDuKrLHcIG5rwVONwuiBAYeh%2Byl280sxydzu0rz\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f220c0956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5771\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5748,"size_decoded":6526,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"db8311bffe3a3c054ee24af6abd5a818","sha1":"03c7e27564828cf517153efa790ec4354a576bde","sha256":"eece9d9c8f73c629e82abf15d3101f6cc7f538efe8e9258d7afb1bc1b9a476b7","sha512":"86f4329126936d858b3d164a9e80439178319ae224a2655f3ebdadb98a81939116fe474d4faea264acdfeffdc416bd8d1970c59ec82a1a932eb456114b96cc2e","ssdeep":"96:RP5PmdtA3PLcV3deglkBTdpG/Py/J+UU3kUvwzUK2VjPVmr5aWZ0:REdtA3TcJ8F5dMi/AR3FvwzoP0S","tlshash":"93c18fb404dd3b6e8434f5d66c614f74d89d8a07ca605bf891afd4bcc4bec764422986","first_seen":"2026-09-27T14:50:44.86922Z","last_seen":"2026-09-29T05:02:52.696509Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/css/1z8nfuusib3o6.css","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.846Z","timestamp":1790658129846,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /css/1z8nfuusib3o6.css HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"ebc-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/css\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zW6XSNu%2FF40fgpNrRLzQ9o32fHIGW8QN%2Fjjijd6D75jPEwgrBjQTAHPNf9ykFRz1vYtQ5D24Ku8NzuuL35IbW9tl%2BJF%2F4FY%2BVMLBAUr0Eqs8Zy3Yw%2Fwd9vt9N1pRIV4r\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a4286f1f8b2856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 835\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3772,"size_decoded":1589,"mime_type":"text/css","magic":"ASCII text, with very long lines (822)","md5":"08ec2a222ea61e114903a8b93766772a","sha1":"2aa8a3d3fb60b3debd1c01d4fe2cbba441b70a83","sha256":"f876d90153266514d18aae6b39bafb98bdb0db09e4ecad5de54b822926b02ef0","sha512":"36d240c03fb48e4ee0d51d82e9730828b0e39dc6c3872413494aa025aecd8fad0acadf05b0945490d721df515dabe72678f394c090cbc1c1664192b560a3587f","ssdeep":"","tlshash":"1871bf205a1e6327e8b68d83768f7b126e28251661d44172f52a199dccef43f13e0b7e","first_seen":"2026-09-22T20:45:26.273383Z","last_seen":"2026-09-29T05:02:52.697833Z","times_seen":6,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/pump-logo.png","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.968Z","timestamp":1790658129968,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/pump-logo.png HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"24ae-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EgubUyXu60yiY126StMiHjHInGePqE69mi7TQW04pG61sYa1L8Nh90iu42znXDh6bYkGhjbpwHl7fKwuffps4J1U00thpWGcRsl9hSmEcKkY0IV3z77pms9OlsLW7scF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f204b6556bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9390\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9390,"size_decoded":10080,"mime_type":"image/png","magic":"PNG image data, 475 x 475, 8-bit/color RGBA, non-interlaced","md5":"16b70be286ccae65488956c9413c6099","sha1":"9c7af8a87825ecc658d327dedbcf76414bea49ec","sha256":"833748c20d4f6960df2d0a6cf8709584df41263b8b0406a2acd9059992f34c48","sha512":"d6fc8a19d0656839d7008024795cf4ef20222a7b72f82a357658433ded3179eb427947cd2b2a8fbf186c3a832ac59e2ec76d15bc3cb850ef431579fd7e3cab67","ssdeep":"192:ZMs9BoneOksi0+GuIzuPN8qIhC65UvQMN5IZQ/WV71QXxUb:ZMeBon9kgpbzu18Vhj5OKkXx4","tlshash":"0712ae9290af0775ef02e0fbb2dcd5b9a4caf266c97441a85b0e9e5d802365c737c830","first_seen":"2026-09-22T20:45:26.331197Z","last_seen":"2026-09-29T05:02:52.69913Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_8.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.978Z","timestamp":1790658129978,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_8.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"4fa-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nXyI00hFWHOn9Se9m83Blo4JyPG5XlLEQNzp8%2BtFQMpa%2B5WdKemI9UOaJupewuIB2Uq0JUJggI%2Fn05i9cVnix%2BPPfrnrIAotz8WUcvZ70HwkI6l8PCPah%2F0BSfX%2Bhvza\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f206b6956bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1297\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1274,"size_decoded":2051,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 73x73, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"264d2c7ef59385e9e7f364f85a1f5467","sha1":"d335edbb20b579ef3e3533cbbd1b3c8c5ac32855","sha256":"5af2aebc6c60dbf8ffee9e26826f574da9c968f6a5c046bfd3118c025da5668e","sha512":"cf8ad7afdb7caed997c1f1b9f656e740312034b59a59c3d3adf7273eac1f434bffb317b3b0ced6141a0d35e680219a5da75bf2559bc8460b20b244b263bd36c7","ssdeep":"","tlshash":"2921e7c1deab0d6ad238dc1dc94705de526231ca7dc3631286292c92b4fcb886650aa0","first_seen":"2026-09-27T14:50:44.803814Z","last_seen":"2026-09-29T05:02:52.70054Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/736d2c80-befe-4d48-95da-b74a049f641f.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.998Z","timestamp":1790658129998,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/736d2c80-befe-4d48-95da-b74a049f641f.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1208-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9jGhw1n4ixcPfi7SFl4%2FGr5%2BLPwrN%2BUa5%2Ba5p6zSv096g3RD4bx2Svg3udpu6yb0Ty%2BP3DBPylucukF8EKiz%2By27nlCsrlj6kkSO547zrZEjuQYSme66j8bvZpBusdGG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f207b7656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4639\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4616,"size_decoded":5394,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f6eb5e2e224737d8fc62b9da43d8992d","sha1":"2d390ca182b04e85145b311cfcc49ee32a70c50e","sha256":"552a93dbb3bf4574b19be9e6efa1228bdfe72092985a27d0678b01cb0f5396e8","sha512":"786d9676b8475be64d5348cf7fce736c03993213982aaf2daf63e40adbe068c92a8954a44d851a7f6277301ca0a0f660b91b07d3ce720ac37898644806e574c7","ssdeep":"96:f0p9c2Wlwq4j8/3viLIKapz4i1wLulC+0QTVMNTVqpCgNjKANmkq:f0pewq423AHapzpuYCcVMvgNC","tlshash":"e7917dd02a143e21b74cb2451d1a90fe97fdc2a8225e57fd0ab57b7a3000549d232857","first_seen":"2026-09-27T14:50:44.903791Z","last_seen":"2026-09-29T05:02:52.701952Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_27.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.016Z","timestamp":1790658130016,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_27.