{"report_id":"16305178-6307-4b6b-b1b3-922b1ba03d3d","version":0,"status":"done","tags":[],"date":"2026-09-08T10:04:04Z","url":{"schema":"http","addr":"pay-bitregill.com/","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":0,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"final":{"url":{"schema":"https","addr":"pay-bitregill.com/","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"title":"Bitrefill Checkout","dom":{"size":11529,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (9860)","md5":"f41d52fb74f59448a5252f06c621d0b7","sha1":"d7eb8642a95ba11399a3ae977f74529064a8f0dc","sha256":"368020a059658172d9654fdbe8802193f0260229beebd277c5882587b3cd0d6a","sha512":"372ad2ea4c6b4409c6c2993abc604f997ad44765dcbcdc32fa5b3f91d18ea2d01364cb85eee6530a28d78d10989c3f7341f5f4bede7b919927e1663cd6f0be58","ssdeep":"192:yT5unB64HeK4EK4qWS2CXDQnnbVmp8qrZCBMr5u775yRiXbcigI7PZr:yta64HcExqWS1gV08q0BJZykgigI7PZr","tlshash":"fe32d8bd140141ab5623c9bf9b50fe5cb005a359cf559a09fbf99216fac2eeb48c443c","dom_hash":"domhash3947585979b9772c57afcae25daca4b0","first_seen":"2026-09-08T09:54:12.699576Z","last_seen":"2026-09-08T10:04:09.335801Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"pay-bitregill.com/","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":0,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-13T10:04:04Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"pay-bitregill.com","ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"domain_registered":"2026-09-06","domain_rank":0,"first_seen":"2026-09-08T10:04:06.166496Z","last_seen":"2026-09-08T10:04:06.166496Z","alert_count":9,"request_count":9,"received_data":629178,"sent_data":4191,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-06T22:43:29.329928Z","alert_count":0,"request_count":1,"received_data":10792,"sent_data":533,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"eu-assets.i.posthog.com","ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-01-23","domain_rank":169009,"first_seen":"2024-02-28T08:06:29Z","last_seen":"2026-09-05T13:34:36.606292Z","alert_count":0,"request_count":6,"received_data":643105,"sent_data":2960,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"eu.i.posthog.com","ip":{"addr":"3.40.5.191","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2020-01-23","domain_rank":102660,"first_seen":"2024-02-20T15:34:02Z","last_seen":"2026-09-04T16:37:29.90553Z","alert_count":0,"request_count":2,"received_data":852,"sent_data":946,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-06T22:43:29.090385Z","alert_count":0,"request_count":4,"received_data":197380,"sent_data":2304,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"pay-bitregill.com/assets/index-qZKngAM3.js","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"6a93e3794f253f935954f22de1c8d185","sha1":"109827c4d65638183c3ac6bdeee4be11b33f490c","sha256":"8eb54ac89c349016d7301d62ec99e9f85f4752b2a52a2b1e7f41c42827aec4c0","sha512":"beabd77457a2db86c7e956502e7e72ffa0ca6697300d86a7f46503b5d9bebac32cd359d3f92fb4729c723ffa73146b2f79053acbd0fd17b82285c0c9dfa61b7f","ssdeep":"12288:GW1Gmk66fm8A+fcQKUjoQxaDwL8pHpm7mTajtoqzZyHF:GW1Gmk66O8A+fcQKUjoQx4pHpm7toWZW","tlshash":"9bc48dda7384237927e301e871d91641f32e966cb226c5f0a9ad44152bc3df8637b7ac","size":584019,"data":"","first_seen":"2026-09-06T12:49:39.635936Z","last_seen":"2026-09-08T10:07:18.422285Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/array.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"bb0663ada90e95da4f32dc36995d9b65","sha1":"bf0895ffa6293cfda8d4d0ef8f20b0fad4b0f352","sha256":"fa000eb4f59311a01980a1f769629ad42fdba2c3c79e38813fad5237087141a8","sha512":"24632736a09400eb0bbd6bfdb259ccf838d7a7e5e39226c5f7ca8f5e59773fdbc12690315b72a1acff05ea23155cf165b42af6c9c01f825ffb6b42a8a2439775","ssdeep":"6144:relBZ8UltAgkQiEO2sKDrw3UcflZwY7UPA2x:YBJKZKDoUcZ2","tlshash":"4c54f98ab77ad0324ae680a5d03a0113e72a7b0d5509c06cf56fdccd399c9897277f7a","size":287790,"data":"","first_seen":"2026-09-08T07:42:26.83928Z","last_seen":"2026-09-08T13:43:13.460445Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/array/phc_uxjE5cAhUj7fPUJhKhSGJY7cFpPXvfuqgrZcSbGBSP7e/config.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"885a1e2c92110451036670f2cbd76588","sha1":"9df6a9db974d3e9fcb83b440930e7d37127889dd","sha256":"afe9329268622d6df38300e76fc355b51001e048649edef2cfac10e73f5bc0da","sha512":"c9bc47e8cb8f89ff6f50202b85f84d0a283246429e046f7d59aa93b4b67651c6e1d3bbdfea0c11e9e6d59c8ad4ff23f6d70cde42718a64d46988a067d0a2d214","ssdeep":"","tlshash":"c621ce2d29680579848e5324ba977d06affe023731186c6cf8dc8b44a6fe5df5a42b03","size":1209,"data":"","first_seen":"2026-09-06T12:49:39.64264Z","last_seen":"2026-09-08T10:07:18.429768Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.428.4/dead-clicks-autocapture.