{"report_id":"4cad75a0-562f-4da9-80f7-7084706f1be2","version":0,"status":"done","tags":[],"date":"2026-09-22T20:54:08Z","url":{"schema":"http","addr":"usepaid-proposal.xyz/","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"usepaid-proposal.xyz/","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"title":"UsePaid - Route token fees through X Money","dom":{"size":608750,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (22636)","md5":"9ff89b1aaa5bfbf5c13db15cc55424e6","sha1":"60f585140adfec7c38dfe2b6367a04a47069307a","sha256":"ae3722d8a95872ea735dfad64e70c30235c739fdd7d8bbec704540378176837e","sha512":"e459f1fd625c7ff22ba429d801f81b82d38530083389ad401ec7f7a8642d7f6d1e8b9ab8464db2ec6affe765b7f667022c2cc8378897bfc31e4136da553c9040","ssdeep":"3072:Mcdo0Xv+lJYuHRYreswAiHHDbxO7sLWeKQ7Dx1LavVfUm:M/HSresw9Dbxk","tlshash":"e3d4d8a84261733f71a3c5ecfba6b7ed914aa70ccd679845e2fd536225c7cc0b522908","dom_hash":"domhash20bd4e34e5182b2b206c00ac17477c48","first_seen":"2026-09-22T20:54:21.236674Z","last_seen":"2026-09-22T20:54:21.236674Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"usepaid-proposal.xyz/","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-27T20:54:08Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"usepaid-proposal.xyz","ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-09-16","domain_rank":0,"first_seen":"2026-09-22T20:45:16.119207Z","last_seen":"2026-09-22T20:45:16.119207Z","alert_count":137,"request_count":137,"received_data":10712437,"sent_data":72324,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"usepaid-proposal.xyz/js/rewards-popup.js","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fcc4bc8d5b4949208ebb45c1474f609f","sha1":"c85a6701d7bf002c6bdc7aefa3f8b9e096e32ca9","sha256":"242d3ee8e8b2502b662c793a8ad47a31b2bbd73338b6d230cd34ce8a0c55227b","sha512":"a1a8b48a00a634393f2a8c405462b782fc47e612b31e0cb1ae7942969ef7565d0ca10b51d0aa10d3355bf441c434e9bc169a7562e20edf641b6a70e850553688","ssdeep":"","tlshash":"4a41401a52b4273285bb308e73ca729838352243fa55cc35fb5c09811fbcd41d8b65ea","size":2242,"data":"","first_seen":"2026-09-22T20:45:26.242209Z","last_seen":"2026-09-22T20:54:21.304807Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/nD58-PCn.php?s=%2Fipfs%2FwA515KIszW8vSvETbspBUAb2cb87241434924ddb834d6c3538ecb1%3Ft%3D1790110409820","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b8623999684fc94e9537761557ba0dc","sha1":"931dcb290564b74ed3611eb5c53b9800e302e097","sha256":"990ace56667f47ce3fe1de915149ce2ba88711c825466cda62e3a1e94ed576c9","sha512":"eabb3d98db3cdeb624f50d38a89a38b3825fd3b532666b3a09ee5277ed0a55954468e0f8d60ca1c5cae701ba1f6de28e649c338825cc35ba3314deaa7e947439","ssdeep":"6144:ch5gDwrq9NWCEiox3Ti/1gFQZDeoV5oMPNFppHSyyA:cs8q9NWCEiox3Ti/ESVPHSyyA","tlshash":"f0d4cbd0b34a56bbd8d6b2b7043349afdfa82d06064b188bd2e7dce4725470791d89bc","size":645585,"data":"","first_seen":"2026-09-22T20:54:21.340015Z","last_seen":"2026-09-22T20:54:21.340015Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"226e2315db69b1f1fb609fa9b853d4c6","sha1":"54dcfd86c0ec28b19e184c63e850493bddf3358c","sha256":"2ad9174da2e6d4c53f6081e14e76874e7b983eb1470d636b182281514c950ce0","sha512":"884c4c6f38e243a2fe60b753d50e09baba2ed629bdc9bd3fa24822dccc273b8072b20f2554080f4068211203b80275427d4e19a263e035b89af6ac2411eebae1","ssdeep":"","tlshash":"0cc080c09571cea8c15e04de1139578b7150687d4475d54ac5ec9f4e6d1dfcc6ec4911","size":181,"data":"","first_seen":"2026-09-22T20:45:26.369932Z","last_seen":"2026-09-22T20:54:21.352531Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/js/preferences.js","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"63a4d0ccd3d1d0dc81b866c876338153","sha1":"76d16300763a313b46dbfdfd298786f9bda1fb61","sha256":"985ffdf520b81b17989211d971532a0cd4974bb6fc859e232ecf7e001ac4303c","sha512":"c096e6843392961efcd43f30a77972724f3dc261fb1db46eeffee6170deb88f859a602ea67320c47274366a0ba8aff704b3d1cb505b5b85b0653d38e180988fc","ssdeep":"","tlshash":"2cd02bb976493673418620fd781823a8f6274025312f5ad8550e5f1cf9e8fa9a282cdf","size":269,"data":"","first_seen":"2026-09-22T20:45:26.263444Z","last_seen":"2026-09-22T20:54:21.347313Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/js/data.js","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"10a46270cfd41baf398b55b3b6ab5356","sha1":"3e8f915539540e65dda83f659b53132e3c083186","sha256":"8585ef495b52e9e8204b06eebce66b2ab771a107fc7c19b2eb727e15e5246c6f","sha512":"25f70fc073f512921acd7cc1276b2f9c25a91c811923c7f8008c423bf0277bd93106f5230a4b5e84aef73d985f391b17a8f1c99371c5fc591c50d4a36f5a8b48","ssdeep":"3072:5juXpbKEt8TkZowc15rZSvwqaghcnAGZ6lVpy4nXNLVYiEEVq+n1HcScXH+OC8dp:NuXagG+Ov","tlshash":"9555fa6811a1a33f3557c6ecfba9a7a9d11af70ccc76d406f1ddc26626c3ce86522d08","size":1371861,"data":"","first_seen":"2026-09-22T20:45:26.371158Z","last_seen":"2026-09-22T20:54:21.353433Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/js/app.js","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1290752a46430e801a1fb3ee3a924ecc","sha1":"655d7e68f0cf3a4cc1c6b55bd213d3559095a6e9","sha256":"63187e3a782e776f8698ee2b50571e916c4b20247c0db396519586ee884fa45c","sha512":"11ab6c2a7773272b280c2c8c4be589d534d9a2cd874ed95021fe21bc14e34c9a1d02280b0d83b4d0c58ca76fc34289bb286a307bd7d7b4c515d1c0b677d75422","ssdeep":"192:4jEdEKl6c6Lmw9Xi18UWMhyPSGubDfQ87YZTyTLp6HpT2oMGOhcej/s:4jmwuhy+3VYS6EoPuBj/s","tlshash":"05128899b076333500af7059b79fa2a07f3500536201fd24b9ac8f846fa6d54d5efa8b","size":9245,"data":"","first_seen":"2026-09-22T20:45:26.274546Z","last_seen":"2026-09-22T20:54:21.261795Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/pumplife.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.900Z","timestamp":1790110409900,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/pumplife.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"3679-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QeHYHN%2FhQMKK8KYnta61VPG%2FIbfSGfRGdJpxRE9Y3iBTh%2BwkrRGL1kF6gj%2FSJCw%2F74%2FHJQUOY%2Ftd7N5tD9IjOZ%2BtF7czeLygc4pZXYVwNzQHWVkIpe1zb9TxCwM%2BTBVaMUHvHOaZYg%3D%3D\"}]}\r\ncf-ray: a3f4330de91aa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13945\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13945,"size_decoded":14671,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"c68e85e896d76d4b2c2a3ed18d6b4d75","sha1":"d2e67e3f25b838200169f175288552be3d95bc07","sha256":"29794ef58dd27c8b23a8bf015f45a385a3b0c781aa202e912f0e0cbda5bb0340","sha512":"3f08ee4fe7979b0520e7f625fabbcb3f0e416fdf098a70825ecb611d1caf7a3064a975a11b93434750e6c045db8013cecf5d821a0bbaa9ffa20583542c398ae5","ssdeep":"384:gnEYygyAqN4EnPn3zCxfYYu3Q5Y6aZ/WjbRWMxza8:KqN4En7Cxfx3z7","tlshash":"6d52d1d3be546c26d643bd739b9c22b40a385c57cbcc8dcb08b9b079b66e74d012a123","first_seen":"2026-09-22T20:45:26.353007Z","last_seen":"2026-09-22T20:54:21.238319Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/vitalikbuterin.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.912Z","timestamp":1790110409912,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/vitalikbuterin.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"c77-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JnIiydqvCUi%2FeGjrqn79KyhfDAEP8MLXAbdsyazaRZckoB12ig9db5J2jxytN8sCpCvT1TEuSNrrWqLhx4s2naju71XOBJIUuh5THP6ynhj2TKx014tX%2BQRHnPYLMvI1x49lBIzYgQ%3D%3D\"}]}\r\ncf-ray: a3f4330df937a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3191\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3191,"size_decoded":3901,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"3740836dfe1e862f1e68465beca636eb","sha1":"0b213d972bdf78e21025adee0c70dd621cfd39a6","sha256":"c8ae14d24c79c116b5ba6816a63bfe50671f04f87181464e53d211e1b64eb795","sha512":"2e665999d02c1eec25c5f3c0858f4de19a66ffa676aeecd880dfd1cd40ce9696c7b616793fddcef8e64b1e9a39797bcd751d4f82f49c52bdd62dd7366ea97496","ssdeep":"","tlshash":"81613c52360a03f3c509c7a151fc350ba06704d2e7a3ca82c3ae6cb1b5d2bd31359618","first_seen":"2026-09-22T20:45:26.363108Z","last_seen":"2026-09-22T20:54:21.239388Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/paperbag.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.936Z","timestamp":1790110409936,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/paperbag.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"432a-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=04oKEyKXa%2B62GjszhjH3cgTTbYU9stFEQyEeDAwLJd1RR3Qh9QI38e%2FvaIfVZTYU2AUohZDVcUMgFCU7tndlxKqoVdfLQWC2SRS4496CupKbv%2BLT1sQbX%2BHU5BxG4k1oGDMm0VG0Sg%3D%3D\"}]}\r\ncf-ray: a3f4330e195ca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17194\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17194,"size_decoded":17910,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"0d622b2f5219cfdbe3a097b2bc1520f5","sha1":"a9dbd4b4b633dbdc784e21ab7a403cdee62ee3a8","sha256":"67312dae3c70903d848bf21be41eb514c6a05fd73fffce0f4cb24ec9980280c7","sha512":"bcd4eb0bf4a4ed1250635edf3c2117ce59f00f377b82ba15c16eb23a1348b738f3444ef4b52fa28a4f09d2c14be95fbf610ffd4be9ab4ad932ea3ba98327b4f2","ssdeep":"384:RFZtmGIMcE7TVKledIov2bq0dwk50tavFNZCtZr:RFTmQ97T84I9bq0aiyetwZr","tlshash":"7b72d05cbac20238ee62aa77f7f2551231845631eb0e91eeae0b105a1df7c4534a127d","first_seen":"2026-09-22T20:45:26.287605Z","last_seen":"2026-09-22T20:54:21.240261Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/1488ffe8-3410-4a89-915d-db9c75da5a0e.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.943Z","timestamp":1790110409943,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/1488ffe8-3410-4a89-915d-db9c75da5a0e.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"30c4-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PSwi%2BqQWBrFvi44RxtUAmt0Ejid85k7cQVDGHdIGjEsklyO010KB5sHb1zTK61h%2BdDx%2FdcHJB%2Bkx032i3nQlepXnfLw18E1iSZisyRK7ALgxY%2FWydXpvJmr7OiN9vO%2Fo10OERdPD%2FQ%3D%3D\"}]}\r\ncf-ray: a3f4330e2965a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12484\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12484,"size_decoded":13206,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"50356bb2e80bc7d7d1a0416f6fd787c9","sha1":"6936a379e897bf85134234cb30bb692d75dfdc98","sha256":"89d2d91569c92b21baa4a14861ce9b6814f2f2e6c198252dd3b6374fbf8a0915","sha512":"2a9dd11c2d2148980e8c0604845bfb99923a5453d32c5861be468c84eb316c096524cd132961b8fd9dc68bbbd8871a5029435061d4ac0c0e81ca3814873721b1","ssdeep":"192:sOB0Y0NbfDiCxLD0MBuok0P/coJgUXHmGGfO6CpNHgzosK/MuBG6fiqwnXH3oFsq:sOB0YI70MBLLHf3m7fRzo7tBGukX3Pj+","tlshash":"9b42bf3603668c2bee4c0738ad144fa4df08df5169890b1bd741469f1fcd6b94b1e8e0","first_seen":"2026-04-10T16:42:55.44744Z","last_seen":"2026-09-22T20:54:21.241084Z","times_seen":3,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_10.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.952Z","timestamp":1790110409952,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_10.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"9bd5-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WwqHoMlOiqBhbnzhzOvtddXRP3G%2BzeyNEfYkMJ8IW1kjSMCY4w%2FmRAxVbOb6cBFVHBOLgbG5DFwl%2FZg09aqrIiLwR9NDtkoeJjemCa0FBUUTIuS92%2BnLd9mWT9wAo9VWnEeuo%2B1rCg%3D%3D\"}]}\r\ncf-ray: a3f4330e3970a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 39893\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39893,"size_decoded":40611,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"ac19b6f187b3a5fe73c81cab1d42c353","sha1":"d1dddd85ed93a6f4469deffb643df82045cd411a","sha256":"1e8acfa735f295313ed83110a51b567d8c4a63a1fb3d2960316e9fa754c7b712","sha512":"ebd0a40a6c6436dce197e4f96b6ce6401ed89136073d116da1a1ec30b8ee15aa59a8f161860d9d5519ddf4cf2041902540ab2f807810df715ba232b9eb14abcc","ssdeep":"768:9hF7+eO91UXDVr3SfYNIlB9K7nVg7wYceNRMpGBdV0tTuv:9zOfUXDJPelB9ynO7dcewgdV0cv","tlshash":"6103e17551927782e3bdc63a4cfccbe19512ace229dea67a44c0186e075c1f0863dccb","first_seen":"2026-09-22T20:45:26.314226Z","last_seen":"2026-09-22T20:54:21.242157Z","times_seen":2,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/a2caef57-b67e-483f-bcd5-5a71fe9d93e8.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.983Z","timestamp":1790110409983,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/a2caef57-b67e-483f-bcd5-5a71fe9d93e8.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"4e82-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DgbPtFoUKqyuEHP4veWFYJwDoi9PryThXLitniRjCOTBwx1LM3RcwvCf4q2JNGx6jFmibfpxToMOEhJkMflLYs%2BD0%2BxVWdj6i6lLK41jigsJM4m7Ya8ng2%2FYnLjWHnE%2FxXZ02KqBcA%3D%3D\"}]}\r\ncf-ray: a3f4330e6988a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20098\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20098,"size_decoded":20814,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"dddc7597a0acbd1b75a1acab71949265","sha1":"7f8347fe883324a41208c71e3b644398f598857e","sha256":"da24fc9e448b2de38dd1258f2c8d48d9085db398dc74cea3a82ecedc385f159b","sha512":"fe2363bcf42f8d157babf7bc99cd1ac87b4ff48ec457f2be6e4c328c026d8b2575478fde70621a9bf28abcdf3bea93b1d534142e67e3526d3259040253f4e7f5","ssdeep":"384:sllh75powBhzERPha3N3AquNGh57xUrBS+MxUzPsO+Jwcv4503/oMAXd4dm:8lh75powvERQ93A47xkS+AUzP5vX0wSQ","tlshash":"cc92d06a5711670ef8cf407480a42716f203ba25d336a71743d1299e272dcedeca71ac","first_seen":"2026-09-22T20:45:26.25888Z","last_seen":"2026-09-22T20:54:21.243594Z","times_seen":2,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/c3fc8496-4e88-4b51-83a6-9c58c9cec858.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.048Z","timestamp":1790110410048,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/c3fc8496-4e88-4b51-83a6-9c58c9cec858.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"253d3-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7xsjEq%2Fu06F%2BO9cTM6CjFv4dP0JqAaW3Sfc91xDpHS1iXNAj2ZW59mbaIPXTKvSaeWkzWnbZaSrSYev5Sr%2FvrG0qwSFxYvlUfhZO9wwGE%2FCtAucAF9Jbwv4u%2B9FSi71KjgNt5otPwA%3D%3D\"}]}\r\ncf-ray: a3f4330ed9c4a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 152531\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":152531,"size_decoded":153251,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 640x640, components 3","md5":"a95952b52c5fd15843e38e7513aa46a4","sha1":"09a026078856eb585cae96cc93a57777497fb751","sha256":"3178a233656e5921f3122cef2882a55481c921040b4e7f35ab5fba37769f3ee0","sha512":"4e0f6cff409b4bbe5e9cf189c15d05fb580601ff99f3a4848a66dd1ac8bbf19b66c4e8b4f6bc8e878945abbf99b93746903b563e7cb8cce2fb49dabd47ec5d57","ssdeep":"3072:JAuL/bmr3zPUhD3JiJNanxC+gKGm6ePvku0Oze0BEWm4Q1EtFvL:GQ/03zszY4xC+gKGmbXr0OlEd2D","tlshash":"69e3135b947fd08890923956f4fd4ac9cb3a18bfb4e2b512b12c3189cc8671dda8a517","first_seen":"2026-09-22T20:45:26.252341Z","last_seen":"2026-09-22T20:54:21.24456Z","times_seen":2,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/rauchg.