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"21e0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=APAJHFqaGkh%2BdFpbSLnNnLBwjE0fkcY4w5%2FtLxz7Bd895nYxvmhUP0FC%2BAas%2FftEQeUVFGOnMlqMjHo%2Fbrgw1Mmv5BTeOaW8ax9z3KwJu3%2Fns76uGbtkmwK0eJkj%2BzIX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f209b8456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8695\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8672,"size_decoded":9452,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b0584ff29d5bb9992f5e60263a6c800b","sha1":"9fecd94c0062e1dab7f134091ffccb715ecf6869","sha256":"4fdb7e8f5ad2570b1b936d9d91659256d547d3cd51a233cc955d4947bdb60ebb","sha512":"5e658d60916f61d38a72f92eb5458f3a20314c6e8ef480e59622595d5dadd814a7324c6d567ee3e8f177eae1569f89839510a4a8e80f7c5311ba0693bbacb75d","ssdeep":"192:3zOdnY0wmIB5/LEdc4iue8I6uwyh9wZsRxv63KC6xtvIOa6lT3:3ydnY0wx/4XY8faUsRxv68PBjlT3","tlshash":"8a029e820e399215ce4ebe60d4b6a17ec2915e9dcd031a0c3223e6b615e11f247797e5","first_seen":"2026-09-27T14:50:44.80507Z","last_seen":"2026-09-29T05:02:52.702661Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/3a497b5d-45c3-42b7-a82c-b12261f7e01a.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.135Z","timestamp":1790658130135,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/3a497b5d-45c3-42b7-a82c-b12261f7e01a.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"c02-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BUIqyB%2BjrokSO37xcyO5GnlHF4yhsFjCJSS4bsIWhv0Mw7im%2FJOQswXrxFt%2F%2B%2Bd5BslZNuZ5C%2BD7uXy9f3PYncQuDLobA7vHjDTVWhyitQbe94nfBwOZbNti84qiRUjP\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f215bba56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3097\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3074,"size_decoded":3851,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 157x183, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7f7af9ae03f8d6b3fbccac71751502b9","sha1":"2597e751188c912ec22fcf2000c3a1c87d0cedf7","sha256":"2080979288103ad23bd25b4802fdfee24d5088e9f035297cef94952dd9e63fd5","sha512":"3efdfb8ed6701e0ab2f2f9f2340e1bd01b329887f51561a5f715b11ad4783f9ac88f9fa713890d4967f9816f79a124c780df4a80f27bbc03bb789dc39cae2f4e","ssdeep":"","tlshash":"d9517e2f7119f1bce2164e5adbd31262c4a54498776a4d137d55f5610ff013423b611c","first_seen":"2026-09-27T14:50:44.827017Z","last_seen":"2026-09-29T05:02:52.630285Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_73.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.141Z","timestamp":1790658130141,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_73.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"598-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fAK%2BkUiL2autPEbzT6JATDK9S%2Bl1azfWKPXZICbBY44Fb78oSdmgeLkMxRZm4LtzoGCT3tv5A0%2B3B6VvwGqVuKvxgdlIvwJ2r7OhZ5U5bJvRJgA%2BUpbJF5nE92TipPQV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f216bbf56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1455\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1432,"size_decoded":2205,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 126x126, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ec7aebe3277e840ceda9d4aaeaec38c2","sha1":"db6b0bb6b208ef9f2b478e03d650d54e177c6ba4","sha256":"591d13015bbf43a97b1994cc212784ae504723eb5649741be0ecb7bb794ad179","sha512":"60027d937a72c3bf31bf5137ee169d14d3c44cddd52c74883cce8d196c493f8c5c6317411afc7e83458f26b1b84b4b6d743934d4ba1cb9cbf4e7f668a47e14e5","ssdeep":"","tlshash":"ac213b543fc5a51845000dff985c5110549261243b7cbd2d31b19cecbf079b0d63db42","first_seen":"2026-09-27T14:50:44.904787Z","last_seen":"2026-09-29T05:02:52.703464Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_76.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.151Z","timestamp":1790658130151,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_76.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2f6-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V8aLNf1a1rjKgH0ar%2Brrn3Dc3R%2FefrwUzFJpX6K7jXbL1ghM6iliK9a3kY1Se%2BR7HSXFx1%2Fzo2GAGlE2fbxZ3cUaBbtrS0b6SFLLawHT8c9QzO%2BIRSQ5qGVFX%2FcfWU2q\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f217bc356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 781\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":758,"size_decoded":1534,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 48x48, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d7434f282c35dc502784e56d7be6f7a2","sha1":"040b213429871622815007a23d0cf54eab2c268f","sha256":"b06ec129eedc7da965e2d56f05533d166433f90df5a9740990a09733f09f72ac","sha512":"c7219204a91447a1d27b57f624a50726b499ecea0bbe7326939d968ec7551da2d8dcac35485f8e646b7171284e1d7e46a886e03aa95c47d703a29973697fdeeb","ssdeep":"","tlshash":"0001b52c8807066cdc00ee0bf52473ec6c7f9fe9ad76ef0f2b1306b05559127a902045","first_seen":"2026-09-27T14:50:44.880332Z","last_seen":"2026-09-29T05:02:52.552641Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/goria.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.883Z","timestamp":1790658129883,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/goria.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2b68-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZAbUKS2oLUGz%2BEzrN6DqOzwOTa4RVO9bRX3WdmQgAPPZ8J6saB7Bcd95RhRV9Xg2wUfpQ8aM3HtwkALYwCa9bJhmRK0kETipu5oi%2F%2Fwsn929MOlG%2FOVUA6sLpGN%2BgFhw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fcb3056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11112\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11112,"size_decoded":11814,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"647192e24367ad60eafe35b04873591a","sha1":"82981a483e2bf853b1b69bedf2cf33c1d48eaf61","sha256":"59aa21d576a6830fb6ebff6637325ffcce7e5b91275aeb5c4da57422e5e66793","sha512":"4ab878d4779e75b0e55630bc056f42743d59284f55faadc170c7bd76ab4083543c2d4795dc100c796987d45293ab2dc144d4fc9d80758be985b54e57780772e8","ssdeep":"192:Iw+ofBxiAMHRJk1YaQMVfmpwUoGhETaehS8Bo5lh907qT:Iw+WWxJUVfcwUnhX8Bo5H9L","tlshash":"9632bfab961aa00b71b58f73666e8f20c7b7d33665ff8f0295a150d1001839e3bd8758","first_seen":"2026-09-22T20:45:26.218665Z","last_seen":"2026-09-29T05:02:52.705015Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_32.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.898Z","timestamp":1790658129898,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_32.