{"report_id":"188c3dff-252e-4407-9e8a-a039f3f9b9df","version":0,"status":"done","tags":[],"date":"2026-09-17T11:33:07Z","url":{"schema":"http","addr":"userpaid.app/","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"104.21.53.43","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"userpaid.app/","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"title":"$PAID Holder Crates · PAID","dom":{"size":65608,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (12771)","md5":"d9e87c5f61fcb2b15ecf862c3dee4a92","sha1":"367f68419f32ae2add1655a43000c40b4f20dcab","sha256":"2123127a73076b7cdb8dfc9ca8da421b25228e21f620e9601a86c48677ac548c","sha512":"63f52dc00fc043a3a9bc35b31074b1a5587fdf8a2998ba880483abf499f0872060aad98bfabd4c69564d1cd7da7e19f15e3d4bd209f14e79bbba769641faf108","ssdeep":"1536:kzctw3XF0gXnZ0XIyr9w3XF0gXnZ0XIyrFw3XF0gXnZ0XIyr9gZ:CXFnJ05MXFnJ05kXFnJ05g","tlshash":"54538d7372a1a03aa133e881a586534f3c24e407d9478764f5ac53e5cfc79e6dae93c8","dom_hash":"domhash444892f70683e62d4471d649b9cb993e","first_seen":"2026-09-17T11:33:09.141112Z","last_seen":"2026-09-17T11:33:09.141112Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"userpaid.app/","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"104.21.53.43","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-22T11:33:07Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"userpaid.app","ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-17T11:19:27.533101Z","last_seen":"2026-09-17T11:19:27.533101Z","alert_count":0,"request_count":6,"received_data":782973,"sent_data":2929,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"userpaid.app/","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c597149a12a11b2466c940dc0af5b772","sha1":"86d138c470da062f60e80a6c14949261fcc49ea6","sha256":"815e7bdfa14960e23b9808193cccc731548ce251db8ace5cf656063e12f15655","sha512":"3e2a32ec923f5ea72503122b8eb780c68cc94dd36a62b6a1b0041e2dfb965de344848b884294de2a46c00bbbb1223d50ba9474ffa3ef5d56ae8eba5969a520e2","ssdeep":"","tlshash":"27c08055e970cee1c51c10aa513463dc75583c2d51d364c5d2bcdcd7648dfc61f4c924","size":180,"data":"","first_seen":"2026-07-26T12:54:14.996794Z","last_seen":"2026-09-17T11:33:09.148849Z","times_seen":2156,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"userpaid.app/","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"306ef92fd3cd6d80b6a9dfc2e604f0cf","sha1":"18fc73ecc61a0859bb5d35acb438d8ba8e1915fd","sha256":"9deb7db1d5f60d9e5a691333270742b6f0cef4a777dbfcaee9e7c5c2747e33d0","sha512":"949013cfaabe9c2b19319592e1bf43fb614cac28d6818aa3064a563999a8a06a7396614985a762c57ba05f7b68c69d9f115f077fb4b37cd23092821b6d05e40a","ssdeep":"","tlshash":"6951ed273ae63026e7a7627752ef234c2835b50758c3db223a9c59902fa1e00927dfc4","size":3113,"data":"","first_seen":"2026-09-17T11:19:31.742694Z","last_seen":"2026-09-17T11:33:09.149825Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"userpaid.app/secureproxy?s=%2Fipfs%2F-R4adm_kdWnVSAmrBhbrhwbfcd00970f4a5cace5c773d589f50a7b%3Ft%3D1789644757157","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc397290bc377ffd88e983e9512794ca","sha1":"53b5d40c1d62c5f9e8ac3777adc16787905959bd","sha256":"cbf34