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.929Z","timestamp":1790110409929,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/rauchg.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"be0-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Hhi8YWmFbo%2BpxbDMPaLyCqH3PKfUZectqAv49qHIomZXRedKy82iTGAaWu%2BpcAhZMiKZUjo3dyiGW0sl9sUHrAPUGr%2BZI7%2FKYAB5rJlEU5jdxAoNXCw4QjGD39TML0OISe8XxkykEw%3D%3D\"}]}\r\ncf-ray: a3f4330e0956a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3040\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3040,"size_decoded":3754,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"1af1c3d432ebb8b93ada366e8011ddd4","sha1":"99379c65fcf19e676cec0e217c8642bcb801db04","sha256":"35ac7df658f2f28f2a04bcb567a3e8f49d1c8463e762bd1573a0dc46ff2e1d12","sha512":"f68bb21a5eaf6032641a6b616e5acccad37c39e7a2a0566a90e2286262b0d20fb95f66f016382be7f3685c5418329482aa3f2ad2923105449d7a7837ae09af79","ssdeep":"","tlshash":"f7514d3aeeeea3fbc4d61830570c255711e919736cdc8c0495486ad69c338d62f327c4","first_seen":"2026-09-22T20:45:26.364073Z","last_seen":"2026-09-22T20:54:21.246389Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/c5945aec-01b4-4da1-9fa4-87d58edfb5b0.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.956Z","timestamp":1790110409956,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/c5945aec-01b4-4da1-9fa4-87d58edfb5b0.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"81ad-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rqTGAhATdIGLAomLOevo8Oq7IwfYZZznPnrdsFHTL%2BWb4MExDT8dpy8kktbSC9g8jYWROeO%2BeIZJtHw6o2fDizF5O%2FuaQ0WbITiw2QUWAxaWUEOBr7bStll1pQ0wAWDq07E5xOCeIQ%3D%3D\"}]}\r\ncf-ray: a3f4330e3972a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 33197\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33197,"size_decoded":33911,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 335x597, components 3","md5":"3fa0e116dd94147a2a51bef9c9048941","sha1":"e1a8e6af3db22df40bdd937e8066804710e1a7dc","sha256":"3dba9cd038eda748a3c3fc9464b448905d9e6bc8293f1d2d382da70e1a428b78","sha512":"cf211359b60b4134aa3acfc69ac094b644bcdde89a333a9d115771041144bb249840e8893b29475091df5c6f566803f87fae5b70f77c1429b3c9cc3f11ad16a8","ssdeep":"768:24uVu3OJ13tYY2z4symuBCHZNW3UG9gPbQEJNYWec/5osjxwQarsZ:+MOJ9tMz4symuBybW92bQSN7f/5orQQo","tlshash":"c8e2f15a778ee40cf5ae09738028397b62e8a7a612fce0c6750051f073e4a7b41968f5","first_seen":"2026-09-22T20:45:26.292721Z","last_seen":"2026-09-22T20:54:21.247454Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_48.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.042Z","timestamp":1790110410042,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_48.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1977a-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0t86kQrBeBm5Z4Le4of1X8c3wJ3LiSMy68TWgUsflFGEmpjDn5AIyNoYjdvi%2BEYaOHiyC06d49dqfkzIVsNg5ZSPN%2Fd%2BulxuDVbP2EQNtVRzdf0cnNUszlYTqehQQxKKNvNiVrzSkA%3D%3D\"}]}\r\ncf-ray: a3f4330ed9c0a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 104314\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":104314,"size_decoded":105030,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1172x390, components 3","md5":"31c78616950367c2c65afd6378318d7f","sha1":"b7676b74523183b39932307c4632c859c9e6f876","sha256":"10fd8d0adbe89dac1affe21cfbccf2aa2d220475260bc3ea00acd663aae528fe","sha512":"eb0f64ff6a3a3b1deb18b0a9502f4e0710afae5259317707dcafa0610798f189449cced66a818fc789f41863129f3f517cbb8fa4ba6fe47897b21d11ed2cb6d1","ssdeep":"3072:7VIt6LKltqc+90r8Dk7yANl324hxKPHpN:7VVLQtqzqwDkxL3gBN","tlshash":"bfa3024fa892f3af78d2cc734227d796a748b7102e2746785241e4894b7ddef89d031a","first_seen":"2026-09-22T20:45:26.270311Z","last_seen":"2026-09-22T20:54:21.24852Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_34.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.045Z","timestamp":1790110410045,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_34.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"ad68-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QUWLoAolhm85Yf5oDY0cHoYE2KxoS%2Bw9nZF0cefK%2F4BAYiDwCP8cVuTm0gaJ3%2B%2Fg5ZRhU%2FmhWc9DMVWDqVfSsnqzCFhlTu%2FR47p2oJFiaaE66BPfMXgY4s3sDG24epHrOyYwPz8%2FFA%3D%3D\"}]}\r\ncf-ray: a3f4330ed9c2a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 44392\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44392,"size_decoded":45114,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3","md5":"d6d8ceda565301a1bde5738fddd147db","sha1":"e1cb5d8560a1ac9278f4ee328b9453f1a93e69fa","sha256":"d94134116fc0d89e4554a830059f4f894a9b1b788703b264c72095e1c805934e","sha512":"cfe584da95da51e361c9cf8c789900a337828974ca41ade66c2ccccc07f7c5ae532cf73507796f463c312cd4f967087de71658fbffc2e83751768ff9e05d2b23","ssdeep":"768:CpP+5ECk/Hos+q/FUACFyM6zafwrilgfSKP+97RYwDwNO2fh75MQNE1Tm+zojFXk:GECHos+qdUzFIzzrilgfeGWsAQNmTHz9","tlshash":"aa13e10c5390c880fae9c6ba1c1bf76795d07a94da5f9c1b952eabf0172d23c63d0179","first_seen":"2026-09-22T20:45:26.238038Z","last_seen":"2026-09-22T20:54:21.251491Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/pump-logo.svg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.897Z","timestamp":1790110409897,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/pump-logo.svg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"89b-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/svg+xml\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rAXhh83jyiKSn%2BmpVCbuzJlLxQenxOtklhUTXGAyOiouoXB1EtHFn7CWdG2u5QrZ4gggB%2Frtv%2FuCmJthJ%2F9CeHc0NsdRCoCIVQkll5OeCtLawiqa0t7uE5wtg%2BIsKb6wiNk6vsQF4Q%3D%3D\"}]}\r\ncf-ray: a3f4330dd917a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2203,"size_decoded":1752,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2453bde6c21392341f27c6d2152db2cd","sha1":"6499a8936200143cdbce9dd84f628c77ed25c7cd","sha256":"5fd26b35cde9423feac2a555312cd5a8e32bc07d934c59e6b750bdbdebac5049","sha512":"8417ad500c4643fcf4333cede2ac6b93051a97d29bea9e731d317156d357c3d8e394dce7a25e213bf07851b2168ab3a982473e298aa4d8ff7b41400e56dfbe35","ssdeep":"","tlshash":"a54181ecb71498bcea9807bfb61420d8361981f93a2740de903e339034219adc414ccf","first_seen":"2025-12-18T09:47:26.931007Z","last_seen":"2026-09-22T20:54:21.252301Z","times_seen":160,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/bbbc4d2c-be21-422e-8531-ca111968aea5.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.994Z","timestamp":1790110409994,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/bbbc4d2c-be21-422e-8531-ca111968aea5.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1b42-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IbzAJuvN5PydspZvyUiwpH9fPFeKDpCpZxGuUInAoO2EU5bua5aGZ%2B9ypp8vO3PHx40vVq8XlrfjmJ3jbutAHMfRMWm05ipHd65CnmNhfzrF6Jdc16IM7d4c9%2BneQpiodCFYwM2vSA%3D%3D\"}]}\r\ncf-ray: a3f4330e7992a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6978\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6978,"size_decoded":7689,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"449f5577e8177393bad496faa8d6c0b7","sha1":"21931161d63b9e3bc9c523095f0760335b17d7d1","sha256":"635a9d0a8e88ea61061a5ace96e9664648a231bffd4e6d54ede92879885393ba","sha512":"c189e5239013b3406b5770b0c82d1d661f5dc70ae101842e69b2a7e76a77c3eb0e69c8c59d8a01b18b6c5d1588218728f69a23622e4371f1f44cf29a3d00f949","ssdeep":"192:lM4Qneg+cDdTx8FXSdoMG7qNIRAxhJ9qm/VY/fdf2:lMBeg+cDv8vMaqSmhJ9qmO/fdf2","tlshash":"84e17e9a8e66d9d9fd54bc3192630cadc3deb5fc8941a0a5eb1e0f4e4bdca052d1e0d0","first_seen":"2026-09-22T20:45:26.30946Z","last_seen":"2026-09-22T20:54:21.253024Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_41.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.030Z","timestamp":1790110410030,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_41.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"dafc-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4TsuEA7Z9J0gkNfBeL%2BS6sm%2FK%2Fd%2BERe0zrxP79snr1PsH0X0fQWWP2p0XN%2FuyTed1mP44gbpSUv62Rg3TlUcRsJ%2FKBDAw0u9C%2BZdwzQuWQboQEAtznIFI7%2Bm9liqdvtnEt%2FdnCzYdQ%3D%3D\"}]}\r\ncf-ray: a3f4330ec9b1a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 56060\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56060,"size_decoded":56786,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"61bdd15ef3a7d4828c76f364851d4385","sha1":"0ad7d33c034601657fcc550900e770652c49b734","sha256":"b93fd29b6aa7bbec772641540bde1411c157a6ef4c66c804b400d463ccf6644e","sha512":"5d6e2ee4bbd484d30becd5448d2d4ae72589ed08aca8d0c31df20b443d3652d3a5b524aab18e527274269f79e649b4e0a102f6b19eb5fdae502d877aaee23e8b","ssdeep":"1536:gN/GWMaA7/dlVj8cjj1pe9Fyx0OaydtY5AHl1:sG8U1lVjPbe9Fc02eOHl1","tlshash":"6d43f20e400fba16f01d583168d01ad64ab17ac16276c1427cfdfa955f750b1bf7d8ea","first_seen":"2026-09-22T20:45:26.228258Z","last_seen":"2026-09-22T20:54:21.253844Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/css/fonts.css","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.858Z","timestamp":1790110409858,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /css/fonts.css HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 11:12:56 GMT\r\netag: \"ebc-65b97bfc7de00-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/css\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sjJ2%2FYojDtyYziX%2FM7%2FRz3xQ6rTVijOzPBxLvuMApMFanYDSD%2B3rmHONdnaQ%2FBw82mh%2FRIyc2jiFcJJKh7B3aUJdHwQUoKY%2F0yKsZBPKidPLHJE4EunIb4gVNqNJ00kZEz%2B7xQJRIQ%3D%3D\"}]}\r\ncf-ray: a3f4330d98fba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 835\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3772,"size_decoded":1609,"mime_type":"text/css","magic":"ASCII text, with very long lines (822)","md5":"08ec2a222ea61e114903a8b93766772a","sha1":"2aa8a3d3fb60b3debd1c01d4fe2cbba441b70a83","sha256":"f876d90153266514d18aae6b39bafb98bdb0db09e4ecad5de54b822926b02ef0","sha512":"36d240c03fb48e4ee0d51d82e9730828b0e39dc6c3872413494aa025aecd8fad0acadf05b0945490d721df515dabe72678f394c090cbc1c1664192b560a3587f","ssdeep":"","tlshash":"1871bf205a1e6327e8b68d83768f7b126e28251661d44172f52a199dccef43f13e0b7e","first_seen":"2026-09-22T20:45:26.273383Z","last_seen":"2026-09-22T20:54:21.254648Z","times_seen":2,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/css/styles.css","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.859Z","timestamp":1790110409859,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /css/styles.css HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 11:12:56 GMT\r\netag: \"2071c-65b97bfc7de00-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/css\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6gfEweafoGScs8G5Ng5XLlVArIIwsove6JEtOOzszfBFix4u7CR1tHCEHEp9uejvfwmXe91DOpmZsfRnso%2B%2FeS%2BK1HVH65YmmovYKdo%2Fs8nDM5EYcC01DL9W2Ci3JIsVMvHuJbLwRQ%3D%3D\"}]}\r\ncf-ray: a3f4330da8fca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 22616\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":132892,"size_decoded":23386,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"26547395105fa57984aeecd1c6802ac0","sha1":"751762aeb441468baf2001521d819091ee71b4c0","sha256":"24356b97889bad64ee3a0297f1dfa69b0c33454519facbb2374069a9f052aa2c","sha512":"630d56093c7d93b957cd35c35d1803528f90c5c75e7752c1474f3a1cb3a664836095ae3fba69cc4eef1bc4831f9de04232ab1f193c38cede920ae5c69ecf8be9","ssdeep":"3072:TY3VdP+di6y/QWYpW+Gjyir6aAaVc6n/UaC/6WXwTngt0saVT:TY3VdP+di6y/QWYpW+Gjyir6aAaVcL/q","tlshash":"39d39114f239d23f7d2365b9d3dce8cc6209b0569e22abfab654231307c33f5592652a","first_seen":"2026-09-22T20:45:26.306544Z","last_seen":"2026-09-22T20:54:21.255463Z","times_seen":2,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.890Z","timestamp":1790110409890,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"2d46-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R%2BR15fWv2oMAjkecHzDzfU9QlAzgCFqGf9qv9b4RwV6A%2FekceJ6%2F40hEJNNrKPLs9BBOdVqsVozLvKpxjNKgjc5dUMrTT%2FS57kzMgWNUlvQKiLB%2BLtKuE1CUpm3c3pf4Rl5myGDw6Q%3D%3D\"}]}\r\ncf-ray: a3f4330dd908a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11590\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11590,"size_decoded":12308,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"36c82656a7325fedb3da5df7ca2c1603","sha1":"a44674849de71acafa6cfb7dc1cae1bc7271caf8","sha256":"bfdae759d1d05484a7ff532b7f28c51f31eeb0efd347f5c8f6b4631509abf1c1","sha512":"6c89b456f05f9de0e277d32606245b4b081aa0b4def786042278d4979b285a971c4a5866811b71cb5cafc39d3f7697abc4c6425312384275ae21a91fd8ed9fc5","ssdeep":"192:s89wX/MJXerJw9nvvyAopU92Kcy3fbQm56+7wyYZvc/uDhOe/vw/wHs3/o:s89wX/Mow9nnyv41z5A9Owv6ssPo","tlshash":"9b32bf212758df07c8bea33449c99241d70a6c7bc6228be7da9613182b794f0ff384d5","first_seen":"2026-09-22T20:45:26.293621Z","last_seen":"2026-09-22T20:54:21.256527Z","times_seen":2,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/sozyuku.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.931Z","timestamp":1790110409931,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/sozyuku.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"224-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h6ZVfltxYGkVqqN6zwaK%2BhRSzlMX4nxcaZTFFanW%2BoFn9VgPdU2go0ELK8GAlf4RYJZ2wFEl2EJEWghlnSTbD%2BpHVRvv4r5o96787LDeCSr04tZMvVnJIdwTT7yx%2FEV8IPUuXM%2Bj3Q%3D%3D\"}]}\r\ncf-ray: a3f4330e1958a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 548\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":548,"size_decoded":1263,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 48x48, components 3","md5":"82365cef8f34236469c96c0a87d5206e","sha1":"cbebdfb13086fb5eadf5cdb444550d76394984f5","sha256":"559170f3abdd2f102e5a8e59f9b9e10955e7996ec97604df5caa0a15106841c5","sha512":"b9b791b721a908e64a31e7b92c3f2c66908a107a7f82c2cbb917d2cd7ad36c8b6f38723d087ce072d29943ddc6cce8e4a2ca46c645f8ba5bd6647d4891b4db10","ssdeep":"","tlshash":"4ff0598ebf2782e0dd95963c13e833cc2189a5b7a2e6878d82913572a5ff4c58f40a04","first_seen":"2026-09-22T20:45:26.247962Z","last_seen":"2026-09-22T20:54:21.257483Z","times_seen":2,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_25.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.004Z","timestamp":1790110410004,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_25.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"612b-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hZHHVzlM%2Bz8VmnDCty6SMdEvIi8TW0nLC30m1Vpp7b%2BkyYWMt1224o%2B985%2FMOc72UobqECMPspFyKHw9XEbYLYKY19IiAnfRDOOoVkcphP4OD0qtw948ZISIS5VPGVa5Oj9Uji7KBQ%3D%3D\"}]}\r\ncf-ray: a3f4330e899aa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24875\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24875,"size_decoded":25591,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"9327b3d5e95a47a6c243f6145c5139d3","sha1":"e0b6d8d6bbd767340eee5f42d90eccb90ddca49c","sha256":"c855db6c89ad4e8fd80e7b253078d3ea221b3436db55b70c8c4d82a4d46e59b5","sha512":"bbbc86e61bfec8461133bdcd568ac5dff8bdc2e997ee62c4630ee91471fa8cacc422e8980666d139e2b594ba352efd3d18e1005b0075821de294d5d792be9a81","ssdeep":"384:su764f3pE9nUAQqy4bqe/O5fSxQgmyQJ8C9I/YqUaquAbR6/L2Rc:b76+m9nLBsT5+QjywI/uuWR6yC","tlshash":"ecb2cff39bb9088ec62d6779068422706267d8c74e126fff748d944cbf2cb842c54b26","first_seen":"2026-06-12T01:48:34.748528Z","last_seen":"2026-09-22T20:54:21.258305Z","times_seen":5,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_29.