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"ee06-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=o7haNnwwLnugQxlVRnTqGrE%2Fy8qDnGgB91j2HhK3QcP4xx67qsvDwF9U%2B4OP3nYDeoTgoKYik1XQOVve6WtqJSr7Ub2wxIW5JxPLdZq4C%2B%2Bt2Wsc%2BK%2FfGuWbgBwHrQQX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fdb3a56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 60962\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60934,"size_decoded":61718,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5c2053ed35e0f44495393e10d3535b1a","sha1":"c4fa5997b1698053e04f56fb5b7d8c9b923bf752","sha256":"6becbec3367815162e52e03ffbf2334380b654a7a2b1ae050345c773c06bb522","sha512":"24a186a39dd5d2d2f2b214b3f1802626de15f257ae0e23d406cd3ba9b94396c1b731ba943f4ce2f87da868d1ec3565e78da4b994fd13abff3a3113e3e8447577","ssdeep":"1536:Maa0nYzll/zvaNKWxCWNs31+K9TF2aQO9V9ccKH:1n+ll/zvaN73NQcKT2aQkcLH","tlshash":"1653024a9584bf846178e4e64d0708096c76e9d32ae805e721a3b7c1fc52f5c8bbf8d3","first_seen":"2026-09-27T14:50:44.943194Z","last_seen":"2026-09-29T05:02:52.705654Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_1.svg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.929Z","timestamp":1790658129929,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_1.svg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"ef-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/svg+xml\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dBmLLMi57iRWE%2FIfCoeqJyvmjd83BrZsL0n9yvi06cdnfU5qO%2FUHSxUohBtdHgZUimD2W%2FroFeTs%2FvdEhzD%2FKJS8gg1A%2Ft2BtS7TTVKj8viBN2txBfJrpucnIVnAXJIO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f201b4e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":239,"size_decoded":936,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6b17b6a136b84968e7631df3c59ed0eb","sha1":"aa23b94b2c28b5a9eb34c7462b3face807ac7a38","sha256":"3caefe25aaf8e295ff709444c303e65e409258b447aab691d8caf3282e2398c9","sha512":"387365e88773bf388ff57d7a5ad3d27390945915c18f5c20781723bae63f4e0cb7b38181f7d8f8d3c7e83c49f1f270733b694c5ceb3a78fd74df185a5688fa43","ssdeep":"","tlshash":"b6d0a7e770ddd408c840876212be3549b09ff0eda386115cfa84767a614eae7793033d","first_seen":"2026-09-27T14:50:44.775772Z","last_seen":"2026-09-29T05:02:52.54276Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/js/app.js","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.008Z","timestamp":1790658130008,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /js/app.js HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 11:17:02 GMT\r\netag: \"2d19-65c60f8db4780-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/javascript\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KczftiKAMt4JjQCj99nr8JhCmAEp%2BIxm11u8d5CRA8egRhckTdhK1L3eTaS%2BogrL4hoirnyfKKeZbqGFaTVwYVHCmePVKJWpggIiEqMTvsPM%2BIvMej5cj%2BwS5FBcFGhd\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a4286f208b7e56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3155\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11545,"size_decoded":3914,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"7f0c492df216f76004f1d81a62c87864","sha1":"54b8ca73a340fd9caa5d9efaee8ca5f41d053ecb","sha256":"790189ff8599ec17b87e232218b26768a0fca78fbc2c96de8541f3e10901cfd9","sha512":"f9c2d459f2443c1b74909a8efb58b0df3ed9258df854554b086342e8ca7f52f2ebd85f0e718b478b0dfd6212dbfa32bf731cca61ffa0166c16af1d3e331c9730","ssdeep":"192:CoJa5o1qmaXTiKRE9F+BHCsX+lGe2eEJqE6RTXKCN8KHhZcqIxS/L0H/j9iuOMxl:CqaXLiju+Q+EhxCuKHuY0fj9ifMz","tlshash":"4932766c60b3323782b730ad6bcb51987b341057b146cd487d4cca481fda96192fabea","first_seen":"2026-09-27T14:50:44.79496Z","last_seen":"2026-09-29T05:02:52.706972Z","times_seen":4,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/8c7c19c7-935b-4610-9dcd-140e2141a2ab.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.040Z","timestamp":1790658130040,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/8c7c19c7-935b-4610-9dcd-140e2141a2ab.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1fe0-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7L2xkwiuHNIuZfCVpY0BR%2FJ0LqeQ%2B0TjVyIAgVRc5V9Ce9H3lMlUYrBBJuWjvOEpU3Y3mks67tCGpsESiVCNoMU%2FCNssA3bcbXr7W9uqMTrCsG%2FmzzQVbEYe4cOPrSXB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20cb9056bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8183\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8160,"size_decoded":8934,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ebdadd2707fb25c8909233ae62479f5b","sha1":"d9ba74d5156473575f97b603e3d85dd44ab6bf6a","sha256":"a0406a3feda5a175ec978f9bb65d55368b3d000c19e75a0f67be30def39270ad","sha512":"3c72ca9a8486481ff83c916a397c077ab38e02dc3cbd303e789fd6ede84b488c683f4a47e5029361959a9fd6e5be0121de14a342c2485186eaacf560ef437165","ssdeep":"192:MF16/GE6QmOkGKRKj39uAibu9eHnkap2DmAXk/tWPswy:MF16v+GIA6uSkFDFaAy","tlshash":"79f1ad088337c240e5dfe9aec1422192921fcbc95d882bc24d4c7ad3f9c49c6171ddaa","first_seen":"2026-09-27T14:50:44.78565Z","last_seen":"2026-09-29T05:02:52.566843Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_74.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.143Z","timestamp":1790658130143,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_74.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"598-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Wm3%2BtzljZrW0U9x7SPjHMLxDfHlYDTAXopmUzioRKGCteOM%2FNOTMMiBOMMH7HY4mTB%2FOoys6XEeXv7HLLO2WL9XO8rOchArSPvOwj1%2BbK7eY13ldITVQtI1invE6jRzJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f216bc156bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1455\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1432,"size_decoded":2205,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 126x126, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ec7aebe3277e840ceda9d4aaeaec38c2","sha1":"db6b0bb6b208ef9f2b478e03d650d54e177c6ba4","sha256":"591d13015bbf43a97b1994cc212784ae504723eb5649741be0ecb7bb794ad179","sha512":"60027d937a72c3bf31bf5137ee169d14d3c44cddd52c74883cce8d196c493f8c5c6317411afc7e83458f26b1b84b4b6d743934d4ba1cb9cbf4e7f668a47e14e5","ssdeep":"","tlshash":"ac213b543fc5a51845000dff985c5110549261243b7cbd2d31b19cecbf079b0d63db42","first_seen":"2026-09-27T14:50:44.904787Z","last_seen":"2026-09-29T05:02:52.703464Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_114.