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e97a30e75fbc335ec91fd5971eca5d0e","sha1":"2d817e742e1c4fcbb543bf9ce9bf669b2d433186","sha256":"18de037c88059549e3064240f2965976e55dbe8c5750b0eeea57c1413c157f7a","sha512":"222aab707b11548bfdc81d282d5c390df3568d2ed45c80d6fbb7af7f64e30fa5b8e82b7dc186fba66f0eafd8de2e095d4174e6431e6b3669f98bdbf86740d35f","ssdeep":"384:QPaXRK3E0kx4LiA8i6DpE8LWGaW4QuvkYtPcR1KvToFpbNm:QPfEq2pE8XaWDYtPU1CToFpbI","tlshash":"6c82fbccb650f37225db5b5e447f0b03e2266518744a8824b11becc9687cb9162afe7f","size":18444,"data":"","first_seen":"2026-09-07T16:36:49.06728Z","last_seen":"2026-09-08T19:34:06.669964Z","times_seen":114,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.428.4/web-vitals-with-attribution.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1a39f0ee07e398ccee173cc331791f43","sha1":"46191cefc203f73d7f23e630a687d98ae47cc09e","sha256":"b46987dbc1a6e14559bac4d8e5d02a4220c5b9d03646cc410df7349486c1e6b5","sha512":"f51f0293003b7c35b5332c913adda19954b6c81a2fed3faf736abd040d89b50d80a9f8d3224877ce7267efcad67cd7095c0edc91b52aae3937b2af3c17137d2d","ssdeep":"384:P+j0oU7M1pcZ3q/yQHi32Zfq0kGFEdQ9EJYkjGNBzvbAp7wO1YU0tw2:P+jluI2Z3q/zC3+pnFEqOJYbAP1YZ3","tlshash":"76b2ead5e952603822f781bb427a4213733aa35254c581ec5abfef9499bc4c623d7f32","size":25343,"data":"","first_seen":"2026-09-07T12:37:13.712369Z","last_seen":"2026-09-08T21:09:14.73012Z","times_seen":114,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.428.4/surveys.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fbf1805db879efe2814e3f4e49731500","sha1":"8d8b40169b65d7b1d0964723d9f7aaaeda5a6162","sha256":"a8ccd837d1188d7226540a853ad27d58f6784fd509121ebcef1497e26a14be38","sha512":"5fa1fbd246453ee224ec42452d83c0e6144fb268ae811c4a170b47bf1beedc2b38e4880fd30d140f0f847cf88faabadcd7d1ffcadcfc0bbebd8c9bb382b3da0d","ssdeep":"1536:E9XyfFmEjuV7YzciHDS21loe+U1AZ98MgSEGSC/Dq:EZGwEjJQwDS2zl1SEm7q","tlshash":"1fa35cd5ba40e1ad51eb847810be5843f33d3b07ae4d4854b1139cd83dda898a39ffa6","size":100335,"data":"","first_seen":"2026-09-07T15:54:41.179513Z","last_seen":"2026-09-08T19:34:06.680733Z","times_seen":142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.428.4/posthog-recorder.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"47c58c37ecc12df7aba1227fe68e824f","sha1":"22e7c10ef8f1b266b15d683bcf6da5e29d9627a0","sha256":"464d1f1b0eb502e411d1f4e32ff90bd02d642faa5133fa56df239becb36e0780","sha512":"0b1a84034e6fbe30ae1bf614c7549c66bd8a8f1793a473a2a3e66d09dda2a18d07827e781624dab2f0301fce37067830d7c8c612d536d2d0b8021628fbd6f4a5","ssdeep":"6144:apcm2ARJjPtHnsDqeDPj976GzYNtcEPRd69:am1ARpPtHn8qk9/YTtPRd69","tlshash":"d8142bda7765603257e65159c06f0103e2326a19308b80b8f26fe8e935bc9c7b177f7a","size":205374,"data":"","first_seen":"2026-09-08T07:42:26.818212Z","last_seen":"2026-09-08T19:34:06.659572Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/config2.js","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"dd0bb0b681dd646bcffdd1030421caa2","sha1":"c736b5ae4c472ee1a94ca83914b699d858dba945","sha256":"95e2caecfd9c3f2bbae2ca498bd10ab28649fd9bde9cab6e957e6ca79f273c47","sha512":"69b546946e1690b2762cc99a08e6c3915517f5be38d2f42937beafcee73df25938d08325c2681d9a9a1855053ea28a05de14de24ca7e77482b77b2b2d353c03f","ssdeep":"","tlshash":"0af0dcb32626603a5ac8b144d5ed0f8c776331078cccb8603e6c00085b1c60fa535ed0","size":456,"data":"","first_seen":"2026-09-06T12:49:39.644121Z","last_seen":"2026-09-08T10:07:18.413221Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"eu.i.posthog.com/i/v0/e/","fqdn":"eu.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.40.5.191","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:41.930Z","timestamp":1788861821930,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 16 Nov 2025 00:00:00 GMT","end":"Tue, 15 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"99:B5:42:B0:EF:B1:77:97:C3:FF:B8:89:87:B5:A3:F4:32:08:FE:27","sha256":"BF:C3:D3:B1:0B:53:D4:58:C2:A8:1F:37:4C:D0:F6:A2:F8:E0:1E:BB:05:FA:53:84:BA:CC:BF:1D:78:D1:F7:A5"}}},"request":{"raw":"POST /i/v0/e/ HTTP/1.1\r\nHost: eu.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: text/plain\r\nReferer: https://pay-bitregill.com/\r\nContent-Length: 1458\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2201,"data":"\u001f‹\b\u0000\u0000\u0000\u0000\u0000\u0000\u0003½WëoÛ6\u0010ÿW\u0002!\u001f6 rô²\u001e[‹u\u000f\u0004K‚m-\n‚\")‹µDª$eçüï;J–-ÇJ›tÀ‚ Žï~Ç㽏÷\u000en8Z±[gá4%AíͧŸçä‡òúSR\\\\¿+-/ß¾û'!oš‹¿×Eûy©Þ“Ëü폗\u0017\tsΜ\u001c\u001bR:‹\u000f÷NÛr\ngx\u003eöR/ÉÜ \rb7ɊÈ͓0vsBˆÒ(Æ)\u00069¶fÂ\u0000ütÃr´æ\u0006W\u001a¨’\rS†3í,îS\t\u001fÎ_\\P¹±\\øŽÖLi.\u0005Ð}ϒr\u0005\u003c¦àû\u001b®X!o,‘²5'\f™Û†\u0001ã'¦WF6–axÍÔë«×c\n’E¡\u0019ÜÈ\u0003\"i•‚ë¡VU€,iôâü¼Á·n΍bK^U3\"ës{@)µµãˆiy\r6¥ÀµU×a\u0015Þ \u0016n‹ð²·þwy\u0007p|\u003eŸy'ßm\r=ùãêÄ÷fÞ«\u0013 ÄÑ«“\u001bûG­\u0017~\u0018ͼïOÞ2²’çç{ðëŸlÍ\u003eï¸#ì=\u0005œ\u0011¹Âbق~Ð΄{}éLðP\u0003gò›\u000ebùš(Æ\u0004*\u0019_–pmß\u000b¢=ué\fðƒÔºnÍÙ¦‘Ê\u003c\u0006ïè‡ðŠç \u0005rÀ鿌ã;‹‚t\u0016Y\u0006\u0017p;ƒºüÊIVULÞÌëBo|µ\u001e‚\bG\u0026išÆ~꧳ÌOí\u0005é\nQ®\r\"%\u0016‚ÙX\u0012*ú\u0003¹á¸âw؀2ÔË;\u0007\u0019ëe®—^ùÞÂ\u000b\u0017a8‹’ø½• R\u0014|Ù*F‘fZ\u000fR²5¨†,õSÏþœ9V\u001f\u0017d{Ù]1ø\u0001³Å37‹hè’(Ïæ~\töè(a_\"CJ›\u0007m¯H´U5\u0026‰µ\u001cÎ{ĒŠB '\u0018ÀµÍù\tV_\u000eäöˆkÙÚ\u003cîɧ¸5’àƀ—¬ßq^uÞR\u0010S¤9\u0005\u0017\u0017Pæìl\\ôˆ‰\tœQí#\u0018®*¹\u0001X͌âDït²\u001bš.