{"report_id":"19313ba9-27a3-4294-b083-cc1e67dc3fa7","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-06-24T15:25:24Z","url":{"schema":"https","addr":"redirection-trustpayment.app/","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"35.157.26.135","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"redirection-trustpayment.app/","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"title":"TRON needs authorization to keep working on trust wallet","dom":{"size":6429,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (821)","md5":"322b5f15e0f01ef08ab02905cdb09b1b","sha1":"bacdadd7683a98f50dfa6211b03a291954be2672","sha256":"56dc4f2bbe0388b60f8e714ca6c328af7c77940ef94c79f83b2dbbfacb3b3e92","sha512":"10535547d3acfc5c53788a9ed75562c5fca8b6d6d35feb746d5b9f7e1a294db028f3c826f4d27677d8f53591a760c9e519fc00560d955c8b8f3c10d64d968e52","ssdeep":"96:nk4ZC0uzgLW+bJFAJIAGjZryr2N4lnY/cULmYjmqryr2N4lHQEzh7K:k4Msssre2GlPEre2GlHPzY","tlshash":"69d1730a60e142bc61bf9994eca1161b758cd21bd1cae121b39e8e512fc7cd9fc23c4e","dom_hash":"domhashadd2b7b81d587c93670f6bcc89959088","first_seen":"2026-06-24T15:22:20.416686Z","last_seen":"2026-06-24T15:25:28.524596Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"redirection-trustpayment.app/","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"35.157.26.135","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-29T15:25:24Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-24","alert":"Detects file containing Telegram Bot API","trigger":"redirection-trustpayment.app/dist/dapp.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"redirection-trustpayment.app","ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-06-24T15:22:12.030213Z","last_seen":"2026-06-24T15:22:12.030213Z","alert_count":2,"request_count":6,"received_data":3385953,"sent_data":2980,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}]},{"fqdn":"api.trongrid.io","ip":{"addr":"3.77.5.241","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2018-08-29","domain_rank":1479806,"first_seen":"2018-11-07T07:42:53Z","last_seen":"2026-06-24T15:22:12.640189Z","alert_count":0,"request_count":1,"received_data":24590,"sent_data":586,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"redirection-trustpayment.app/dist/dapp.js","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"md5":"df06c22900afe20d679413da99aff65e","sha1":"b3bdbb6e31335d72fdf1331f00f42848f33f9a34","sha256":"cb5001fc5d07106fa8adccf5a4cd4b5c71f83b96a94e7722467e919308ab7080","sha512":"28e95351dbc7de611af8258a04bba930b723b14c14e9cbf19480abd93a43988d685c6f9ac59a36a8c482683ed793f9ffc05e33f0c8930db1698750bc51ea9924","size":3347566,"token":"8727669700:AAGig1LZ58zZyilm_kxXkd1N58cOMnrsmiM","is_revoked":false,"bot":{"token":"8727669700:AAGig1LZ58zZyilm_kxXkd1N58cOMnrsmiM","user_id":"8727669700","username":"Trxtransactiebot","first_name":"Tron","last_name":"","chat":{"chat_id":"408992628","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"redirection-trustpayment.app/dist/dapp.js","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"introduction_type":"importedModule","is_inline":false,"md5":"df06c22900afe20d679413da99aff65e","sha1":"b3bdbb6e31335d72fdf1331f00f42848f33f9a34","sha256":"cb5001fc5d07106fa8adccf5a4cd4b5c71f83b96a94e7722467e919308ab7080","sha512":"28e95351dbc7de611af8258a04bba930b723b14c14e9cbf19480abd93a43988d685c6f9ac59a36a8c482683ed793f9ffc05e33f0c8930db1698750bc51ea9924","ssdeep":"49152:a5DHQtSGSr5ND/rETKUQwF7UbQFnE/kpbDUUvuywe8GcUs8FCy9t0l:HfYCpbDh8VJ","tlshash":"c5f593486bf720219753f0398a1fdc49b239e80b154ddd587a4ca2e46f5843887fafe9","size":3347566,"data":"","first_seen":"2026-06-24T15:22:20.438642Z","last_seen":"2026-06-24T15:25:28.548126Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-24","alert":"Detects file containing Telegram Bot API","trigger":"redirection-trustpayment.app/dist/dapp.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"info","text":"Download the React DevTools for a better development experience: https://reactjs.org/link/react-devtools","filename":"https://redirection-trustpayment.app/dist/dapp.js","line_number":0,"column_number":0}]},"http":[{"url":{"schema":"https","addr":"redirection-trustpayment.app/dist/style.css","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://redirection-trustpayment.app/","date":"2026-06-24T15:25:01.328Z","timestamp":1782314701328,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redirection-trustpayment.