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.233Z","timestamp":1790658130233,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_114.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"151c-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4AUA2jbqzdabCSt2UrLtmucUvzBc5nDuoFnxM%2FZN1i6vFu6wYMYULsNnx%2BNyb7hQ7DJMdPLU%2BprfFlSv5WS6Urf2mxbEUrS4AfNfLgNx1sAw3b7IBIwNRW7X5nZsAXwn\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21fc0356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5427\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5404,"size_decoded":6176,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c0bad90f8a083f62d71d08332bd9d31e","sha1":"8f233c41145e1bd9fff823bd2b0848a171639b94","sha256":"526ea84094a7d7332d8788a94bdf984276258f0e9f7bd8f7534e31da4b4938ed","sha512":"863f61b633eb6c3d61964d9b59ea5ef6488449c7377036e2ad8e94f46d9e25c1a879b4decc4c803889236432439bb8b772e57dceb4a63848da019857eceebccd","ssdeep":"96:gbzxvfmsgAW8+EwQiz95ZmsQy7C18newAxDUj9yN:gbzxs8+7lCxDUjMN","tlshash":"d6b17d1911ab93cd2ca29ec5b13f06812b41463ddc6b38a41ac3c5848ea3ba8c757de6","first_seen":"2026-09-27T14:50:44.91673Z","last_seen":"2026-09-29T05:02:52.708315Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_116.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.242Z","timestamp":1790658130242,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_116.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"e1a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=knC%2Bwe2TCcxLfped6fGVFnkl3iAPgPZbsOcDtnf7XC9ZxWO7GLRWZOcBEeQKiyrhpcs4Pzfzlqku5QjB1BSL4I0WsvQ3hoMtocQTzIwPdrxFtlXmusoqyrK0LK0%2Byck2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f220c0656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3633\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3610,"size_decoded":4379,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5cc3fedbd610fea4b46af88ac52f77b4","sha1":"8bb64467d0d6742347eaa8fc7d745daeffd79fb7","sha256":"643213c87383358e6aa1dbeabc4045c6e4641c5e9419aff93c92ffb6eacc2ceb","sha512":"4dbd3f7540f76acbddd6e0f701f3cb04a94006817d28ee48dd642a3d09b01a7548370b87c40e065c815bf7847d117b230e668bee1452cf30ecafc9413c0b7578","ssdeep":"","tlshash":"e7715b76a4d980e83a13c6cd44dfaa89fb8a591bf0017345010ced3233e23a44336dfa","first_seen":"2026-09-27T14:50:44.896729Z","last_seen":"2026-09-29T05:02:52.709759Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_126.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.917Z","timestamp":1790658129917,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_126.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"1742-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9IwmKv2Rtogm2U68rVGByoF6iR%2FTmgvzgtqGbzh4qiz1jvfPis4UIVPX0GtaBt%2B5VgtRmDhnI0mCjH89VnMxGNaf1Ob1AJJ3uhrElQTWDqZxjvgl8qhQcFtxrPb6blcn\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1ffb4756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5977\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5954,"size_decoded":6724,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"25bff2fcc4458c5b576f48fe024f2541","sha1":"88ad1f26936ac798de1b2c7255684e20cc31dda3","sha256":"493deb0e338f1d065e3532714b98fc01a2fade8493395c3786a456cf8c8dbf0a","sha512":"2cb2f8334ac24c647cd126d0fa11a959ad03841e541b32ac3e66ead05e1ddee350bef26955dd8f1d6ff4613801576b796e5bc8f3e6405695aa8c9949ecb68a2e","ssdeep":"96:i+ON4y42It/pDt1+jB8h8RA8TWURf062mA/ttixktm2btK2KjAdy1lX:tM4f2ItV7+u8RFTWUP+zm4yvX","tlshash":"d4c1afb9a96c7d275f7462cd9c73ae71944e1f2cb4618846c8123120c840ca3c99feca","first_seen":"2026-09-27T14:50:44.891599Z","last_seen":"2026-09-29T05:02:52.711208Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_130.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.926Z","timestamp":1790658129926,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_130.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\netag: \"736c-65c5af802a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mOyAI36n6%2BxMrEk%2BKVt6sEryASacJOMj46zcpXc5CtFPnyO4RRI6a3gu2t6Duc%2FvTla2%2FdK0VkYx3qOZT331P3yQLKhiHmpCVfN8Tty0KC4gaPURI5vCFRXkbWZUFh8r\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f200b4c56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 29571\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29548,"size_decoded":30323,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x341, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"327540604628d0819cd6ee15380e7544","sha1":"c27e41fcfe7f23382c64ba803b1ae56a4335c9b1","sha256":"a555dbc57840cc59a1f5a7d7faa170357c343cafe6ea236141ed030d547231d4","sha512":"3f38cd89c482864d30f699132a01a7b44594af3d2e6f26ac1af75c731a302e457c0c95f36e501af438510f960cdf3958b7b6b72489007c7c0990a90620753543","ssdeep":"768:S8JYNzyOKv4BRJ94Q1ma2YmrqduI7zllopl49ePzeoIh:JYy4fJuQ1maNH5v/Gl49eSlh","tlshash":"abd2e043dcb28dac5bf1053cd3929ab66229d5fc1d2a329ccd076aea1be3d121106677","first_seen":"2026-09-27T14:50:44.835956Z","last_seen":"2026-09-29T05:02:52.712287Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_68.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.126Z","timestamp":1790658130126,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_68.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"19d2-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vD3yU5r83ZQgGPyubrBkjjG4nGH4NHe928moOaJmYzoZiGpXsNIrxe3kcmUYlFnDHJtfBrkeQtJW9ojoZAOrmXFKYX4wVdQm3Ifk6m%2BFpAB1QJC56bvw0aLC6i3QR3M%2F\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f214bb856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6633\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6610,"size_decoded":7380,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 253x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7355b319df440e7646a7a20801cc8936","sha1":"d93a5e3ca7ab7a88ceddd4522535ed39c63996ef","sha256":"5a3bb12258cb8dd142400d95a819780c1e809f97fa937f5e1be922060946d1a6","sha512":"982f2dd91fc337fbf527bc921388e13b52ab8da635c08ed71c94f3028f651323fd8fe3eb9661bcfed2dc702fb06c1fde66250ee2a7f89d366bf868af16a45d00","ssdeep":"96:bWym/j88TleR4FVVAf4CiRQBtI5r7CWebyLSucDsP86WoKwz/ealMQkFk8fsn12A:bWyufG4Nw42tI53hebMus/WjJQkzNm","tlshash":"2cd19e7baf2d5f7785e4bd60a0e453e51aeed648490c6305f3a5474b6203742307ee20","first_seen":"2026-09-27T14:50:44.939741Z","last_seen":"2026-09-29T05:02:52.713459Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/nip.