e4cbfe91465f56f868ee74fb1c4a4b14a5b1897d9c3ee01c1faaa53bf3d","sha512":"57f3897b816d316c4df6aa2580c84f31fb5b286383c83c4f72e5f43c6f24191c2a00ac1deb13feeda6d67d770136d693d07ab26835b96acef69ae30827cb4284","ssdeep":"6144:ch5gDtrq9NWCEiox3Ti/1gFQZDeoV5oMPNFppHSyyA:csFq9NWCEiox3Ti/ESVPHSyyA","tlshash":"0dd4cbd0b34a56bbd8d6b2b7043349afdfa82906064b188bd2e7dce4725470791dc9bc","size":645587,"data":"","first_seen":"2026-09-17T11:33:09.147086Z","last_seen":"2026-09-17T11:33:09.147086Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"userpaid.app/favicon.ico","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://userpaid.app/","date":"2026-09-17T11:32:37.496Z","timestamp":1789644757496,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"userpaid.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 16:40:57 GMT","end":"Tue, 15 Dec 2026 16:40:56 GMT"},"fingerprint":{"sha1":"14:4A:C4:2F:AD:32:00:34:EF:3A:92:EF:A0:13:66:08:A8:3A:C9:6A","sha256":"56:89:B9:68:FD:E4:4B:C2:AB:D4:DD:7D:5A:6D:D6:7C:0B:4B:E3:4D:D1:52:38:66:CF:FC:15:F4:C8:BF:09:E2"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: userpaid.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://userpaid.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Thu, 17 Sep 2026 11:32:37 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 16 Sep 2026 18:33:36 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E%2BuAnn4xoPhgBbvqqYQ4cHy6BZ0fJUxyCY51DA%2B8gBlgGoQvH0fHBvhrHKYKq74FgpOhzNb4tg7RrPknvwEq9JnNwZVN85QGztNvt1d0yNTAhh4rGhAntPujRVilKKk%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=6,i=?0\r\nage: 821\r\nvary: accept-encoding\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3c7ca9659113181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65438,"size_decoded":18076,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (12771)","md5":"5f4a32dc0a47b8ba796158d4c2646c4d","sha1":"2bba9a4068c6e72dc7a3a482849c93e736d015bd","sha256":"2bf998b3e4cf57f8f2deccd656b013509afebab10a78356c2fde702252967f50","sha512":"9dd7a9525bf1c9c7bcb6ffd6632c3b20a14671d69db45da2fa74d193a5c7c972fde15c5ebea721804641b14bdd9d025895331e74c310e8da265fb6ab8e25f18b","ssdeep":"1536:NmCUw3XF0gXnZ0XIyrfw3XF0gXnZ0XIyrow3XF0gXnZ0XIyr9gZ:DXFnJ05aXFnJ051XFnJ05g","tlshash":"5c538d737261a03aa133e8816586578f3c24e407d8478764f5ac53e5cfc79e6daea3c8","first_seen":"2026-09-17T11:19:31.736443Z","last_seen":"2026-09-17T11:33:09.144449Z","times_seen":3,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"userpaid.app/secureproxy?s=%2Fjmpd%2F","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://userpaid.app/","date":"2026-09-17T11:32:38.226Z","timestamp":1789644758226,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"userpaid.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 16:40:57 GMT","end":"Tue, 15 Dec 2026 16:40:56 GMT"},"fingerprint":{"sha1":"14:4A:C4:2F:AD:32:00:34:EF:3A:92:EF:A0:13:66:08:A8:3A:C9:6A","sha256":"56:89:B9:68:FD:E4:4B:C2:AB:D4:DD:7D:5A:6D:D6:7C:0B:4B:E3:4D:D1:52:38:66:CF:FC:15:F4:C8:BF:09:E2"}}},"request":{"raw":"POST /secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: userpaid.