ˆƒæÉ\u0003\u0007ŔaŠHÅÉê˚)ËÛ%*¸‚ì)@\u0013Ò\u00027º”¦‹º6¸nF\t\u0017yq0ä['¨XSá[ø¨¥\u003e¤ør\t\u001ajÛ+¹X¢\u003e™v6\u001cÉuÍq'\u0006ÚLk;á@\u0018|ëLÉBÏúFɊ‹\u0015¸£¨ðò™'l\u000bA1\u0002ie\r\u00038Ô©bXw%¼gì\n®—„ö §lÛ\u003e¥ÐÀˆÙS-œÊ\u001asqÈ\u001d%Û×\u0017h;@îmƒ\u0005\u001a Ö¸já[êÇgŽ‚â\u0016àeg)¥ÕJYeð–×UÚ:vw!\f3î\u0026I”\u0004ó8N¢,ABà5_v-âª\u001f%[\u0002;àýB»©±'\\ÿùÛ×ÆÆ\u001e|i]vÕ5 \u0017Žž©L\u00043âQd\u001e7”‚º\t¦ÄM}\u0018ËI\u0010†lîgAÀº.»éæÏWe¢9èÂÑ\u003cs\u001eŽ£2ö¿‘+\u0026¾m«Ø¶[ÈÏ\u0002·•Ñ»æ\u003cwCÏùß\f\u001c)‚˜([ÐSy;…y*‹\u000f±ÏY0\u000e%¾´n\u001c\"–q•öE‰ák6Ù\fŠªÕ%h«è¾œ…„:6LY1P£aαÇÅÿDoéä\u0004®PÞ\u0016…Ý4˜Xvk€÷\u001c´†¾á,‚4Œã\u0003øP,ƒá´U]M9‹È’\u0003è\u0000é.9.˜(\rŸ´ß\u000e‡Nõä-\u000fæ\u0002¸óÇgfâÁÜøøў=L—\u001a߀’Æ”È\u000e6FÁ»Ùut\u0001mGâрê֑ùóñÚÜV\fle½èä ›–\u0014’ÚEÝ÷\u0026=8-C´Fª­¬\\ìgß \u0007Z…í\u000bPcv\u0010=\u0011›\u001e`ã·³N¿\u0000Š\nÌí{\u0004Î1t\u0017ñ\u0012¡ÎßÏ\u0006\u000f~ѕ]íž\u0014\u001d`ukúå¶{¡õY1©Šk‚a)¤»êA\u001afJ\u0017¡I\u0005¦TÒ\u0018»8\r*4¢ðnkž4]vKýÝ’@ù­a_\u0013Sʎ#ðœT“eÓ±±1\u00186XºÛõ\u001e\u0003ú%\u0006`¬nÌ4ŽÙ\u0006û¹e-\u001b5ˆ\u0006^Nö™s¼Æçnâ±ÂÅ^1wáŸ$ô‹4ÍbÜ=E4ࡉñ‚‹\u001d^Â\u0004Z\u0016‚ç04_xÉ‚W£EÖ¾• \\\f¶¶šÛ•ËŽ\u001aۅ»©\u000b±Ë2\u0018Ïã6ô¼ð\u0001\u001a¶Ý\u0012›©·NäϲÀï\u003cü\u000bÃQTÖ\u0011\u0010\u0000\u0000"}},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 10:03:41 GMT\r\ncontent-type: application/json\r\ncontent-length: 15\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: https://pay-bitregill.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 23\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":15,"size_decoded":426,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-09-08T20:39:06.835427Z","times_seen":50146,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.135Z","timestamp":1788861813135,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 10:31:27 GMT\r\nexpires: Thu, 02 Sep 2027 10:31:27 GMT\r\ncache-control: public, max-age=31536000\r\nage: 516726\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-09-08T20:34:17.737637Z","times_seen":279125,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":30,"send":0,"wait":19,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-08T10:03:32.354Z","timestamp":1788861812354,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitregill.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 13:27:02 GMT","end":"Sat, 05 Dec 2026 13:27:01 GMT"},"fingerprint":{"sha1":"B3:A7:B3:CE:BB:16:1C:08:94:12:16:9E:72:3B:F5:F0:37:71:A6:A2","sha256":"8A:0A:46:33:CB:AE:39:B5:71:39:4B:F3:9D:26:7A:EE:1C:CE:B8:2E:A2:59:B4:13:E0:97:4F:C9:41:97:E2:44"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: pay-bitregill.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Tue, 08 Sep 2026 10:03:32 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 444\r\nConnection: keep-alive\r\nLast-Modified: Fri, 04 Sep 2026 11:02:14 GMT\r\nETag: \"365-65aa6336b3980-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":869,"size_decoded":754,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"987c6dd27b3817d7b38fba8fa16c5140","sha1":"ca15c7234f7e3d6ac1e891d87fe1715269f0c98b","sha256":"97409b06c85f6e81d39a83ea945ca134af36768c682f70caa8400816e9637b7b","sha512":"8643717c56c38d6199d451603deceae6cc649731bfbc0cf8a38de3170219cf02674a856cdb4341dd74d8ecd3d32a085e61602f98c59d4b0c669e72a3ef435788","ssdeep":"","tlshash":"6a111e876cd0c81913100a965c81f819ec87928b8708dd98b5fb40fc8f987ca4d8b9d8","first_seen":"2026-09-06T12:49:39.63478Z","last_seen":"2026-09-08T10:07:18.417328Z","times_seen":5,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":8,"connect":29,"send":0,"wait":34,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:32.840Z","timestamp":1788861812840,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 08 Sep 2026 10:03:32 GMT\r\ndate: Tue, 08 Sep 2026 10:03:32 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":1447,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e85517dadd43448782d60d7f207fddce","sha1":"6cd31f870727ba8090fac9602b42524b4139a619","sha256":"88fbd0b95222be288587a149c324189ecbd8de0d6f0c94f528ec53857e52b66c","sha512":"5edc78df5bb062a9a2e1ea6724c14dd7eb80d77ea0fa9572de4bb0d52bbd0d163815b08a1ae77084f99fbefbb07715da1c61f0bb36fb498710c91387792955f8","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:vXuM0p2+4","tlshash":"04227792002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:13:11.065101Z","last_seen":"2026-09-08T20:35:43.927981Z","times_seen":43240,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":36,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/assets/index-qZKngAM3.js","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:32.843Z","timestamp":1788861812843,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitregill.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 13:27:02 GMT","end":"Sat, 05 Dec 2026 13:27:01 GMT"},"fingerprint":{"sha1":"B3:A7:B3:CE:BB:16:1C:08:94:12:16:9E:72:3B:F5:F0:37:71:A6:A2","sha256":"8A:0A:46:33:CB:AE:39:B5:71:39:4B:F3:9D:26:7A:EE:1C:CE:B8:2E:A2:59:B4:13:E0:97:4F:C9:41:97:E2:44"}}},"request":{"raw":"GET /assets/index-qZKngAM3.js HTTP/1.1\r\nHost: pay-bitregill.