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Jun 2026 17:34:09 GMT","end":"Tue, 15 Sep 2026 17:34:08 GMT"},"fingerprint":{"sha1":"C9:1A:00:47:84:BB:38:06:57:D8:39:97:8F:4D:AE:D2:CD:AB:58:F9","sha256":"C5:35:49:80:1F:FA:8E:AA:AC:6D:01:C4:C4:C3:8A:A5:74:44:AC:D1:27:23:D0:17:66:82:A2:0A:08:57:9C:96"}}},"request":{"raw":"GET /dist/style.css HTTP/1.1\r\nHost: redirection-trustpayment.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redirection-trustpayment.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nage: 199\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=UTF-8\r\ndate: Wed, 24 Jun 2026 15:25:01 GMT\r\netag: \"20854c0cec4b6f59b91b2487f060e9d6-ssl-df\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-nf-request-id: 01KVX3R4GRZQYJAGDHT2Q496K7\r\ncontent-length: 2236\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}],"data":{"size":9498,"size_decoded":2686,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (9497)","md5":"b06fe9cd947da97b2da9a602bc9ba6f9","sha1":"782f6b8b7f04c716cc88da3d022386ae63c2c3e7","sha256":"aa9912ddb6afb619211727e03782b5e423d7a88bfdac2d63b82bd84c8f865063","sha512":"5a91f5a3d7bb7343a545475b3492ee134a5fb99e5ac250b4d0b3972d639c22c224b8712857eef44b8c06158588cb8d59d89adf5ceb1a089776fc10f63edc31bd","ssdeep":"96:K058JJ78Q8hkBBT3/9Kwy/ATrP/9Kwy/ATEO1wSoumZnBebJJfR7jroFigf2x6ij:nC9JycH9Jyw1wcjbA9yrnlVn","tlshash":"67120cdd6260309e3c438cefdd946d55711928d3aa2efbe7b88203036af71a55bd1207","first_seen":"2026-06-24T15:22:20.43234Z","last_seen":"2026-06-24T15:25:28.526565Z","times_seen":2,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redirection-trustpayment.app/dist/dapp.js","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redirection-trustpayment.app/","date":"2026-06-24T15:25:01.332Z","timestamp":1782314701332,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redirection-trustpayment.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Jun 2026 17:34:09 GMT","end":"Tue, 15 Sep 2026 17:34:08 GMT"},"fingerprint":{"sha1":"C9:1A:00:47:84:BB:38:06:57:D8:39:97:8F:4D:AE:D2:CD:AB:58:F9","sha256":"C5:35:49:80:1F:FA:8E:AA:AC:6D:01:C4:C4:C3:8A:A5:74:44:AC:D1:27:23:D0:17:66:82:A2:0A:08:57:9C:96"}}},"request":{"raw":"GET /dist/dapp.js HTTP/1.1\r\nHost: redirection-trustpayment.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redirection-trustpayment.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nage: 199\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=UTF-8\r\ndate: Wed, 24 Jun 2026 15:25:01 GMT\r\netag: \"31608f8873b68d4a2a5d8d402046085a-ssl-df\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-nf-request-id: 01KVX3R4GW0ARBAGPMD7CCV6MY\r\ncontent-length: 767714\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}],"data":{"size":3347566,"size_decoded":768180,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (944)","md5":"b86ece7cd6a72332e212c2062c021e0b","sha1":"dc1bc60343a679582f744b6d620cdd6a2bf1c6ed","sha256":"ec2fe89ed576b91c12d000f2023d43f00cc8c532698019817417624a619a0c8a","sha512":"8fdd3433b05b971322a5b886afa76b913ca1f5f9555f46e9dfb0e76b984fd7c17262b32c18150e263cd2f06dfb33f766a0cb07a102033ac74fe9feb55ca17086","ssdeep":"6144:DnnnkP6YbTuToxhUdU3a+HfRR81EFtS5+KOO0m0k7TV/HCKLWoWqGDwIvjqZe6Jz:DnnnLovbbVnx5DwH0QtSTCSr8lkG","tlshash":"0e256088aaf721319653f03d8b6fdc84b239a807164cdd557a4ce2a46f5443887fabdc","first_seen":"2026-06-24T15:22:20.435193Z","last_seen":"2026-06-24T15:25:28.537344Z","times_seen":2,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":122,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-24","alert":"Detects file containing Telegram Bot API","trigger":"redirection-trustpayment.app/dist/dapp.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"api.trongrid.io/wallet/getnodeinfo","fqdn":"api.trongrid.io","domain":"trongrid.io","tld":"io"},"ip":{"addr":"3.77.5.241","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://redirection-trustpayment.app/","date":"2026-06-24T15:25:02.148Z","timestamp":1782314702148,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.trongrid.io","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sat, 24 Jan 2026 00:00:00 GMT","end":"Sun, 21 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"1C:A8:6F:3E:C5:B4:D2:B6:D4:CF:B7:3D:33:C8:01:91:CF:2B:0B:46","sha256":"E7:8C:E0:5E:57:9B:91:63:C3:47:CE:CC:C6:41:11:7B:C7:56:4D:E2:73:35:8C:D4:B1:B1:A6:6C:07:8C:36:50"}}},"request":{"raw":"POST /wallet/getnodeinfo HTTP/1.1\r\nHost: api.trongrid.