{"report_id":"41cce46f-8f41-4b13-ab41-46a6fc9c83a3","version":6,"status":"done","tags":[],"date":"2026-03-13T03:01:10Z","url":{"schema":"https","addr":"arcusfinance.net/borrow","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"arcusfinance.net/borrow","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"title":"Arcus Finance — Institutional-Grade Lending on Solana","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T23:49:08.313059Z","times_seen":17808208,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"arcusfinance.net/borrow","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-17T03:01:10Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":7,"urlquery":0,"analyzer":11}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-13T03:00:46Z","timestamp":1773370846,"ip_dst":{"addr":"104.16.249.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":45322,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)","source":"{\"timestamp\":\"2026-03-13T03:00:46.266445+0000\",\"flow_id\":514444704481341,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.43\",\"src_port\":45322,\"dest_ip\":\"104.16.249.249\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2027695,\"rev\":5,\"signature\":\"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_07_09\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2024_04_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"DoH\"],\"updated_at\":[\"2023_10_05\"]}},\"tls\":{\"sni\":\"cloudflare-dns.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3273,\"start\":\"2026-03-13T03:00:46.262205+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-13T03:00:49Z","timestamp":1773370849,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":34034,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-13T03:00:49.047859+0000\",\"flow_id\":367762981625887,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.43\",\"src_port\":34034,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.43\",\"port\":34034},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2598,\"start\":\"2026-03-13T03:00:49.040991+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-13T03:00:49Z","timestamp":1773370849,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":34024,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-13T03:00:49.051152+0000\",\"flow_id\":1099874516967213,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.43\",\"src_port\":34024,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.43\",\"port\":34024},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2598,\"start\":\"2026-03-13T03:00:49.040749+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-13T03:00:49Z","timestamp":1773370849,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":34042,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-13T03:00:49.063021+0000\",\"flow_id\":949065330303514,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.43\",\"src_port\":34042,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.43\",\"port\":34042},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2672,\"start\":\"2026-03-13T03:00:49.041498+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-13T03:00:49Z","timestamp":1773370849,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":34040,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-13T03:00:49.065330+0000\",\"flow_id\":2235100945293626,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.43\",\"src_port\":34040,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.43\",\"port\":34040},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2597,\"start\":\"2026-03-13T03:00:49.041274+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-13T03:00:49Z","timestamp":1773370849,"ip_dst":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":34658,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-13T03:00:49.079909+0000\",\"flow_id\":1235494551755572,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.43\",\"src_port\":34658,\"dest_ip\":\"104.18.54.45\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.54.45\",\"port\":443},\"target\":{\"ip\":\"172.18.0.43\",\"port\":34658},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2598,\"start\":\"2026-03-13T03:00:49.072500+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-13T03:00:49Z","timestamp":1773370849,"ip_dst":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":34670,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-13T03:00:49.087954+0000\",\"flow_id\":1982309907636244,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.43\",\"src_port\":34670,\"dest_ip\":\"104.18.54.45\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.54.45\",\"port\":443},\"target\":{\"ip\":\"172.18.0.43\",\"port\":34670},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2673,\"start\":\"2026-03-13T03:00:49.073748+0000\"}}"}],"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-03-13","alert":"Hunting_JS_WebAssembly","trigger":"link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"arcusfinance.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"cloudflare-dns.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-08-23","domain_rank":0,"first_seen":"2026-02-25T03:05:04.781981Z","last_seen":"2026-03-12T20:07:07.154249Z","alert_count":8,"request_count":8,"received_data":40697176,"sent_data":3880,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cloudflare-dns.com","ip":{"addr":"104.16.249.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-03-28","domain_rank":112,"first_seen":"2015-04-09T01:00:28Z","last_seen":"2026-03-09T13:53:45.620073Z","alert_count":1,"request_count":1,"received_data":521,"sent_data":511,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"link-auth-5157.vercel.app","ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2026-03-13T00:51:59.321144Z","last_seen":"2026-03-13T00:51:59.321144Z","alert_count":0,"request_count":4,"received_data":2853247,"sent_data":2259,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"192.178.204.95","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-03-08T22:19:32.591288Z","alert_count":0,"request_count":1,"received_data":19761,"sent_data":525,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"arcusfinance.net","ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-03-07","domain_rank":0,"first_seen":"2026-03-13T03:01:13.400434Z","last_seen":"2026-03-13T03:01:13.400434Z","alert_count":8,"request_count":8,"received_data":719739,"sent_data":4065,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"192.178.204.94","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-03-08T22:15:01.701196Z","alert_count":0,"request_count":6,"received_data":217470,"sent_data":3315,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","fqdn":"link-auth-5157.vercel.app","domain":"link-auth-5157.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"0d6c1892a2a8c95402547f0e2c20b15f","sha1":"0033700f89bdb89bc3d8e68a392f88c3aa113658","sha256":"87352786d3c34fb048697bc915de13ff90c85c9d2f16dc593ecac73bfc5bde73","sha512":"ee150eef5548e65b6c7f45c90eb250c022cd638a51033bf238aca2650a062493d924978ecf97d7aa9cad7541f46f45a72d8078463d36f94f12c5b7f04fe1a437","ssdeep":"","tlshash":"c3c01243725e7491806541005b237244b805252d68619450bb79cab91f905a7d9b058d","size":178,"data":"","first_seen":"2026-03-13T03:01:18.922405Z","last_seen":"2026-03-13T03:01:18.922405Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/borrow","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"ebb8261cf1025418d9cc1e19084d442d","sha1":"7207a3a915b2396317de43e860b49c7579553c62","sha256":"e6d75be685f6ff4524323882c780d09c501a4748bb9f3bdca6d333adcd9312eb","sha512":"f974fbacaa8662fbb782ccf5ce0a4846177718a359731271038070ef91048916c905b42604af5b0fe68580b70d91229b51c61c832c0b4084b6cda1d6f0161d25","ssdeep":"192:EQg3drpriQeXQIdCpqO4D4ogfoiY+0dhNPnsEsC32pf7kuqGZvkpSFVBbNtqq8jq:XKdqDCpJwskwkEZxtN+NH6R+4n","tlshash":"f592d88ebf93123b66a3616e2bafa25c717650031509cd34bdbd93002f909b51275bfd","size":20833,"data":"","first_seen":"2026-03-13T03:01:18.256492Z","last_seen":"2026-03-24T00:31:00.391394Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/noir.js","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"78060487fec5a4fcacfb7099f800813d","sha1":"7bde79f4339b09cdb1f968b285a5e2a5dc82845b","sha256":"48ed46dca9bb021d57f5adbbba5764a9cc288302f4e71d07290db46f33f77f7b","sha512":"8345aa84eea957f01ecaed4c71d75f94c8e252c42462f466f6feeca3c1864fe757989b15a1b85e1451fa0c94a09b4c7671c454615abca5ff07804e48737e2bd4","ssdeep":"768:g73/CqN0Xs0HoBI/Y8q9lGj//Azm/g89Xn5aPrr9:g73/CqN0Xs0Ia/YZ9lM/oVKXncTB","tlshash":"d5c21a6bce8f3e90cb251e1623ee1dc50a1d5b8a74e348cd960eb7c9815