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Tue, 08 Sep 2026 10:03:32 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 04 Sep 2026 11:02:10 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a9aa532-8e953\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}],"data":{"size":584019,"size_decoded":213054,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (42312)","md5":"6a93e3794f253f935954f22de1c8d185","sha1":"109827c4d65638183c3ac6bdeee4be11b33f490c","sha256":"8eb54ac89c349016d7301d62ec99e9f85f4752b2a52a2b1e7f41c42827aec4c0","sha512":"beabd77457a2db86c7e956502e7e72ffa0ca6697300d86a7f46503b5d9bebac32cd359d3f92fb4729c723ffa73146b2f79053acbd0fd17b82285c0c9dfa61b7f","ssdeep":"12288:GW1Gmk66fm8A+fcQKUjoQxaDwL8pHpm7mTajtoqzZyHF:GW1Gmk66O8A+fcQKUjoQx4pHpm7toWZW","tlshash":"9bc48dda7384237927e301e871d91641f32e966cb226c5f0a9ad44152bc3df8637b7ac","first_seen":"2026-09-06T12:49:39.635936Z","last_seen":"2026-09-08T10:07:18.422285Z","times_seen":5,"resource_available":true,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":30,"send":0,"wait":59,"receive":87,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/api/wallet-connect-url?site=evm","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.106Z","timestamp":1788861813106,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitregill.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 13:27:02 GMT","end":"Sat, 05 Dec 2026 13:27:01 GMT"},"fingerprint":{"sha1":"B3:A7:B3:CE:BB:16:1C:08:94:12:16:9E:72:3B:F5:F0:37:71:A6:A2","sha256":"8A:0A:46:33:CB:AE:39:B5:71:39:4B:F3:9D:26:7A:EE:1C:CE:B8:2E:A2:59:B4:13:E0:97:4F:C9:41:97:E2:44"}}},"request":{"raw":"GET /api/wallet-connect-url?site=evm HTTP/1.1\r\nHost: pay-bitregill.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://pay-bitregill.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Tue, 08 Sep 2026 10:03:33 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Idempotency-Key, Last-Event-ID\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":112,"size_decoded":432,"mime_type":"application/json","magic":"JSON text data","md5":"8d5ec02e31c035549d5b4df8a2bda57a","sha1":"454e36769d50d45339f1bdf6160f0e1e72372056","sha256":"fc02d999b3e0e304053e467cfe370bbd392f3cb924cf3b705e31ecf2ef23406d","sha512":"cabd8c3a9102bae878b10dc380c75cd2953767b3623cc50bef8a5d9e985b5f90ba99c62aa6a0f934679f88a437932f0767fae036cb89eaadc4c2f3ad0fc5c162","ssdeep":"","tlshash":"b2b0925643186825a612dac47606aa7c655b2061a89a82a95280f928833ae6a0645483","first_seen":"2026-09-08T10:04:09.340019Z","last_seen":"2026-09-08T10:07:18.418607Z","times_seen":2,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/api/wallet-connect-url?site=tron","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.108Z","timestamp":1788861813108,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitregill.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 13:27:02 GMT","end":"Sat, 05 Dec 2026 13:27:01 GMT"},"fingerprint":{"sha1":"B3:A7:B3:CE:BB:16:1C:08:94:12:16:9E:72:3B:F5:F0:37:71:A6:A2","sha256":"8A:0A:46:33:CB:AE:39:B5:71:39:4B:F3:9D:26:7A:EE:1C:CE:B8:2E:A2:59:B4:13:E0:97:4F:C9:41:97:E2:44"}}},"request":{"raw":"GET /api/wallet-connect-url?site=tron HTTP/1.1\r\nHost: pay-bitregill.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://pay-bitregill.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Tue, 08 Sep 2026 10:03:33 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Idempotency-Key, Last-Event-ID\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":111,"size_decoded":431,"mime_type":"application/json","magic":"JSON text data","md5":"bc2f753f7dd462b679bbbffeeee2150e","sha1":"e92a51151f60ab0f2b4609d075964f461c59c142","sha256":"724c7ad131176f9cac40aee0102172410b6de504690d3ede97ee11239381eb2f","sha512":"8d38d9d60fcc06f1e5d0160d744de4dc463643d3fb1a13010ca9da3878909bf467a58fb8a91bb3342128d9e30865ac41659d9949152fa84371ba7618f4b85c24","ssdeep":"","tlshash":"45b02222030c0c02abb0c338020fff0c88cf0028c8282208ea0b28003a2800b3a8b283","first_seen":"2026-09-08T09:54:12.717682Z","last_seen":"2026-09-08T10:07:18.424412Z","times_seen":3,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/api/wallet-connect-url?site=solana","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.109Z","timestamp":1788861813109,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitregill.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 13:27:02 GMT","end":"Sat, 05 Dec 2026 13:27:01 GMT"},"fingerprint":{"sha1":"B3:A7:B3:CE:BB:16:1C:08:94:12:16:9E:72:3B:F5:F0:37:71:A6:A2","sha256":"8A:0A:46:33:CB:AE:39:B5:71:39:4B:F3:9D:26:7A:EE:1C:CE:B8:2E:A2:59:B4:13:E0:97:4F:C9:41:97:E2:44"}}},"request":{"raw":"GET /api/wallet-connect-url?site=solana HTTP/1.1\r\nHost: pay-bitregill.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://pay-bitregill.