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.274Z","timestamp":1790658130274,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/nip.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"1b8c-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yFTJSLqqF5sbq6Gb7Kr3jTj7DoXv%2F%2BLXEVItDpg0HI55iTeHdzjqqdusJrKo14oWI%2FYym77fCqSk6Rx2JYZJtCCopcCA8xm6VmdcpKYGsXSXAXb65P5bYlLVGl2hBOs5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f223c1256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7052\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7052,"size_decoded":7749,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"aaa24952ff85c3c80630ddf994d6c93a","sha1":"5cf704c372e11136a23067995851b5afc73f1076","sha256":"9e139b4d0225446e5a53c76aa174cd4df020ab31e3a88a4f952b12b5015fd352","sha512":"5fab116428bee7a5fe8868f36a38e60da76498d718c4bef7afab00324cb89e40ff61d41ed489cbad9253f14e1c765ddee26c2c3276271962ca87597aed917aeb","ssdeep":"192:sxx0PDs0nBBBBBBBBBBBBBBBBBBBBBBghtNPSL/gYu5jPiVdX8eC3MLBovb:sx2rs02tNPMn+g822D","tlshash":"c7e14c1e4ba704c3deaccb3002d8c319246587fb97c8759523116f9647be5a7b93a681","first_seen":"2026-09-22T20:45:26.243251Z","last_seen":"2026-09-29T05:02:52.714521Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/fonts/geist_mono_variable-s.p.42jdkyb02hb3d.woff2","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.576Z","timestamp":1790658130576,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /fonts/geist_mono_variable-s.p.42jdkyb02hb3d.woff2 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/css/1z8nfuusib3o6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:18 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\netag: W/\"1155c-65c5af802a980-gzip\"\r\ncontent-type: font/woff2\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a4tV5qKXF6YLo9NqHXOi97unrumQ%2ByEU8RpZgHhgZrLocCh450s2gWlyjTExjpEgz2TuZ7wOuxVSFNpDBYY6s6ZuoLBOgeZ73e9Qb4PQMl16wWe9mOwRk95LiW%2B0PIoU\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: a4286f241c2756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":71004,"size_decoded":71689,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 71004, version 1.-19661","md5":"8383036bed6b5635fbd81508767479af","sha1":"9d76d5f55ee84013fbeb5e4926d5639b64633a1d","sha256":"5f687a5dd4c87da13deaff9f6b9503d5e62249ff501265a96b134565f9aa8c87","sha512":"d60bc8f9db90a6b601d80266e1d930f3d52678c0bdc0c446d2fbe73e0cd65bf3dc8fff13e3526c0eaad6254c259f19bcf1ed363b3e167bf53af533ee729b03cd","ssdeep":"1536:NLBTv7jXKc2l9+JBzGpMxlvEQYr6uabio0nX/DMUQO52TeB9k:lNfKJTCOMXvjYr6Yo0X/VtYak","tlshash":"d76302c4588221b2a506177bf79e201465c7fea2af88ee0e5c24dc177c86bb47fd65c8","first_seen":"2026-02-13T09:31:04.691023Z","last_seen":"2026-10-12T20:15:57.25758Z","times_seen":2298,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/image_2.png","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.775Z","timestamp":1790658130775,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/image_2.png HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"286-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9IGW7fDNc%2FHoAWP6l64WEqQq7alYhdBvK3OhQmbgS2D4b5eMHu1GJ4N4vcFTErFeVKxU98dDo3Imyful%2FOLoJGO0ITr4OtjvPI244MB%2FcC%2FP%2Fq%2FY%2FZS30r4vqdrR%2FWUN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f255c3656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 646\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":646,"size_decoded":1350,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"0fe7ba65ac7ae4076998b3a1648a69fa","sha1":"479ca3bd95df26f90a58e6683602453a87772663","sha256":"d461640712795ae68487bc8a33b0bd88d35d035ce7bf46f843c4fba9e1fe782f","sha512":"04f3c9da71a840d764f94a5c6eea2793700afb7ebbd67b7ca5db1f058ed85dd62be1ec9a786d01b9b57505095f8f5f1e0b8e1b1cc8d1fffaeb7ef42ae586b9c2","ssdeep":"","tlshash":"3ef08d6a5332d231ceca5aa299230400285320a4ab3fb830f06259f20f42cc8bb0a34a","first_seen":"2026-09-22T20:45:26.337753Z","last_seen":"2026-09-29T05:02:52.716641Z","times_seen":6,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_40.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.042Z","timestamp":1790658130042,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_40.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2244-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a2klaLJ1nwCYq1oBuUcCeJPCTXarC6sFGIiZUg%2Fx7AXmscO6D8sQPtj6R3JuNTR7h1fkOpkjA5twuMBasXsuL7gNj0k5Y7btol6G15mrNQohmobfcTDfUpLvdqnsSzDa\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20cb9256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8795\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8772,"size_decoded":9540,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"02ff2cf6c14a9174c4a04d25fb9d2714","sha1":"359441c531ad49f53843af027ae92097b2da30c1","sha256":"7cad8871e076525841eceefe11f174d6653d0b5799b6abddf9e859d84ed540d1","sha512":"b1a17bf95edd5ef513686f22f0bc0710272c1a7b08ccdd3bcc615c77ba88f929f9f83e58dc8451faf047d0b718d4c85c2e3d528ee1b100d20f6121110fd19367","ssdeep":"192:ez43lgwKLjQpP3bOTUlIpsB8ddRpNbRDU6tFW2PhZaiDI:vlwch3CTUlx8ddXjxPhXDI","tlshash":"a102b0b8a507cb1a0b72bdd578847cdb03a9d08192735e4c7526f96411e2b4ef1c928e","first_seen":"2026-09-27T14:50:44.848939Z","last_seen":"2026-09-29T05:02:52.568075Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/garrytan.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.881Z","timestamp":1790658129881,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/garrytan.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"7c4-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YHi9eb1J5nHMgIjmDqFhw4rtaSH%2BcvIgk%2BAU3%2BJ%2Fb5B3qun93oZNiUZzqwrc04BOmtl6pMYGAvZwFtkMu3AstCYYOME5kOpVSNu8NsrN1vDSwlYp%2Bd8vopMwYTmjfddk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f1fcb2f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1988\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1988,"size_decoded":2688,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"c1ecb9a2facbf690429feb1cbc03e546","sha1":"b1d0a80c61584498c2f7bcf21a4823a57b5d9850","sha256":"9e6c33ea7e10606eba9330863cd1a76206df8e11b9bd3774d301b3e6063c7f89","sha512":"85b00978f8ea0c33e4553f82c5d0924a98fde2e5afee3b85f18d4988f6c5e4472d09391cad01c48f8148a8f42469801f91c22ebe8ea99b91f7692c667bc98647","ssdeep":"","tlshash":"04412c0449bbe4c8ef54863c17d1b5ea21c8e3a204f27d0a6fbd952183521537f58b1d","first_seen":"2026-09-22T20:45:26.311393Z","last_seen":"2026-09-29T05:02:52.717621Z","times_seen":6,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_6.