f47a44cc6e9","size":27887,"data":"","first_seen":"2026-03-13T03:01:18.221279Z","last_seen":"2026-03-24T00:31:00.381694Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"0997b4ccb231a063eaa09558e5a019c3","sha1":"6f0cc98cd98401d3f4631f8f49fb7c55fa083e1f","sha256":"3ab239d881f1859e139fcedd05e5b3df67fba92ed081993ae1bf06f5ac26ec5b","sha512":"8eba0a640004ff49201e9d7c7df9abb89c29e971d9aea3f1ed81ab1ce0f49e54c0f887d0d0fa7aecfd870e7b6795fd4bc4c2020c03f75814894bc4df0cf8d228","ssdeep":"","tlshash":"c9d023b62975c930769c03473076e3a426603050b711e14181d8cc7fbe21ed354b559c","size":217,"data":"","first_seen":"2026-03-13T03:01:18.925265Z","last_seen":"2026-03-13T03:01:18.925265Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/borrow","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"8f2a62ac6a950abe6ede209ca4a398b8","sha1":"f614b32898fd8dd0f1b8617deeef6a8f9a592926","sha256":"423a7b01a5858a51a7239b96a62600e2a11ce9be89f1502b98793f3b497a2a9d","sha512":"db7b8fc81018ee52569803e234c67bd7c07f2f28dd1ad74e7dbeba55de24ca7d21b099809d9d8cc510c999381766593f5aeffb8d7e27b6751a24bef584e8aada","ssdeep":"","tlshash":"681100753b2a5534cac5418b317ee7a83e3260217a02e084c36ccc399d18e8314efcbe","size":902,"data":"","first_seen":"2026-03-13T03:01:18.932574Z","last_seen":"2026-03-13T03:01:18.932574Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/assets/index-VIWygw2o.js","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f5ccf1023d72d033bdbb73e9e382a176","sha1":"6d5f99e0bcfb2c27d863bbb080d1a3768a1cbfa5","sha256":"d3bf19a53d3a7d0ec1c934ffee14108b8deef7d258f8339fa8bc4a4d311e99c5","sha512":"70beed520529a2630b07021b50494baae027dbeb7fd1ead6448d7a14f5d72d0ec42bc1900313823a8df91a52146b31ffa06093761c9ca9246ed40a00537c5423","ssdeep":"12288:IMrHt40KOsDP6ztGqE5U/Uloq3yaAN/bg0d47gM:IoHtG0oja/Uloq3yaAN/bgE47gM","tlshash":"2dc49ed87145b669a7e305e1506f4206b23e1d16b40e8464f03ceceb6a7150ba2bbffd","size":562329,"data":"","first_seen":"2026-03-13T03:01:18.235551Z","last_seen":"2026-03-13T03:01:18.905025Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0bf159b96f2dca5cecaf7f6e5bbe8412","sha1":"24377f59b012ba1f923e91085d519480c2ad512e","sha256":"c7794d6f19b1061ed2ef40a49eb0b0e69f4e16d44784d19a7fe13e01f8a1b0ae","sha512":"d0e5d7c0eb7ee9b9a4ba181a0860faa2220c430bb9b6198ab821dd4c574e884df5c6cdcc49c6ff7100290b2a53106a870c8ce8899cf3e95f8e3db3879b1ae078","ssdeep":"384:zHgOGsxqo2t6/EPNmGiniCw6XvKPyfzkdfJpMwtccP11Nil1Eqmq5cg1xUU/K7my:zHgOGsqUiHM0JJWvcPA8ucgX5K7h","tlshash":"80c2d9c630cb7579b36570b0346ff0ea6ab97d94710c8a65c12498f0bca5368e87be1d","size":27114,"data":"","first_seen":"2026-03-13T02:59:02.244263Z","last_seen":"2026-03-13T03:28:24.791889Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","fqdn":"link-auth-5157.vercel.app","domain":"link-auth-5157.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"579aafb3e09073c3efbc40790d25c7d9","sha1":"1009a654ee495236517de0cecd4f51229a607376","sha256":"0f9d06911491dfd8215a44d2f1f412b233f684df836496531c255301b1499e89","sha512":"09c5e9c51932d6579302b20f676bbc5a37203235a21f456d712a66764902a88fce5d93a6e0a0f15c93db782162a545afeaa0c4a9f1a6f6790f9f9de36114e610","ssdeep":"49152:84+xtaUFAYp8Su3ilTYDMsvpXrdVCiG/NdUgmS9UT9bCWCawOJGSH17129hBpWLX:WxuitgJCWCawOJj","tlshash":"75d57cb073b1707907e792d454a71100f234a44a700984bcfbec95e7af9aaca957bf78","size":2844606,"data":"","first_seen":"2026-03-13T03:01:18.935134Z","last_seen":"2026-03-13T03:01:18.935134Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-03-13","alert":"Hunting_JS_WebAssembly","trigger":"link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"arcusfinance.net/borrow","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-13T03:00:45.177Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arcusfinance.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 23:26:12 GMT","end":"Fri, 05 Jun 2026 23:26:11 GMT"},"fingerprint":{"sha1":"1D:65:9C:8B:F3:3B:3C:45:B6:27:1D:FA:4A:BA:B1:49:F6:1A:92:DF","sha256":"FF:65:1E:AB:7D:75:08:E8:B8:EB:C5:03:0D:BA:FE:CC:84:CE:98:69:50:8E:21:95:AD:31:54:24:EE:2D:0E:6B"}}},"request":{"raw":"GET /borrow HTTP/1.1\r\nHost: arcusfinance.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 13 Mar 2026 03:00:45 GMT\r\ncontent-type: text/html; charset=utf-8\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rpzzq%2F3WHFre1UGifM5xijQhts42kG8gGwHflxtgoFnYfHI05LZGSgyBG%2FB5xYu0Bqka%2FK1%2BTYHC2gqJAcwQJ99FhCdaAdiNOyTKn9qQc4A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sun, 08 Mar 2026 01:12:56 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9db7ca469ddb120a-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2545,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (928)","md5":"b02d20c42dd55b94f16aea7bf9de40e4","sha1":"27e20ef9b8ed64824029a47f21575c7744d80688","sha256":"66aca92a24cb864de3170108a2bbd65c6a0f457b314a86953bc6f25ab4b4935e","sha512":"7c891022bce42f58ecec7b0f79e953a2ce05afffc4ac49e0ad3754d638998de0164cd8d014cb5275e9f31170b000eb7bd267d34b40165ca613be6282c17bc0f0","ssdeep":"","tlshash":"735123775a5088385261812924e6f30dad76e053d7049588b6acd8ee4fc4ec684ffab9","first_seen":"2026-03-13T03:01:18.89042Z","last_seen":"2026-03-13T03:01:18.89042Z","times_seen":1,"resource_available":false,"data":null}},"time_used":299,"timings":{"blocked":33,"dns":16,"connect":3,"send":0,"wait":227,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"arcusfinance.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/spacegrotesk/v22/V8mDoQDjQSkFtoMM3T6r8E7mPbF4Cw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.204.94","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.406Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:00 GMT","end":"Mon, 27 Apr 2026 08:37:59 GMT"},"fingerprint":{"sha1":"43:A0:56:D7:CE:45:C9:96:6F:34:12:13:53:CC:34:DD:63:FB:5D:20","sha256":"A4:AF:37:76:AF:D3:DB:1B:79:93:8F:E9:D4:21:4B:BA:43:54:3D:F9:56:DC:18:E9:5C:CA:1A:7C:B2:C7:DF:9B"}}},"request":{"raw":"GET /s/spacegrotesk/v22/V8mDoQDjQSkFtoMM3T6r8E7mPbF4Cw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://arcusfinance.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 22288\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 10 Mar 2026 06:58:25 GMT\r\nexpires: Wed, 10 Mar 2027 06:58:25 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:26:34 GMT\r\ncontent-type: font/woff2\r\nage: 244941\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22288,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22288, version 1.0","md5":"87c506d88b9f587f0e2292bc271f5083","sha1":"c0781ea2f29013826dc1eb8db40f4d400d9df710","sha256":"0640890476fc1198ab4de571fb658de443c4d85b66466ec09534a8737ab1ce9d","sha512":"25171eb14ce4c75ccfdb6f1c2a7de82182fd8d3d79cfa108df2d0e015e4ac84678ad97fdf90cff2ac2f24934531fcca3289343129687f176f21964ce5cd01b02","ssdeep":"384:TB/NWnO5qgQvU7gd7EeEX5qPOJO4FqaCEuAsCyzvDfxPdjuHsrC:TBlo1vUsvZqO4MAsCKrxxuMrC","tlshash":"8aa2e15b3f6bde211a27aebf4fc957b0a3ac6c1db2dd2712c198b104408962cc5d5ce6","first_seen":"2025-09-05T05:08:09.568652Z","last_seen":"2026-08-09T23:33:03.619715Z","times_seen":26983,"resource_available":false,"data":null}},"time_used":525,"timings":{"blocked":236,"dns":6,"connect":48,"send":0,"wait":41,"receive":14,"ssl":171},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.204.94","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.413Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:00 GMT","end":"Mon, 27 Apr 2026 08:37:59 GMT"},"fingerprint":{"sha1":"43:A0:56:D7:CE:45:C9:96:6F:34:12:13:53:CC:34:DD:63:FB:5D:20","sha256":"A4:AF:37:76:AF:D3:DB:1B:79:93:8F:E9:D4:21:4B:BA:43:54:3D:F9:56:DC:18:E9:5C:CA:1A:7C:B2:C7:DF:9B"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://arcusfinance.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 10 Mar 2026 07:34:47 GMT\r\nexpires: Wed, 10 Mar 2027 07:34:47 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nage: 242759\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-09T23:47:22.934303Z","times_seen":255745,"resource_available":false,"data":null}},"time_used":819,"timings":{"blocked":373,"dns":0,"connect":55,"send":0,"wait":45,"receive":24,"ssl":305},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/spacegrotesk/v22/V8mDoQDjQSkFtoMM3T6r8E7mPbF4Cw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.204.94","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.419Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:00 GMT","end":"Mon, 27 Apr 2026 08:37:59 GMT"},"fingerprint":{"sha1":"43:A0:56:D7:CE:45:C9:96:6F:34:12:13:53:CC:34:DD:63:FB:5D:20","sha256":"A4:AF:37:76:AF:D3:DB:1B:79:93:8F:E9:D4:21:4B:BA:43:54:3D:F9:56:DC:18:E9:5C:CA:1A:7C:B2:C7:DF:9B"}}},"request":{"raw":"GET /s/spacegrotesk/v22/V8mDoQDjQSkFtoMM3T6r8E7mPbF4Cw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://arcusfinance.