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Tue, 08 Sep 2026 10:03:33 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Idempotency-Key, Last-Event-ID\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":112,"size_decoded":432,"mime_type":"application/json","magic":"JSON text data","md5":"c7916016f09c6f9c618891a7c80696c8","sha1":"5b8b187a1090906c5510ebe64670e256f27b7ebc","sha256":"6391187863be31a7ae50592713de6c9cb89519a010532c47cbfdb3dc2ff66752","sha512":"a34885e5dbae82355f8137243427319310e1a848878c9b7336a623d738d63c7c686f5bd63c05ef9706c05d5bb9064c7a2e0344af6b718353eb96ab3f8b26bf57","ssdeep":"","tlshash":"30b0123307e86d72dec397c4290b2a4c7c8f14074955e3ad394ce82252692ee3995697","first_seen":"2026-09-06T12:49:39.638767Z","last_seen":"2026-09-08T10:07:18.428665Z","times_seen":5,"resource_available":false,"data":null}},"time_used":619,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":619,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/ultramodule-1.0.6.js","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:32.842Z","timestamp":1788861812842,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitregill.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 13:27:02 GMT","end":"Sat, 05 Dec 2026 13:27:01 GMT"},"fingerprint":{"sha1":"B3:A7:B3:CE:BB:16:1C:08:94:12:16:9E:72:3B:F5:F0:37:71:A6:A2","sha256":"8A:0A:46:33:CB:AE:39:B5:71:39:4B:F3:9D:26:7A:EE:1C:CE:B8:2E:A2:59:B4:13:E0:97:4F:C9:41:97:E2:44"}}},"request":{"raw":"GET /ultramodule-1.0.6.js HTTP/1.1\r\nHost: pay-bitregill.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Tue, 08 Sep 2026 10:03:32 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 444\r\nConnection: keep-alive\r\nLast-Modified: Fri, 04 Sep 2026 11:02:14 GMT\r\nETag: \"365-65aa6336b3980-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":869,"size_decoded":754,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"987c6dd27b3817d7b38fba8fa16c5140","sha1":"ca15c7234f7e3d6ac1e891d87fe1715269f0c98b","sha256":"97409b06c85f6e81d39a83ea945ca134af36768c682f70caa8400816e9637b7b","sha512":"8643717c56c38d6199d451603deceae6cc649731bfbc0cf8a38de3170219cf02674a856cdb4341dd74d8ecd3d32a085e61602f98c59d4b0c669e72a3ef435788","ssdeep":"","tlshash":"6a111e876cd0c81913100a965c81f819ec87928b8708dd98b5fb40fc8f987ca4d8b9d8","first_seen":"2026-09-06T12:49:39.63478Z","last_seen":"2026-09-08T10:07:18.417328Z","times_seen":5,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.146Z","timestamp":1788861813146,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 10:31:27 GMT\r\nexpires: Thu, 02 Sep 2027 10:31:27 GMT\r\ncache-control: public, max-age=31536000\r\nage: 516726\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-09-08T20:34:17.737637Z","times_seen":279125,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":20,"dns":0,"connect":0,"send":0,"wait":35,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/array/phc_uxjE5cAhUj7fPUJhKhSGJY7cFpPXvfuqgrZcSbGBSP7e/config.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.481Z","timestamp":1788861813481,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 04:32:20 GMT","end":"Sun, 29 Nov 2026 04:32:19 GMT"},"fingerprint":{"sha1":"12:D9:D6:77:38:5B:C9:F0:5B:CB:FA:8D:A4:FD:DC:38:9C:E2:0F:B0","sha256":"AD:D0:73:85:E5:83:92:52:79:97:D8:28:6A:6A:7F:D7:3B:EB:B2:29:18:06:17:3A:9B:6B:88:71:F6:4C:7B:DD"}}},"request":{"raw":"GET /array/phc_uxjE5cAhUj7fPUJhKhSGJY7cFpPXvfuqgrZcSbGBSP7e/config.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 10:03:33 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=300\r\nvary: Origin, Referer,origin, access-control-request-method, access-control-request-headers, Accept-Encoding\r\naccess-control-allow-origin: https://pay-bitregill.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 1\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nlast-modified: Tue, 08 Sep 2026 10:03:33 GMT\r\ncf-cache-status: EXPIRED\r\ncf-ray: a37d1fbe4a1fc272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":1209,"size_decoded":1252,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1009)","md5":"885a1e2c92110451036670f2cbd76588","sha1":"9df6a9db974d3e9fcb83b440930e7d37127889dd","sha256":"afe9329268622d6df38300e76fc355b51001e048649edef2cfac10e73f5bc0da","sha512":"c9bc47e8cb8f89ff6f50202b85f84d0a283246429e046f7d59aa93b4b67651c6e1d3bbdfea0c11e9e6d59c8ad4ff23f6d70cde42718a64d46988a067d0a2d214","ssdeep":"","tlshash":"c621ce2d29680579848e5324ba977d06affe023731186c6cf8dc8b44a6fe5df5a42b03","first_seen":"2026-09-06T12:49:39.64264Z","last_seen":"2026-09-08T10:07:18.429768Z","times_seen":5,"resource_available":true,"data":null}},"time_used":212,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/favicon.ico","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.692Z","timestamp":1788861813692,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitregill.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 13:27:02 GMT","end":"Sat, 05 Dec 2026 13:27:01 GMT"},"fingerprint":{"sha1":"B3:A7:B3:CE:BB:16:1C:08:94:12:16:9E:72:3B:F5:F0:37:71:A6:A2","sha256":"8A:0A:46:33:CB:AE:39:B5:71:39:4B:F3:9D:26:7A:EE:1C:CE:B8:2E:A2:59:B4:13:E0:97:4F:C9:41:97:E2:44"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: pay-bitregill.