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://redirection-trustpayment.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redirection-trustpayment.app/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 24 Jun 2026 15:25:02 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: openresty\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":24290,"size_decoded":2888,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"bdeb46d27657e37f47acf7907455d39e","sha1":"6db03358404e1f85ab6040c99eb867cba9288795","sha256":"8117cd0cab7ae5d1b209c6ea21c802997c0cac6bcf45825970e6c75238be285b","sha512":"ecc7a311af21a6d1dab8a2cacb7dc5d92ebda23ada3e3a06f801a2f48b4431e7e73a23e27a847dfc8e0e8a2f8edc580d41444d41178ea89365a4a74177ae0a0d","ssdeep":"192:C+HBp9n/zbFyWFe7/JRunBua1QRGaUO7pX11iLivkFizRXi4WdRiFTJ/1I1H1DaT:V9//FkIy","tlshash":"26b2fe85097a17abe746738a5c0334d34340352a4eca6eb5cb6ce8a9dc0dff8779d44a","first_seen":"2026-06-24T15:25:28.542994Z","last_seen":"2026-06-24T15:25:28.542994Z","times_seen":1,"resource_available":false,"data":null}},"time_used":380,"timings":{"blocked":-1,"dns":2,"connect":22,"send":0,"wait":36,"receive":0,"ssl":320},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redirection-trustpayment.app/favicon.png","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://redirection-trustpayment.app/","date":"2026-06-24T15:25:02.251Z","timestamp":1782314702251,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redirection-trustpayment.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Jun 2026 17:34:09 GMT","end":"Tue, 15 Sep 2026 17:34:08 GMT"},"fingerprint":{"sha1":"C9:1A:00:47:84:BB:38:06:57:D8:39:97:8F:4D:AE:D2:CD:AB:58:F9","sha256":"C5:35:49:80:1F:FA:8E:AA:AC:6D:01:C4:C4:C3:8A:A5:74:44:AC:D1:27:23:D0:17:66:82:A2:0A:08:57:9C:96"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: redirection-trustpayment.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redirection-trustpayment.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nage: 198\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-type: image/png\r\ndate: Wed, 24 Jun 2026 15:25:02 GMT\r\netag: \"424ce5f95b48ebe8022c63e044edf316-ssl\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nx-nf-request-id: 01KVX3R5DK2Y48XANZ6C19MX4Q\r\ncontent-length: 3573\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}],"data":{"size":3573,"size_decoded":3961,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"67cfb8f7a1c657d7363f9d6c64984860","sha1":"2144f31719678726300e52be44782588df63bd10","sha256":"f21812d7d0c440d5020bd83f5e97547ae2457444a62637e18a3829e9eec21ddb","sha512":"0ae58bca633337ca89df9f5d263fdada50683786c1ec14fa7cff526fd82f40d7f019adacb383ce5ad145c489cd585a78406ac3f09e133f47a589fd5bdab3527f","ssdeep":"","tlshash":"77714df200c524383dcea2581fda65dded163d92cc53016fa094659c16e5731d54542d","first_seen":"2026-06-24T15:22:20.420458Z","last_seen":"2026-06-24T15:25:28.544823Z","times_seen":2,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redirection-trustpayment.app/favicon.png","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://redirection-trustpayment.app/","date":"2026-06-24T15:25:02.253Z","timestamp":1782314702253,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redirection-trustpayment.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Jun 2026 17:34:09 GMT","end":"Tue, 15 Sep 2026 17:34:08 GMT"},"fingerprint":{"sha1":"C9:1A:00:47:84:BB:38:06:57:D8:39:97:8F:4D:AE:D2:CD:AB:58:F9","sha256":"C5:35:49:80:1F:FA:8E:AA:AC:6D:01:C4:C4:C3:8A:A5:74:44:AC:D1:27:23:D0:17:66:82:A2:0A:08:57:9C:96"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: redirection-trustpayment.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redirection-trustpayment.