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.021Z","timestamp":1790110410021,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_29.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"dafc-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=00fr9Cr0w5Vbm%2Fhe6q750i3N0MK9b3rjq%2FiDpD62%2BW3ANfGCpHs9b7HUWs6qKIGbcqMdyQ6yO4enKOTW0S6oULGWHGrvse6g%2FGZ5qXJ1WlgTsgJbcfUkpqp46MdxBcvk0VkaImrayQ%3D%3D\"}]}\r\ncf-ray: a3f4330eb9a7a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 56060\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56060,"size_decoded":56776,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"9e5bcabd54e212fa978d4f224e32be27","sha1":"8284628560ec3a0922ceec538bb076370b445f1b","sha256":"4c43183a4ed169a7ccda2eaab93a5b146d55aa8ee3917d4f08cbfb37e7a2ebc6","sha512":"b72072c1fa74dabcf11480b947d75d97e0dc73bf691c675c94c23fcf8413e5d50d64a3b1e44ba477b2d614da990ed35e7106a32c5603404b69885d650477cb31","ssdeep":"768:s/ymDaDcScPp1qFB5BasogiGvAxnjntQSC1WXegjc17CFteblrFqrSlBBb:ky7McB5BafGvAxJA1EtebhlHb","tlshash":"1743f1622b764576f89909f8949c5a2fcf0b6b69c92c05dc391f7b287b044b01349f67","first_seen":"2026-09-22T20:45:26.345337Z","last_seen":"2026-09-22T20:54:21.258997Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_43.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.035Z","timestamp":1790110410035,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_43.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"300e-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ajQwfmkmrT16Nd4DuIyMqtO3thmDxIvp71KlA7hHQWLurGERO2lcmI8tcFqLRjc2X9dbvq%2FhA0pKeLDNa4y3mCGNio20s6QYKwzv840%2Bd1pkXkNdfdk4ZkiLeEje%2FZre3ZVqM2Cbpw%3D%3D\"}]}\r\ncf-ray: a3f4330ec9b6a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12302\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12302,"size_decoded":13016,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"c35872a5b529fd2f8efe024b06aa5295","sha1":"e86f23e0615edcb5fa55b35694d3049a4dd2e79a","sha256":"db7024137316e2188044e1470db905b9d50c7e798a42cc55ab2fcce97b6ca922","sha512":"1deb34b572e990f5864f24d7add7f2579043df52d8c8e4a61303725fbff8a998a82a3915b33325fda72f57f2a2beae5ab57d0def92566df0e8698604ccd0e51f","ssdeep":"192:sbJLx1PdqzGsGrhxHvTqhOrIRAKKjNnEhPJ31GX+seoG1/bStdCM:sbBxldSGPrPHvT46KENQRVspW2XB","tlshash":"e7429dc26314951ae16e07382ecd1b349ab0ae359a40b30ff1cdd54d9f6ca371809bd2","first_seen":"2026-09-22T20:45:26.230666Z","last_seen":"2026-09-22T20:54:21.259729Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/css/interactions.css","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.886Z","timestamp":1790110409886,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /css/interactions.css HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 11:27:56 GMT\r\netag: \"fe0-65b97f56cc700-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/css\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qu72yCf5o1FRq0dwCqOoHV9weRo7d7Vg%2BN8xsRxYDsp9DuoaEA0D4MMsgNVHvCRnwCN40b5CzsewoyHbMCHXe%2FAo8oCK7L1fI3Pqqp4MpLbp2SqX864%2Bt6%2BGdjKDw%2FWgzxeyVirWDQ%3D%3D\"}]}\r\ncf-ray: a3f4330dc905a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1453\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4064,"size_decoded":2222,"mime_type":"text/css","magic":"ASCII text","md5":"4114bef161ccd0c8d9a9fa6d637d6bb5","sha1":"89a8171343e03993a9fd7be712f3deb643a9ed37","sha256":"66279fac7b32c3d8987d81b48755392be00f90013846d39a4b004c3aa655c816","sha512":"5efe40de7ffda672904d92f991a38b6490f2474f467d31bd44a2797fa86f46bedcd5785414d25857353a74f0cd1dff23228b86734ee9e5de044a95f339b1bc15","ssdeep":"","tlshash":"b8817593bf082205f167b5917f93875ea3285243e4129bbdced8745cc78e0a019bbb59","first_seen":"2026-09-22T20:45:26.301375Z","last_seen":"2026-09-22T20:54:21.260484Z","times_seen":2,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_1.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.906Z","timestamp":1790110409906,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_1.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"97b2-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XYGeB4QMQwFqEZUoPgZDL%2F%2Bte9sBVgVVgFFGFWONjsRnVGbcono9hbXzovDA7lkdKAvqkKpA6DuB1ooISxu1MxLizdPu5oUZgk8i%2FrIKMxCDt8Y8tyjHQ5%2BpG4aQtsfi1c8ewnF3Aw%3D%3D\"}]}\r\ncf-ray: a3f4330de91da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 38834\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38834,"size_decoded":39550,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"f7ecadbe0e1c30f5598077e2aeaf6b30","sha1":"70e5f7e6ddc6006311270b0d04688f381e403c30","sha256":"53b9bca69f0228919f1e8e6564118ac5a9a48db20eb0a7eeebab355ecf151d98","sha512":"baf78e89ebef0736290e280acce0eb07a4211d3549df40b4bc2db6c4ce2e137a84f07a72f22df21fce804e13305a9dd37154f41189a04e4ce77fb0a0ab591212","ssdeep":"768:l+HQCafHDbgXHm1sWThIYJPowIjEYnzBW9qXc0:EUbgXHKmYJt6v1Um","tlshash":"7703f160db814d0beaff8479758177eab735ee10d15ea87122f2824923b18c45c5cadd","first_seen":"2025-08-12T07:22:13.889351Z","last_seen":"2026-09-22T20:54:21.261224Z","times_seen":8,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/js/app.js","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.925Z","timestamp":1790110409925,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /js/app.js HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 11:11:48 GMT\r\netag: \"241d-65b97bbba4500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/javascript\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5EjP%2FfPD57g%2FrozZdLWAl6%2BHVyQAT%2BO4RYHvKzkkUDoAj11NXrQ0HRyVwDjBbcbD4NoNrDaEKjw1bFQ3vXX1P4SJl1JY7tikw0vfvURx%2F6UXyo%2BXRQ%2Fw%2B1vvQOe6%2FhUVOy6cw2Wc4A%3D%3D\"}]}\r\ncf-ray: a3f4330e0952a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2926\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9245,"size_decoded":3711,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (408)","md5":"1290752a46430e801a1fb3ee3a924ecc","sha1":"655d7e68f0cf3a4cc1c6b55bd213d3559095a6e9","sha256":"63187e3a782e776f8698ee2b50571e916c4b20247c0db396519586ee884fa45c","sha512":"11ab6c2a7773272b280c2c8c4be589d534d9a2cd874ed95021fe21bc14e34c9a1d02280b0d83b4d0c58ca76fc34289bb286a307bd7d7b4c515d1c0b677d75422","ssdeep":"192:4jEdEKl6c6Lmw9Xi18UWMhyPSGubDfQ87YZTyTLp6HpT2oMGOhcej/s:4jmwuhy+3VYS6EoPuBj/s","tlshash":"05128899b076333500af7059b79fa2a07f3500536201fd24b9ac8f846fa6d54d5efa8b","first_seen":"2026-09-22T20:45:26.274546Z","last_seen":"2026-09-22T20:54:21.261795Z","times_seen":2,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/patrickc.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.926Z","timestamp":1790110409926,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/patrickc.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"b4e-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NpPrbVfCoFOT5pLam%2FeRdmtOr0MOrcnCJOejOg2uzApFoNrujIgFcgq30u6hP1Ah7bye2qztCX6lJLG107T2QQ%2FuhJKxqGrGoYaXNf1%2B5bTLpw9f9TUfRgNxj31YnHJW8dNnQxR4Gw%3D%3D\"}]}\r\ncf-ray: a3f4330e0953a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2894\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2894,"size_decoded":3606,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"44bc0afbf28a6cf0edf8df5fd68102b3","sha1":"3ec087acbf9ee80beda09f5b986ab82ecc52fcfe","sha256":"01ab126bd5fdc4a5d67d5cc9bac25563510fe574c215928a1ca4f95c73de4cd3","sha512":"de44c54d288e4fa64a6a18376d8a647f9915903fb07ee690fff92519e73f090e11b46b6fc0ab0ad0fa980b08d39b86ce9962557950d16ef50da230c4c7f915ce","ssdeep":"","tlshash":"50512dc73d219ec1db25ae3bb5f4198df64412b994f65d28b442a510d4a73609f72390","first_seen":"2026-09-22T20:45:26.322608Z","last_seen":"2026-09-22T20:54:21.262394Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/322ea46d-4b2b-4b98-9b7c-3d7038e4a02b.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.967Z","timestamp":1790110409967,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/322ea46d-4b2b-4b98-9b7c-3d7038e4a02b.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"2477-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6SAkGzQlI%2FNyNq67Phrt%2FWKQ1hm%2B64a1AXgGDllFBGWK%2FBE8PG%2BXhqAEr9j8nI3KNvkc1zEC72jiLfjcwsfUIANvjuGT%2FM0S40Rzqak4RRBymM0jcl2ceFEUROGLD479qhXW9SGCmQ%3D%3D\"}]}\r\ncf-ray: a3f4330e497ba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9335\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9335,"size_decoded":10053,"mime_type":"image/png","magic":"PNG image data, 70 x 70, 8-bit/color RGB, non-interlaced","md5":"d158285d7b1bf923c6280bfc6e160183","sha1":"56ccc841b1d5775c855e56d21a0c51c1b45af354","sha256":"59d6680224b2258a5fd7db2fca79a06a8a8cc0c562282381a10f4c8555b1e775","sha512":"35f095aabac1c22a895cf3c36b076c7915d7b6b95c897cb3906800ea16638dbfd8f4808121f9c834032c9cce88349486557a7b27f68cbb2af91fb03f01dbd1ea","ssdeep":"192:Tbvfq2lBSSXKDiSk65SOaROed/Ht5bgyobLrirKrlhsmGTF+x68yE8:/vfx6bD4lOQtPYrDvGRY68M","tlshash":"d412cfc9ae4d980fc56ff6358a4db9574a99c598c7bc5bf05cc28a3871e302247486c3","first_seen":"2026-09-22T20:45:26.281444Z","last_seen":"2026-09-22T20:54:21.262999Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_28.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.019Z","timestamp":1790110410019,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_28.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"2befe-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zUIk6jyy6glrDVoaMLn5PwgWIVh9N5Sk%2B6%2FEyaCKke1OfAOA5MS563z1tG8dU5qedp%2BMsESP%2F3CxZROi8hPVBdSFlGputr2PgZvJYUR4nRmeZ49ad%2FySZZXgpUIgm%2Be0eeTFC3I4Qg%3D%3D\"}]}\r\ncf-ray: a3f4330eb9a8a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 179966\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":179966,"size_decoded":180688,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1265x422, components 3","md5":"39b0c93b67dd1e10ab2dc0043d4d6eaa","sha1":"2fa1d06f6d9e2dd9a5ebc0f27e69a08f04b2b023","sha256":"45d82d8f55dcc856135ae4e06ab41a7034728336cbe2eb2997146af9c22bced7","sha512":"800e0da82a6c6665c258c8cfc20edce46597b2516a4c8c63978d22940034764bb64b7dad6912a3f5eb2cd62ba2a96184c073d701e83881fbfdee4891361389c9","ssdeep":"3072:chiiq7gD/top2qqniKqw7u5lQmo+lCcSzlW7PtVakwdm6gCCVlrPWyUodlmIfu4n:chiiVjk2J7u52moGSOPtwbYRreyrel4n","tlshash":"020423167cbd4f4efbe4b876296bd3241fe4344b57401a0523a8da0483f148dea9d6ae","first_seen":"2026-09-22T20:45:26.260003Z","last_seen":"2026-09-22T20:54:21.26356Z","times_seen":2,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/chirp_500.p.1uhf2wlav09eb.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.845Z","timestamp":1790110409845,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/chirp_500.p.1uhf2wlav09eb.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"aec8-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5OrgvqfPFdGarfRxSM6SPBJ%2Bq5KrwBDMQmRADmdawV%2F2uejoB4X%2BYdnVGXGUPGd0PF7BNBSXWh5YLb9em2fZyBsDaguVlVf%2BflPOJWc2dfk7OxCT%2FTqrUgU2qAOFDncE9FumkidddA%3D%3D\"}]}\r\ncf-ray: a3f4330d88f0a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 44772\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44744,"size_decoded":45545,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 44744, version 1.0","md5":"22898c3b88ef29da6a41c302510f28b4","sha1":"f9cc37a5977f1163068a0a73d289ae2431a7fb82","sha256":"29bf369dc4c1b989f933e482f76b961acc5478bf48800547b18d6cc6b9b9dd91","sha512":"f270ed67a28469b36694a7600187a07ab8fa82877d3a52bbb442c6344091e3ed815ffec90238605fadba4685dad0f5ef0fc9145ead8ff38ed21969a4f6a5ef72","ssdeep":"768:dxszm2WHLjjPNDTCw4nY1ljkbpYNdt2gN8BHcVegXUPaMaU+GRquWGvJvaivBHFE:nc+5DTCi1Fkb8dQgN81chXUPaMUGRbv0","tlshash":"c7130101adfb73dee7857b743b860b65f8106646b7d259fc20e365ca05d7a2fb2200a4","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-09-22T20:54:21.264222Z","times_seen":3783,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/nip.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.894Z","timestamp":1790110409894,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/nip.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1b8c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I5GX%2F4Ep4oFConTvqGW1pWQADDNBzIyzIMsiZcY0Z0P9OSxeCusojkgz0aTy38ljOVJZEkeT2A45CWrPnkf0pX%2FzTTqML4Xw5%2FMwxdIktxO68B1yVndpN22hvEo6HuxGkj3rYROWUA%3D%3D\"}]}\r\ncf-ray: a3f4330dd914a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7052\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7052,"size_decoded":7765,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"aaa24952ff85c3c80630ddf994d6c93a","sha1":"5cf704c372e11136a23067995851b5afc73f1076","sha256":"9e139b4d0225446e5a53c76aa174cd4df020ab31e3a88a4f952b12b5015fd352","sha512":"5fab116428bee7a5fe8868f36a38e60da76498d718c4bef7afab00324cb89e40ff61d41ed489cbad9253f14e1c765ddee26c2c3276271962ca87597aed917aeb","ssdeep":"192:sxx0PDs0nBBBBBBBBBBBBBBBBBBBBBBghtNPSL/gYu5jPiVdX8eC3MLBovb:sx2rs02tNPMn+g822D","tlshash":"c7e14c1e4ba704c3deaccb3002d8c319246587fb97c8759523116f9647be5a7b93a681","first_seen":"2026-09-22T20:45:26.243251Z","last_seen":"2026-09-22T20:54:21.264786Z","times_seen":2,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img.webp","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.944Z","timestamp":1790110409944,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img.webp HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"20e0-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BaXjQn018XRxyyb%2FqhAM5ZG1oD6g6RMm2fESHlQQ3kn2MK98N3JPVr8%2BKE8uF%2BROiByp7UA9bvDoUsIUKR9iyljia%2BYM5QEo9iGgj06VubGOn0E9Bh28w5vCV2VKXeS7yMBW9oyGkA%3D%3D\"}]}\r\ncf-ray: a3f4330e2968a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8439\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8416,"size_decoded":9208,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x288, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fbfa2fea94c2a752464c85452026c90d","sha1":"2d3fdb2c9dfa9066880209b8bcf727aa5d04180a","sha256":"75ec296cccb6eb48e5e0a0b07e6ca231b0f259c969072af258219a03aa261656","sha512":"f9309f06393a33b0211c225da80d6156207f1b7e89c5908d22c37b967e1bbd16725d511657e527cb320d1295d540c7c804070cc65356e637584ffffba684141d","ssdeep":"192:DPaqS+KMoCW2X8h8KIHFubV0U15VqcRssWjlUeBwICuznP4O:DPa7+212XwYMbV0u5VqcRTWjlHBwxubn","tlshash":"c202bfd2d8c892c83231895ae6405dd0f3f4d109788127f6a3da1df8e78ce0ed5969ab","first_seen":"2026-09-22T20:45:26.244303Z","last_seen":"2026-09-22T20:54:21.265343Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_8.