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Tue, 08 Sep 2026 10:03:33 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 444\r\nConnection: keep-alive\r\nLast-Modified: Fri, 04 Sep 2026 11:02:14 GMT\r\nETag: \"365-65aa6336b3980-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":869,"size_decoded":754,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"987c6dd27b3817d7b38fba8fa16c5140","sha1":"ca15c7234f7e3d6ac1e891d87fe1715269f0c98b","sha256":"97409b06c85f6e81d39a83ea945ca134af36768c682f70caa8400816e9637b7b","sha512":"8643717c56c38d6199d451603deceae6cc649731bfbc0cf8a38de3170219cf02674a856cdb4341dd74d8ecd3d32a085e61602f98c59d4b0c669e72a3ef435788","ssdeep":"","tlshash":"6a111e876cd0c81913100a965c81f819ec87928b8708dd98b5fb40fc8f987ca4d8b9d8","first_seen":"2026-09-06T12:49:39.63478Z","last_seen":"2026-09-08T10:07:18.417328Z","times_seen":5,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.428.4/posthog-recorder.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.703Z","timestamp":1788861813703,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 04:32:20 GMT","end":"Sun, 29 Nov 2026 04:32:19 GMT"},"fingerprint":{"sha1":"12:D9:D6:77:38:5B:C9:F0:5B:CB:FA:8D:A4:FD:DC:38:9C:E2:0F:B0","sha256":"AD:D0:73:85:E5:83:92:52:79:97:D8:28:6A:6A:7F:D7:3B:EB:B2:29:18:06:17:3A:9B:6B:88:71:F6:4C:7B:DD"}}},"request":{"raw":"GET /static/1.428.4/posthog-recorder.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 10:03:33 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a37d1fbfae6ec272-OSL\r\ncf-cache-status: MISS\r\nx-amz-version-id: J7okZlWrI1i7PUsKYypJ3bNaU8WC.hNU\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Tue, 08 Sep 2026 07:36:55 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: aAa7sgyW8EBSFokhxHeUqSf3Fgh+q4/ZrlAObvF7sct8J6TACZsWSi9HZrefUJPI4jcIlbpvmdM9eGB4PZzCZM5SeaUImVtd\r\nx-amz-request-id: VTRCDD7V3ZY0ZJH8\r\netag: W/\"47c58c37ecc12df7aba1227fe68e824f\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":205374,"size_decoded":67095,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"47c58c37ecc12df7aba1227fe68e824f","sha1":"22e7c10ef8f1b266b15d683bcf6da5e29d9627a0","sha256":"464d1f1b0eb502e411d1f4e32ff90bd02d642faa5133fa56df239becb36e0780","sha512":"0b1a84034e6fbe30ae1bf614c7549c66bd8a8f1793a473a2a3e66d09dda2a18d07827e781624dab2f0301fce37067830d7c8c612d536d2d0b8021628fbd6f4a5","ssdeep":"6144:apcm2ARJjPtHnsDqeDPj976GzYNtcEPRd69:am1ARpPtHn8qk9/YTtPRd69","tlshash":"d8142bda7765603257e65159c06f0103e2326a19308b80b8f26fe8e935bc9c7b177f7a","first_seen":"2026-09-08T07:42:26.818212Z","last_seen":"2026-09-08T19:34:06.659572Z","times_seen":20,"resource_available":true,"data":null}},"time_used":176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.428.4/dead-clicks-autocapture.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.704Z","timestamp":1788861813704,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 04:32:20 GMT","end":"Sun, 29 Nov 2026 04:32:19 GMT"},"fingerprint":{"sha1":"12:D9:D6:77:38:5B:C9:F0:5B:CB:FA:8D:A4:FD:DC:38:9C:E2:0F:B0","sha256":"AD:D0:73:85:E5:83:92:52:79:97:D8:28:6A:6A:7F:D7:3B:EB:B2:29:18:06:17:3A:9B:6B:88:71:F6:4C:7B:DD"}}},"request":{"raw":"GET /static/1.428.4/dead-clicks-autocapture.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 10:03:33 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a37d1fbfae73c272-OSL\r\ncf-cache-status: MISS\r\nx-amz-version-id: WXPAWcmdfyyZlEyC46VZOvaszXWpd3kP\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Tue, 08 Sep 2026 07:36:55 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: hm05ypazTd7hDdBN5dz+PhDT6OFHSxUqXYxyN59H/yldUH0NEyYdivdu5M9eW6SBN8BB0fRaMiE=\r\nx-amz-request-id: VTR5Q5XB5NG23CN7\r\netag: W/\"e97a30e75fbc335ec91fd5971eca5d0e\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":18444,"size_decoded":7927,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18392)","md5":"e97a30e75fbc335ec91fd5971eca5d0e","sha1":"2d817e742e1c4fcbb543bf9ce9bf669b2d433186","sha256":"18de037c88059549e3064240f2965976e55dbe8c5750b0eeea57c1413c157f7a","sha512":"222aab707b11548bfdc81d282d5c390df3568d2ed45c80d6fbb7af7f64e30fa5b8e82b7dc186fba66f0eafd8de2e095d4174e6431e6b3669f98bdbf86740d35f","ssdeep":"384:QPaXRK3E0kx4LiA8i6DpE8LWGaW4QuvkYtPcR1KvToFpbNm:QPfEq2pE8XaWDYtPU1CToFpbI","tlshash":"6c82fbccb650f37225db5b5e447f0b03e2266518744a8824b11becc9687cb9162afe7f","first_seen":"2026-09-07T16:36:49.06728Z","last_seen":"2026-09-08T19:34:06.669964Z","times_seen":114,"resource_available":true,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.428.4/web-vitals-with-attribution.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.705Z","timestamp":1788861813705,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 04:32:20 GMT","end":"Sun, 29 Nov 2026 04:32:19 GMT"},"fingerprint":{"sha1":"12:D9:D6:77:38:5B:C9:F0:5B:CB:FA:8D:A4:FD:DC:38:9C:E2:0F:B0","sha256":"AD:D0:73:85:E5:83:92:52:79:97:D8:28:6A:6A:7F:D7:3B:EB:B2:29:18:06:17:3A:9B:6B:88:71:F6:4C:7B:DD"}}},"request":{"raw":"GET /static/1.428.4/web-vitals-with-attribution.