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://userpaid.app/\r\ncontent-type: application/json\r\nContent-Length: 1342\r\nOrigin: https://userpaid.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1342,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QB6wLPAigAEAASA98CJwBCAzAAAgEAagMAAO8nhn2XtsKCAZ1QFhaMoVJXsnQXsIYCAAC9je9yKLIAtx9dWvQLX4u-wb3SwG1rwnampJf3aZZEolITVTFJfqqChoxG8XSdXIA-w0JHRHTM4_KJ_hfk0p1hmAI4wKnsa0Fnlfg4C-1ovSq-WlRicmdMU4s_gw2HMzoAlvHsnge1nu1XC1gViUePyuXuOyAr4Gor5uZ--dfH4JimoZgyrrz5D32eY8XdMs8uy1Y3ITEXJvMJrSQiMEb4e7862Cva_0k2Oi5uLh0ZVdWuf_VyYfycUjWbADQS0CmGZnbrj0fANfiyug5ki8sLm1Jk9qH6mYMBrPBO5kURDcZDpI0gSCTJRFKbOdYfxoRfl2D_LV_-CEipDG5VWixQvurj6JspvLhJsAywKNJe8YhfnxoVPsNJZzcvbOpbNnsem_1eda4IUEGSgwUzMoLQmGQFLt0Ay3URVFBSn12YONuhGr5WqolGFHH-8qAGtQq6yay_WhtPmAfOzPKHSrlQK8Wn3AHh0fjQOgYNRWE4QSWEW7CHJM-Cza0wE98s0D9vga6pc8iDo7uaoeV0kQ6yFIuIqZkqHPzHsKDdworKxqM7zJUtRjmHpJlcjKztU9UKEidjAsag3CDAKNTDTEp9P8EkHZBAmkZKOh6sNolGCN3jVM-YppWg8Qm4tbO4Vt3nSH_Rx-_JrJm8bMCn1w5fou58qfiFOyu40igXPfKYHxOrD7_nwQRs3sXU14n1yaQZ41ObqSO0RehqKzAlrTlmtnx0dasNz9mzFeDrt9lDJwK4Qs3zxFjCYGkwFE2lJpef8Ev43JF32QWVFqF64TeOzicO_4i3bxTfvKI-OfKQPozzfRg4t100KqxsndkjymKuuaw1VBTM9x3mqYVc3bxI7P4W_avmhsPbCPxXCefjKQ1NH7mDuzur-BYK1vAWe4kV49x5_pRZ-IUTjErTbcdbZgPwalDfG1g41yM7P_bsI2Qmk8uythmTuUH_aQ9qLTW2zBfNIG5fsPOW2tlDhENJAs2baQk2FTjd10EOZ__vTJv6vqs5rjiBY3_U9E2eqL5QcFJcqTC0KHsTMPo7nJtrFid1-gNwWO60SyvGKVgnEn-w3FfjCrjGNOQ_PyOQXNPxR1RIclz_3lwOdDaRXqPti567lhSFoiQRBerEye8Jmv0q6bCSY7zOdR-GNqhqGHMwCxLRNe4gvlkwg0WuvnDR5ro53cuuUi5bGS42sDYzacgQ\",\"challenge\":null}"}},"response":{"raw":"HTTP/3 204 \r\nserver: cloudflare\r\ndate: Thu, 17 Sep 2026 11:32:39 GMT\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"a-bAsFyilMr4Ra1hIU5PyoyFRunpI\"\r\nx-ratelimit-limit: 20\r\nx-ratelimit-remaining: 19\r\nx-ratelimit-reset: 1789644818363\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 204\r\ncdn-cachedat: 09/17/2026 11:32:38\r\ncdn-edgestorageid: 1445\r\ncdn-requestid: 18ab5e3c210d654b1691af726a6fab7b\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xD6C0yVWRlkDgoeog6P33IIUSPf9lfIZU0ZQgzPpLHzPNtSeJHLCVunvaotueaHjVkdNL0rY6i2OGJID5oSkCwXXn4t16uNguGZy0VU8t1WX1NM3IKuT7ULr8qyxNts%3D\"}]}\r\ncf-ray: a3c7ca9ae9eb3181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":3283,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T17:41:52.790885Z","times_seen":18519253,"resource_available":true,"data":null}},"time_used":803,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":803,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"userpaid.app/","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-17T11:32:36.751Z","timestamp":1789644756751,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"userpaid.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 16:40:57 GMT","end":"Tue, 15 Dec 2026 16:40:56 GMT"},"fingerprint":{"sha1":"14:4A:C4:2F:AD:32:00:34:EF:3A:92:EF:A0:13:66:08:A8:3A:C9:6A","sha256":"56:89:B9:68:FD:E4:4B:C2:AB:D4:DD:7D:5A:6D:D6:7C:0B:4B:E3:4D:D1:52:38:66:CF:FC:15:F4:C8:BF:09:E2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: userpaid.