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.924Z","timestamp":1790658129924,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_6.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2cf8-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FwY3p2wIRmI7qjDQHXjKH2KtcS1%2FfhMQilK9HHK9HjrQd6do6WvqQLcEsQYUH74hU3ntF0ixYI6eiy2k1%2Bqg%2FDyWlcEW%2Frh6nHqCQCl7585g0rZVh3XG9hjOit2jOsfJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f200b4b56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11535\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11512,"size_decoded":12287,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9776da0e1ef1a4076ea6fa9b7ec54873","sha1":"0355c59a453328148da09f96b164370e057f5251","sha256":"209e4865f74ad5137d6b6f6f511ab45a8f91b1820f87071c14610e3a77350130","sha512":"027e81dc5411439e5fcd3246f31cecd0c683b22dba92b60e90761db1abb48b33bcd5f1b1573f6737e40e69285981c01646b092c4207f4b0cced8b9e0df3d21c3","ssdeep":"192:IkGeZcwwWilRgUjPgOq96pMfPRknY0uE/Gb32T1NRoRMyV5fBVZCqMRJDy3KGMJ0:IknIGG896pMWnY0uqK32TDGGyV5pLj8i","tlshash":"0732af484542f7f3170a3e09e6f116c9a40c25df75912e23bdeaeb4b53a2b4c874b687","first_seen":"2026-09-27T14:50:44.919432Z","last_seen":"2026-09-29T05:02:52.718333Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_29.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.023Z","timestamp":1790658130023,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_29.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"746-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QLGU20C4sZ3CN2YveUJjCEj%2BCGJUzuW3EK1RqjKJxucoxMrkcaHHinDKVrGEQ4DVLnqSminpoC5EPJQbgDvcjEV%2BaS52acy3UP%2FENbjG90OVAA6Or%2BfymOdrVXSJds3b\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20ab8856bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1885\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1862,"size_decoded":2635,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 200x200, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0962a4ee1b6b3e5a1ff344c610cc3fd0","sha1":"4acc0adbfeb19f83284a30ef027b68d29b83e115","sha256":"cb2e47666d7815c58a0176ce9bc1b500077c374694a4727da44f65a6aba26f5b","sha512":"27a7200c4fff378b045fc2c48e46181e3f789b87ad624c63bfe1f7093e73577f6103ad88aa8cde46cacc95f4afbb40a7e5ecbad8afbccce032d9e0b0b8c70752","ssdeep":"","tlshash":"4c31194d4d08b122e38f722e8000ff48f1d684c7eb7e8a8a502e898315e495ee58380a","first_seen":"2026-09-27T14:50:44.846036Z","last_seen":"2026-09-29T05:02:52.719235Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_38.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.039Z","timestamp":1790658130039,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_38.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"886-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fXXxF6C1lSomJFCtFSvdJWTTw8f62dqab%2F7Ws8pQAkjxKtuJUInOoqVbEVaVB9JgJHA5WeBXOumSXotUeEJqujHWuCaC7Ne%2BO4aBFSd%2Bq0ehEYdiFZflEFB7MoyBYpkD\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f20cb8f56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2205\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2182,"size_decoded":2953,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 252x250, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bab1508c9b8c8c9f345d4fd29acd723b","sha1":"33ce8d77bf2e5c80600cd5b1854825bf6a345acb","sha256":"f267c27783c2f157f72315181f2830491df76edbba4038f90c69768d4ca7cde8","sha512":"376e7e6ef4f8cc01458f55fe02e1e75a4b55a4eb863be6c3a85bf7cd464c90347c4981525494e54675581406125869bd8023106366e97ee896e9f102cc56f9ee","ssdeep":"","tlshash":"f0410b75cda735fba16b0ff25e00eb945b197df0aad247b055982306f060c9150504af","first_seen":"2026-09-27T14:50:44.949954Z","last_seen":"2026-09-29T05:02:52.720323Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_60.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.107Z","timestamp":1790658130107,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_60.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"4d4-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eVmu%2BqQxV115Q04YoSbxIUfe72pwzJPhkWJ8UeDgH3arFQecQCQGIQaYAMZbTRo7CoMG%2BJ98epJDBYwozI67TTu0TNZlJr0mUNPfUtisJ%2Buacos%2Fa18gB4mGWG27t%2FWi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f212bae56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1259\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1236,"size_decoded":2011,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f4e9bd130cf97c6658c387ca58f1fc70","sha1":"47ae07a10a47c38dd069118f79e92cf8970d43a9","sha256":"2214d7ca56c965301cadcd6c2984d44ee59c94ea68da085c09ef02c147db4026","sha512":"ed217101e8637fbac13ab45ba89eb48cff5f1002b0cd43b6cde4ff406fd9f7613c3e942e3e64bd7969be201765ebd8109ff02030e562185ecb4ed8b325e137dd","ssdeep":"","tlshash":"932184e1f9c87f61ee84fba903a407b2690d245fb3905b137a9fc48449020e86c752ca","first_seen":"2026-09-27T14:50:44.838102Z","last_seen":"2026-09-29T05:02:52.721372Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_71.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.139Z","timestamp":1790658130139,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_71.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"43c2-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=laxXI6ZhHPE6557qGWYVPOqlZ8323rbbbYOgNse7Nz%2B3%2Fp1rZnzuhkB9%2FjOGCu7hq60ENEhWFjPbBGM3KipMK7LkdGCKNOvhl%2BBnXXvL8GIvWh%2FqUV6vMSHStB5SoC%2F0\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f216bbe56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17369\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17346,"size_decoded":18125,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c35dc82d1af955eb80ae1ba314f37301","sha1":"b6c30002af4806d3210e53e38221300b1af49bc3","sha256":"93259f7a4978db86bfa07438da2e6b601d412fc2e3b64e8196131bd4bf36353b","sha512":"57ae6de267ad1f3d4aac18604be82843209ac86e7c728b15c0a62de8fd4c109e3f49c67bbccfbfbbb4da2b4a044cab0e024dea8b36c1ae246d0983777f3d53f4","ssdeep":"384:rXPj3mD+OjxVAjc2qWGrt4vw08LvFWRkaccnkonSreWugHvSQVHIQA318ozg:LPj3m/xVUc2qDZ08LvFWRE4n4egHa2oY","tlshash":"f672d060d26bbde8e2d02e70719f4219374e097851e387e7a1b7e31f4269510ab66db0","first_seen":"2026-09-27T14:50:44.859784Z","last_seen":"2026-09-29T05:02:52.722276Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_85.