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 10:03:33 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a37d1fbfae77c272-OSL\r\ncf-cache-status: MISS\r\nx-amz-version-id: bKLY79mVdQKhdTXVfyioQJy4BReyvQvR\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Tue, 08 Sep 2026 07:36:55 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: wGEl/xOdsA7W+i3nKWv8YzKyerCoqqP2FajKq/evFgK/+OcMyk9VqOEL4fgRFxgWWS2xPt3YqU5clEaqTet73R2D8FUvNvO3\r\nx-amz-request-id: VTR2D2YQ3Q2Q15X9\r\netag: W/\"1a39f0ee07e398ccee173cc331791f43\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25343,"size_decoded":7738,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (25287)","md5":"1a39f0ee07e398ccee173cc331791f43","sha1":"46191cefc203f73d7f23e630a687d98ae47cc09e","sha256":"b46987dbc1a6e14559bac4d8e5d02a4220c5b9d03646cc410df7349486c1e6b5","sha512":"f51f0293003b7c35b5332c913adda19954b6c81a2fed3faf736abd040d89b50d80a9f8d3224877ce7267efcad67cd7095c0edc91b52aae3937b2af3c17137d2d","ssdeep":"384:P+j0oU7M1pcZ3q/yQHi32Zfq0kGFEdQ9EJYkjGNBzvbAp7wO1YU0tw2:P+jluI2Z3q/zC3+pnFEqOJYbAP1YZ3","tlshash":"76b2ead5e952603822f781bb427a4213733aa35254c581ec5abfef9499bc4c623d7f32","first_seen":"2026-09-07T12:37:13.712369Z","last_seen":"2026-09-08T21:09:14.73012Z","times_seen":114,"resource_available":true,"data":null}},"time_used":171,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.144Z","timestamp":1788861813144,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 10:31:27 GMT\r\nexpires: Thu, 02 Sep 2027 10:31:27 GMT\r\ncache-control: public, max-age=31536000\r\nage: 516726\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-09-08T20:34:17.737637Z","times_seen":279125,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":20,"dns":0,"connect":0,"send":0,"wait":30,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/config2.js","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:32.838Z","timestamp":1788861812838,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitregill.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 13:27:02 GMT","end":"Sat, 05 Dec 2026 13:27:01 GMT"},"fingerprint":{"sha1":"B3:A7:B3:CE:BB:16:1C:08:94:12:16:9E:72:3B:F5:F0:37:71:A6:A2","sha256":"8A:0A:46:33:CB:AE:39:B5:71:39:4B:F3:9D:26:7A:EE:1C:CE:B8:2E:A2:59:B4:13:E0:97:4F:C9:41:97:E2:44"}}},"request":{"raw":"GET /config2.js HTTP/1.1\r\nHost: pay-bitregill.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Tue, 08 Sep 2026 10:03:32 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 456\r\nLast-Modified: Fri, 28 Aug 2026 21:53:32 GMT\r\nConnection: keep-alive\r\nETag: \"6a92035c-1c8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":456,"size_decoded":722,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"dd0bb0b681dd646bcffdd1030421caa2","sha1":"c736b5ae4c472ee1a94ca83914b699d858dba945","sha256":"95e2caecfd9c3f2bbae2ca498bd10ab28649fd9bde9cab6e957e6ca79f273c47","sha512":"69b546946e1690b2762cc99a08e6c3915517f5be38d2f42937beafcee73df25938d08325c2681d9a9a1855053ea28a05de14de24ca7e77482b77b2b2d353c03f","ssdeep":"","tlshash":"0af0dcb32626603a5ac8b144d5ed0f8c776331078cccb8603e6c00085b1c60fa535ed0","first_seen":"2026-09-06T12:49:39.644121Z","last_seen":"2026-09-08T10:07:18.413221Z","times_seen":5,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/array.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.107Z","timestamp":1788861813107,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 04:32:20 GMT","end":"Sun, 29 Nov 2026 04:32:19 GMT"},"fingerprint":{"sha1":"12:D9:D6:77:38:5B:C9:F0:5B:CB:FA:8D:A4:FD:DC:38:9C:E2:0F:B0","sha256":"AD:D0:73:85:E5:83:92:52:79:97:D8:28:6A:6A:7F:D7:3B:EB:B2:29:18:06:17:3A:9B:6B:88:71:F6:4C:7B:DD"}}},"request":{"raw":"GET /static/array.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 10:03:33 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a37d1fbc0b07c272-OSL\r\ncf-cache-status: EXPIRED\r\nx-amz-version-id: .JYTP21xp38KKM2xaXkIi1KZ0AElUpei\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Tue, 08 Sep 2026 07:37:00 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: Ng3keeBD2j47j6hIrMKIO2VkJl9BZTrOLPZz37bbx5jvFwq8rgSIVikB4x3mUHebTDO6GZIqA2bBAI0NPeDLsEqiudVnuC3R\r\nx-amz-request-id: VTRA5JH7ZYXWCGEV\r\netag: W/\"bb0663ada90e95da4f32dc36995d9b65\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":287790,"size_decoded":93757,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65526), with no line terminators","md5":"bb0663ada90e95da4f32dc36995d9b65","sha1":"bf0895ffa6293cfda8d4d0ef8f20b0fad4b0f352","sha256":"fa000eb4f59311a01980a1f769629ad42fdba2c3c79e38813fad5237087141a8","sha512":"24632736a09400eb0bbd6bfdb259ccf838d7a7e5e39226c5f7ca8f5e59773fdbc12690315b72a1acff05ea23155cf165b42af6c9c01f825ffb6b42a8a2439775","ssdeep":"6144:relBZ8UltAgkQiEO2sKDrw3UcflZwY7UPA2x:YBJKZKDoUcZ2","tlshash":"4c54f98ab77ad0324ae680a5d03a0113e72a7b0d5509c06cf56fdccd399c9897277f7a","first_seen":"2026-09-08T07:42:26.83928Z","last_seen":"2026-09-08T13:43:13.460445Z","times_seen":14,"resource_available":true,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":4,"connect":2,"send":0,"wait":172,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.428.4/surveys.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.700Z","timestamp":1788861813700,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 04:32:20 GMT","end":"Sun, 29 Nov 2026 04:32:19 GMT"},"fingerprint":{"sha1":"12:D9:D6:77:38:5B:C9:F0:5B:CB:FA:8D:A4:FD:DC:38:9C:E2:0F:B0","sha256":"AD:D0:73:85:E5:83:92:52:79:97:D8:28:6A:6A:7F:D7:3B:EB:B2:29:18:06:17:3A:9B:6B:88:71:F6:4C:7B:DD"}}},"request":{"raw":"GET /static/1.428.4/surveys.