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 22288\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 10 Mar 2026 06:58:25 GMT\r\nexpires: Wed, 10 Mar 2027 06:58:25 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:26:34 GMT\r\ncontent-type: font/woff2\r\nage: 244941\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22288,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22288, version 1.0","md5":"87c506d88b9f587f0e2292bc271f5083","sha1":"c0781ea2f29013826dc1eb8db40f4d400d9df710","sha256":"0640890476fc1198ab4de571fb658de443c4d85b66466ec09534a8737ab1ce9d","sha512":"25171eb14ce4c75ccfdb6f1c2a7de82182fd8d3d79cfa108df2d0e015e4ac84678ad97fdf90cff2ac2f24934531fcca3289343129687f176f21964ce5cd01b02","ssdeep":"384:TB/NWnO5qgQvU7gd7EeEX5qPOJO4FqaCEuAsCyzvDfxPdjuHsrC:TBlo1vUsvZqO4MAsCKrxxuMrC","tlshash":"8aa2e15b3f6bde211a27aebf4fc957b0a3ac6c1db2dd2712c198b104408962cc5d5ce6","first_seen":"2025-09-05T05:08:09.568652Z","last_seen":"2026-08-09T23:33:03.619715Z","times_seen":26983,"resource_available":false,"data":null}},"time_used":776,"timings":{"blocked":364,"dns":1,"connect":51,"send":0,"wait":42,"receive":6,"ssl":297},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js?","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.517Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arcusfinance.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 23:26:12 GMT","end":"Fri, 05 Jun 2026 23:26:11 GMT"},"fingerprint":{"sha1":"1D:65:9C:8B:F3:3B:3C:45:B6:27:1D:FA:4A:BA:B1:49:F6:1A:92:DF","sha256":"FF:65:1E:AB:7D:75:08:E8:B8:EB:C5:03:0D:BA:FE:CC:84:CE:98:69:50:8E:21:95:AD:31:54:24:EE:2D:0E:6B"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js? HTTP/1.1\r\nHost: arcusfinance.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ndate: Fri, 13 Mar 2026 03:00:46 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: 9db7ca4ebb5235a6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27114,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (27114), with no line terminators","md5":"0bf159b96f2dca5cecaf7f6e5bbe8412","sha1":"24377f59b012ba1f923e91085d519480c2ad512e","sha256":"c7794d6f19b1061ed2ef40a49eb0b0e69f4e16d44784d19a7fe13e01f8a1b0ae","sha512":"d0e5d7c0eb7ee9b9a4ba181a0860faa2220c430bb9b6198ab821dd4c574e884df5c6cdcc49c6ff7100290b2a53106a870c8ce8899cf3e95f8e3db3879b1ae078","ssdeep":"384:zHgOGsxqo2t6/EPNmGiniCw6XvKPyfzkdfJpMwtccP11Nil1Eqmq5cg1xUU/K7my:zHgOGsqUiHM0JJWvcPA8ucgX5K7h","tlshash":"80c2d9c630cb7579b36570b0346ff0ea6ab97d94710c8a65c12498f0bca5368e87be1d","first_seen":"2026-03-13T02:59:02.244263Z","last_seen":"2026-03-13T03:28:24.791889Z","times_seen":5,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"arcusfinance.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/cdn-cgi/challenge-platform/h/g/jsd/oneshot/ea2d291c0fdc/0.5096034414901575:1773368879:f5hEJtP72ZuFv6qXZ5a1h0dE3IBHkgqIOuLSLGnMeeo/9db7ca469ddb120a","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.788Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arcusfinance.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 23:26:12 GMT","end":"Fri, 05 Jun 2026 23:26:11 GMT"},"fingerprint":{"sha1":"1D:65:9C:8B:F3:3B:3C:45:B6:27:1D:FA:4A:BA:B1:49:F6:1A:92:DF","sha256":"FF:65:1E:AB:7D:75:08:E8:B8:EB:C5:03:0D:BA:FE:CC:84:CE:98:69:50:8E:21:95:AD:31:54:24:EE:2D:0E:6B"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/g/jsd/oneshot/ea2d291c0fdc/0.5096034414901575:1773368879:f5hEJtP72ZuFv6qXZ5a1h0dE3IBHkgqIOuLSLGnMeeo/9db7ca469ddb120a HTTP/1.1\r\nHost: arcusfinance.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 12149\r\nOrigin: https://arcusfinance.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arcusfinance.net/borrow\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":12149,"data":"kfE3sdIajOR99blb4z4zfz9IKzkjzk3IlIDSEzB3nlR1zFJQQZTq-lRKE8czR3QrqzUaM3RDzSU4ImqaHhcTczQyc6czjrVqYYzbxjlW3-O4B$dhf9Klf3-i8eX1l5pdzj$b2RBj-Bb$dwHmfzIvJjgrd4qRtz3sdHdIuzSnzJJ-XnAXGaKEQAKEbzRQdz++uIA4zY5$arMXbgPyWIJWfzsPSzhfzXvPKzOFksEx3-$w2GEHnhe1QNg-fzssXzIfmAqMsYyO9z-V562KxXgqzj5qKljE3zsvfxsg3eJEzPFtAl680Y1sfznFXOj0eBJkAyn70ZI6zjduRnPqOlzz4+qKzX4CRj5Rh5jz-YizR7TYdzIhgeRCdAgXdzYgfNnnxcVZFCAFCYYf3XXyF2Qnao-qvbienX1cfzIOmUIznhYvSN5xznExfinx+XMI36JxuJnvX95XaGWNqSdy6f3RdlvzjjWT1h4SQGsQwg4C6VQkWxgQNShB9cUgw$xvwsv8swUkryOczRnggijWnPDeFpaqh3y8-KAXjAel2j$PdXCjwA7x4z1$HfyDW0Wv1I1xcNe+qNg9txn0o28SxgpV1MK5RT6YspSRUSB+pBGJVNxnM+f7iC7xz$m5sbgUx6dJfl3v1FRRORwT31X38dwgP-WVAvGsGy$xz8cuRIy-OPuxg5lfZ2xWsyIlWYWWZ5ZGzeIY4ztCR4mzwu4plRUVhzWh$AkOn-Nj2gs-ZSgtkPvhWDshCVzgwumMQhTBmPgXiCEapU1qBtbEkqz-CJsnhnKnXKBdbJPmhIHhIG$Ch07RzeGon0P4$ohkzUUxa$FR9IG$R$ph-XXhVGR6OzemOzV6If7f0jlpdUI6z4Ubne4nXXe3KznpBdReOEzmeP3nJflBsmje3VRzVlGInnqOmoYq8RzpdGbBhcnVOXIvmBaBGhduYUzdOIuWuOVQjIItO5thnHHgOqw-7OIW-jxrzVDEYwhfa3Uz7Ds6Je73f9iqA0bJnV8n7Oq1v7fsuFns67+JEEQTAZzBFJbPGF4$YAVYaBe-4rh6IYd$t96ThvgKsFj39lYR6jsF$mjBYugb7gTEX5nUhgP3wnI$d5gDh3wzAvtM5IK3Hs6pENBbUg6-1feznCebj9ITmSDnXKnZIY-EAqDzdymZ+BG-XCV2bUbJe-l8WhB8zDZYKImlBtzVOGQhlRc0hQ0+zKIYJePvfPTbgl34bBHm8POA32YeF32OgEb4n6aJG-nu+XTEbKnpWoGaW7j$dI8lqhPnrdk89Pp0ROlJlaKCfzmzhYOrzagoT7zfEXip34zDKvZRzlBmdd7lwjVhqFzOoE$J95ql$d5hmgj3GFnQunDvddD4jmByl0wp3VzSOz$mAG70nieBzmwW3UIQk7UhGz-YR$XzYv0g4UII4GgVKC1qzh3QAR4zodIllqD7hMIvSOqGvXOk7I7y2Tma+GMKzdK80II3VFzORch2FGqxiKRZ5woR8eqiRZv$fvVhigKEefw5z$cvy6qIvAfP2Huukl31uWROVuxpZWuUzwmj-2yyZUzEzMu8zl46nIbzTurBEb6RzDKRzqjMcHo2F$pae3S-cx0IFQI1jqRDxOjzNIfRjbfsUdzSfzqimoG9-Fk3t41yrqAbpY1zzwp3lBKQJ-7EgkgkImrf-g8qk3sjURSY1B+e6OlsRj-7JUIt$aO78Ugq4c8$3Vjf+EIvHzbCrhX4XTXl3fBfbzJO8ERKrB3gOwon2Y4Z38RiK8HrrfB2TmKDfvTOqymqAcK08ff6HOFjSsp3nBSqA-YEmOYfAgdGjdThCM3Kn0QgWfhdZnXXYaSXEXgZiV6b0OJh-7zgh3DAxX3jYZX03c$Y-2-lVeZgFnplcUBsXBEV$YBdIKbznu85eXQbtH3n7xvezkKgnnTnWkafQbjHnGQlITz31Q3hbQa$j3XJaFWHAGIhzRsOQSbJszVjbVa+pHKFX0j+b9bxRDZS-EQq6WiZgBzjmQGSK9UQMzpmyHA89JOMO1dNQzndk9YQeIg3b-5OqZGwFiK6qze$nEgIYV$hqvVdJxdv4VsgJIP5clY2tAcpD9YaU7-4gdS-nhFbTV$pzJdGrquBWzsAh-T5xNJAaUz94vTUbrr3XAuxVEwSq2wtz+A+MSGvTV3pCIQE6AWzzFPrhi8Pi$JaS74EFVv$wIK1ehstoJk1j9n+AZUfJpSc9j4uJFJE+n5P$IYiQjsOKvqYBci9x$2RgOqRfTQMb0Ee$t57Tw77bnRlxU1hBRzvxuV9XiwIJ7OgAhYXb8i3pYGBZHS7q0G+z+2a0jkXAq+AtDAa74OlEic$caJyWlIHlAHhKdrrOkiWfz5s$Oqj3wR+oFqiHz66elVzm8aAf9PUSPktDYxq4sJK9TWkKTYMVRsaFUCqb4MO1I$EsCiHizYxApAJVQCB4BK14gBdzHfWqHV3hnEaw3JC8lvgePD9qssjm9k95xgIAF5XVg5-sIn6m3ip6Vka74pnFRiMyPpK3E5neyO0djYckqYg$tcqDgkrOYrdnKkqer5e0IygaJzbO89ZrdIHZ3O2aYUz1-E-hhc$mdzyghVGOzc4u6S4mp43V3V3py5E1me6S6TX2OftyCJxP3piEzEg4w18DXz9dfV0DmXj5nTUNxx4egdlh3GpW6RBiHSCXsdR094GeZOQ$0H-A0HUqmg4Td38tdhCJYxXd0n0TUzcw5ud8RyXE1TR$0GIKEIn-C4YkSXdO3Rjv-en$C9f2izR3qmYYQlIQym8InpEFqwhnq$jYfOa0Ejq8EY1tpqdD876F3ib0oMg9DioVUB0UmC$$5sjgTf9EjRnq7xSwRhf$99YhJqRDT6b4Eg-ta5WSe57od-47kM5r8ZAuX6bJiIYe4Z$Ti8ETxSDalrXBhjaOjIW9PV$2klCrm5zTVCKjWG-j11bnPW3dRlHv61qQQzzdOsi2ryBwRAaatS3gQ4uhgW8pwih7UZov9aoYGSAQ8Edhc+ln4iblrHaKbJ9zEkwIVIlH38uwtpQoHrMW13mtq56gjNRBU6A7XksGUmu$7BNfEUnj5Cq4Uz7KZUQnFmJYJaQjgNlzyupCwO$7H3nv4U7oKhlxVm7hAvpcXi-js79F-lda1GtfhgUG+9v7eps85ko3djjPwk-sbz1cMbq7tciRAKz9rJEPYkYWPX1mVE2txdqPYT31SmRW$wWCE094jAwoMUOAJurGUiARjxhZ8u9$hbUjvrSzUAJKKuKjt+5S3rVM3qsC2KErpEIaTYRSGQkgj7H3BqXCV44h3j-is$PUrfcJj2mroSvW$-TSiwc9RcY1$zGjRNDP$jk4eCFoTDKA3ZXEVk4CTrtdvN9MOxblBgHzU67yV6S1$9WyMs6pbiFyMz7ZyogGV1EQ$AOKReGnjRs7K6mzJyzDYSSn7gm8l8VVjjb1V0oowdoe$oBXVpwFoBbKoZpX19-MX7pIBBKghlBmGWWMVhoe$OhlmZ$lICB5qh$PI6tS4ptfUciRt6SoIXUJoEjV3SngnBnX1jJpKq46o7I6wsW8-8h4o4xgE6Ae1cn3GzEambU7wbXvKv$dXJhb3FJ0K7nwmYt+Wz17zujZ4eW8dOq3K3D-oBhahljc4mp$or$VhWpW$lAgzGqXiCGa+C1KbEI5ddR0nBjmwcXFUwAVSSznncJjdfE+pXo414OnkWX3HPUgEqOSGS$bt+Uxsen1KJRt3e4OYu3MAUoAxvBVjyUXqXWBodAjd5BmoUnFKf35ImwBbbKfhAXaGMGvmM1G4+iy$xmYSVoWSNVOprdVIW4pWR16K+1Ct0OToRGqDIS9HEQpJEnSHBjStYpmbdO$oRU6Ou4KE5Kl3tIvJfnEhbY1AAYxtEUPj0Q0Oyp0Qz-l$WbSV3tWVvb6khG9Q0Xo-8-gUdWfV2quRK4JHNWw1CWCBfRZ1y1mAN4DqcVKWaABKJI+x9U+UYJBIlRdGvJtURodSizriTE+p7ISnrG4QtogztxyGlWpSCUKsejYxBD4GRSF3nK9nZ1xX$miGj1BzCWbxa1KIO-dKIKqE+1tJRorHuAfABj7xaU+SY-hRuENxOnIkJ4e+Ej0YjBjWbwRU+orWDblnS-GXuwRUwAf3eXvBDswA8$BIDYY$sopXhQK1YAoJXRzQf33kWmc16dhkhDEngzM3uEh1BIYOXbWbISfp71nnfKfVcmexWOe3YHSnIRhJjt9GhzUJfblzu-eAlKIShVoRxJEDyRsSXG3to1fIoGlmbtWABQcHdKWjjjzsBbRwfiohtXEnBGOIbBn-lqTjK1RHE-7Qs1gz0tIRyXvXFtYSfK8bg-xw8sbBCYvQJxmHbOI$$OiQ3w7bf-g-UQTwc$nOhOoVFmExIbddDo8hD1IjmorBIXRszzsmS-M+PEoSaYJi+UQEXX+QaBmwiKfh$wrp7z4$Bz1tmO1idbv4Z1XdyY$iVOVOYjuRtJd3ZDBqnwxHS4AD1qe4Q1yU$Eywg1ni8iuRboVpn-PEWYz94sBhbHzOVz7xOjGYgSInEINUmS6IqElEExzMAQUwzYzvv-lzohlBeOz6ZGZGgTdm7O23TSFHIGFYomFQBxpE5hQXOzMAWKDd9bl35Ixtf$OQ6D5+TBJ+pY3FFG351s1SxoMJCiro1H7-XFgRfjOnkHKSrEpWIxJJr+IHnswW83+t73X+7kSgKIF3XEbdXOkBFB+DQVzbWIgRcmaTzkwilIZoXTI46iJHg-+OGE6VHUCtGBJSM4Pdp3avqH7s$DxqVnUJnGDY6xb3UDJAgHKS$OawztVh9WfjaBU16dVw7b8IKRObFwatQpCKZxjIXkysBx0JOT8JIqAtyqctpJM$eMaG9V03zH09DqY-go4-mU3qxMBn-GBkS$OnDk0DBnMmtmmS9DtSaU09U$5EmpUIQzjbfjlUSRqEUiWmbtbTyKWIKzUm4UddbHdSYjgRq5ItpQRqk3dj+JCqCWmkh4ttIkkU4ItFYBoVQEZmunYIdVAXEj7DU$b1t-6IlnfvABe9Q$jWe4AhfMIsehMoiDdMKVXTKOz6YpPQz4t9csf5vWqddbVEavFW-GCXtgrMdkK3bor9w3D$s$Qp7QKdnzbGjMZkD9BnwWbQ-nHtOhB6WAJj0odFtKewWkjB7E6SiIYRiKl63pR36VQFnvrQ0Je6EUVW8S-$j+I9jWtI0XXzAB8UPVC1EhHtGJ062UK6dDC60kUEk9gqI-bpyo-YhYTvFdWiGSw+lvE6WSd91O5GmtDxSnOIpYvTbE+tzQXUg-njJzK-89Yjgd1vug5hO1Zq5zvDFd+dkE39axYztOl56sVmlIJHKVHs1SaUbhzoz1EInEFHooRHbD9jJDC1CVP3ubJ5fAlW23MOK99GC$GKrsgH7sb4bVyXjUtOYnUVz1MS9QV5WGG6WsGEqvt1etdhdMgRlGDRwtmQWm45kHZSXi-3BQCFCguhAMRKy+WpN4O-WACg7$YTlJQJjOgVKBiOF1F4odhxUQR4Av6b8XwtOdJo2gAz2j2jcEVHI$Vzqkgbm$Fm8XO-MWdHSx-GAYOsCYzkcBkTujYHCYFVVQE6hE74VbCHKUmSZv5GX1e4PxQ$1MRDI$FMVJKRy3I5D5g8fXin$FEvmtBsSbgKjB0TWnUJ1qI-tXPJM$unKKt+Zt+mDDMqeHPWyw7QGOv32vXsOIGAXekWgbSQeTeU+HghB9h$YJhVwmVQt3VxzM$GBkIY+J7b7RuISxwXFxPgQB4KB+Snjeio5tzTBnvQBnaUwSu9SjB$8+eVDkzGQRdVmjx8HvzhR6lJyUXaXzU+r3I$9EAhDR31Dt0Ya88RVIhV5vID0A++PH8Ebb-HzCG9w9gAYqs5vFRHv6Q6rvrvK$sTYjOIOjSx9TcoRknZ3VgE6FbTuwZtyAZSUxyKypUYFEB1nTB4UX+mbtVGVGOpYUwKI6ZVDEsQMsY+b8OhOnOMwDcwtJl-BOl6YVvzD9zg6WpJgnT3Jz0Y+FVXwX9s3SIS9HUFXesOYnnxkUpSyQtHrXFxyTM$SOfXOH9-sBPElYgblYIIUSEVSnWd-dj6t3jwaamY2DsT9woIfB8P910IIxz6nHr-H9jBfbOOh9IVPMdpNwgvE9AF9YGdjBAJdmSehjKsn5jwcX1sA4E8X8TPShTaJZ-YGvnnmT9-0M39c6QvhFK31+3g0TMKy5y9vWVPbU7OQSl6VGmjIleUOzqagIp6$JkH5skDlv66cZFv3wcalTCAgPkgjFpV$BmBePpSXSPU7dORb1CisFgU-1wlTiwPhvEUS6F9I4aT5K7Rb4wqKAK$nhbrATlXtWp$FH6rUwcm7wkA3Ekkr9sUgQKm8zuRlkna6hfJCYwGks$Md$YPeIj65oaFy9msYDsvXlFFrFksMseREUYmiQfGZieQbCPV$K1en6BoFQvnitDKPOmQXTzlQMFrfOPUTkZgFGYo-Xv+ZTkVTmnhO89j26qHQFnzdbwxa1ikghPo0Mi1BzyKvU7WlnwwfBgefB8j754xIhkTo6VzxPUlubupRMvksMvrig6ClIahykFa8AbjdI0XVRIg-p0biMRaQpaDd8agZ4ORT84C4a2+4ZMWn4cV7t$QWt9jKb9zI9FolaQpU6lPo8kqbCStc6$l1+hM3Ns6Fm-DC6WVhvnj$DvUxdIK$KSqjm1Hb4-9h50Mgh8$s8SDWni4jWGQkq8KM6iZTezFsknH0MH1PpUepeS4yq9nFoVKEnX$PXKbOlnYr$kOCEIQE4cina1px0mmNY$sPR4x7Id15OVIDDrZ9ClSHrMr4uoBYg6KJ8usCB5T08eet9OFhqWpAZSaKpEk3yOa9t$F5QW5G11ASUcg$8Z6ggu1gKIR-xSRoT7lAbrK2pVWtbMkTUY3OTSUICJCbg2jt86j9he2vOg$wD8dHkZ1qMbG--2Z36QGQUhCoTlyqgiQMscV15JpJpF$UCbrvhmkSRoUONjvABm1J8IqhZQVdWxFmiQBDhcdBeggU5ubAKs9RvhSd5xtS9z9jTS7IPu1-q-qYPqsuns3AzIKOmnvXlXgMpPsOznr5BV4jd1+kCjQo-6MWpEYIal65gdjnPjW0POonbRwMP$ZtktRMZMgVVCmwp28b18iqg6C9sTux$8-HlQfeiRYxQ6Ksg0xXIgZVvWAv8GRl2fuymQf90vNMCIPVI5luIl$FMSRn6VbadxdW7F1U9JfAz8MSzOD0x2kzv9ZoG-hsTKuQUHOjGVAdasVxsBjSts1fXqG1XWahj1JjSVn-g$4fFP-hIau6MGZDgtRboysWJiYSRiHr4ioMXizj-Szr3jmovlcsexcuGxcjJ66SSOuDio$Cugj0Q-i73SeSPtBS8IbHeAguR71-OM8nSoAMQPsPspVCaFoPEOUYmBpY378droSdCRZb$ee+dbVb$pK4vIu6WgYWH7QQ9yyyfCcz-V6bhi800Nw0c7qgg+idNOOij0Y+fmp2HqQKOYR7qh7rep6cvQF$OnticBpJu6$9f1ZSjesnkYMdAi90WgsWEdh$2ujsAihbDmJDN9Q+nAbSXJw3IITmIDsIIu3J2Emdh-YGphRnXIIYE3OmebI83t+P1z$oalEXHAjQI+kldkBJIj1fKPF9E39RpS8nXkeQBhUd42kwXRzXdmOX4rpzK6ysnWYyVFy$2q084kfQq-Bsiq23d6ImRSmy3$fUT84$YzP1uBJz23VOQC9t1frkf0z84OlzImzRphFzwAIqP9-nIZV5eeObREgQ974GK6aViqqWIXbcIVX8XKOXgboE+r2Il0hVklnXV7VyEuzSBBspSbyzFlW4bnd3$Dc3BOgztnqhwjg6bzgehEaEaJXdbYIgBSkpnHxRdhd2Vadq2Ijhhdn$BfBgTs6HRzvI1Gg0mJOnjSsoevRdBfQjAj4OEvRgAYcqJglkzcAifJBcbC7bxne-3BJBbz7kk3O2dfjlOlEaJn8$ebyIwzkqOzDOE6hmr1BPxqNBDz6nygvd0QaFHOkMs$zGz0wK89bz6bgk3E7RVdB9snj7agxUvPq+9Deh+jZEh4dMbXstnrR1XdqoEabn9muitBkQjXYGR-UDQC3H4W1s0zubyzJEE3b-5$3vRCQagGS$7Ynk1RnGCXOE449nYXnS3nVspR7ElSegx0pEeEB$IdY7bbnva8EGzXdYum2zrT$7O6jAOVbldMgKDHfSWRwmdITYx4jXbOIl$patBfEVKOSOdB3SXfjSOnntEGqUEBVT4PvjynFVIzOeyEFgnNdrmAdcaq1jaQYEf4pzUOYHAnrEEnf90oXlEoJDzs1-9l00RXeJh5hml$BxV1Sa9m9Bvnwc0IMOn9XhmjbczPVh+jXYjOQ7+RQznPjXngkBm8mFIXEckDesejKm34DSrfKbEmbTm8X1oIcDXDHsSzi3yD8qS9Ea3tn4zel9O$OOUb1q0aTl7QTSHUh0GA7VlvZJjzQAy3Ngnf-3RKsB-$I-I7Bq3QjRSR0V6B-qNhRPJDn2jDB6qTMM3IY7VdFbJslOQWnByfrGBgEFgJ1Qo$ddszwYl0mF$rhwmTzRl1aij-2hCgft+ni9iTE+R$zKg8f59VAzoI1hBXzxlgq-zFUhmC3bai03d-b-yk4JuzHOVczfBwjRxNXeI9SQEGkvGVY3e3b4b8BtO+EzPOnnIQz+azge8iRfsf3+zr4BDx4U5-Isu-6IXb4Ph4kTDHnUE9QkaOnzwRtFr45dpYkOjjIZRdI0zz3O4Y1HVf6CmE0+jEKlbU4rrSlS0pQ-IJlBBIFzeDqsDGsD3gGpSTX$adEznWfz2E3qaAAzjDYcimnhAKACFUyBa0U859lrEdRlsWkbY-YRiTAwW-tI18yTO4b0h2sfImuVc8JEpU6zF5et8UIYYGsW4mrq8c3CNR0RSRtv7lh5Zh+fnOUbl3lPJItk7k4sSjxjgEzdvqWlXEX-IbSqW9En6IxAUzzzYp7zaBDIm3epF8JkqjIPVCeYVzy$3YYkGzzdiPgrpv3HEdfj3oEEfm9$uRC4cDzYaa+xboEnqezNqPbpZesdJvCIPhX4qiGaEPIu4z2g1oGryIt3C$EnsE-xheV5063ZnMfEVjU2sKv3olk+mlzR$7Qw5jaQhkybmRXx8-lOkCSdyNCTBkzS0v7EagSBKlnqaSZjbFmvm34ySm2gIE9IFAYqrYaSrcX0mdm+3g5ReOZ4vjOGjzMOaSZKYJqZARSFHhBI2Q96O5TBqEInjC$Fbsv58lEzY-6Y6WMAAOfgdnhjzyn$3+EQdrRvTsB-OzzgztlJaSHoh6IcGPxctj+tvXSBArtEIJKJImjeqeAro8ljhb478zszoqk-h-Jv-uj0jWzC9pIt+B33Iz7xSqj6DRImzWVS4jgQ7H9IwkFq5zVfY0z6qqgZvQxRqbJbevdqeGkaItO0bbXCznAQ9usFUnSFZrbYW9feCPk47S46zz9x6IrnXhFO0zRXOthHzadbVmEy95ej9bJJBOqzo9WaVfIlIGiorROYDA6VmJ9I-Id3n4zn-ZeJa-EQ4PkR-DD414Ocp4F1ifXBq2QDQOaJgHZzUX4GOcN1bDVZqsW6zJzEaoDi2j-$TU1GlSK9K-DP+5UueCagCOWb8Y2tO3jap1ioOOR7a3t+a29ZvRFJ0qO9iactin30Bf9UTSACNjMOadzvu8y9d4k-EsXKzml23C1ikXSzxRNYRXluqAmSbCUmcUxC1ZF$MJ+atgK03TZF$YBzl4ti9Iu8g--XQz-E-q-06ZHC+NUGzdEl1A4bzScqbOwSHuPF1HhzsC869$TVzT-+4YZt503TeGhqvIl-Ej3eDDyESzNW0h0a3TS+YMtCUMEdeboDyDn-UUghszSMFNHgK347hb4YezpkliecwccHZPQiIcm-rhzP4ayIPHUcdzXby9XIqq$A6Ct6QZ7CBVdigpdYFl4IsBKMBCmds6aRl21ZRsnRHq5jCjXR5V3VzYYOhf6Z0TEM4nNUUh5g2JOl9yW7qVfh7-IV6OwdGtJlujcGClnzSXYHhp9kTnf9TzoEnfyd3Qe+OlS04qWYjyGAn5zSmU4WrJZTpqv$6sEZh5dRHjNH0mQYqW6Axi3psbIAtrVq4KG$z97RcYrrK4W4QonRXQmTEyTPIpob6SbIwcFzKyhQdSsjsJWtclchPz+Xv9-xxRiGqzEsXxCmXxRVvigTYF94Mlr0U$-x9vdKYOhuIRJ3xgyXDqVrII$wjxgadzmpJObirl9g1KCscW+a5rAybbSShic7074QSgs+XIA3w3Ptsczs+iG$Xpe8TE4T8i6gES203TejOEIhsda00eGBn-uKcSkeCjxhKhjTpWl-EwzKEEmOyXDVfiDj9YY1YpyEFFvqO138qv6R7CsBRXeln-Xv3tfTapjvtpqgB$n6fqyl9qEAF5J4WdavoC18HnAGQ0-ESb-entvZcB4Of2XHg-WjhX-AmEMjMfZdgaFRfog5d9nD-Q8KZAQEH4-dQaYWi24yWQdzmvcjBnY6NBHnHdEdjNyg3QBPj5flcbWXlwQiT4H1Ae6bIq6Qrc66D$f5KWJFNh0AGI5egvjrdAJMS3ybe6rJHkRSPgt3abzjRfr3Sil+GAmGRKyIAWbkjkZsDWJYtRzneBthqn2Wb6ZrP6m8q-E+IQFez4a+D8Jgup$zCc5agwP-Y$+vFAwYvhDpqj0RWFTdE6yd-J6USkFNE2eoWpY5CmQctwra05rpsFS2F2iQ9BTl16ki5tH7E7gCbO6PKm6lW7exCqX5+iRvEWf7mEna6ii$t1fe718r$nCiKzWcpjDnVaghiY6tSU0gwSKg-iXG+00dz284bVV8Ymih06BS1vMXPFPiotgweNsRBRaHwm05qDNkHiYF2e671wVzMMiY6EhO7v5VzM+iqPlhqA1R$uSqp3enh4fcRK35ZKFY9h7eoIl655SnYUSV695S15EiAYWihjx8R4tPSxYuwibuVB857BtnJw-j2kV49+ibFThUpHB$TSnpyWBB56dVS8MfxhIQhl7vi$E51vOPchkb2mSg6vS9Pihh7NFng4yWYF5hTd9aS6gOiGlCwynA$YV6n11m3kV+eGV+DX16PnxXW85pnvaKws9kHd9RpBv0pgsjkHdTIaVv0iEP-knAwRicFOtqepkEAJRSe6ApKPFz1Awa$ugjdBPZSNEdsaBvYKKFtWD7MQlWg6jT6Jw-AT8PrgtosYPwJKtJk9M1WYF05yOEU$OvbpPF95V69ceOvS116e5WOYr8Jge1WPTWh7XcqagtG9eWi-KXFi9FeK2d2WWzCrpw67pOV15utWFVaM$pveoBPhe4huHwSYIuEx4T0a5FxUadjS3d7+HcdlIXY4qi3-vs5FctdPC3bfrfztEvR5F$jnzkOQSn8jWsfwNWI0p5JJRlS23sxzqOZUMl7dIigx4TzqpTfBR2IRXpCJ2kAxQFZ5aE1kSnj8xgdckdnN5+tgcivBMzdtnqQzzzRxJDTwk$WumTfU5opOARczNPKBtqsfhIDvIxAHI5nbXkOOT39z-r-3RD4GEQR$ztSawzzzBKIgIt4IEQIE0R1RuVQz0cexbhwaQkqbEn42aAdb8jGRwEiS1G-TjWowmcC8zszs9Iqja7zzhOnjZzzIYqpCsTfR5h16elD4j4z4Bby-IlzOWbs67zAyOCbTFpCFg5xxjVz+DNnQU5Hje7zzoQUg5wEQNCY4EHrU6w34znzbz$pZF9cxzrxlwz$-8YIqj+BX2t8U+PEJJjbqi3JD7zQ-9wwb7ZtGzl8knm$IG71zhnMqI2gjIbrC6elz4zzhgeqeq6pa4jOIz624C8W3EoM7zfzFEs84hiCb5RQF7zmziMV4j3BnnQ4BxG3CgEiRKBxSCusoTld3m1qHG3SzkbJIizGB722nsjQ+s6Ye4mVcq68MnnTWVthtpdI6zoR$R5FOCo3kgOPIp1uaxqXIEZP7mGwtE9lBDdzhIbTg-zszwgefnNTzWaQFqYzIzR+g3kQyGqcl$+8za3zgzSzXzRzQIj4BOt0ORSQtkAs$zqvbCnxt0CAY3m3W$tGE0dPnR5RHzugB3h3I3lywfz$QMzjZ-ezlD8FYgvIMz-enJ-6FCg7Om3KJzzRnxu+zWI-D1+97l6D3yBmTG1f7$X+umfkN9GwISz3HjYjYm-njuEP3zzpxxkzz"}},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/plain; charset=UTF-8\r\ncf-chl-out-s: /jzIh6PJj3zaNfPqB0zHvg==$bZh9T36wXEVoOUD7OZdi/g==\r\nset-cookie: cf_clearance=PBvNCg.w3YQDa6T5MbgDsT0k4fWYekJRl0ma3Fgopn0-1773370846-1.2.1.1-kDpOuJATYfoAgG79jm1ks.kIITDF5jR6GW6_V_Mmo4c_CEbjGQ_DXETzZNCEzqpiBIFwdjZqIGoup2wkaFBQFu_1IhtUxGskseqpGCEq0sbVB3.U62ZeFuRS7jeNi2Mk1Z7145XSN94JWBjqsVbNILShrXWLb7GgHX1WXuIqcplW6Mvd.tdDfb3..H7alQun7Lvea_d9D1v1aIfoYF3dwAZqxqI2pkFUD.TDA2Rwn7o; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=arcusfinance.net; Expires=Sat, 13 Mar 2027 03:00:46 GMT\r\ntiming-allow-origin: https://arcusfinance.net\r\ndate: Fri, 13 Mar 2026 03:00:46 GMT\r\ncontent-length: 0\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: 9db7ca507b7335a6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T23:49:08.313059Z","times_seen":17808208,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"arcusfinance.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/favicon.svg","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.862Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arcusfinance.