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.951Z","timestamp":1790110409951,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_8.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2lKrObAjjVoVrivp4Mi1K5xQhA8bh5c3z84Qch30zatCDDo9DMuPfAF6Dvq6FMTk%2FVP4ZQv7LSxN6Ng1CznyC2A%2FWIzL7Xj%2FhDl%2F3GtnsNyagelM4Z9CwosksE1OfTQ7rl7e1JZN%2Bg%3D%3D\"}]}\r\ncf-ray: a3f4330e396fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33514,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"c31d52b648eb8b383079b31e55fa43e5","sha1":"3cfbf3e3baba2e36cc76c02393c567fd6ee03575","sha256":"1a1297a98358955876fe2c6f47627e36850584c8a6a50542382225592da6470c","sha512":"7eeab9820484ea1459af765cec8f1172e03efbf1209929c624efd5efec2d9e7d9c28ab45fd08395bee736311f6f1c13ad1c5cec020bfaeb3ee92fb998f5f6adf","ssdeep":"768:S3Pvt386RXI8y7SrLzJTX1Tv+Vejk1Mw7SFy83KGScW:wvF86tIYL55Pw7Sc8c","tlshash":"ace2e0e03b5c2405f42ce6f850a3b7f3abe55f1b291449ab748f88edbb35130945e952","first_seen":"2026-09-22T20:45:26.233229Z","last_seen":"2026-09-22T20:54:21.265909Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/a5b1c441-f086-4ff6-9a42-b803f11917a2.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.985Z","timestamp":1790110409985,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/a5b1c441-f086-4ff6-9a42-b803f11917a2.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"5445d-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Afo0OlKSuWbLD0OSXs4rNVsni7P22kK4Nz%2FdWpuGupKV4dSjQ5fsICFDjd0APv5M%2B2aU8Qetm7ykZ7cV20lHfZvmwpFZJvUcbAqeJ%2F80VTCS6IZmj3UcO460f%2BmY83RyaZLG%2BhpX%2BQ%3D%3D\"}]}\r\ncf-ray: a3f4330e698ca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 345181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":345181,"size_decoded":345903,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"ff5396fed8e463c7aca7b2d5bfa1ea40","sha1":"26b3c1bedde713f85f7e4f42015903c7d42a5c5e","sha256":"3eeb138c32d8c55a8d4b492100b39c9902e14d9cf91751539c5c477fcdf8254f","sha512":"149a13f54dc83b9c90ada97496905b56d1dea08699258921291df6fd40a122cd10385e4e376504316e7c5465c4195a6b7384e29efff024ace95cbfb01df9ba95","ssdeep":"6144:P73+xznOeHACHuUu6j4UVHm/11PiHPKE4adRQTqczwbCCxroy+qJQ/pzfvPxautI:Pb6zOeHACHuWRVHUVivP4aXWlgQ/qChO","tlshash":"5f7423b0247a8d23999644b230bcdcc69d2fe580b482d4f6798fd796e7123c07a3b657","first_seen":"2026-09-22T20:45:26.282544Z","last_seen":"2026-09-22T20:54:21.266489Z","times_seen":2,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/cali.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.907Z","timestamp":1790110409907,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/cali.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"ee8-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hlu3SdwhD0u1%2B6btFgFGImxThM8Tuo0s8EIxlXEux%2FU9xjGkJJ9utDo2i4F9U%2FmDxdii3dKC79NL0tVfTlYGmPQfXyizHFHRLtrsmlEUTZ%2BCHfBsEKcBWvreQAPnV15X4w9cVccGyA%3D%3D\"}]}\r\ncf-ray: a3f4330de91ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3816\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3816,"size_decoded":4530,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"8259cdaaadac23368e6aa64b8ead4c16","sha1":"d44a84ff4d3fb4e035216f4260fa914b0ef18011","sha256":"42e539e98b68ebfacab5da141faafa43370f7790aef1ca2102b32077e54ea6a8","sha512":"55bb52c7fb32ffb548e4710415289994c87d0997bfdf4d677240c497b0d218c330a9bc89af2d5c6d378dc35a4188dc4040a1a1d32c7e5ab21ad451bbec845a57","ssdeep":"","tlshash":"ed717e1d0bce11b0c8c719370bd06b49e30a1c267188774ac6c577d954a9bc58b20b15","first_seen":"2026-09-22T20:45:26.340341Z","last_seen":"2026-09-22T20:54:21.267068Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_19.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.984Z","timestamp":1790110409984,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_19.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"612b-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MJc0AKTpP8FR7vHXN6dOTG%2BTYLhPMpXmgosOPKLGqWUfN0PEqxrwxX2L5zOSnTweQU%2B7XJv0dCC2wtolxN4BTzBTbQy4gKsa04ICcx6WBwh5PPNNvl%2FHHjY1xsmuXkGjEa4xQnjh4A%3D%3D\"}]}\r\ncf-ray: a3f4330e698aa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24875\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24875,"size_decoded":25589,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"16f7214efa4651b259c8bff529e278ee","sha1":"6727066d4cf7464e067247ddc394166e4223c379","sha256":"d2ef57fe6cd330b669fa9eabf4a32395aefce89e1ad3474a248e8c2b30b02332","sha512":"31839c0682ba177b3559da1d36e0284356164e1187ef930020da4e35a672295be905aab09c08348f4a29bbdbf296f781342225ac5dcccca5bb076856ff9a403c","ssdeep":"384:sllh75powBhzERPha3N3AquNGh57xUrBS+MxUzPsO+Jwcv4503/oMAXd4dy:8lh75powvERQ93A47xkS+AUzP5vX0wSQ","tlshash":"9bb2c0695711570ef8cf407480a42716f203ba15d336671773dd299d2729cdde8a71ac","first_seen":"2026-09-22T20:45:26.239258Z","last_seen":"2026-09-22T20:54:21.267586Z","times_seen":2,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/universal_sans_display_400-s.p.0wwhol2x4qvj6.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.850Z","timestamp":1790110409850,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/universal_sans_display_400-s.p.0wwhol2x4qvj6.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"9294-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uU4px8f1Pz3eH4aY92LYdrCsDpP39hA5A6TC93XpZFA1VtMyMnCekgoMaOcfVlguKq4HIXafV2vd1D6mEgVG%2FVAyetS5JWPD64GCRE3jxQ%2BicYeNwPCcHoIuECBshXpgxw1%2Ff1%2Bwrg%3D%3D\"}]}\r\ncf-ray: a3f4330d98f4a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 37552\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37524,"size_decoded":38323,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37524, version 2.458","md5":"eaba7d09ddfc5df7cfb61f04a28e1811","sha1":"5bf96dac5b0b9d045b433208cd66072ec16e9507","sha256":"93094d338937c45b1d85ee9ddb6311f0a246c8d46d2eb5c5a51205b9e2d416fb","sha512":"eadb6cd1646710fccc5a67e7d6a05b78320a122f51f85148af962b65216069bf223ea1a43280398f8c60b48794b37748185626374adc8f1e76f40882b463d255","ssdeep":"768:2ox5aiVuOgxisg+qAIZTCQH2PtTfhmw4IYE1s4ULDXPBB+:26MiVtZyIZT+PxZmwVYUs4UXXJ0","tlshash":"a5f2f1908e53e9fbc7c91378a9375839f59269f901cb0d1a81675b0d7c19388d11ea3e","first_seen":"2025-06-06T16:36:33.159265Z","last_seen":"2026-09-22T20:54:21.26816Z","times_seen":63,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/js/data.js","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.922Z","timestamp":1790110409922,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /js/data.js HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 11:14:38 GMT\r\netag: \"14eed5-65b97c5dc4380-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0eO9VXj98UhW1Xth4mTOyjYCSOCZJQgFvPyN4YBBiCAgXTpcwLVsnmoJGIz078IFyXTahB6WRLFyRfR%2Fe1WIxWuUUKn9o8Hjk%2FhlQxgVsfSSrc%2FRSC44WNg63joClix9vRtboaUcCQ%3D%3D\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: a3f4330e094ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1371861,"size_decoded":49215,"mime_type":"text/javascript","magic":"Unicode text, UTF-8 text, with very long lines (65448), with CRLF line terminators","md5":"5b125565bf10be6d7c0430024554af73","sha1":"a20241dd8a582f111c00380e8d7f1262497995b6","sha256":"a982cd4bad99d679b2eae4a95d58e40f2110c7c17250dfb32c71ea4c0ce187a3","sha512":"1af896b06a3d73e855d6335f78661c9069faec661763564026d3ea858d3841263a543c1e1d13ae2a0afea9b27912564017551a2751dddd5730bf77b6a7df0344","ssdeep":"3072:5juXpbKEt8TkZowc15rZSvwqaghcnAGZ6lVpy4t:NuXagd","tlshash":"0e25f8650261a33f3167c5ecfbaaa7e9911ef71ccd769406f2ddc26925c3ce86122d08","first_seen":"2026-09-22T20:45:26.24103Z","last_seen":"2026-09-22T20:54:21.268656Z","times_seen":2,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.034Z","timestamp":1790110410034,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"7c930-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2VgPJQD3kEQdQ054PFFxyHWPVa%2BDG%2F5DDfz%2Fmxcc0WX6FftjbFmVyIiH8nrUKOfHBknpY3Nf7UHsoBFurN6TMRWV%2B7TSIhGdtZffbbpi3%2BGTUPekr9smNxVirz5PUbIp4XizEm%2B%2FZw%3D%3D\"}]}\r\ncf-ray: a3f4330ec9b5a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 510256\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":510256,"size_decoded":510979,"mime_type":"image/png","magic":"PNG image data, 1500 x 500, 8-bit colormap, non-interlaced","md5":"c5329a0943a38b79aadcd400e4480b63","sha1":"29263155394e6bccfee9552202c84d7c6b5ad239","sha256":"f3bf9f81a2b4f51dde452ee03a7339572bb5c03931f99d6aba0d3dcd408fe14c","sha512":"9f3ac385e9d8ab5e36bb65f8413372743270d2fabdec6313bae7a8a1f687883063ff5ce1cbdc7c14441fe730f222645fbab1d8c269648a673f716a7880e1fb87","ssdeep":"12288:a7DAsL3b1+nzwzEDk2xyfNUD8dcxnTT3Vga7A29YT/bznmOs6:aBLLacYToNwFbgyK3c6","tlshash":"6bb42330d990d8161facb7439d41579bacbe934212ccd128b625659f323666bcb3bf1c","first_seen":"2026-09-22T20:45:26.229441Z","last_seen":"2026-09-22T20:54:21.269199Z","times_seen":2,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/74555ca0-c15c-476d-a1fd-2907067d0cfc.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.049Z","timestamp":1790110410049,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/74555ca0-c15c-476d-a1fd-2907067d0cfc.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"b620-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e21GJQacKqnOF3i8H%2FRlXxwwNf%2Bhen0BPx4Tp61csvFRJC1lq%2BamVKbb%2FN%2Bjc9OK94kALnvciWNw2Yks5wGDwk%2FBAAVsIU%2BBf4SqqtjslYEFTK1PnQa4uSCm2Dt00Q%2BLBR78w2gnkw%3D%3D\"}]}\r\ncf-ray: a3f4330ed9c5a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 46624\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":46624,"size_decoded":47347,"mime_type":"image/png","magic":"PNG image data, 227 x 236, 8-bit/color RGBA, non-interlaced","md5":"dcd917e23a294b7f976858fb655c0361","sha1":"0e5782338334ddd9c609417805459819fa2a6665","sha256":"1b23edbf5abf57f0bb0f1d060701166218823a139e09df9c65f940b4513d01a1","sha512":"00193e122b2ef6c8e395d4f760426f4cb05263a208a0f29ef0d4300bf5388a46be2cac40d07f9624288670196772d0157c4b701051b40edaba1efd7aaf9dac1d","ssdeep":"768:Hggiza/QzKDFLqMC0VV1VENfXb9hOhauLlF0BF9n367K+9q7/SQGxnR0EXDC:Agwa/xtwfXfYVLlwF9nmK+e/SQGn9XDC","tlshash":"9f2301a322e2dd28a33f5125fc9cc5561be65459cc07b0ebe28cc634235f01539ca9ab","first_seen":"2026-09-22T20:45:26.284517Z","last_seen":"2026-09-22T20:54:21.269734Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/apple-icon.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.702Z","timestamp":1790110410702,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/apple-icon.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1701-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kLEpaOYHHtdCX73DyRT6uZeV45Wy6YrgpVjZWJ6Jan%2FLByjZiN3scrAka4GnQSx73jMvkVJ26mBHRHoBHmSJqwUct3rkOXl0bVvzFPBxIKK61wXKjp8v2llYgYau2OwevWe5G3LpPg%3D%3D\"}]}\r\ncf-ray: a3f43312ea94a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5889\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5889,"size_decoded":6600,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"e53b2d86bca1a14c4e72be0bc4431e64","sha1":"cee9f58fdfd078c8d0a7d8cd1d5e7834cd9b5e7e","sha256":"c366cd2ae8d92baa980f3904aa9993abda59f39a1c12511cd756398a590df5d0","sha512":"52140cec7469f5a7b4d8486ed46660d9ab4fc49590c1b60b9f4c255242351f09f30f0931742bb5707e052e2b803bbc535e719aad7e2c2b52533e118e24034793","ssdeep":"96:F8nErYdUjhUW8ucq3DsrlCvEsZMKDawM7S0te8qXxBs5iJde+OeTp:FadUlUTNlAEWDM7cbXxB8iDe+Oe","tlshash":"efc18f12924097c3572e13332c80255dbfd275a606f3aa5b59f7f9b02d6c21864ed1c2","first_seen":"2026-09-22T20:45:26.368797Z","last_seen":"2026-09-22T20:54:21.270397Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/chirp_700-s.p.2ipqzzc7oyrxx.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.846Z","timestamp":1790110409846,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/chirp_700-s.p.2ipqzzc7oyrxx.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"afd8-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PPOjvCmR0MT4ntHD%2FdYyvehxQCcle%2F%2F3ZD%2FLcaIu%2BrI16GSO%2BzivNLZlYeX5%2B3gZ430iTkAz%2FX1rPNUIy5jau4LTSQML%2B2dAFmWSc%2BmmzHl94UFdtu2vnH%2B7xmyIXQgsPt7YW0ENcA%3D%3D\"}]}\r\ncf-ray: a3f4330d88f1a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 45044\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45016,"size_decoded":45829,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 45016, version 1.0","md5":"05fb8f8991f2c79721c71285bb6863cd","sha1":"289fcc339daa8f24f432b6d8d78e776566cb4cc6","sha256":"c385d866c78cf2c91ab9dc834291fa49f806aa0805840ebf3bbd1b41e33f55b6","sha512":"65c793b5e1f772f6714c29f0b041e38965711a9828bf3ed1ef40516d841b924b1b192f9eb02186025abda84eec5c5fd15f65b335201d9f7fd2cf2387cca394a3","ssdeep":"768:95nDfv+GmbHY6PoZYahtmlIV4r2rKf9m07kMiqDnX3kpa:95Dfv+GmbHY/RhmIVjrKfX7AcX2a","tlshash":"fa1302c811225df3af3ff4381425768f70648afd22e0b63790e96a77728b957a908d10","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-09-22T20:54:21.270911Z","times_seen":4244,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/universal_sans_text_400-s.p.0kzgqcuw2bgx3.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.853Z","timestamp":1790110409853,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/universal_sans_text_400-s.p.0kzgqcuw2bgx3.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"923c-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UDmazNTdq5ZOtwoa1JB6QoS8TZe%2B%2FsST5Tek9VwZRVGv%2B9RD6ZnZr65BiqciELqc1zUMCzzoopI%2BVldWGjAFy%2BDjfYN4yOThglbFLdtfKzWRAdei46jXCYiFn43U2qULvEnf9JR3AA%3D%3D\"}]}\r\ncf-ray: a3f4330d98f7a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 37464\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37436,"size_decoded":38237,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37436, version 2.458","md5":"9f6a2a8e0f21e2377f6452225639c581","sha1":"d4b40c7a444cdd6818013590faa013a58a8bc29f","sha256":"9fd5761ce2a410ace711709ba538804bae481f99cf0950e99d421da593e79e18","sha512":"5a1ee42c7aafc8c7094574d11d7a66b46de5568a362291d36acd234249b91f5d7ac96c8deffb6ab9e266170095e1836c95ca1ff374c4c39b2066a23dc8319ab6","ssdeep":"768:UWz18FOQGVmA4Y95uU3uoXS+ihQJtmzxUtmEwkJoXs:dz18FOQa4o3uK4OYzxUx+s","tlshash":"10f2f1d1a7a28c1065c1ba216b79ec7354b312411dd50ee3a78e40eafdb27a8d81c3db","first_seen":"2025-06-06T16:36:33.0664Z","last_seen":"2026-09-22T20:54:21.271506Z","times_seen":65,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/naval.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.919Z","timestamp":1790110409919,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/naval.