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nage: 198\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-type: image/png\r\ndate: Wed, 24 Jun 2026 15:25:02 GMT\r\netag: \"424ce5f95b48ebe8022c63e044edf316-ssl\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nx-nf-request-id: 01KVX3R5DMCB33B667QNB128ZV\r\ncontent-length: 3573\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}],"data":{"size":3573,"size_decoded":3961,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"67cfb8f7a1c657d7363f9d6c64984860","sha1":"2144f31719678726300e52be44782588df63bd10","sha256":"f21812d7d0c440d5020bd83f5e97547ae2457444a62637e18a3829e9eec21ddb","sha512":"0ae58bca633337ca89df9f5d263fdada50683786c1ec14fa7cff526fd82f40d7f019adacb383ce5ad145c489cd585a78406ac3f09e133f47a589fd5bdab3527f","ssdeep":"","tlshash":"77714df200c524383dcea2581fda65dded163d92cc53016fa094659c16e5731d54542d","first_seen":"2026-06-24T15:22:20.420458Z","last_seen":"2026-06-24T15:25:28.544823Z","times_seen":2,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redirection-trustpayment.app/","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-24T15:25:00.969Z","timestamp":1782314700969,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redirection-trustpayment.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Jun 2026 17:34:09 GMT","end":"Tue, 15 Sep 2026 17:34:08 GMT"},"fingerprint":{"sha1":"C9:1A:00:47:84:BB:38:06:57:D8:39:97:8F:4D:AE:D2:CD:AB:58:F9","sha256":"C5:35:49:80:1F:FA:8E:AA:AC:6D:01:C4:C4:C3:8A:A5:74:44:AC:D1:27:23:D0:17:66:82:A2:0A:08:57:9C:96"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: redirection-trustpayment.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nage: 199\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Wed, 24 Jun 2026 15:25:01 GMT\r\netag: \"07244a6decf52314737f1ea12216df1d-ssl-df\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-nf-request-id: 01KVX3R48WYPJDSX3FYHYAV1X5\r\ncontent-length: 1638\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}],"data":{"size":8696,"size_decoded":2089,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (593)","md5":"360750eb131be790a5cf110bc0b365f0","sha1":"0e82d14597c342b3cf14251ebc1903f73806327e","sha256":"90a05f402d9c7fb711bc46273a9e4eeb88176dfa2bf8e39410011dc9b33fa193","sha512":"5579175d66e516e9c8f94adb692e6c4770af606c9070c232d23428d070503abdb1f53900d55cf0867ca9e8c16db9d94dee8a601f211fa27074af76204e9bbe0c","ssdeep":"96:UWSwjm+a5FAJIAGjRryr2N4lPCAmCIryr2N4lPQEzR74:U/sUre2GlSre2GlPPzm","tlshash":"1702844664e146f8607f48a4ecb2261b690ce25be1caa51973dd8d502fc3cd9fc62c9d","first_seen":"2026-06-24T15:22:20.426169Z","last_seen":"2026-06-24T15:25:28.545652Z","times_seen":2,"resource_available":true,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":50,"connect":23,"send":0,"wait":23,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redirection-trustpayment.app/assets/main.css","fqdn":"redirection-trustpayment.app","domain":"redirection-trustpayment.app","tld":"app"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://redirection-trustpayment.app/","date":"2026-06-24T15:25:01.326Z","timestamp":1782314701326,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redirection-trustpayment.app","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Jun 2026 17:34:09 GMT","end":"Tue, 15 Sep 2026 17:34:08 GMT"},"fingerprint":{"sha1":"C9:1A:00:47:84:BB:38:06:57:D8:39:97:8F:4D:AE:D2:CD:AB:58:F9","sha256":"C5:35:49:80:1F:FA:8E:AA:AC:6D:01:C4:C4:C3:8A:A5:74:44:AC:D1:27:23:D0:17:66:82:A2:0A:08:57:9C:96"}}},"request":{"raw":"GET /assets/main.css HTTP/1.1\r\nHost: redirection-trustpayment.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redirection-trustpayment.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nage: 199\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=UTF-8\r\ndate: Wed, 24 Jun 2026 15:25:01 GMT\r\netag: \"dbd7a5d1fa000ca2e792deb9c42a7116-ssl-df\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-nf-request-id: 01KVX3R4GP76M4RVAD32C9RS8T\r\ncontent-length: 2784\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10454,"size_decoded":3234,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (8181)","md5":"e66076713d2c825acc2d6a0c6de1944a","sha1":"64f47e09dfe399d236bf59e926be22c150e7a149","sha256":"0c8c9be11b3db367735f4945f941ee3e7f1d0077b8ba2721f874f7c7455fd72a","sha512":"49c803223aafdfb3970f3db7a3bd54cac93c2b333a70446cd52d72b282b2ecfbfdb6ba1025d375b5e14adc1122318ff213d72a2ab2247890a9d50ffd4e2ce421","ssdeep":"192:Y7JXSS7JXSdiJ+eWVtDnOMwhw5Uv/lpkj:GFtlMwhwat8","tlshash":"2122551ea755042bbd6384fae9d4b659701774c1de2ad7fba8836500ebe61f328d3304","first_seen":"2026-02-11T15:12:46.882248Z","last_seen":"2026-06-24T15:25:28.546558Z","times_seen":5,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}