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 23:26:12 GMT","end":"Fri, 05 Jun 2026 23:26:11 GMT"},"fingerprint":{"sha1":"1D:65:9C:8B:F3:3B:3C:45:B6:27:1D:FA:4A:BA:B1:49:F6:1A:92:DF","sha256":"FF:65:1E:AB:7D:75:08:E8:B8:EB:C5:03:0D:BA:FE:CC:84:CE:98:69:50:8E:21:95:AD:31:54:24:EE:2D:0E:6B"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: arcusfinance.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arcusfinance.net/borrow\r\nCookie: cf_clearance=PBvNCg.w3YQDa6T5MbgDsT0k4fWYekJRl0ma3Fgopn0-1773370846-1.2.1.1-kDpOuJATYfoAgG79jm1ks.kIITDF5jR6GW6_V_Mmo4c_CEbjGQ_DXETzZNCEzqpiBIFwdjZqIGoup2wkaFBQFu_1IhtUxGskseqpGCEq0sbVB3.U62ZeFuRS7jeNi2Mk1Z7145XSN94JWBjqsVbNILShrXWLb7GgHX1WXuIqcplW6Mvd.tdDfb3..H7alQun7Lvea_d9D1v1aIfoYF3dwAZqxqI2pkFUD.TDA2Rwn7o\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-type: image/svg+xml\r\ndate: Fri, 13 Mar 2026 03:00:47 GMT\r\netag: \"dgx02pv97xwpjl-gzip\"\r\nlast-modified: Sun, 08 Mar 2026 01:12:56 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncontent-length: 367\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tEqcpK3Tur%2B2VJbhFOkpgJ6CC6swNpHx343QVFPXrRvR2C3CbGcsaYKhVxS7qPzzmFR1qIUlvUjS%2BYU17w7LNJqrmq9O6%2BHgPUpI15XRT4o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: 9db7ca50eb7a35a6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":705,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7ff6569f517e23b2a80d81ff486c7dc3","sha1":"81064ec666a5b384736d25912c46cc3efe742816","sha256":"1abe938a39308b21d6d6d44e8fb2471878944e1b49957072ad50a3a96f4ab88f","sha512":"5a0ff63cff8a52825af735b58dbe5ce7a9d923306d86809cb258aa719b6ebc5e6ed49a53fea6c57b0bec76ba773f5ff03ae53a29c3663307606ebd5ea7363cff","ssdeep":"","tlshash":"6f017015d39cac2fe498d314c716f032d51e41d356454220b42d2a79b7555e6693b3d8","first_seen":"2026-03-13T03:01:18.207228Z","last_seen":"2026-03-24T00:31:00.385706Z","times_seen":4,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"arcusfinance.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:49.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass2-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 13 Mar 2026 03:00:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 3967947\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nETag: \"5a6a3867cbfe36845cfc495e5ca7f0ea\"\r\nLast-Modified: Fri, 23 Jan 2026 15:28:10 GMT\r\nVary: Origin\r\nServer: cloudflare\r\nCF-RAY: 9db7ca5efaa11525-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3967947,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"d93576ba91ca34c6a838ecb0a2007171","sha1":"c4e5bde21d173bd4fcd9129fbdbde6222c276da2","sha256":"bd3b1e09eca059acc8e0bbb505184eb2e25f7d41b27842fc776734881d4742df","sha512":"1757d06e3d6fcf45d5a48f8f6339866791fe4add35e57b447144d7b3bc7c7b25a851adda4b4abfdadc8dc7134f21016a79f7405bb79e50115dce6a8c93a59ef6","ssdeep":"24576:avufiMHLszpYKMLHl4XSjC3h+NeQo3QSlw:oFMHLsMl/CzsAw","tlshash":"db2523ae806d4dc1229501a12516783c14a5a07e8df2bc3db5a8df8dc29ff7b9ce90f5","first_seen":"2026-03-07T01:35:12.450999Z","last_seen":"2026-06-01T09:54:50.000032Z","times_seen":63,"resource_available":false,"data":null}},"time_used":1202,"timings":{"blocked":63,"dns":2,"connect":11,"send":0,"wait":402,"receive":665,"ssl":46},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/assets/index-VIWygw2o.js","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:45.602Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arcusfinance.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 23:26:12 GMT","end":"Fri, 05 Jun 2026 23:26:11 GMT"},"fingerprint":{"sha1":"1D:65:9C:8B:F3:3B:3C:45:B6:27:1D:FA:4A:BA:B1:49:F6:1A:92:DF","sha256":"FF:65:1E:AB:7D:75:08:E8:B8:EB:C5:03:0D:BA:FE:CC:84:CE:98:69:50:8E:21:95:AD:31:54:24:EE:2D:0E:6B"}}},"request":{"raw":"GET /assets/index-VIWygw2o.js HTTP/1.1\r\nHost: arcusfinance.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arcusfinance.net/borrow\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Fri, 13 Mar 2026 03:00:45 GMT\r\netag: \"dgx02pyz6hgzc1w9-gzip\"\r\nlast-modified: Sun, 08 Mar 2026 01:12:56 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nage: 0\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z1tuc1HHLifJhRT6QbsJwzvHxoe4%2BdqXYt1Lh%2FXpupLIBY2MgauDUqwVffDA2z0pZLiIcv9Qomiur6V0W3dzQ6h7ZrV3SYCfl%2Fc7xsbP1W4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9db7ca48fac635a6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":562329,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (37534)","md5":"f5ccf1023d72d033bdbb73e9e382a176","sha1":"6d5f99e0bcfb2c27d863bbb080d1a3768a1cbfa5","sha256":"d3bf19a53d3a7d0ec1c934ffee14108b8deef7d258f8339fa8bc4a4d311e99c5","sha512":"70beed520529a2630b07021b50494baae027dbeb7fd1ead6448d7a14f5d72d0ec42bc1900313823a8df91a52146b31ffa06093761c9ca9246ed40a00537c5423","ssdeep":"12288:IMrHt40KOsDP6ztGqE5U/Uloq3yaAN/bg0d47gM:IoHtG0oja/Uloq3yaAN/bgE47gM","tlshash":"2dc49ed87145b669a7e305e1506f4206b23e1d16b40e8464f03ceceb6a7150ba2bbffd","first_seen":"2026-03-13T03:01:18.235551Z","last_seen":"2026-03-13T03:01:18.905025Z","times_seen":2,"resource_available":true,"data":null}},"time_used":415,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":297,"receive":118,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"arcusfinance.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cloudflare-dns.com/dns-query?name=_r.chrome-extension-da0e5-bc.com\u0026type=TXT","fqdn":"cloudflare-dns.com","domain":"cloudflare-dns.com","tld":"com"},"ip":{"addr":"104.16.249.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflare-dns.com","organization":"Cloudflare, Inc."},"issuer":{"commonName":"SSL.com SSL Intermediate CA ECC R2","organization":"SSL Corp"},"validity":{"start":"Wed, 31 Dec 2025 19:20:01 GMT","end":"Mon, 21 Dec 2026 19:20:01 GMT"},"fingerprint":{"sha1":"F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59","sha256":"E3:B0:28:26:78:9D:65:3D:22:4D:3E:DA:CB:E4:E8:77:CB:72:86:FC:4C:92:26:72:F6:22:67:41:CA:57:AD:65"}}},"request":{"raw":"GET /dns-query?name=_r.chrome-extension-da0e5-bc.com\u0026type=TXT HTTP/1.1\r\nHost: cloudflare-dns.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/dns-json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://arcusfinance.net/\r\nOrigin: https://arcusfinance.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Mar 2026 03:00:46 GMT\r\ncontent-type: application/dns-json\r\naccess-control-allow-origin: *\r\nx-content-type-options: nosniff\r\ncontent-length: 245\r\ncf-ray: 9db7ca4d4dc02efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":245,"size_decoded":0,"mime_type":"application/dns-json","magic":"JSON text data","md5":"ace4e4628471071a7d0015d55b7666f6","sha1":"edf5afa8dc53f272bfe07fcf95d96ed12ff20bb9","sha256":"af994f01100217a66732d50c32d7b3dfd6fd2f91a682f83233d3285d5cbecadf","sha512":"953c9b5315ac6b382f895ef5843abf0a0ed4b0c81718170fc33e55407bba1a9e61c9334efbda0ae0f54515aad786600ec3fd262dcf3d4f31a2da195585ce3a28","ssdeep":"","tlshash":"c3d0a5895044457c74075744c4c31447df7c23b273dc7d7596441f54e6cf3519046277","first_seen":"2026-03-13T01:00:07.424252Z","last_seen":"2026-03-13T03:01:18.906257Z","times_seen":2,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":20,"dns":2,"connect":1,"send":0,"wait":8,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"cloudflare-dns.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.204.94","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.410Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:00 GMT","end":"Mon, 27 Apr 2026 08:37:59 GMT"},"fingerprint":{"sha1":"43:A0:56:D7:CE:45:C9:96:6F:34:12:13:53:CC:34:DD:63:FB:5D:20","sha256":"A4:AF:37:76:AF:D3:DB:1B:79:93:8F:E9:D4:21:4B:BA:43:54:3D:F9:56:DC:18:E9:5C:CA:1A:7C:B2:C7:DF:9B"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://arcusfinance.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 10 Mar 2026 07:34:47 GMT\r\nexpires: Wed, 10 Mar 2027 07:34:47 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nage: 242759\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-09T23:47:22.934303Z","times_seen":255745,"resource_available":false,"data":null}},"time_used":773,"timings":{"blocked":359,"dns":0,"connect":55,"send":0,"wait":42,"receive":13,"ssl":292},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.434Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arcusfinance.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 23:26:12 GMT","end":"Fri, 05 Jun 2026 23:26:11 GMT"},"fingerprint":{"sha1":"1D:65:9C:8B:F3:3B:3C:45:B6:27:1D:FA:4A:BA:B1:49:F6:1A:92:DF","sha256":"FF:65:1E:AB:7D:75:08:E8:B8:EB:C5:03:0D:BA:FE:CC:84:CE:98:69:50:8E:21:95:AD:31:54:24:EE:2D:0E:6B"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: arcusfinance.