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"6ff-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ku4gBTyHW21HYHU2STr7ws3PsMc6GvbNATROtKg5QBHZEFen8UWB5xg7QpsTaXFtnntgjpdMvJJlwItHRvuVxQ%2FGWAbNtOkjiX6RpInh7R6OS4HhGNhHZSS7bMHnwzaH38U7Ww3UYg%3D%3D\"}]}\r\ncf-ray: a3f4330e0947a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1791\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1791,"size_decoded":2499,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"5dc48e5780e3f8c6ad6dea03379e7451","sha1":"1df77427818f7e803a08e73c5fa6d470fdc50ea2","sha256":"462ab7fbf3a4ff7bcf6935d18a428be30761007ad3d40c9e8c68cd155dc59276","sha512":"0b09d9c0117c7ca9ee1ecaf88fbeb459efd89650bfaf136e4240c9dc98fae22c6786392629bc82f31840cb7756b0beb723a6e155ea6ed169349f9731df6a11c8","ssdeep":"","tlshash":"51312b873e0978e4e932a7b051da7366a364aac7828dd1f50d18fa6811c2051884b7a4","first_seen":"2026-09-22T20:45:26.313304Z","last_seen":"2026-09-22T20:54:21.272046Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_4.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.943Z","timestamp":1790110409943,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_4.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"46d8-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3nSVTnTRT%2Btg%2FibZmBC7zxJplsPwRXfPwZ0qBqC%2B7dtxp1TirtfjyvoZ1GNHeCBVUZzCEgdBvOPKHlSyyMc9V4XTTz0XZRbOzBecfxPUytlTQQBl2YID0eP0XqXtCYK7qVagwhJrQQ%3D%3D\"}]}\r\ncf-ray: a3f4330e2966a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18136\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18136,"size_decoded":18850,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"e9640b4a8782a3cdddcb3fbcc118802f","sha1":"9b5d900e91828eac0cc47b360e39335b11d9385e","sha256":"34ce4a1f046bcf827d6fe9833e684fe8d3090d9b143e6e6358ca60dd641d46b9","sha512":"aa51868c0b5ec8c23fe65db46b3f577f5c04ecceec2a1a81ff21e561a66a8fe856a42b3f28779d08cf14bb4420a2fd44673fe0de906267d1ab3c7114c8e9c99b","ssdeep":"192:sOB0Y0NbfDiCxLD0MBuok0P/coJgUXHmGGfO6CpNHgzosK/MuBG6fiqwnXH3oFsK:sOB0YI70MBLLHf3m7fRzo7tBGukX3Pje","tlshash":"b682be3603668c2bee4c0738ad144fa4df08df4169890b1bf75d469e1fcd6b94b1a8e0","first_seen":"2026-09-22T20:45:26.224645Z","last_seen":"2026-09-22T20:54:21.272639Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_9.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.953Z","timestamp":1790110409953,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_9.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"a601-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UpZ7e8U0hQx5Ch%2FjxB3jjy5PpnK4kvCD0flFGwXJJfYXAg0U4iRDlAfG8GDl0QXMn%2F4DGyv%2BeRmu3VQwB46HTCIH6VZtrAfIgcC5N0EECeBQtYnM2bQ15fmrmruwz2OaWu%2FLh4NE3w%3D%3D\"}]}\r\ncf-ray: a3f4330e3971a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42497\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42497,"size_decoded":43213,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"df0cfe16037e4ece725a9301c876efe9","sha1":"14dcc0fa5beb5f9d16743c174ac41288ddc15b22","sha256":"3d825b64de778b9d64c67868e51cb7ffd834a486d9ef407f80fe2c6fccbef24b","sha512":"78e2f98d2a23711b71b65bd912152020f5638163414d1d4e71c6bd41ccf11a336b085a63ee4345e92910389f7d45790de1cc8c81a9a55a032620e38866da2977","ssdeep":"768:9hF7+eO91UXDVr3SfYNIlB9K7nVg7wYceNRMpGBdV0tTu/:9zOfUXDJPelB9ynO7dcewgdV0c/","tlshash":"d313e17551527782e3bdc63a4cfccbe195126ce229dea67a74cc186e075c1f04529c8b","first_seen":"2026-09-22T20:45:26.225906Z","last_seen":"2026-09-22T20:54:21.273279Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/736d2c80-befe-4d48-95da-b74a049f641f.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.011Z","timestamp":1790110410011,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/736d2c80-befe-4d48-95da-b74a049f641f.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1825-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BSp1PeAqDYBOz3%2FOnG7wM0ez1GUvMOyRDQc4ClexxjflEz2oU49PgVvGE0Fpjl3aeEbpY72gKiIP%2Fo55WID%2BtFmjTLFhS3KPE8cK6AhA8DHMwzmZ1RJ3FYbsHkVa5izWA9whE1skYQ%3D%3D\"}]}\r\ncf-ray: a3f4330e999fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6181,"size_decoded":6894,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 256x256, components 3","md5":"2a36329b503665cf020d9795748b0b24","sha1":"27e0e00f3b88173a1eb4d1a60c191ac3a0bc99fb","sha256":"df1a433465ae673dc3f1f00711c24ca92e22eecbecff41ce68516a4b67086ff6","sha512":"4f15b6b131c83cc29cc1c60e45a5bb9844aa37c6ebd97f41aaa735d50bf66dd11ca27336692b7a692e1bb8ad543977e3161f5a9674d0e401944d3b960e46da91","ssdeep":"96:XcFaysHV6cqKh89mLRPeJ2hLUIVDQnfjn5s2Ew+k036eYFhGnFQsjKbsJoMuRKV+:Xp/z+9mLxk+xPDql/bsJoMuRKV+","tlshash":"f2d18eb7260f2019f21d0b3393331b949a481f9019fa1d776d71b3145660dc0b320577","first_seen":"2026-09-22T20:45:26.333654Z","last_seen":"2026-09-22T20:54:21.274107Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_12.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.959Z","timestamp":1790110409959,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_12.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FTxOuefHei1IKdGiy%2F2Abng5d1%2F69R9ufMsU%2FIUB1waCbjkYvr7O9MSqzOGJ4v1wiXp92inBcRPbiH78ZHWvk2TyMci0edC96yeKTQlfQVIAcTwpfsn%2BtZ73TFxpkGWONVDaru35pw%3D%3D\"}]}\r\ncf-ray: a3f4330e4976a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33514,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"8f8aab1c6be87d95eef2aa8728801d25","sha1":"7aba6c703f4c567f0e6fc9e6c4b05f4c27fd013e","sha256":"689e8d5d43f68c8e883bca48f7b7937070c14d042cf23df8cf40e40a94726fba","sha512":"d56395eae2b5832e92417f4fcf9e4e3eb9bd133aa0e8cbe49cf784a6d2cadfa5f6cbe19eb9317ca23f70e0990d87059b9f9ab389f7428360e99b3388df039649","ssdeep":"768:iQ+FH05XKDtReg5RnQBuaYGvVgT/gXVvOKJ7:iQkH8XKreg5RnEua3agXYKJ7","tlshash":"88e2d053e23d2265cd0d493c255216929b15bf1c34772386b3bcfd7ea3482cb6782597","first_seen":"2026-09-22T20:45:26.299519Z","last_seen":"2026-09-22T20:54:21.274661Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_16.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.970Z","timestamp":1790110409970,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_16.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"612b-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=17jofM%2FYKlaBqvXSogCUjt8m%2Fu7ygGfog84s3O22epoiSV%2B%2F0Pi5RyFpjCzlKzT1KmHUlTD%2Bp5glTTgzlwfi%2FyGMUMfsFw74%2BQhXyRSt8QA5MAgjL9uE%2BPZa5wEoMeu6L5WzJWzVQA%3D%3D\"}]}\r\ncf-ray: a3f4330e597ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24875\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24875,"size_decoded":25599,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"4c9972cae45080c55f0703afdf3c04a2","sha1":"92174f6a75f73ccf6608c50f83240c3501cea132","sha256":"a4145db332ed55f1897a7ed4c3762ec5c95d0c4ee317dfe44c3860bf30166182","sha512":"a6f3a40fc34c2f87f5a40b03153a14ea6cdf449b29623f662946f0d2c342983fc392f76036db43c8fa452cfd2612ad6309cf7d8347f74962f68919cd6e0b5ee9","ssdeep":"768:+2A7eeJpWak5XOgOHUnHGIlJs4BYi3HsH0:+2OeIyesmyJNBYiXsH0","tlshash":"eab2d1e5335699b2fadc1f34a981ed87d713dc611020566bb7cd8cea3bac1dc44a4340","first_seen":"2026-09-22T20:45:26.3104Z","last_seen":"2026-09-22T20:54:21.275285Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_45.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.037Z","timestamp":1790110410037,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_45.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"612b-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Cv%2FlWknLwnQyueoWSc24OxyCOOY8kFMmtD6pzWVCTsSCwxAzY7Z5WXUs28LR12oM2LqMQB7C8C6nPgn2i8tyPklEhimb29TpP3INqL%2BfsK9Tmub%2BReZG4b6dBwOsUzTN91Tygylvhg%3D%3D\"}]}\r\ncf-ray: a3f4330ec9b7a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24875\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24875,"size_decoded":25589,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"625ed2359030647592e471ad439b3b70","sha1":"bb02131cb8a86c16615c666b2df7fbd651db23a7","sha256":"9879363a3fcb44fc9fb3b146f96b0fcd05bca9507e6d7db55bceb9087b79414d","sha512":"47a35fc631a528b0b1484680063210f83364918769d4ea6870cc161e5051afdcb36a5ce422b5e18624f3ecce322c034598714c1e6e8dade73006c235024d9e19","ssdeep":"384:sn6JXbSqc/nMp+ZgD++ZDtIEbUu3Rkwes15n8YRnsHEKcP/yjq0ETdH:hJrhc/9gD+Bdwjbn88nsHEKwyrgdH","tlshash":"4ab2cf10fb995067c46cfa7110424b557abcfa4854c30f87b40f1b6e3b749cad678ba5","first_seen":"2026-09-22T20:45:26.366586Z","last_seen":"2026-09-22T20:54:21.27609Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/image_3.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.383Z","timestamp":1790110410383,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/image_3.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"51c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LMLznXKpSrtBSqQvme9%2B%2FWJkWTja%2FZDDdfMsfriHB38RH4qUj7IaH%2FJN%2B5aXkrNiUSynTTth34kIp5GlYJtaXgZRniVconnmg4NrU%2Fn4pc%2FAsO54Btchvi8T%2BMwt8DgKbI9vAL3NIg%3D%3D\"}]}\r\ncf-ray: a3f43310ea27a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1308\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1308,"size_decoded":2029,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"8cc132addd128718cfb14d8dcfb5c303","sha1":"ad1fecf4c25fed16e196d30d91fe7fea23ff508a","sha256":"111813d04b9ff9134353c93dbf68905d2a5db07d16ebc28f9eb376cef9600664","sha512":"2857e0e578947c8e632e5017369bf6dac486945cd65d1f1588f982b91b620da9b1bdb0be0e86b520730c6554d233de0e6448802ca0d272e8b47fc9d673ac564b","ssdeep":"","tlshash":"7521b78e6867dd36c69c087429091c1675734c5da607e48c7202b16d6d7659620f7355","first_seen":"2026-09-22T20:45:26.285557Z","last_seen":"2026-09-22T20:54:21.276673Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/chirp_400.p.0pvtyi5mcffff.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.840Z","timestamp":1790110409840,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/chirp_400.p.0pvtyi5mcffff.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"ae74-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9%2BtwLQeRCxV0Hz1scNRIvCBpiZlwuFLTJQ6UF%2FO8pAPdyl1ZEtC7u2VSAib%2BGdG9FJvAJGsfD%2FWqiaY9G3oc5yoEQ5YnoOD7%2Fq30hrJhB0Qe7E5WquzKpd3pgO98ONXhZhH%2BjeFoBw%3D%3D\"}]}\r\ncf-ray: a3f4330d88eda0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 44688\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44660,"size_decoded":45463,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 44660, version 1.0","md5":"af0fd092a950cd858a160490ae22d16c","sha1":"4291c81c52514932f517529f3d3c24f4a40609ec","sha256":"858b70c0b816c651b12a0849e17c83eae8a76aade2fdf02e98848d5d25868c82","sha512":"64123d00581d6d45c1fe0390911e20fb732a9875eebc667c45ca4f84e5768657bdb1fa9a307c150d6e5644a7e8e5cd274c58f879fe059b8c6e1dc73e2a039b35","ssdeep":"768:hgJ8wY+W8lE34E/C6z3sbYqg0OvVQ8J4WSrQek4cXzrrhDn:NdQlE34E/C6sbTg0yV54drQ2cXz/hDn","tlshash":"e713f1606f916fa8f45417fecb63322e95b2b83228cc036db4351e55794c5c52c8af9b","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-09-22T20:54:21.277248Z","times_seen":4261,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/vladforbes.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.898Z","timestamp":1790110409898,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/vladforbes.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"7b29-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VGy38JArSQwQKTwoUghkQKHSRG1XBd4aDbov8j3sSRQYb%2FQ73v6sFAuK1oE%2BgUNBHl8kwpdHzrTROTLu7vdOMtiiDCA%2FSF1xHvy3HluO3Ry1HaGJVAyMPGf4m3e1JpgsTKKEieQMhg%3D%3D\"}]}\r\ncf-ray: a3f4330dd918a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31529\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31529,"size_decoded":32243,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"6b5e45cf396d4b31cc6811717638fa4f","sha1":"4734a07fcf1c5cd820c700abeaf0bde07076cf37","sha256":"d31541f02f70f3e4a8de03a552ae71c47c2a38f58fd75eb8b0661ad6d04f1c0c","sha512":"43355c107d751281840782564d2b98821334f5a3627bdc3b127a2f754651390c9f710ff57f60d9da15467030ee081bafd496609940e09d36ac93071717b00682","ssdeep":"384:iKtXS9uxVdiDZbFxXgCObvq/Ki5raD/FJJ+f7R7IhC9klZ7h9nT0969Roy139SFO:dtX0uxiZN/laDNJJ+TRUoalW6gKTwg","tlshash":"ebe2e186391e9c374bc560300609bafff66892f2b95c73225ec59d442fafa2e4730465","first_seen":"2026-09-22T20:45:26.317217Z","last_seen":"2026-09-22T20:54:21.277787Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/bob.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.911Z","timestamp":1790110409911,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/bob.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"119f0-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GY1WW6zeuBgs1IgMVvEwChHq3rml5WCAOLGnzwjbENCCeXe7r5M%2ByWLhfx9lzbLgMEWJdW8r%2BSgqldhjfu0naen8xjeW6umeGc940lF7W44oaTN7xC4wWQ8Aqp%2FgYpxbIh1P0AiXbw%3D%3D\"}]}\r\ncf-ray: a3f4330df935a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 72176\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":72176,"size_decoded":72890,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGB, non-interlaced","md5":"bcb90c306b64df74e3c3a3706b6681a9","sha1":"04106560ede7c2d2bb7c6e94f1cc276327d43de0","sha256":"ea7745cb97e1432ab121bf9a7e9422f2b2125475bbd0d95faf4bb9fcb8f5c8ab","sha512":"35376c44f7775df93a5e2778a8160fa81ed9fc31a10f63dfedd3ed70bf4d6bfd71c335d98d289f5006d37d4c9b406e155cf4f47a99d47c6373da904131d317f3","ssdeep":"1536:BeC7ynMn4x3ExUMJczXlQlSOQn2sr/DrPHb7z6tQrGfWwxdwdGE1:M6ynMn4xUxUf1QSn2sr7LHb7/rAtx6dd","tlshash":"596302e0e32c3a2991a32c11b07abe5e53261d34d8714a4fb7574bf8784769a791ce83","first_seen":"2026-09-22T20:45:26.354266Z","last_seen":"2026-09-22T20:54:21.278407Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_13.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.963Z","timestamp":1790110409963,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_13.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tOERKjy9NojIrflL4aLBAKA3l%2FpHDvgmMGb%2FHNR4uGc9DFgy5U%2F0oO0Qa32TZqxpnrHvcphsZPCBPWnU3ChPilFAxRCzzDb0%2FHt97zInP6hFb7j3KDq6h5mJmqLbs7kbWq9Ne8ewCA%3D%3D\"}]}\r\ncf-ray: a3f4330e4978a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33512,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"fed5c957d0d8e5dbec9a1b482394a05f","sha1":"b4f62b5f798682ddbe5dec1146bb81a34e1d180b","sha256":"14dc4d71675c430ae03fc0dfff0a3aea8b7a7086258e549e102e2bd58c32f819","sha512":"880b98ef97b610cc49cc66d106cca5548ede1ca38eeedcf7dd19b3059ed554f1cb6fed8667869e2263cff1e91ed844240fefc309ec59cb12b30965d285dca783","ssdeep":"768:23X237aKR6K9cgtMGAIxnOLVnFT7VHuQ5R:GXqWKzcuMGAIxnOLVnrHug","tlshash":"b1e2e16fa7a681d8fa2c4d7d4e4183c65b06ba3811d3cf09740f355c3fd69818e2a799","first_seen":"2026-09-22T20:45:26.318504Z","last_seen":"2026-09-22T20:54:21.279419Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/7dd26e4a-1fea-4c86-9c3e-94b0d8b1c2d6.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.006Z","timestamp":1790110410006,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/7dd26e4a-1fea-4c86-9c3e-94b0d8b1c2d6.