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Thu, 17 Sep 2026 11:32:36 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Wed, 16 Sep 2026 18:33:36 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rhHlY8S%2FrNs2swdyS7BVc5fswfpwxDMi1jORGMtFAe6pyisS4LLpN4n6h0mvBJajThFY4P0rmwTjUcNnbeMbt82Z0gqhKzwHNeetWZxr1gVH7o05YYc9sS8rqR9TvfU%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\npriority: u=0,i\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3c7ca91fff03181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65438,"size_decoded":17647,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (12771)","md5":"5f4a32dc0a47b8ba796158d4c2646c4d","sha1":"2bba9a4068c6e72dc7a3a482849c93e736d015bd","sha256":"2bf998b3e4cf57f8f2deccd656b013509afebab10a78356c2fde702252967f50","sha512":"9dd7a9525bf1c9c7bcb6ffd6632c3b20a14671d69db45da2fa74d193a5c7c972fde15c5ebea721804641b14bdd9d025895331e74c310e8da265fb6ab8e25f18b","ssdeep":"1536:NmCUw3XF0gXnZ0XIyrfw3XF0gXnZ0XIyrow3XF0gXnZ0XIyr9gZ:DXFnJ05aXFnJ051XFnJ05g","tlshash":"5c538d737261a03aa133e8816586578f3c24e407d8478764f5ac53e5cfc79e6daea3c8","first_seen":"2026-09-17T11:19:31.736443Z","last_seen":"2026-09-17T11:33:09.144449Z","times_seen":3,"resource_available":true,"data":null}},"time_used":275,"timings":{"blocked":-1,"dns":22,"connect":17,"send":0,"wait":201,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"userpaid.app/paid_files/css2","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://userpaid.app/","date":"2026-09-17T11:32:37.167Z","timestamp":1789644757167,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"userpaid.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 16:40:57 GMT","end":"Tue, 15 Dec 2026 16:40:56 GMT"},"fingerprint":{"sha1":"14:4A:C4:2F:AD:32:00:34:EF:3A:92:EF:A0:13:66:08:A8:3A:C9:6A","sha256":"56:89:B9:68:FD:E4:4B:C2:AB:D4:DD:7D:5A:6D:D6:7C:0B:4B:E3:4D:D1:52:38:66:CF:FC:15:F4:C8:BF:09:E2"}}},"request":{"raw":"GET /paid_files/css2 HTTP/1.1\r\nHost: userpaid.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://userpaid.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Thu, 17 Sep 2026 11:32:37 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Wed, 16 Sep 2026 18:28:08 GMT\r\netag: \"6aaadfb8-35b4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LA9kpeEoXzZd7ApLMf%2BCy9yct1EH8LgZe989Jgy4SECdTW3IYDDZPd%2FGwWeOCM1CqqQtxNcq3ddlYz8Z66MDtnyNL0nJWcDNei69wUn7UW49qIhUgp3jeHtJk0f12Lo%3D\"}]}\r\ncf-ray: a3c7ca9448943181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13748\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T17:41:52.790885Z","times_seen":18519253,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"userpaid.app/paid_files/BmgkEEDttxO6.js.download","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://userpaid.app/","date":"2026-09-17T11:32:37.168Z","timestamp":1789644757168,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"userpaid.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 16:40:57 GMT","end":"Tue, 15 Dec 2026 16:40:56 GMT"},"fingerprint":{"sha1":"14:4A:C4:2F:AD:32:00:34:EF:3A:92:EF:A0:13:66:08:A8:3A:C9:6A","sha256":"56:89:B9:68:FD:E4:4B:C2:AB:D4:DD:7D:5A:6D:D6:7C:0B:4B:E3:4D:D1:52:38:66:CF:FC:15:F4:C8:BF:09:E2"}}},"request":{"raw":"GET /paid_files/BmgkEEDttxO6.js.download HTTP/1.1\r\nHost: userpaid.