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\nlocation: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\ncontent-length: 0\r\ndate: Fri, 13 Mar 2026 03:00:46 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: 9db7ca4e3b4935a6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27114,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T23:49:08.313059Z","times_seen":17808208,"resource_available":true,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"arcusfinance.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/spacegrotesk/v22/V8mDoQDjQSkFtoMM3T6r8E7mPbF4Cw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.204.94","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.422Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:00 GMT","end":"Mon, 27 Apr 2026 08:37:59 GMT"},"fingerprint":{"sha1":"43:A0:56:D7:CE:45:C9:96:6F:34:12:13:53:CC:34:DD:63:FB:5D:20","sha256":"A4:AF:37:76:AF:D3:DB:1B:79:93:8F:E9:D4:21:4B:BA:43:54:3D:F9:56:DC:18:E9:5C:CA:1A:7C:B2:C7:DF:9B"}}},"request":{"raw":"GET /s/spacegrotesk/v22/V8mDoQDjQSkFtoMM3T6r8E7mPbF4Cw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://arcusfinance.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 22288\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 10 Mar 2026 06:58:25 GMT\r\nexpires: Wed, 10 Mar 2027 06:58:25 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:26:34 GMT\r\ncontent-type: font/woff2\r\nage: 244941\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22288,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22288, version 1.0","md5":"87c506d88b9f587f0e2292bc271f5083","sha1":"c0781ea2f29013826dc1eb8db40f4d400d9df710","sha256":"0640890476fc1198ab4de571fb658de443c4d85b66466ec09534a8737ab1ce9d","sha512":"25171eb14ce4c75ccfdb6f1c2a7de82182fd8d3d79cfa108df2d0e015e4ac84678ad97fdf90cff2ac2f24934531fcca3289343129687f176f21964ce5cd01b02","ssdeep":"384:TB/NWnO5qgQvU7gd7EeEX5qPOJO4FqaCEuAsCyzvDfxPdjuHsrC:TBlo1vUsvZqO4MAsCKrxxuMrC","tlshash":"8aa2e15b3f6bde211a27aebf4fc957b0a3ac6c1db2dd2712c198b104408962cc5d5ce6","first_seen":"2025-09-05T05:08:09.568652Z","last_seen":"2026-08-09T23:33:03.619715Z","times_seen":26983,"resource_available":false,"data":null}},"time_used":538,"timings":{"blocked":228,"dns":5,"connect":57,"send":0,"wait":48,"receive":36,"ssl":158},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"link-auth-5157.vercel.app/api/v2/handshake","fqdn":"link-auth-5157.vercel.app","domain":"link-auth-5157.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:48.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Thu, 26 Feb 2026 06:28:03 GMT","end":"Wed, 27 May 2026 06:28:02 GMT"},"fingerprint":{"sha1":"D6:62:1A:52:B7:FD:F6:BB:FA:AC:01:9E:BB:CD:40:86:5F:04:95:51","sha256":"4B:37:7D:7D:8E:17:70:BB:E1:51:9B:58:96:24:6C:11:6A:B3:AE:A9:68:43:46:58:B3:30:F0:54:F7:EA:43:38"}}},"request":{"raw":"POST /api/v2/handshake HTTP/1.1\r\nHost: link-auth-5157.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nContent-Length: 71\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: application/octet-stream\r\ndate: Fri, 13 Mar 2026 03:00:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3cNO3vkcX%2FbijSsnF5WKtk1xIP8agWukjN8CKH%2FRYJOQhT7fGNWBiKoYetr5aYUfFSr0gnAlbWRZXanG7wB6aK4PChN406ulgD%2BlF6B0RU0eFgUZRGB2EtGs%2FReRz0Yn%2Bisft%2BlC\"}]}\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nvary: Origin\r\nx-session-id: 48a8f5f7747b45c344502351c2206664\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::arn1::zq222-1773370848369-950400a0d02c\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"de4230c647fe050dea14043986faf68c","sha1":"895c091b720a080ba9137e72d3800922aad8567b","sha256":"565e44cfc87e62ac9ef39e2eaff15fdafac40381d28c867b34b2f2f6701a4f43","sha512":"2ae1d3a5b40ef7e7f338d4bd1eab70736be176b71a4858c2302f6af0661d533ce4abba0a73329b7e34a6d026932ccd0ba8cfa6f65e40cedb63f8dfd1a3d36bba","ssdeep":"","tlshash":"76a0220000383088fc00b0e8b0223f2e0a30282a2ae00c8e830cfe20b3e30a00222883","first_seen":"2026-03-13T03:01:18.908253Z","last_seen":"2026-03-13T03:01:18.908253Z","times_seen":1,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"link-auth-5157.vercel.app/api/v2/binary","fqdn":"link-auth-5157.vercel.app","domain":"link-auth-5157.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:48.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Thu, 26 Feb 2026 06:28:03 GMT","end":"Wed, 27 May 2026 06:28:02 GMT"},"fingerprint":{"sha1":"D6:62:1A:52:B7:FD:F6:BB:FA:AC:01:9E:BB:CD:40:86:5F:04:95:51","sha256":"4B:37:7D:7D:8E:17:70:BB:E1:51:9B:58:96:24:6C:11:6A:B3:AE:A9:68:43:46:58:B3:30:F0:54:F7:EA:43:38"}}},"request":{"raw":"POST /api/v2/binary HTTP/1.1\r\nHost: link-auth-5157.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nX-Session-Id: 48a8f5f7747b45c344502351c2206664\r\nX-Config-Id: 69acca861b6b3339908fa00b\r\nContent-Length: 111\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: application/octet-stream\r\ndate: Fri, 13 Mar 2026 03:00:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PFKnQwSW5Am%2BdZonvDaTj5n1%2BwNk9OVexUOAD9CQiqk5vjh4so8HYRAFxLljeRn3T51Hqph%2BMhdF4W8kmNGRv8TbbkslnLZE0faOGhSIZwcfyMtxnoDOY8AALbvCVev6mydwG6mW\"}]}\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nvary: Origin,Accept-Encoding\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::arn1::4g2rv-1773370848875-6a140ad128e3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":1135,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"fe94ae0243d48d4bfcf4217533b3db5c","sha1":"8b48624c6e11b66089378608f51b8e9c53d9e4ef","sha256":"cf8bc7eb79d5d63ae68476068bc391331eb47afcfea20a84c01e0b9b4546ab3c","sha512":"eb1c9ff3aa3630ea2a2f539606bdabb75a365a9d11d8c01a095be1d628b14eb70bd7a3aa28e61a31498d94ef9719012301ca2edd332ba24456c6bfddaf6572d0","ssdeep":"","tlshash":"c921c6c76a201330dd8789bc3cfff9b1d698aca62d18c1e46186d4519de0513a589025","first_seen":"2026-03-13T03:01:18.910644Z","last_seen":"2026-03-13T03:01:18.910644Z","times_seen":1,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":100,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"link-auth-5157.vercel.app/api/v2/binary","fqdn":"link-auth-5157.vercel.app","domain":"link-auth-5157.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:49.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Thu, 26 Feb 2026 06:28:03 GMT","end":"Wed, 27 May 2026 06:28:02 GMT"},"fingerprint":{"sha1":"D6:62:1A:52:B7:FD:F6:BB:FA:AC:01:9E:BB:CD:40:86:5F:04:95:51","sha256":"4B:37:7D:7D:8E:17:70:BB:E1:51:9B:58:96:24:6C:11:6A:B3:AE:A9:68:43:46:58:B3:30:F0:54:F7:EA:43:38"}}},"request":{"raw":"POST /api/v2/binary HTTP/1.1\r\nHost: link-auth-5157.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nX-Session-Id: 48a8f5f7747b45c344502351c2206664\r\nX-Config-Id: 69acca861b6b3339908fa00b\r\nContent-Length: 111\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: application/octet-stream\r\ndate: Fri, 13 Mar 2026 03:00:49 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dGWtZvY%2BMz6vVF55jia5EIxr3hPSb8tjuxKm9X4MaBvdGziPT0P4JxUR3tHi73uX2ne2ahcHzAO77zs4p%2FyIzI59L6XtEGAwtuHGdJCH9xPicg1zOsFg%2B0PZ5DqwaypESmkRfktf\"}]}\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nvary: Origin\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::arn1::4g2rv-1773370849024-4922bb11dee2\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":111,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"ccd857a8f57ae49714043000ddd0ca36","sha1":"226f70927797ea2c7eb02b5a0c9f3540ca14b88e","sha256":"f3bdd56f82d195a12d7f273208e964b4effea8fadf011f15d9e9286cccd7391f","sha512":"1effdb09f7391b40b4c5bc3105da2abff0dd9bd8eefaa2d162c13efb4dc0ae2f6818967881be986348d30a9c37a2cc103d4414bc1e443ed34a6993b6b63c8e5d","ssdeep":"","tlshash":"10b012010652819edd6414ff90c5467425c0b54501294e44907531365510c15fe61936","first_seen":"2026-03-13T03:01:18.913001Z","last_seen":"2026-03-13T03:01:18.913001Z","times_seen":1,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":234,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/assets/index-BS5FaMTV.css","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:45.604Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arcusfinance.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 23:26:12 GMT","end":"Fri, 05 Jun 2026 23:26:11 GMT"},"fingerprint":{"sha1":"1D:65:9C:8B:F3:3B:3C:45:B6:27:1D:FA:4A:BA:B1:49:F6:1A:92:DF","sha256":"FF:65:1E:AB:7D:75:08:E8:B8:EB:C5:03:0D:BA:FE:CC:84:CE:98:69:50:8E:21:95:AD:31:54:24:EE:2D:0E:6B"}}},"request":{"raw":"GET /assets/index-BS5FaMTV.css HTTP/1.1\r\nHost: arcusfinance.