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"3d8f-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1%2Blnj2mtBSBKWxbRBWUKLLMMjgo6mjJgijHzdVtr3%2BxdO508OwvqXYNxRvsZMzYlTOMJ0X4xNtvCwL5w2G6gkBdOasLfYdtxKYc2alPwpg%2BjIEc%2B%2B3oLRKQmD2lJHSkb%2BK6T5jjgtA%3D%3D\"}]}\r\ncf-ray: a3f4330e999ca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15759\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15759,"size_decoded":16479,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPCM), density 10x10, segment length 16, baseline, precision 8, 256x256, components 3","md5":"39653446652c18747eef2de88bb52175","sha1":"8a41b17d84e4b1f7a75bb8332d59311e34164ecd","sha256":"d14e49de52ac511f4535566abb8823210b08ec2c5dca6d894df1756cb4ef43b0","sha512":"7b19952d8151e3e396594ec2b700ff2376dd90af6f0cbfc9b4b5ebe551a0f3c87584409794fa827b1fea2b172b2bc472c23c2de00c6f92ffc4829dc929fc574c","ssdeep":"384:x5toYW73KWEaJX09v8AJohYUuJB250NMNe19wW:vOnTKWElJToyB1R","tlshash":"fc62d056a758c07a8a3742f5f2e74453f7b17b897a18ebba0ed044f16f04376049607b","first_seen":"2026-09-22T20:45:26.220773Z","last_seen":"2026-09-22T20:54:21.280076Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/elonmusk.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.894Z","timestamp":1790110409894,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/elonmusk.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"44ff-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JhU%2FGmNXhHYsio%2FhAVTQ82CfmQcAlWySOzGP0ZWMOa4m%2FWx1WUg4EZj0AoF5ACJ49Thzw4MNE3YizHTtDJltdHnfDMlgSJZR0NR75sbfpKcmHn4dQrDJUNQ11cEYaQL9B%2FtkPM3jGQ%3D%3D\"}]}\r\ncf-ray: a3f4330dd913a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17663\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17663,"size_decoded":18379,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"f76b8a6fc5da402223d6ba127ce697c8","sha1":"79df050581e97d75a50d3e8b168ec342cac6852b","sha256":"0800079ff2d3ad0a1708f88de3b055d606193d3d7b6fbc3c32ee03897a876306","sha512":"38fbce2ebff01ae6e6ac6384345fc9e47b001d6900cfdca2cdf89bd83a5524f5d9c9c3b97b5c2d6cfa1c830b86dfe7efe8bb0e1123d7861ef89caf580c80b5e9","ssdeep":"384:Rl2qUApXjLzIQ1n1KaS3b3cZunVom6CzkExN1qbiERbHpzLUcdYh3GfAO4:0uXjP1KPcoKXqbD18j99Jyh3G4t","tlshash":"f682e1a3ec45d6b7fe5f36f64a1100080ecc5cc66185cbe789b1fd4e9ca548721a036b","first_seen":"2026-09-22T20:45:26.330141Z","last_seen":"2026-09-22T20:54:21.281177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/paulg.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.917Z","timestamp":1790110409917,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/paulg.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"7c8-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aPcGoe7FoQc1YGf5Xn%2FynSJegz3AeIf%2FU7fm8rDIlWW3F29h5kj3weNZfgn%2FXcpSfLuW4oS1q6KyVOSl%2FuZDlOdnWH6qqwtQr%2FSHTVuWhUADy1rm1EABoJAkjynrlqNge%2BxWblDfqw%3D%3D\"}]}\r\ncf-ray: a3f4330df93da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1992\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1992,"size_decoded":2710,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"ae8294f35c46de00d467c2d112931e6a","sha1":"e6b07323e3370a44f40b4311192be4c7b5be3275","sha256":"27274f68738448c17a2ab2a3273c3a9c6902d42fff641bb1c5d99e63d2723612","sha512":"ac46fdb633234d7a141af4a92f9bd02a40914e913a1a0888e613fea02ace0ee2dc4876300a6a810415c9bfd93ba870fd51884475e48764a58d58c4a5b856dfd6","ssdeep":"","tlshash":"024194892b66d2c8ec68edb5099c33e74807b46a2be5860e494621044bf718acb1192f","first_seen":"2026-09-22T20:45:26.335231Z","last_seen":"2026-09-22T20:54:21.285387Z","times_seen":2,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/apecat.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.937Z","timestamp":1790110409937,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/apecat.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"19db-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mgRbKZpm%2ByiKz8ljQx3Ru82cZIL3Dusu0%2FEzkCSYKMFDv8MhoAsaUPdYkTfAsRY9mg9U1j75MM4fzajrOR4y4DtqShrrc%2FnVBA3nANpvyRhTR6b59lzezf2GkYu0yIbxD7iJLN2A6w%3D%3D\"}]}\r\ncf-ray: a3f4330e195fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6619\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6619,"size_decoded":7332,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"30b16dad62e9ff081e1ff518930e53fa","sha1":"e796c4c4bb87c6470e6ab8ed366d6811964b25df","sha256":"a9dd365de15786f2623488125d2fccb523aad7a51015baa9550829b110671318","sha512":"5e298caaf38a7800cff6483fdbaadce837adbd6d4157e593ef75fe1f3398f694ccb92c7ff496d564c1940057804f77cb0e669aa4ad59ba3f5088ad99f7a57748","ssdeep":"192:evUDC79ZCguVlfxj8wzFJ687L8QLDNZi3:6UCS3lfxj8w5w8PZA","tlshash":"42d19e2af2f271e4fdb6bc721ef90ef450168e212215d6464ba5200446b51b64f96fce","first_seen":"2026-09-22T20:45:26.269071Z","last_seen":"2026-09-22T20:54:21.286033Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_17.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.973Z","timestamp":1790110409973,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_17.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"a601-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wU6ny7grM0pcqLHduK7LqMbpnyEi2y2tBxQFCNxBkeAaQrB4OwolHrzCqEsnbKGyD60W%2B7ajEU6EMFMwvq4eGp46GDzK%2FvuT20qmLa54l0xu9YfNvsxP8IYC%2FZTDSyW5P7MEKqCkLg%3D%3D\"}]}\r\ncf-ray: a3f4330e5980a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42497\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42497,"size_decoded":43211,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"47b20c9bb7c6aa4118c6da0ebc0d7252","sha1":"36329fa470831111faef0a343b4b1c81cd9d5cb6","sha256":"05f5d79439c6153f459a8acee55672705b125216e38a59d8d45299edf191217c","sha512":"8f90e705b89d03184cce4babca05974935adac08e85208ec83454c4e4c2e8398b8c48670bbc9ddbbc9bded645dd9d47ee81736dc2300bf2c348fc79b84a0f147","ssdeep":"768:tRxPP02b/t8YqtI3deVr7anEjML18G3OrZWsugh+NO5:DxL8YqwdeV3andhMZWwh+S","tlshash":"1113f2bb56202405ddbc2cb83cd61ea5ef8ac97a7801672577af016c736cab16237353","first_seen":"2026-09-22T20:45:26.256086Z","last_seen":"2026-09-22T20:54:21.286701Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_31.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.018Z","timestamp":1790110410018,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_31.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1f66b-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TUwX9BGzeM0P8F6woOAqpcfx%2FOJOHA%2BnpDBxSGomHEVQUJXDlwR8i6cxyir0%2BcqqzQSzMEl537QtKIoNTjKBl6acT0pC9LC1Gfbn7pqxd3wC%2BvpQQeSeahaKRjepiK%2FUcLGyQ6996w%3D%3D\"}]}\r\ncf-ray: a3f4330ea9a5a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 128619\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":128619,"size_decoded":129339,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1400x466, components 3","md5":"94a9df5247a809f21adcf3a64f2ad4bf","sha1":"d9a4297ac03c2e97550b076dea64a318010d5a55","sha256":"44a8f8b831df46c29e4a388839e153c58accfa261eece92ec8b761121ec5f103","sha512":"e5a20ac47ebfc47b0b26378e7b65f141ed6010b8e214bfef7d8d3abd8bf94f28ddcc0e7729af76ca2de9662b2b4f730bd7b4ad34889b8cad4b9457e3a3dad582","ssdeep":"3072:rYQiWgA1JWL/HvVKdUr+Wb6g2rt++8oV5Ae1:piFEM/HIdLWet++Lr","tlshash":"99c312a9f8a33070e7b4264911d31532c9cd308a6e5f57721d7919ec83a52af30ee77a","first_seen":"2026-09-22T20:45:26.356189Z","last_seen":"2026-09-22T20:54:21.287254Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_50.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.044Z","timestamp":1790110410044,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_50.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1400a-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UxhaQFhr%2FcK4fJh9WXXCE%2FhYvYR%2BAID57KMRcgDlswBqBigJav0crLNmUsAE%2F3BPFTt0rgMEFFsAnEqw07qyF%2B9MiCmOjDR2TdpMwkXNtpM%2FvqmzQuoxtbWjonlFayRmGQXIEhDhFA%3D%3D\"}]}\r\ncf-ray: a3f4330ed9c1a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 81930\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":81930,"size_decoded":82651,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1439x479, components 3","md5":"44241b4172eadf2a4eb85957ba8122f6","sha1":"4e00407d814a7d3fa90a518b914cd5cff923eac8","sha256":"a5096c49f92f8ca62c2517356283848f8143fad72aebed5dcbef5d2fb1a53f90","sha512":"86e243a61d9b1f5f794b04ff4043f98a6f64e764ee90d9a9fc768668483779584dd7e1c31b453bec9efea9566efc49826f54ee3e8bac659fe3de453bd3e75356","ssdeep":"1536:27wlfv0ExNgKvIPne5YVvBbmJjE7ZK8e1BnOkGNRdMpO97DOZoo3T0:27in08aaopK2PNRypOEoL","tlshash":"cf8302d0b0646bdde47d24a291d6302151308eae3f7cb8be66249bd27bd82a839c7531","first_seen":"2026-09-22T20:45:26.357253Z","last_seen":"2026-09-22T20:54:21.287942Z","times_seen":2,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/universal_sans_text_550-s.p.2oz54pkhn1rbr.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.855Z","timestamp":1790110409855,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/universal_sans_text_550-s.p.2oz54pkhn1rbr.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"97ec-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=86bRZeais0%2Bl%2BwMbh6Qnye%2FqzUeSrNLDT3G%2BKkFwtSTbWRfDgyraNZkaFoJQhbnGR1Nb7SaAieoB5%2Ft4XkA5RZp%2BO%2BVNP5KV5DvP5FgTFQ4VQW9rsgRoMZX%2FIyiqly%2FhbM3O%2FSeSjw%3D%3D\"}]}\r\ncf-ray: a3f4330d98faa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 38920\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38892,"size_decoded":39703,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 38892, version 2.458","md5":"ad7c05a5a6cc687c2a8944061b1a9ce1","sha1":"5dbf0364e2c06fb324a5b03a95c40bc818904172","sha256":"e6ecf6aaa4d146fcd426008afc1b7eea0dd6a08953eac301c00a1d9118042ebf","sha512":"51b645a0e6dc65c44e5875e5fd1168ec5ce31578c8a1eb0e515a8fea84af6485df13cded4eb9cdc56fdf252f01fbe9602f13700bff8c8b7cff815f3a8d6e7bbb","ssdeep":"768:qWyVhcFUc9aYqhS8tsDNbihm9l2EZzzuwbk6PC7TTLb9JM9NXin:qWOhcraY/8tlh2ZuwbkmCnTLzM/X+","tlshash":"9d03f183911f1921c2ca00e1587717fbbbfa2569e56410dacb9e5bf41fb4fb3a144099","first_seen":"2025-06-06T16:36:33.094553Z","last_seen":"2026-09-22T20:54:21.288584Z","times_seen":993,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_24.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.015Z","timestamp":1790110410015,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_24.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"107d8-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8qh3Z9vFCBKQsXznI%2F3QRJsr03Mrx3qYUJvlCT8a9%2FZFUcapCtJ3bMtn4LI4qdNM%2F5NO3sBLgt3C6x2%2BM689qzowL30hQrHOeUTR6gpI1BwVrR1TTW8lKB9XSJ8qok8djeGC1VYQtQ%3D%3D\"}]}\r\ncf-ray: a3f4330ea9a3a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 67544\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67544,"size_decoded":68261,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x499, components 3","md5":"ef9ecef9bef4c3c1f437f9cd3ce1ef9a","sha1":"b336de77fbb2d6c695ff51966e642ffe4c43c711","sha256":"55208a36e51f333541aa6a8c4ab65b5423e2012cabb5d76b5db9bc1a6a539fea","sha512":"48f3748d2a7efc7fa6c46064f7d619c38d65f0d1936b26e791bf6b0f7c65c87aa779f133e7040c308b0b9ca72e234def696b0ddebc7d22152d7d0105fc1dff98","ssdeep":"1536:ECEq8+b173yJ3XQyHN8rZhtPPvZsKvxGiUHjITQfZ3mXorA:0q8dFgyYFuKJVUH0Efpmj","tlshash":"9863027933909c11f1800572eacc3b609fa735e7da50965f652b3ae12d2822c2b93b4f","first_seen":"2026-09-22T20:45:26.251235Z","last_seen":"2026-09-22T20:54:21.289211Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/chirp_400-s.p.0pvtyi5mcffff.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.839Z","timestamp":1790110409839,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/chirp_400-s.p.0pvtyi5mcffff.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"ae74-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ooAOqToyqn0XcsQhV8zEYLDgHzFGvPlocKWfDlFTDHO9bGB3cP3ia%2FqXISKBrp9ahgytsGL2tKfvAMSi5hTuJpMss1bNCaRqlwgiK89Boa17iDWwnF7OlYo7LboZtNYAgATsGEc73w%3D%3D\"}]}\r\ncf-ray: a3f4330d88eca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 44688\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44660,"size_decoded":45453,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 44660, version 1.0","md5":"af0fd092a950cd858a160490ae22d16c","sha1":"4291c81c52514932f517529f3d3c24f4a40609ec","sha256":"858b70c0b816c651b12a0849e17c83eae8a76aade2fdf02e98848d5d25868c82","sha512":"64123d00581d6d45c1fe0390911e20fb732a9875eebc667c45ca4f84e5768657bdb1fa9a307c150d6e5644a7e8e5cd274c58f879fe059b8c6e1dc73e2a039b35","ssdeep":"768:hgJ8wY+W8lE34E/C6z3sbYqg0OvVQ8J4WSrQek4cXzrrhDn:NdQlE34E/C6sbTg0yV54drQ2cXz/hDn","tlshash":"e713f1606f916fa8f45417fecb63322e95b2b83228cc036db4351e55794c5c52c8af9b","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-09-22T20:54:21.277248Z","times_seen":4261,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/garrytan.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.938Z","timestamp":1790110409938,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/garrytan.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"7c4-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M0aTVlHT5lRBsMPVtHDvUfD6VYPW5Tm4WvB%2Fte3JNz%2F8Ar%2FCwjWH%2FuDf4MyvOM8K7i%2FOSeCpiNnICV1vyC9nwSEIaFwdKSWIyNUJ0%2BpEErFDmsTshs005%2Bq1cKwcHqnFhWK%2B3R68sw%3D%3D\"}]}\r\ncf-ray: a3f4330e1960a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1988\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1988,"size_decoded":2710,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"c1ecb9a2facbf690429feb1cbc03e546","sha1":"b1d0a80c61584498c2f7bcf21a4823a57b5d9850","sha256":"9e6c33ea7e10606eba9330863cd1a76206df8e11b9bd3774d301b3e6063c7f89","sha512":"85b00978f8ea0c33e4553f82c5d0924a98fde2e5afee3b85f18d4988f6c5e4472d09391cad01c48f8148a8f42469801f91c22ebe8ea99b91f7692c667bc98647","ssdeep":"","tlshash":"04412c0449bbe4c8ef54863c17d1b5ea21c8e3a204f27d0a6fbd952183521537f58b1d","first_seen":"2026-09-22T20:45:26.311393Z","last_seen":"2026-09-22T20:54:21.289791Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_44.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.036Z","timestamp":1790110410036,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_44.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"eb5-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iScshNCDbXPLhRYRgJnQTGmn8oVCx9XG08DBUorhKQTLH0CyjjS%2BUaj4SI9Wy%2FjtBm6oek7tbXdQASSR6f6H5Tp28Yz6E9FGXrjBn552n0u384DlIjfH%2Fbjk%2FWULPMHLVEalDclp0w%3D%3D\"}]}\r\ncf-ray: a3f4330ec9b4a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3765\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3765,"size_decoded":4479,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1279x426, components 3","md5":"ddd0358a5207ad50655464b82d491e93","sha1":"ab41bd97df9ed0cbb698f8f90dc0f223552e091f","sha256":"33abed17e677d9f66e8b9797406a30fa6222f5e47212c53f4f6e0864ba33d0d3","sha512":"3be5c377a2f64a345e0fbd83fc00822f965715633a5f2b75d13566c526ed56f14cd52cf528afffa9ec770e3e5b942ee5b574f4aebf577d19a66cd90316f4038c","ssdeep":"","tlshash":"1c719ae23b498422e43f17314ea8e765a7588e4063415b8bf88b3c106fef0f0d0801e3","first_seen":"2026-09-22T20:45:26.298685Z","last_seen":"2026-09-22T20:54:21.290318Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/geist_mono_variable-s.p.42jdkyb02hb3d.