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 10:03:33 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a37d1fbfae61c272-OSL\r\ncf-cache-status: MISS\r\nx-amz-version-id: Ml2Xgx3HSzxwJtVBltE4AgMvFIpV54ux\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Tue, 08 Sep 2026 07:36:55 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: Dneiifcg0HRAfXGCoeIC9xatksTI1x1ACEcTPoV+hK7kLe9eF3a8kT6EY3MfOinLGI0O8LMsO24=\r\nx-amz-request-id: VTRFJ8S02JC2GK74\r\netag: W/\"fbf1805db879efe2814e3f4e49731500\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":100335,"size_decoded":34531,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"fbf1805db879efe2814e3f4e49731500","sha1":"8d8b40169b65d7b1d0964723d9f7aaaeda5a6162","sha256":"a8ccd837d1188d7226540a853ad27d58f6784fd509121ebcef1497e26a14be38","sha512":"5fa1fbd246453ee224ec42452d83c0e6144fb268ae811c4a170b47bf1beedc2b38e4880fd30d140f0f847cf88faabadcd7d1ffcadcfc0bbebd8c9bb382b3da0d","ssdeep":"1536:E9XyfFmEjuV7YzciHDS21loe+U1AZ98MgSEGSC/Dq:EZGwEjJQwDS2zl1SEm7q","tlshash":"1fa35cd5ba40e1ad51eb847810be5843f33d3b07ae4d4854b1139cd83dda898a39ffa6","first_seen":"2026-09-07T15:54:41.179513Z","last_seen":"2026-09-08T19:34:06.680733Z","times_seen":142,"resource_available":true,"data":null}},"time_used":172,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu.i.posthog.com/e/","fqdn":"eu.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.40.5.191","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:36.482Z","timestamp":1788861816482,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 16 Nov 2025 00:00:00 GMT","end":"Tue, 15 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"99:B5:42:B0:EF:B1:77:97:C3:FF:B8:89:87:B5:A3:F4:32:08:FE:27","sha256":"BF:C3:D3:B1:0B:53:D4:58:C2:A8:1F:37:4C:D0:F6:A2:F8:E0:1E:BB:05:FA:53:84:BA:CC:BF:1D:78:D1:F7:A5"}}},"request":{"raw":"POST /e/ HTTP/1.1\r\nHost: eu.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: text/plain\r\nReferer: https://pay-bitregill.com/\r\nContent-Length: 923\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 10:03:36 GMT\r\ncontent-type: application/json\r\ncontent-length: 15\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: https://pay-bitregill.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 23\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15,"size_decoded":426,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-09-08T20:39:06.835427Z","times_seen":50146,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":0,"dns":2,"connect":25,"send":0,"wait":51,"receive":0,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitregill.com/assets/index-B5fUkYfB.css","fqdn":"pay-bitregill.com","domain":"pay-bitregill.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:32.844Z","timestamp":1788861812844,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitregill.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 13:27:02 GMT","end":"Sat, 05 Dec 2026 13:27:01 GMT"},"fingerprint":{"sha1":"B3:A7:B3:CE:BB:16:1C:08:94:12:16:9E:72:3B:F5:F0:37:71:A6:A2","sha256":"8A:0A:46:33:CB:AE:39:B5:71:39:4B:F3:9D:26:7A:EE:1C:CE:B8:2E:A2:59:B4:13:E0:97:4F:C9:41:97:E2:44"}}},"request":{"raw":"GET /assets/index-B5fUkYfB.css HTTP/1.1\r\nHost: pay-bitregill.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitregill.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Tue, 08 Sep 2026 10:03:32 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 04 Sep 2026 11:02:11 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a9aa533-98a5\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39077,"size_decoded":9760,"mime_type":"text/css","magic":"ASCII text, with very long lines (39076)","md5":"4917cbc1e3fb27efa222db31528d59ec","sha1":"63124d7dc2e31270290d0b9b6ea792ab62d53a56","sha256":"466cdc1f3bf1bb42b3dc39e1e9d3514adbae66d1e0541f1dd85747935e533de0","sha512":"f9d8fe68a1bf208520e951df3e066a8c48c4c40f2fb7f886c1e1cf5e71292f6f2e6eb9cb9cefff8a9f4d6fdd02386d2b1269f343daa17d8fc5937cd11e965d43","ssdeep":"768:sTlyK4yceiO+wR5fMB7WysfJwW6rM+wnex0Xj04w:sTkHyceiKR5fMoaW6rM+wnei4R","tlshash":"6903a7a4f33add7fac33947e63acf42c610566869d1167dafe02651386c73f21d62228","first_seen":"2026-09-06T12:49:39.645257Z","last_seen":"2026-09-08T10:07:18.427576Z","times_seen":5,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"pay-bitregill.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-bitregill.com/","date":"2026-09-08T10:03:33.143Z","timestamp":1788861813143,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-bitregill.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 10:31:27 GMT\r\nexpires: Thu, 02 Sep 2027 10:31:27 GMT\r\ncache-control: public, max-age=31536000\r\nage: 516726\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-09-08T20:34:17.737637Z","times_seen":279125,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":20,"dns":0,"connect":0,"send":0,"wait":23,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}