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://userpaid.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Thu, 17 Sep 2026 11:32:37 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Wed, 16 Sep 2026 18:28:10 GMT\r\netag: \"6aaadfba-825b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HU8nP6C1eHwAuWsehSkyG4SURrf5kGfr0X7DHnWHVMrymU78WduguaXIbpXpM9gUwshn23to7OKU9AxQ9x%2B6PG2OV9giVrUU%2BXbVpKlYSemqq3XEFHRCx8%2FZIkLgsiE%3D\"}]}\r\ncf-ray: a3c7ca9448953181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 33371\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T17:41:52.790885Z","times_seen":18519253,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"userpaid.app/secureproxy?s=%2Fipfs%2F-R4adm_kdWnVSAmrBhbrhwbfcd00970f4a5cace5c773d589f50a7b%3Ft%3D1789644757157","fqdn":"userpaid.app","domain":"userpaid.app","tld":"app"},"ip":{"addr":"172.67.208.191","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://userpaid.app/","date":"2026-09-17T11:32:37.172Z","timestamp":1789644757172,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"userpaid.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 16:40:57 GMT","end":"Tue, 15 Dec 2026 16:40:56 GMT"},"fingerprint":{"sha1":"14:4A:C4:2F:AD:32:00:34:EF:3A:92:EF:A0:13:66:08:A8:3A:C9:6A","sha256":"56:89:B9:68:FD:E4:4B:C2:AB:D4:DD:7D:5A:6D:D6:7C:0B:4B:E3:4D:D1:52:38:66:CF:FC:15:F4:C8:BF:09:E2"}}},"request":{"raw":"GET /secureproxy?s=%2Fipfs%2F-R4adm_kdWnVSAmrBhbrhwbfcd00970f4a5cace5c773d589f50a7b%3Ft%3D1789644757157 HTTP/1.1\r\nHost: userpaid.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://userpaid.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Thu, 17 Sep 2026 11:32:37 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"9d9d3-U7XUDB1ixfnorDd3rcFnh5BZWb0\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=0WcnDNOcZ_4CM02dN0Zj9A.js\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/17/2026 11:32:37\r\ncdn-edgestorageid: 879\r\ncdn-requestid: a0541eca612c2adb5f488ee89f54decc\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uMvKIa2sb5cmwpu2quDbFgQs78VIiRXVesiTjLqBQPR79H%2BfrykPpaX1aCcxOkST0GHun%2BsIZATNic%2Fsj8ncQKfg1LGIxa3BXMjhBpEZ%2FOMg579ek8vMiwzDBviTCgU%3D\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: a3c7ca9458963181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":645587,"size_decoded":142488,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"dc397290bc377ffd88e983e9512794ca","sha1":"53b5d40c1d62c5f9e8ac3777adc16787905959bd","sha256":"cbf34e4cbfe91465f56f868ee74fb1c4a4b14a5b1897d9c3ee01c1faaa53bf3d","sha512":"57f3897b816d316c4df6aa2580c84f31fb5b286383c83c4f72e5f43c6f24191c2a00ac1deb13feeda6d67d770136d693d07ab26835b96acef69ae30827cb4284","ssdeep":"6144:ch5gDtrq9NWCEiox3Ti/1gFQZDeoV5oMPNFppHSyyA:csFq9NWCEiox3Ti/ESVPHSyyA","tlshash":"0dd4cbd0b34a56bbd8d6b2b7043349afdfa82906064b188bd2e7dce4725470791dc9bc","first_seen":"2026-09-17T11:33:09.147086Z","last_seen":"2026-09-17T11:33:09.147086Z","times_seen":1,"resource_available":true,"data":null}},"time_used":619,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":532,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}