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.849Z","timestamp":1790110409849,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/geist_mono_variable-s.p.42jdkyb02hb3d.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1155c-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2ONTrZUr8BQo9JhTrq2T7%2FJu1%2Bj3o2yqWgEvpoxneio%2B4yWDDulpwMIEcJo7IRoHGg6%2Fm3RN7vRjWnZv76YeyQHCqGVKVdo19q3sI1ZHlSgI%2BogJU0YJQKctSyGQIY7Mu448QhlcMQ%3D%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: a3f4330d98f3a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":71004,"size_decoded":71788,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 71004, version 1.-19661","md5":"8383036bed6b5635fbd81508767479af","sha1":"9d76d5f55ee84013fbeb5e4926d5639b64633a1d","sha256":"5f687a5dd4c87da13deaff9f6b9503d5e62249ff501265a96b134565f9aa8c87","sha512":"d60bc8f9db90a6b601d80266e1d930f3d52678c0bdc0c446d2fbe73e0cd65bf3dc8fff13e3526c0eaad6254c259f19bcf1ed363b3e167bf53af533ee729b03cd","ssdeep":"1536:NLBTv7jXKc2l9+JBzGpMxlvEQYr6uabio0nX/DMUQO52TeB9k:lNfKJTCOMXvjYr6Yo0X/VtYak","tlshash":"d76302c4588221b2a506177bf79e201465c7fea2af88ee0e5c24dc177c86bb47fd65c8","first_seen":"2026-02-13T09:31:04.691023Z","last_seen":"2026-09-22T20:54:21.290986Z","times_seen":2188,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/goria.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.896Z","timestamp":1790110409896,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/goria.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"2b68-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n10qCwnMdipVfbqhQQ%2Fz1rBwECotU2b1mIFNnPtB4f14j%2FATqUAFKnwoJ%2FsNFTp9NtigiS4VJJ4kdQ%2FBKRZX5ztUWC7MHeV4Yc2ZTcxKijBdueT8FF%2F0uwaHth8PlgTtWKhNyghDRw%3D%3D\"}]}\r\ncf-ray: a3f4330dd916a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11112\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11112,"size_decoded":11830,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"647192e24367ad60eafe35b04873591a","sha1":"82981a483e2bf853b1b69bedf2cf33c1d48eaf61","sha256":"59aa21d576a6830fb6ebff6637325ffcce7e5b91275aeb5c4da57422e5e66793","sha512":"4ab878d4779e75b0e55630bc056f42743d59284f55faadc170c7bd76ab4083543c2d4795dc100c796987d45293ab2dc144d4fc9d80758be985b54e57780772e8","ssdeep":"192:Iw+ofBxiAMHRJk1YaQMVfmpwUoGhETaehS8Bo5lh907qT:Iw+WWxJUVfcwUnhX8Bo5H9L","tlshash":"9632bfab961aa00b71b58f73666e8f20c7b7d33665ff8f0295a150d1001839e3bd8758","first_seen":"2026-09-22T20:45:26.218665Z","last_seen":"2026-09-22T20:54:21.293227Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_30.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.022Z","timestamp":1790110410022,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_30.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"8f7-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KKi8qbP6pUJwAsYrO3jUG1a7UGBYMfUcy8nKxZLWP8f17yrInO04wu6QkDX0V2vSSkTaswZw9roZV2iJW0%2BXAsWUP7i54sjL6NcCv0x7iEMHXpwzrPIRvbIZNq8pINbNDfbZgmzmdA%3D%3D\"}]}\r\ncf-ray: a3f4330eb9a9a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2295\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2295,"size_decoded":3003,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 941x313, components 3","md5":"93f29c217ca426768bcf0849a590c591","sha1":"1c1e62b54a2c51a0156732248e47af7677b51f74","sha256":"ef2d14c00e852e7f39c5bac06345e6c408cb3b998222e54f1c68486227eb6984","sha512":"129d5e983ebb77e9c65b869e56612efcae7c34f65bff2728f44c054b7640ef2925c41448c694eead682563e9548ab947cbaf6d14366d744ac47b342d7e05e2f5","ssdeep":"","tlshash":"56419ad63f438c02e43e0b714e94c79967124e1273501b8bf9873890afed1b414802e3","first_seen":"2026-09-22T20:45:26.222041Z","last_seen":"2026-09-22T20:54:21.294167Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_39.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.028Z","timestamp":1790110410028,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_39.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"29fb-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A7pk7JyzteGbB8Hon4OGJqAEp6o%2BngIEu3vt7O0lSb%2F7rKAlh6z5SgKjrFmW%2B8PHc2IcAF%2B4dnSWHf5ttaLcTovvuEdJws8djoQC6J7XUDWeathf9AZcnRTeWPPyrTsAufpRCd%2FKWQ%3D%3D\"}]}\r\ncf-ray: a3f4330eb9afa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10747\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10747,"size_decoded":11465,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 449x149, components 3","md5":"fb1c0aefa9d4564f86a234e615548874","sha1":"2053df31f2ea5dbe4d5f00726253352aa4c44c22","sha256":"e36989cb3ff2eb6b836e51ef6d409ebb99d0006a57a15271f99866f48ecd5614","sha512":"420bb16ce45abb89db3a4dd6ebe7c4c4ab35971d4c1d5d768323549312bee93a84e8876a280babc7558ad668cc1df3f069bec77e40e185a0077026519155271a","ssdeep":"192:LNMNqSotOSRJRIHe6tFGQ4LHNs2yT9MAAaghG9y6agcFPCJXQqhyh/Jyg:CwSo4Shb6tFh47NWZMbhwyocFPCJ3A","tlshash":"1b22bf8d1603f13edd5c7e32c49a0654bad4c6308c10824f298aeebdef2944f866516e","first_seen":"2026-09-22T20:45:26.350742Z","last_seen":"2026-09-22T20:54:21.294974Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/c7ca2aff-6dbd-4f6b-bc89-1c8c3c9f54e5.webp","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.971Z","timestamp":1790110409971,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/c7ca2aff-6dbd-4f6b-bc89-1c8c3c9f54e5.webp HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"36c8-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zU9sMG3lo5pSJ8JMaqKpxUhkampC%2BbLKoKLJPphMKHbf8TlujtCGy4WwwPBtuDOdsXAS0fxve%2FM4oz6p0SjWP1oz7KnjgSKvhX9HfTpxB8o4hfbTrOa4%2FumwhdOCXBCT7AOc%2FFLLsw%3D%3D\"}]}\r\ncf-ray: a3f4330e597fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 14008\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14024,"size_decoded":14776,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"075d20da8a6bc9bf01300af0a80877a2","sha1":"634693a16f7a5dd395eb85bae348692245404105","sha256":"544b1d5630a995cbcd11d11791eda5364873ecd6494bc87e04da7a70566e7af9","sha512":"06a05ab73e55fa81d2fd06ab6f6be65b0abd8d0f709a665d3a0d529c5164252dea1d2dd0385ae00efe10db3ed70d6424c4953abf386155c36d191bbefe4fbc25","ssdeep":"384:CaDxvJVCE5BBR/wVEHy4BvRXEAx9p5uz5zJCQjBZvvebfix:COJVCE57R/wVEHy4BNx4dHDve2","tlshash":"4b52c03b87824c45c80c5bfb850f73192ca1836bddaf68518165cd55b1f39abc68adb2","first_seen":"2026-09-22T20:45:26.325845Z","last_seen":"2026-09-22T20:54:21.296228Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_22.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.997Z","timestamp":1790110409997,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_22.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dd1d5NfWpvx1F9%2FQkm46K3uoFiPeYmEPwZjUTBBQ649bySFcFBTtTQfD2rL1yan%2FzWKKZBBXQJyQ2ZqvEQXQI%2BVa%2FjfEPQtk7MTSwx9Glfgj4IDrMhSOwkcCJn1ic89c68Jx90ZV0A%3D%3D\"}]}\r\ncf-ray: a3f4330e8993a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33512,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"a3889d5bf4623ef50d3040e63b18d8aa","sha1":"4bb2e497e3a3d3e1949dc42da3f3425ec3273e35","sha256":"9d6a738c5384eace5d3d9d63af08139bf82bee92d34e9b2aa34fc41f74de5520","sha512":"842a469b8fbc891e4ad11f5971d6f2ce14fb20236637b9820df10ec3287f2a574b7f9ced7d5fc55e0ede599514fed48711f6816438ec258846f427662714ed65","ssdeep":"384:sFbCpBylDA8ZaqACibRWRnjEp5T4PjjkAbqfd1t9la9bOsicoOqb1MyGBYrVmMGT:ubAZ8ZRFwRWRn26jv6d10RIcAPFfDK","tlshash":"11e2e1b7d3d53253d89c5bb7489883ac71239a55daa0e5e1b2cd3f281fba8848d31192","first_seen":"2026-09-22T20:45:26.279263Z","last_seen":"2026-09-22T20:54:21.296963Z","times_seen":2,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_32.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.002Z","timestamp":1790110410002,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_32.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"a601-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yW8nEfLLzk3HFaQfVxAdhtaK1IjYIkGr3b2k7fqxFDrl8qrETZ1IngpSZZL8rLbG5RXzhB7GvdnGx5ye4dQcCaHtjGDUcRnylUrQJMrCPW3pWfeNu%2BqihU%2F08DgFcCLD%2FEXSP%2B%2BRmw%3D%3D\"}]}\r\ncf-ray: a3f4330e8999a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42497\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42497,"size_decoded":43215,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"9f445805f1243065500f617be176e180","sha1":"1a01b4a37603cb603d9f1c13ce62c1e9e3750d9d","sha256":"3cf9faa6c8ceb7d19ce85381ed389304b049658b21b6dbc6f5301c06845a656c","sha512":"f2412cfb35ae60d08fb06fb86b559b63c23860840a1ed377832aedbec30ad7d49510e3afe74d98e068403b9795fda673665d422900268b356cd7ea7e334bf14d","ssdeep":"768:cvznXLQ0MczkghxFMo6cyHTfjJc96dXp9gDVFGK:cvzXLQTCZhzBTcT24N0GK","tlshash":"ab13e16a97fd5b62c35dc23c026f5bc0f895a79af3941716b05db43c939d224e18e350","first_seen":"2026-09-22T20:45:26.283495Z","last_seen":"2026-09-22T20:54:21.297537Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/f4e8119f-ec8a-4160-a330-ca0290dbc0e6.webp","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.003Z","timestamp":1790110410003,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/f4e8119f-ec8a-4160-a330-ca0290dbc0e6.webp HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"36e8-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1cDj9JLn1unDeWFQWsopszxnju626hM4dA5Jcxv5SeYlCXxbte5c%2BGognaCeZrOddS0fhNku2whqt%2BbaVN8QlOP9dgQqkH8REaXpOahnIm5qBdOEpUnIoB2ZxVevqIhD5b0kQwCcjQ%3D%3D\"}]}\r\ncf-ray: a3f4330e899ba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13917\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14056,"size_decoded":14681,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2273be9e70aee4b163740aaaab670e85","sha1":"67d774271e7488bfdbbc936d8268376a50cd5c67","sha256":"f91835a6042abaf03d5bf6873bf7d01b7adff40fb550dcb2689ed5bdd315e863","sha512":"daf2ac3a47e9ecdf0d1656c1e4099d58a9f9e8311db1466264e03691f8080003b4d8613870fc8b3fd6206d4105a06d79b95cc3d86fea8f81790559c872db3359","ssdeep":"384:z8/6LTQnWA/gWn8l5MozdsiKJANm7lNQwsX5K:zfWWn5vpXKJem7Qwu5","tlshash":"1552c0f1faec97def9e402bf884222ba77251c03da69c8470f31041679568e1539b5cc","first_seen":"2026-09-22T20:45:26.305511Z","last_seen":"2026-09-22T20:54:21.29922Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/potatoecat.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.927Z","timestamp":1790110409927,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/potatoecat.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"ce54-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sj4PxRo9ypw5vIICO%2FpKztsWCehOJPMUxOCfv3z0BchHwMLsP57EShnzeayWMOpOwLjSkS8QPA54phL%2BfrcPRItc91j0bhxY%2Bv6tTe9ioK4aMXsntovQ0XAi0tnixSs%2BP3cOvTdUsA%3D%3D\"}]}\r\ncf-ray: a3f4330e0954a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 52820\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52820,"size_decoded":53535,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"5452370961fc957c829258430fb173f8","sha1":"cb6375d0f9863c5a60b62b5434eeb173d7daf316","sha256":"f748f3c14c1c58a4465dedffb85bde38a68ff70425bef4e7fd3e656a47ae96ea","sha512":"d45ce5bc40cf467a31daa44528eace0a3e67e287cf1bbb8981817fdf76fcb595e3fb770bdb2ceb41477945225578fd9accc02ecdda67d6ab644d6d7508970e7f","ssdeep":"1536:Ze1Rs21e/EauSuCApVbMwYguEbDphE3UXMgh8i:+RsXzu9pJMwdbDCU8GX","tlshash":"3e33f25a3cd9ea67904a73b873feba94ade30cb6a54bc5f721c2d30440b76280f64951","first_seen":"2026-09-22T20:45:26.254433Z","last_seen":"2026-09-22T20:54:21.299768Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_42.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.032Z","timestamp":1790110410032,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_42.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"300e-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0G3MmNjE9P9J3ISEMssD9VgmyqnUucD9sba%2BuL01zTqsQPNzUM2lB20dycTe0m60jx3W0pDB3Z%2B8TK%2B2pR7wUdTwbOsiTZIBMVlpVO1oClm8hgKehKckktqsAAc%2FeT683Igd3f2ikg%3D%3D\"}]}\r\ncf-ray: a3f4330ec9b3a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12302\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12302,"size_decoded":13018,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"d39367755cdb8d57e7b63e8b61b31d48","sha1":"4365dfb752efc7c63e9ddbe062ee9f90f37d69ed","sha256":"ab6e51856406aa16af663a9f1a356139d51991d5a21224b079ecf78ca1342fff","sha512":"cd92cda62d1396e9296750626a504598a09e7bc8f57d1dc4f192dfd867c738f82a73f0c3e97e76e91e941f872a1a9824308fd1d87c363bcb35ebef208f1d41f6","ssdeep":"384:sOxi6IX4dyxhiPjk8C1ueFjnclwdkXa5FV:q4QokPrFV","tlshash":"5f42afc25371a316f87fa574c28ec662510daf5af8c1ab4d3e0e36b833217c0e99419d","first_seen":"2026-09-22T20:45:26.297309Z","last_seen":"2026-09-22T20:54:21.30062Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/nD58-PCn.php?s=%2Fjmpd%2F","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:32.590Z","timestamp":1790110412590,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"POST /nD58-PCn.php?s=%2Fjmpd%2F HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\ncontent-type: application/json\r\nContent-Length: 1324\r\nOrigin: https://usepaid-proposal.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1324,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QBAwP6AisACQDXAk8DIQAkAyMAAgEAXAMAAO8nhn2XtsKCAYhxIkpSQSI1Vnx5sI4CAAAB3vuWHjGOQm8UJD9q4l5tYbX8ejdKe1N5mgF12FgxrqGSaapZ35fvvivcKkve6gTLvSvEJU8bJoDxJtpkDlLSQNIi_5wVar_PwNAClIXm2zKIPmKOQir-6DQ0ej19cb__TXBgXLA9ktMEbstuL5BOZJxeq-qjGLgGdMkNpCNNkKC6lqjCsw4vpcOmG7MY6zb2pwPliKrn_xvBIzj9b4Yn5edBylkByKuZdnnsobXQs0uiTneZvON2uf4MWydV_06gTxmC3B69r3PENddT2lAWwAtGILCrFUSo6Pio-0fJcFwqeZvAX2bgBNMt5_EyC8IwIQqIG_Yr-MJfzfWVOotUUoUpquD6m-OZMEOWQismkOEAWLo22kRLbPD-rE9XhlObNs2H3vtIYWOrK_KgpCYJLGrVlINPJzZAmYkIxvvj1nLixqIEShutgUIsXckZyvsqD775F17jG9J-wSCowmpidcZULo-atzEsJQtSOcG8Vcwvge8dSe_dn_ov8nIJQAiZ_4nvyoDZf-WxTBUiHPPdEbtFT-rfQ0RcciRwCuNgCplWeFWRUEdVBxAVgPLXMcDwQ9Lg29G9OCShBCed72bRCCVqlpLxUF6EIMrr03SFV7dqPa_JZEXcas5BeMaBRc_lS1BiiACYIaq17RMWPxAaTofhfh9S3WyIk43vhersoAVfrKitS4I8aXyFoDsl1szOgHH-f-qYYIeoFHW0_tM1JX39OyHHu3nDOhm5rP3CSnpkOMuE_54BjHbSmWNc9yrI4VCAucCFCrWkbJqJ_LTBENVLhzp703fX-c6jXCN3LzfGtXT8_NXULiR28qwLVFourS8n7gMYKIAVYbJ5jy-6o2CPd9oMISs8vKR2l5ah-52noleg7_JLXVBry6U3FL4JQRdeYNze5hjJ6Xb8NpnbiFrcl0uwm8hsuC9stqeXFEC2sZ1zLg8hHz9zAz3OteCzj_OqYkouRxhaysEkv-Rpukrv4VRvkvJvl9wrWYLDiimLfBbWikd_-5DAOTxnFbqB9EnmIgvhoWBfrUIfmOAdL8w3o79jDGDZYQ7_fQrOXxc1QtfKQMnvwPZWCq9KfrlbKekx-k1KC6uJD4bgX8UJRIOzh7OQyY6bSMuAQsn6f2SQtIho0NjfxjM2r2NWe6Q1RnbPGVVPgXdS6l1WLyocu0ULEA\",\"challenge\":null}"}},"response":{"raw":"HTTP/3 204 \r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ndate: Tue, 22 Sep 2026 20:53:34 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nkwnsgTPkcnABmbWUAoIZWJgw3Z5%2B3aPbCw83KH2okeV3ZVRJc41qU2iMZ1Z91pKkKkXO%2FW2d8PIyE5KKel5mLJnqWLNWK7Vchhg37ApGKDvJ8KzMaspMDFz8%2F8B5mYZWgUBcJ6Fyg%3D%3D\"}]}\r\ncf-ray: a3f4331ebde9a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":2565,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T22:48:26.020574Z","times_seen":18607473,"resource_available":true,"data":null}},"time_used":1820,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1820,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/eloncoin.