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arcusfinance.net/borrow\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-type: text/css; charset=utf-8\r\ndate: Fri, 13 Mar 2026 03:00:45 GMT\r\netag: \"dgx02pyz6hgz1fqe-gzip\"\r\nlast-modified: Sun, 08 Mar 2026 01:12:56 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jZQ89Jcf54YbQBzQExxhwrIbTWwrkBKN5stX2YJqAg%2FqEx6U%2BAfuHoxD9mekPGWjrN05ol3lC2ybepXKPairhdkbLQ%2B9oCKXlE%2FZpyntiz8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9db7ca490ac735a6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67046,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"ec1ed5878b7f9d43584245befdc6f3d4","sha1":"698c920d0e3cc1cddc2968425a094bf37a6be60e","sha256":"f093ea8cc3c79fa313fafdbaca71ef538236cc9def0739f3a4916fe0f633b597","sha512":"9774eb79b46ee62f8d01b5d7ccfe51c6bf5661045222dc3f35fabcaa08782cafe02e9d0c00c09f9f087a2f0ba54194dd8aadd92348a6ac6509df0cbde9aee9f8","ssdeep":"1536:0cMGNAhT5CBEkBMUaaGvCr378VQZkt5FNCoQy:0cMGNAhT5zkBMUaaGvCr378VQZkt5FfH","tlshash":"1463a61eb919617e3c2790f883dcb9ec610af0c0de3b06b9be9a41215ac37f61977558","first_seen":"2026-03-13T03:01:18.227177Z","last_seen":"2026-03-24T00:31:00.375385Z","times_seen":4,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":250,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"arcusfinance.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arcusfinance.net/noir.js","fqdn":"arcusfinance.net","domain":"arcusfinance.net","tld":"net"},"ip":{"addr":"104.21.20.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:45.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arcusfinance.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 23:26:12 GMT","end":"Fri, 05 Jun 2026 23:26:11 GMT"},"fingerprint":{"sha1":"1D:65:9C:8B:F3:3B:3C:45:B6:27:1D:FA:4A:BA:B1:49:F6:1A:92:DF","sha256":"FF:65:1E:AB:7D:75:08:E8:B8:EB:C5:03:0D:BA:FE:CC:84:CE:98:69:50:8E:21:95:AD:31:54:24:EE:2D:0E:6B"}}},"request":{"raw":"GET /noir.js HTTP/1.1\r\nHost: arcusfinance.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arcusfinance.net/borrow\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Fri, 13 Mar 2026 03:00:45 GMT\r\netag: \"dgx02pv97xwplin-gzip\"\r\nlast-modified: Sun, 08 Mar 2026 01:12:56 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nage: 0\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c8LXOv8ykKWlBmkFkWksbdNMYB2fNB4VFTrZtvI6Z%2BV9um1cbiONbcSLJ3vjJ7zCBEMpURtYMlxT2PnQbcH9UyuGstXdr%2F49ryt6yIycI3s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9db7ca490ac835a6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27887,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (27887), with no line terminators","md5":"78060487fec5a4fcacfb7099f800813d","sha1":"7bde79f4339b09cdb1f968b285a5e2a5dc82845b","sha256":"48ed46dca9bb021d57f5adbbba5764a9cc288302f4e71d07290db46f33f77f7b","sha512":"8345aa84eea957f01ecaed4c71d75f94c8e252c42462f466f6feeca3c1864fe757989b15a1b85e1451fa0c94a09b4c7671c454615abca5ff07804e48737e2bd4","ssdeep":"768:g73/CqN0Xs0HoBI/Y8q9lGj//Azm/g89Xn5aPrr9:g73/CqN0Xs0Ia/YZ9lM/oVKXncTB","tlshash":"d5c21a6bce8f3e90cb251e1623ee1dc50a1d5b8a74e348cd960eb7c9815f47a44cc6e9","first_seen":"2026-03-13T03:01:18.221279Z","last_seen":"2026-03-24T00:31:00.381694Z","times_seen":4,"resource_available":true,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":267,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"arcusfinance.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Space+Grotesk:wght@300;400;500;600;700\u0026family=Inter:wght@300;400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"192.178.204.95","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:45.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:01 GMT","end":"Mon, 27 Apr 2026 08:38:00 GMT"},"fingerprint":{"sha1":"AD:23:3E:9B:CF:2B:A1:EC:31:14:63:D1:58:73:BB:E7:C5:32:16:8C","sha256":"B1:5F:45:BF:00:8C:68:35:D3:42:B2:67:66:47:9D:BB:42:41:07:56:3A:C4:1C:D6:10:7B:B7:53:C2:71:81:33"}}},"request":{"raw":"GET /css2?family=Space+Grotesk:wght@300;400;500;600;700\u0026family=Inter:wght@300;400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arcusfinance.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 13 Mar 2026 03:00:46 GMT\r\ndate: Fri, 13 Mar 2026 03:00:46 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19075,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"ba7ceeb33d47d62007b8fee0236b13ee","sha1":"e2c6d581ec0ff90ed8dd209cbc9934f0676b7715","sha256":"da7e8c3056b8553045869854518352bf0e4e53608066d174fe9662ba8b98b86c","sha512":"5c833a70ab4a4f4d4812b90eed835daa69f4ee5023530096918f85ef81869ff7bbdadd22ad1140b13b32259e0e157c67301d75e3891723733caa79e726adbc9e","ssdeep":"192:wNA1cO3lnxirNNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGqcGGDZx/C:8KYXuM0p2+/KDgRt","tlshash":"8282ca92002ba500eb931cc223ce7e3abe8e60856085d6796ffd1cc99cded62436476d","first_seen":"2025-10-06T02:03:50.371719Z","last_seen":"2026-08-07T22:49:51.215991Z","times_seen":1098,"resource_available":false,"data":null}},"time_used":556,"timings":{"blocked":246,"dns":1,"connect":40,"send":0,"wait":63,"receive":0,"ssl":203},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:49.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass2-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 13 Mar 2026 03:00:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 8319275\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nETag: \"ffdbd9550fb16af66a8cf7717da03833\"\r\nLast-Modified: Fri, 23 Jan 2026 22:07:07 GMT\r\nVary: Origin\r\nServer: cloudflare\r\nCF-RAY: 9db7ca637e700883-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8319275,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"c7f02284ef4c6c534add4f4cf923bd2e","sha1":"a8a1b5efc7188d57767b8c10dd21a5bdaba1aa4d","sha256":"ec27d89fbe8d16080062e2d897533f7eb588857b3955dfd53a7d5d240121bc2a","sha512":"7821407b7deebbbd4ded8b8d19129e39ca67ca223f89605a6491de9e2b3344d9b3598bf0561f71ee60690509852fe5534812d49fd9e4caa5953bc2035f08b73b","ssdeep":"24576:bDYQNB1s7x5nT9wysI0jlfn8CUBJRzdUkkIrCfh2SA8RMT0Y:bDYCBsTqTjl0TBLWLZ2SA840Y","tlshash":"0925336db03d9653ebaf30223e5a13c0aedb901c8dbd3e213384ad21875b5ed1d6865d","first_seen":"2026-03-07T00:53:06.700379Z","last_seen":"2026-06-01T09:54:50.069305Z","times_seen":64,"resource_available":false,"data":null}},"time_used":2010,"timings":{"blocked":773,"dns":0,"connect":0,"send":0,"wait":100,"receive":1137,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:49.044Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass1-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 13 Mar 2026 03:00:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 2031700\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nETag: \"a22dc9face81ff1665651f1052a0a99f\"\r\nLast-Modified: Fri, 23 Jan 2026 22:55:18 GMT\r\nVary: Origin\r\nServer: cloudflare\r\nCF-RAY: 9db7ca5eeed7c759-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2031700,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"37d621b0888b9c9acaadc1142424a21c","sha1":"cbb67a69d5c908ed0643897721984ff71bf7a0d8","sha256":"b69becaf20ae2c964f0068c915b5d036da7dc363b1ea662f069f53f647706314","sha512":"474aad76d233471363cdabd9efc14cc91b32e291fc0e70d5bac4f9e5e20c36399f05f2f099795fa60cc9a7147632933594604474935b1e73923115ea8eaf7391","ssdeep":"24576:/2TAaRkFipRWRSlpAzUWOsWWvbLqhDVtxB6Ewq4zG:ZhZv4JsZDL8Da1a","tlshash":"e925333bc65d46417aa900115b2162708d3368ac58ffe63383edde72d78ba3c7d643a9","first_seen":"2026-03-08T18:49:18.127937Z","last_seen":"2026-06-01T09:54:50.06681Z","times_seen":62,"resource_available":false,"data":null}},"time_used":710,"timings":{"blocked":54,"dns":3,"connect":1,"send":0,"wait":353,"receive":243,"ssl":50},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:49.047Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass2-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 13 Mar 2026 03:00:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 3967947\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nETag: \"5a6a3867cbfe36845cfc495e5ca7f0ea\"\r\nLast-Modified: Fri, 23 Jan 2026 15:05:42 GMT\r\nVary: Origin\r\nServer: cloudflare\r\nCF-RAY: 9db7ca5eefd8a41f-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3967947,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"d93576ba91ca34c6a838ecb0a2007171","sha1":"c4e5bde21d173bd4fcd9129fbdbde6222c276da2","sha256":"bd3b1e09eca059acc8e0bbb505184eb2e25f7d41b27842fc776734881d4742df","sha512":"1757d06e3d6fcf45d5a48f8f6339866791fe4add35e57b447144d7b3bc7c7b25a851adda4b4abfdadc8dc7134f21016a79f7405bb79e50115dce6a8c93a59ef6","ssdeep":"24576:avufiMHLszpYKMLHl4XSjC3h+NeQo3QSlw:oFMHLsMl/CzsAw","tlshash":"db2523ae806d4dc1229501a12516783c14a5a07e8df2bc3db5a8df8dc29ff7b9ce90f5","first_seen":"2026-03-07T01:35:12.450999Z","last_seen":"2026-06-01T09:54:50.000032Z","times_seen":63,"resource_available":false,"data":null}},"time_used":1090,"timings":{"blocked":60,"dns":4,"connect":1,"send":0,"wait":360,"receive":600,"ssl":55},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:49.