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.178Z","timestamp":1790658130178,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_85.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"20be-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RGbWaM%2Bjtcja8p6YeFgD2vBP%2FWOa8q4kdWBdEUsslXnYYo0i0eUb3mcSW%2BROGKRI34XH6HjviCUEUy9FjrErKD3IUjM0I7PkTHtsj4JL8S1Y3JhjeqOS%2Bn2QrKW2WppN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21abcd56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8405\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8382,"size_decoded":9156,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"40c808e6a75a8c500af8390c868ec664","sha1":"57a39824aa18a6bf73a24d6e214f561762522fe1","sha256":"42ce0ba65eae9c2e53cf7753cf1c1ecc63cf7e34f501d0657bc76204ee0576b7","sha512":"4b99488a570cdadad98c6fd8f8695de2c2a93cf46ac479bf5f90706a32387c5b40a99ba6237ed936f39c137acb14b2d60e8e10f07962a06dbbccc84fc572ab79","ssdeep":"192:uzh4a0jwOcSrseTX7NDM7ce4PGxU6WEE3YAPRQr:uVKw+TpDSchiU6WEE3YAPRq","tlshash":"5802ae4c3d25c6a09eb758f6fc98d0c043774666959a3e71505dc45cc1b21ee1a43bda","first_seen":"2026-09-27T14:50:44.930912Z","last_seen":"2026-09-29T05:02:52.723132Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/5jFvaVi1.php?s=%2Fipfs%2Ftx2kbwdjmHEPcuTrEvu-WQa1707393df31ed9a3ab0c0448c77a782%3Ft%3D1790658129803","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.838Z","timestamp":1790658129838,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /5jFvaVi1.php?s=%2Fipfs%2Ftx2kbwdjmHEPcuTrEvu-WQa1707393df31ed9a3ab0c0448c77a782%3Ft%3D1790658129803 HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript; charset=utf-8\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N3Yi0c%2FhrqNHdI1vxxkLatpiwiFzFppwiZS%2FFnY%2F9dzTrZ3FHIsiHtmeJGMYB2%2Fop%2B1tdZZbaRpnsEJrdVg4XAYX7gpw7%2FOvEc6Yf%2B%2FOVW1PMczZp0SxPNnNVe9Gy5il\"}]}\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4286f1f7b2656bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":645595,"size_decoded":124406,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4f0f4ca923747f323bb05e4b6e40b661","sha1":"701b67250ba0825252e80307444d99732320a7e5","sha256":"864d925eb02313b491c4f5c9c2a06367c6ffba7f71fe0c16e3d7ae0b2cb7bf12","sha512":"cf02f5a8f39e6755c1c28980531c6a1e1784265e58627a7c00462b9774e6fd3f391d1fcfe1b397e80c32edaac691b97de12b323985e1025a5d6d70660ac366c6","ssdeep":"6144:ch5gDMrq9NWCEiox3Ti/1gFQZDeoV5oMPNFppHSyyA:cswq9NWCEiox3Ti/ESVPHSyyA","tlshash":"ebd4cbd0b34a56bbd8d6b2b7043349afdfa82906064b188bd2e7dce4725470791dc9bc","first_seen":"2026-09-29T05:02:52.723859Z","last_seen":"2026-09-29T05:02:52.723859Z","times_seen":1,"resource_available":true,"data":null}},"time_used":568,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":511,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/clyons.jpg","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:09.963Z","timestamp":1790658129963,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/clyons.jpg HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"49d-65c5af7e42500\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 29 Sep 2026 05:02:09 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XvWbSb5HOPCX2hgCe7HknoI9cktmxQEhVAYtnwTkKkP3ahaZWc5b7IIvS6tYVJcELBvnqPesaexxwvoUx1FbhWIKDLKhXtrWRkdgHtA1cXlH41ZQBtTLpRbjjc3UNUps\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f204b6256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1181,"size_decoded":1871,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 48x48, components 3","md5":"ad210f608a72d287174e6571ed8d7201","sha1":"f352e07915ad6d7181384c79bc4f6e2bc7d53062","sha256":"a19145084bfa70501c8e935d468c3616aab3fbee9a8ce6e078fba1932b35e2e9","sha512":"14441fd9ba43a27f99e0d51c123f436022a192bd7dda05cf620722085640089666fe7e038f1e7c4b5b84c180c376df3e50019bf272e9e38690d01b4bda3ab490","ssdeep":"","tlshash":"7e21c609dd238af2cc450174ebe5331823c5a4672898c98543d930ce86df447eb48b49","first_seen":"2026-09-22T20:45:26.348299Z","last_seen":"2026-09-29T05:02:52.724913Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/bc401271-3856-47be-b879-3bb5beee16a1.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.081Z","timestamp":1790658130081,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/bc401271-3856-47be-b879-3bb5beee16a1.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"4de-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kxlE7MffYoN3o057AtwLzIcgf0%2B0xP%2F0O5%2FgNReI6uByK0UsiIYsbANVc5dYIVXD7jbr70DjAtPcf31uzrf0JcmayzVRTZSDls77DFqRED%2B0OJBvD8LtJhMuxQJAJybM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f210ba256bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1269\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1246,"size_decoded":2019,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d966940031ec26a0ca7019b5e0a15daf","sha1":"378eff4e9a7bd8d8bf4bc893522f7c2d328d1a8a","sha256":"5f38216f9b8e019ea21fbf391f123365a8bcd11564f0e9d847b7cf976548d855","sha512":"f2919e79847e525c4154a6478c1d26553a3f95fdf56c6b87aab0c58b8d8f8c6b55d05008d4827a71b147510ceeff54407d910efa2551f2a6e48437bf16c0a926","ssdeep":"","tlshash":"53210a37028af7ed6620e115bb31a244e5c428f2330a0bc34209eea09295274d66dfb5","first_seen":"2026-09-27T14:50:44.847002Z","last_seen":"2026-09-29T05:02:52.586675Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_86.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.183Z","timestamp":1790658130183,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_86.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"16da-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jf2UtsDi3M6Hbo%2Bvn5tOqWm6a0ACU6mNA8GsjgMnMh%2BXXwrTmYduypjpUfs4mDUvqKvefAWe60kRepCKW6J94opJt4LxorOAMHOWQOgQpaL78YAvk%2Bv9cz6QAM7aOSBB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21abcf56bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5873\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5850,"size_decoded":6622,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x144, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b4e6550a24e1d7cfe06e4b4f119a3596","sha1":"cb0591a304c664021bb27fa8cda3bbd4422137da","sha256":"cebe767481469618f2238de21c4f4c8896a7322bc72ac37df74f0f763e7af737","sha512":"4b48df85b6729fd7c8f365c89404123c2a96dbff14653b5a32db618b16c996636ffead60dc2591c89efdbff5e2417da4d9212b2f5a8a3467f81ed9889bcb77c1","ssdeep":"96:3s9Kj5XgfSC457p1YHXyyXbEZ/UxYSdp2sB1H4kCBCBhPDZr8flYEBc:8MMx4573aXyyPYK3JTBhP5wSEBc","tlshash":"9ec19edb969bdaa043b8ccb09ffe041e8315b0ae169f433aa42e1cc6ddd1072990178d","first_seen":"2026-09-27T14:50:44.960619Z","last_seen":"2026-09-29T05:02:52.725853Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_90.