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass1-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 13 Mar 2026 03:00:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 6028322\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nETag: \"cf5ac8fca45e5d0409fef8923c179975\"\r\nLast-Modified: Fri, 23 Jan 2026 22:54:30 GMT\r\nVary: Origin\r\nServer: cloudflare\r\nCF-RAY: 9db7ca5efedf35a6-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6028322,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"702758821d82f5549c2922f81710886f","sha1":"f318b7afd08f139ed22ac505130fc66efcc40962","sha256":"8b093466588a613d01fdfa9d301866c5a064d3f7e8b8d0105c6b3df4972c15bb","sha512":"27b892bfafa582e0d5b19eb7d7c7e714c468c58aecb3bc69f81b37b273f9222cb302f34045e4bfb3d436e6be55a3fa54b223cd6f801045bed2a8ba6dc3c41c90","ssdeep":"24576:WKS1/OBbi61/Vvx5qYONFC9VGM60S15tk+ebyMyRfMdlE:38h+tvxpOXC9VBTOFR0dS","tlshash":"412533b9b82a3481eb0179507d6f2522a9f7746f487b7f734354fa2363eae85d2c1018","first_seen":"2026-03-08T18:49:18.14445Z","last_seen":"2026-06-01T09:54:50.017658Z","times_seen":62,"resource_available":false,"data":null}},"time_used":1506,"timings":{"blocked":64,"dns":12,"connect":1,"send":0,"wait":350,"receive":1035,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.204.94","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.429Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:00 GMT","end":"Mon, 27 Apr 2026 08:37:59 GMT"},"fingerprint":{"sha1":"43:A0:56:D7:CE:45:C9:96:6F:34:12:13:53:CC:34:DD:63:FB:5D:20","sha256":"A4:AF:37:76:AF:D3:DB:1B:79:93:8F:E9:D4:21:4B:BA:43:54:3D:F9:56:DC:18:E9:5C:CA:1A:7C:B2:C7:DF:9B"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://arcusfinance.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 10 Mar 2026 07:34:47 GMT\r\nexpires: Wed, 10 Mar 2027 07:34:47 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nage: 242759\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-09T23:47:22.934303Z","times_seen":255745,"resource_available":false,"data":null}},"time_used":497,"timings":{"blocked":226,"dns":0,"connect":0,"send":0,"wait":79,"receive":33,"ssl":159},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","fqdn":"link-auth-5157.vercel.app","domain":"link-auth-5157.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://arcusfinance.net/borrow","date":"2026-03-13T03:00:46.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Thu, 26 Feb 2026 06:28:03 GMT","end":"Wed, 27 May 2026 06:28:02 GMT"},"fingerprint":{"sha1":"D6:62:1A:52:B7:FD:F6:BB:FA:AC:01:9E:BB:CD:40:86:5F:04:95:51","sha256":"4B:37:7D:7D:8E:17:70:BB:E1:51:9B:58:96:24:6C:11:6A:B3:AE:A9:68:43:46:58:B3:30:F0:54:F7:EA:43:38"}}},"request":{"raw":"GET /demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow HTTP/1.1\r\nHost: link-auth-5157.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arcusfinance.net/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\nage: 0\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Fri, 13 Mar 2026 03:00:46 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BSTyvSkCVG97euM5CcnkAc1RS%2F03%2Fcbp7bXLD%2BXDq%2F1wyfqro3ZWdZ3mWb%2BEKTxH2LA%2B7d07%2B5mKdJQtPMKXe5828OwtxSF2le7EzsfyMQ9DxZtAj58gVwKTj9RY6rt%2FIVgV1O6Z\"}]}\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nvary: Origin,Accept-Encoding\r\nx-ratelimit-limit: 60\r\nx-ratelimit-remaining: 59\r\nx-ratelimit-reset: 60\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::arn1::zq222-1773370846659-80d94d7e3c39\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":2848446,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (33714)","md5":"6ec375da889d83d510c5964e53835d08","sha1":"597f8973e670488e87e3c399828fd729e65bbf6c","sha256":"de6a471830f7299f6140c5a0d70d7e263fa1dbd089338fca33b8f18cebce6b8c","sha512":"be5d94f89bd1a269cd00155c67380cbaebb482649e0daf2260af6630bfdf2895decbb7683d38fbce940134ca7ceaddc7ca80e162c78fac2750b8eac67da2eb05","ssdeep":"12288:b44LZxNuaZYNUIFPfLUlKY4Ue+jFy1rq6c5249AZQmYN8Ge5CK3i/R0u4gpJ0:b4cZxtaUFBE1r5c52aAZSu3iZ0uTJ0","tlshash":"0d256cb073a1b07a03eb92d594661100f334941a700d84acfbaca9eb6f959cf957bf35","first_seen":"2026-03-13T03:01:18.920238Z","last_seen":"2026-03-13T03:01:18.920238Z","times_seen":1,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":139,"dns":14,"connect":1,"send":0,"wait":10,"receive":0,"ssl":121},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:49.045Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass1-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 13 Mar 2026 03:00:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 2031700\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nETag: \"a22dc9face81ff1665651f1052a0a99f\"\r\nLast-Modified: Fri, 23 Jan 2026 22:55:26 GMT\r\nVary: Origin\r\nServer: cloudflare\r\nCF-RAY: 9db7ca5efdf40883-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2031700,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"37d621b0888b9c9acaadc1142424a21c","sha1":"cbb67a69d5c908ed0643897721984ff71bf7a0d8","sha256":"b69becaf20ae2c964f0068c915b5d036da7dc363b1ea662f069f53f647706314","sha512":"474aad76d233471363cdabd9efc14cc91b32e291fc0e70d5bac4f9e5e20c36399f05f2f099795fa60cc9a7147632933594604474935b1e73923115ea8eaf7391","ssdeep":"24576:/2TAaRkFipRWRSlpAzUWOsWWvbLqhDVtxB6Ewq4zG:ZhZv4JsZDL8Da1a","tlshash":"e925333bc65d46417aa900115b2162708d3368ac58ffe63383edde72d78ba3c7d643a9","first_seen":"2026-03-08T18:49:18.127937Z","last_seen":"2026-06-01T09:54:50.06681Z","times_seen":62,"resource_available":false,"data":null}},"time_used":858,"timings":{"blocked":66,"dns":1,"connect":11,"send":0,"wait":418,"receive":303,"ssl":51},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:49.057Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass1-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 13 Mar 2026 03:00:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 6028322\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nETag: \"cf5ac8fca45e5d0409fef8923c179975\"\r\nLast-Modified: Fri, 23 Jan 2026 22:54:15 GMT\r\nVary: Origin\r\nServer: cloudflare\r\nCF-RAY: 9db7ca5f0fe0a0f0-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6028322,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"702758821d82f5549c2922f81710886f","sha1":"f318b7afd08f139ed22ac505130fc66efcc40962","sha256":"8b093466588a613d01fdfa9d301866c5a064d3f7e8b8d0105c6b3df4972c15bb","sha512":"27b892bfafa582e0d5b19eb7d7c7e714c468c58aecb3bc69f81b37b273f9222cb302f34045e4bfb3d436e6be55a3fa54b223cd6f801045bed2a8ba6dc3c41c90","ssdeep":"24576:WKS1/OBbi61/Vvx5qYONFC9VGM60S15tk+ebyMyRfMdlE:38h+tvxpOXC9VBTOFR0dS","tlshash":"412533b9b82a3481eb0179507d6f2522a9f7746f487b7f734354fa2363eae85d2c1018","first_seen":"2026-03-08T18:49:18.14445Z","last_seen":"2026-06-01T09:54:50.017658Z","times_seen":62,"resource_available":false,"data":null}},"time_used":1338,"timings":{"blocked":63,"dns":9,"connect":4,"send":0,"wait":346,"receive":874,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://link-auth-5157.vercel.app/demo.php?id=69acca861b6b3339908fa00b\u0026parent_url=arcusfinance.net%2Fborrow","date":"2026-03-13T03:00:49.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass2-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://link-auth-5157.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 13 Mar 2026 03:00:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 8319275\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nETag: \"ffdbd9550fb16af66a8cf7717da03833\"\r\nLast-Modified: Fri, 23 Jan 2026 22:06:40 GMT\r\nVary: Origin\r\nServer: cloudflare\r\nCF-RAY: 9db7ca629f2fc759-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8319275,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"c7f02284ef4c6c534add4f4cf923bd2e","sha1":"a8a1b5efc7188d57767b8c10dd21a5bdaba1aa4d","sha256":"ec27d89fbe8d16080062e2d897533f7eb588857b3955dfd53a7d5d240121bc2a","sha512":"7821407b7deebbbd4ded8b8d19129e39ca67ca223f89605a6491de9e2b3344d9b3598bf0561f71ee60690509852fe5534812d49fd9e4caa5953bc2035f08b73b","ssdeep":"24576:bDYQNB1s7x5nT9wysI0jlfn8CUBJRzdUkkIrCfh2SA8RMT0Y:bDYCBsTqTjl0TBLWLZ2SA840Y","tlshash":"0925336db03d9653ebaf30223e5a13c0aedb901c8dbd3e213384ad21875b5ed1d6865d","first_seen":"2026-03-07T00:53:06.700379Z","last_seen":"2026-06-01T09:54:50.069305Z","times_seen":64,"resource_available":false,"data":null}},"time_used":1736,"timings":{"blocked":637,"dns":0,"connect":0,"send":0,"wait":166,"receive":933,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-13","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}}]}