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.191Z","timestamp":1790658130191,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_90.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2122-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9LwSUmC6N1ag0S%2BCY2FkjSkPmTqSKIE%2BWFgE35OB4fYeiwTOBeMBqPGqvbqj8Ol8cBJ9QF3S%2FCdN3LUBfUdH57syEIi1uBgX5T4zKzJX%2F4FT3RAgT%2FmAE4Nf7G5rWnD3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21bbd356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8505\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8482,"size_decoded":9258,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"aad4db672da426d6bcb879c63cb60ea1","sha1":"93984981a0436bce8fda004ac3a1c3ab284b6f99","sha256":"fde557bd29ea53bf63665ababb8daf9c933831d1d25a07dbcd247cb6fb1e4848","sha512":"2a7a4d8e0f93c106e63f9a48b3f3c7190be246fe89a2ded87965036d1c8f08aaaa46af56b8e94b37bcb4c44fbd0f64e52f6ddd748ecaeacaf156803eddabf386","ssdeep":"192:ZLPKrGhesdn0lDiruhgAgBEOgQ2B1GM+MbqIvLoM3ByxKQHXw:ZLPKmalDiqbgBelaxMnvLoM3B+KQHg","tlshash":"7602b05a6b40c896506d39050b11a1602d1e2b5f318ecd08b6ffd4b77bf6b641db2c23","first_seen":"2026-09-27T14:50:44.78995Z","last_seen":"2026-09-29T05:02:52.726659Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_93.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.197Z","timestamp":1790658130197,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_93.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"302-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jtQ04qsMq5zymmLmaSR4PrOj5E5B2HaSkH5HmkFiCAs%2FEYQOr0VBX%2BAu0feQSOqZN6cbWQPV9WjtCJeToyg5F3Rddb9YfYcRQvty%2F8GTTnRFmoKbLVJrNuwM5steZCZC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21bbd756bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 793\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":770,"size_decoded":1540,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 48x48, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2458f4c932b8a77e1034b38dd2502d58","sha1":"424879529aaf19e5a80257b6a18e17d433299b79","sha256":"49985045c09e4677425106b5f28194c30e81178f79ea229c0ad9b8099093627a","sha512":"4bb104b1318e26e78f1cbcbc44d4a4639e8b6c74bf90766716607445b8bb68773cc2b6e927b9908d71e3630daeb22f0aec440fff659f1812b1bb972094fc2bba","ssdeep":"","tlshash":"f501b5cafb6624748c01fba773373a66231a04f3489ada58608318a128d9276172726e","first_seen":"2026-09-27T14:50:44.932124Z","last_seen":"2026-09-29T05:02:52.727627Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_110.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.225Z","timestamp":1790658130225,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_110.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"294a-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g2aKXWuuRGRiTCsoA94YnItNqbvyjAvuXHbr4iff%2BOXkeIoiUK1vOuv5yitQdISaZn5mS5DYO5AqPWsvm%2FRx3YSQy9%2Fdjqo0SGZzUnkhdWJ09nnO20OP3mhkhJSutnl2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21ebf356bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10593\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10570,"size_decoded":11343,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"725aa3bed5fc77478765bd55c7bcbdc0","sha1":"a792771e39c8913a7466eeee213b259681aed813","sha256":"4a050643c06034259f80ffb03f75e1ffb8ba59686393a0de4819d167ae062a93","sha512":"f8cb8911194bc1132bc6714d5326063a5894d6861c4c6f0b6e367d3d309e1336f52551912a3133b8f851a64f77caf8b85045a8e415baeb438d21b72fff92f601","ssdeep":"192:12pLyGjeSPwHHzqEBNVSG9dbiAKTJ+rQnn85WZEpzU7EtZP1nRTxjGa:12bRhm3SabiBT6085AyZNKa","tlshash":"c222be79cc834cd88e9714ac6b8ffa6df591907198698c8e5351a71588eee98b31f102","first_seen":"2026-09-27T14:50:44.850032Z","last_seen":"2026-09-29T05:02:52.561841Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e-usepaid.xyz/images/img_115.webp","fqdn":"e-usepaid.xyz","domain":"e-usepaid.xyz","tld":"xyz"},"ip":{"addr":"172.67.167.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://e-usepaid.xyz/","date":"2026-09-29T05:02:10.235Z","timestamp":1790658130235,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e-usepaid.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 27 Sep 2026 22:38:35 GMT","end":"Sat, 26 Dec 2026 22:38:34 GMT"},"fingerprint":{"sha1":"EC:E5:FF:61:92:9F:7F:E1:E9:FD:20:80:1E:52:CF:BA:3E:AD:BD:BC","sha256":"BE:54:14:71:7A:C4:B4:F6:C1:F1:46:22:84:5F:21:96:5E:50:AA:A8:B0:F6:1D:D7:9E:DC:2F:B1:4C:03:42:7D"}}},"request":{"raw":"GET /images/img_115.webp HTTP/1.1\r\nHost: e-usepaid.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://e-usepaid.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sat, 26 Sep 2026 04:07:16 GMT\r\netag: \"2a6-65c5af7e42500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 05:02:10 GMT\r\nserver: cloudflare\r\nage: 131\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HtMWOqT3tNGZyEly%2F1DvRTtrNAk%2B6i7imYlc6ZUrkT3tNC6XaUQnb2VYGc2ma3hjtIkSQE%2BX0IjF2%2F4tnxHCEMhT8%2Fqov9SdYFOABYIkiQfikKEXq45y3u%2BOpbnNrh2w\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a4286f21fc0456bb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 701\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":678,"size_decoded":1454,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"056e72dd014bd55cb50da77a7191a228","sha1":"008074abf266c5710e195954e377b6d91b2f043e","sha256":"5c0accd94f96f7b9dcf2fbdadf9eaffb59acc9d5cd3683e58256b1c67c4c7659","sha512":"45fff6aa652846b93a225b1b286a507db59f9a4f0018338dd6f48c19f4c8f6f8a12bd66fc5085bd635194979c79b61d5028bb8cdcfff9fd6c8e4c7839660a531","ssdeep":"","tlshash":"670183055909af121859eefb267b43f41ab768ece1c1113998c3dfde08e9b4428047dc","first_seen":"2026-09-27T14:50:44.83993Z","last_seen":"2026-09-29T05:02:52.55509Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"e-usepaid.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}