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.893Z","timestamp":1790110409893,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/eloncoin.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"12999-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mqqH9xyuJOU2m2rHVT59J4AxlgAOqg52pFqV0ZBc4EOREa4ZyCs1ZfvLsY8%2F%2FlRUf%2FdJ0qIYVNT%2B0rji3oR3X2Y%2BN%2FLJx8U9u4ldx7%2Buy%2FCcDwU9aVBSZBkZ1AyJgNLtzxcVtJ%2Bqqw%3D%3D\"}]}\r\ncf-ray: a3f4330dd912a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 76185\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76185,"size_decoded":76911,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit colormap, non-interlaced","md5":"7ff4feca4a8757f8b772cabe966408b5","sha1":"96b03b20d760b42c415394fcfc9a1bff864b5ad9","sha256":"582875d2df221e26e3d1af112e0128c78f981aa42b293d6bddbbe33e8f61984f","sha512":"66118ff471a432e55df51a20652a22bb2defee0f1471c05090c451049a75226b59d84a3ba858508cf426470d92b9710c69d2d4587e36d8ed6426cbf61b626845","ssdeep":"768:ROOfevRkbKhRMiGjpxAPdh79gmqenVVNK1ltEXAQzuoh/4xsfjdu9R1MYdmozcrW:ECW/Gjp4Tw1ltEnzusgsf2MY0ozBpnVj","tlshash":"3073011748e970ff12874cdc21b4a173f07c007477a9a9f89366792a2bedd621b3c4a9","first_seen":"2026-09-22T20:45:26.275797Z","last_seen":"2026-09-22T20:54:21.30183Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_7.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.949Z","timestamp":1790110409949,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_7.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"a601-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w9yb4fXvIz345Vefqm2mW0hhpUVe2%2FZlcpMYpP3ztjjKMAQQqqe5rOnJTVy0%2FbPlbP8cLpNGm3JbsUrFQKDe%2BW7oeCwaBeHGMm9cjnj6tp9%2BvPSdHyhAPKw1zMc2K7T%2F5AtZLo2Tog%3D%3D\"}]}\r\ncf-ray: a3f4330e296da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42497\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42497,"size_decoded":43215,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"bd23d8e2b615112fe5a3d2f5b1dc51f4","sha1":"c2663943fd87a0e35a5430eb51d24ab5691edd43","sha256":"c271ee2954cb8b3bcb8594bcee101c15e004f537f74a81dcdf3c1dfe49215aaf","sha512":"4010c103d15c384820b7b467ac13bc42ecaf2d63e85a479bd301f58d931be0d934c34b6d37b025f9e72f2bf6e2df83b519a01f91b551033eb44529f7a8cfe769","ssdeep":"768:EjFO8kuV+Rgu57G6thwBAnNOAW8Z7lZV8quBWRH80Tozwf7taCX:P++95rwjmlYreHFfE+","tlshash":"3b13f16437bac685d4dc0c3d9270cbc5720dfd22d9d1fe99b5ec2499a3e227008fa598","first_seen":"2026-09-22T20:45:26.246389Z","last_seen":"2026-09-22T20:54:21.302371Z","times_seen":2,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_26.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.016Z","timestamp":1790110410016,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_26.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"4d1e-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DdZLn0br%2BvUuMjkf7y%2BI6y%2Fk%2Btp2R1yijZE%2B0UJFpVG1943vigV65DNHfsHFs2qiWXDn9Py5bls%2FS%2F5r5rNXI72RamSpLl9OP2UIrFiAan8bbXAKO23VihidNEtOxZObn6DjHZAuJw%3D%3D\"}]}\r\ncf-ray: a3f4330ea9a4a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19742\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19742,"size_decoded":20464,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x499, components 3","md5":"9bd637b54706eb319192582df1ebf6c4","sha1":"52256dfcaab1d26060c0e519ec0f4d656d875533","sha256":"26af4a578ee60e8780a032434e6ed5b8a6d0aa3262b6e4a5c4cfb903ba86ae11","sha512":"f2f0bb6e96612d250fb775253de07ffbf7c900ab6f711fcf8575c2fd7f14d262019843f62e18372b6d032116d57947f52668d5da9b85408af3d213a7cba16f5e","ssdeep":"384:x4ktw10BiT0MZdChFkc/E84/uhsTT9pgunpZ9:x4ktwGm0mqW/WsTZ","tlshash":"7992bf8e9596c1a6d12c43b38d871b490a251d4e3f4c1503dfb8c9952b1e1bdfea09e7","first_seen":"2026-09-22T20:45:26.276956Z","last_seen":"2026-09-22T20:54:21.302896Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/dora.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.921Z","timestamp":1790110409921,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/dora.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1206-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x9gAM%2BRFpl7ISZuflVfXliSekEU5WbxAOsqtYkbGKAdpyx6gk%2FYoSdnuEJfYevFCoJbDL2wqRMM6bmSoiejTv180VKP%2BodH4jOmCbPs0nc9e1rGKYAR3XKnMrYC%2Ft8stcvSkeaSLHQ%3D%3D\"}]}\r\ncf-ray: a3f4330e094ba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4614\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4614,"size_decoded":5329,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"25d6073f4cd7557b3a938882f7304e81","sha1":"481767d598767eee7a22df2686776d34e6c0d482","sha256":"9a563be1ed6603e27dc24d578da9c64e34a646a052deaa6f597720aaad40724d","sha512":"2db20b96fd68bbeb35b55f11cfd6620dab2b96103f2f97affd985c1adfa8d2de06eb2fe275f12bd6a3327692136d7ebcef6f76feeb44ebc621076006e3a544d5","ssdeep":"96:emyIIM+jrJCZLDtx1A5grbgi9ojkdJ8Fo2oszwkT+:0nrJkDtjAEYjkdU7Y3","tlshash":"6d917d42938bc9c6dbb8da78537bb750320dcd8761224f81e57121bfa5d251186826a8","first_seen":"2026-09-22T20:45:26.286596Z","last_seen":"2026-09-22T20:54:21.303617Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/pmarca.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.922Z","timestamp":1790110409922,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/pmarca.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"f6b-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bPmEEa8SOi2eFj74KBH8GF0EP2cYv%2BJmQ9Nt0mDGgrr652N0XNA26V5pnCW%2B%2BMaQ%2BDx96%2FLE3D1793oRKcRw3ssK3eW%2F48q3%2FWL2TbfJtYer7TcnXcOnwHjRXMjetHqysmBgqmE%2BGg%3D%3D\"}]}\r\ncf-ray: a3f4330e094fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3947\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3947,"size_decoded":4669,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"a9acb1071855ed61221ade9632a40f72","sha1":"5104ad3b9d554e7df300a6a85eae1f9f1dc19226","sha256":"a4bc7f43e5127119c7b7bee029e921b1c14810f4065fd5bebdc6e87cf21685db","sha512":"2291dd10337c710460f48e0214f6dc273c691b094a099c1c899a50a342c000f6609b11a7ab7b352bc0ef7ca77dd6f7d7a88ac6880ba631352429b6f92ab3cace","ssdeep":"","tlshash":"1e817cfa056144e6d8d847fbdb0e3bab710da09b786ef06b1b2686c26e394c4011503c","first_seen":"2026-09-22T20:45:26.236884Z","last_seen":"2026-09-22T20:54:21.304178Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/js/rewards-popup.js","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.928Z","timestamp":1790110409928,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /js/rewards-popup.js HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 11:29:58 GMT\r\netag: \"8c2-65b97fcb25980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/javascript\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IRS8PhtX6UcSnevxp89skpFCGJk4hef7KAarif7XRCNurHcq6RaEfdae1QmfgPqWmuQ891TvTQeAC%2BhwRn49ap%2BoJZuUSc0iuz4qwW2ysuf6cN9WgH4TEFgPNrpFp26pZfm8dlEAHg%3D%3D\"}]}\r\ncf-ray: a3f4330e0955a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1003\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2242,"size_decoded":1773,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"fcc4bc8d5b4949208ebb45c1474f609f","sha1":"c85a6701d7bf002c6bdc7aefa3f8b9e096e32ca9","sha256":"242d3ee8e8b2502b662c793a8ad47a31b2bbd73338b6d230cd34ce8a0c55227b","sha512":"a1a8b48a00a634393f2a8c405462b782fc47e612b31e0cb1ae7942969ef7565d0ca10b51d0aa10d3355bf441c434e9bc169a7562e20edf641b6a70e850553688","ssdeep":"","tlshash":"4a41401a52b4273285bb308e73ca729838352243fa55cc35fb5c09811fbcd41d8b65ea","first_seen":"2026-09-22T20:45:26.242209Z","last_seen":"2026-09-22T20:54:21.304807Z","times_seen":2,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/stonkcat.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.934Z","timestamp":1790110409934,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/stonkcat.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"7136-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ERxLxNGBL4P3BK0Eykkx1Q8uwc%2B64dNzYdUwLYfhaP1LC4nvIHbdRzf9Xp3Vjr9QuZjYN%2BIyZN9jkWuVgMughd4fbBCLesh7He5DE1I%2B3JdkB1cVqkQrSZmoYwKBIR3yTmvrD0fVfA%3D%3D\"}]}\r\ncf-ray: a3f4330e1959a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 28982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28982,"size_decoded":29696,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"b63f84f3c7e132bcf30dc25a7e3fce3d","sha1":"fd88f6c3097778f040629af82dfdb4da8db93bea","sha256":"9252295d01a4696e54204c7fa8557b064e60deb10e0ffc7635bc9bc84f8b2ab6","sha512":"15e5b43ac53d13a40de085ccb0e8aa175dc51c94c8f69f14f585a09654ea16bfb7ecd14a6b626bb7929f346a6423d6d9e491ba1e0c8b880881d6f8a297bdc30a","ssdeep":"384:SSRAfSCDK8bx/gyF0gq8/UuCDFk0Pey9KJwgDgcbBf0epXjdUoIMC4hLQkImK/Lb:qvtFF/UFDFcy9K1DgIBf1dUo6P/z43bW","tlshash":"72d2f127ea467b95b46f834987cfbb481da4743b59ba5c8011bb40810d3d0b46ffbad8","first_seen":"2026-09-22T20:45:26.22328Z","last_seen":"2026-09-22T20:54:21.305355Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/pump-logo.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.941Z","timestamp":1790110409941,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/pump-logo.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"24ae-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aLPhnbDX5LIe5C16BRQZyGrlYUI04NUFfpOnHHptggNx%2BrXBYbVBVit6IYIBoTvq%2BAl9SrEYRzyMJuxzlVAzY5oTUqKVMCfpxMe5uOykT3bPsUUsqW%2B%2FRJwpfn59xYjM1esd%2BdbYNg%3D%3D\"}]}\r\ncf-ray: a3f4330e2963a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9390\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9390,"size_decoded":10106,"mime_type":"image/png","magic":"PNG image data, 475 x 475, 8-bit/color RGBA, non-interlaced","md5":"16b70be286ccae65488956c9413c6099","sha1":"9c7af8a87825ecc658d327dedbcf76414bea49ec","sha256":"833748c20d4f6960df2d0a6cf8709584df41263b8b0406a2acd9059992f34c48","sha512":"d6fc8a19d0656839d7008024795cf4ef20222a7b72f82a357658433ded3179eb427947cd2b2a8fbf186c3a832ac59e2ec76d15bc3cb850ef431579fd7e3cab67","ssdeep":"192:ZMs9BoneOksi0+GuIzuPN8qIhC65UvQMN5IZQ/WV71QXxUb:ZMeBon9kgpbzu18Vhj5OKkXx4","tlshash":"0712ae9290af0775ef02e0fbb2dcd5b9a4caf266c97441a85b0e9e5d802365c737c830","first_seen":"2026-09-22T20:45:26.331197Z","last_seen":"2026-09-22T20:54:21.306026Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/1eee5c3d-0e9f-484f-a1e0-b2a4401d591a.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.981Z","timestamp":1790110409981,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/1eee5c3d-0e9f-484f-a1e0-b2a4401d591a.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1f5a8b-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zeQ98Ez%2BJtXdrNTI3L9JGblDbVvJIv3E9BxRZ23%2BVvURJ7HiuMrgjz6ucbqJJ0%2B8NNnJeXXfDnuWOPFnxuO0V67NtmU57AYv2z5iN6uIUAini6k8rSDwwT77Bv4gxzBsqXtfZgHg8g%3D%3D\"}]}\r\ncf-ray: a3f4330e6987a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2054795\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2054795,"size_decoded":2055512,"mime_type":"image/png","magic":"PNG image data, 1254 x 1254, 8-bit/color RGB, non-interlaced","md5":"f1fb5a1d2b81ca651ffb7303a9ab88f3","sha1":"4efb362085e6deaa783f315efe0d43ea97d03188","sha256":"d996343e7c13c620e31a20e866ef3f84c8ef5523b1406df0265d31a030445f61","sha512":"530069c824430ace772e36f4c1d6cf5ff0d11010493a0ddeb26bb361da7a027e823699f26034838307fc33f231d7234ea1135e0d896f77364960512c6bf6aecb","ssdeep":"24576:4Re2974wxk45Q+jT3M5SbsCDuLGXUU+NesKLspe:2+Ok8T80YLGUN4Lspe","tlshash":"412533ea1535654bf1546834aa61fe324e3372f0286d00de94ecaf90c1afc8785e9b7d","first_seen":"2026-09-22T20:45:26.257185Z","last_seen":"2026-09-22T20:54:21.307001Z","times_seen":2,"resource_available":false,"data":null}},"time_used":279,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":271,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/zwh.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.909Z","timestamp":1790110409909,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/zwh.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"39b0-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yDRXR6Qq9yjna1AvaxuAYq%2BPpw%2BJobkGBSbhG85JDQcEv5GRUXi4lvxOna6e3ppLPIt0tyYbtvJ3gC%2FzjWfj9HDCHduWngvMbezSIV3%2BzTkKmrFv6dh2JXEXUoBYynAfybQU6REi5Q%3D%3D\"}]}\r\ncf-ray: a3f4330df927a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 14768\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14768,"size_decoded":15484,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"12871587c1ef7ae943556ce7944bebdf","sha1":"310dc12555a0cb75680b9e915c5951c5a35b3b39","sha256":"d0dcfa25db10371888524f4407bdf26e362ae0cb637f5ca823cc5683c6512894","sha512":"10f9d158e3f1c221381709718b5a74a2ed716051a1ea200893205f5439227dda60b94433977a24a4a3121a822f9f2003b1632fdeb336edff7087d290974544cf","ssdeep":"384:BSOun3PjIr80w/KscvMfZYLyq1F/3PcuTFP:BSLn3cr8oMBYLpFHcYFP","tlshash":"e262e066ce387fc2edb25d3180bd75a9b4a51605388e2ce3ea423fc98335257c2d0302","first_seen":"2026-09-22T20:45:26.290732Z","last_seen":"2026-09-22T20:54:21.307953Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_3.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.942Z","timestamp":1790110409942,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_3.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jhVjctbO6bA6ftg5vOwhRNgowsj1umPS0iEbHER5tRdjTNW8gl0Z2mw2%2FhKkgS%2B0Rjxi%2B0U4yX1crFBqxRIM9BX3YDwIedtOzJjc8JXzsIn7dmxXK8TsHlH7BzV%2BSX9fmvoqNcJELw%3D%3D\"}]}\r\ncf-ray: a3f4330e2964a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33512,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"b7a5e161178d95d3db5708c0abfc27a7","sha1":"e2f981198f0008cfc13cbd8926b94b41331abe40","sha256":"813d1d62dd2454f6ec589a68d82ff360aff16c7c7088498a895b3dca0f31038a","sha512":"3cca2d2818a25fd1bbeee77756ea248597dac741b8e895a1621d339ca5f38a7f94621a934e052e255f204ce452b79d4c4a2aeaa0e80950a67e5d915997da3717","ssdeep":"384:s8gmdPR4GuDfCocSl6i6cyukQzIQbmDNmcvs4Z//3yIDJmTpFEWyMdKcYC4VjNFS:hjvucE/TdkQFbm8cVVPwTpFHJYC4pC","tlshash":"92e2e18e5f92badcdefce4b512664391ab31652140a4038db84c897ddb36145e3dc724","first_seen":"2026-09-22T20:45:26.291713Z","last_seen":"2026-09-22T20:54:21.309669Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_15.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.968Z","timestamp":1790110409968,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_15.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"dafc-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5IZw1Pt1qEhXPGeV6aa59%2FbisLrC%2BfYzu2GG9VFz%2BUyCOHH8OfSahWwwDEXshOFZ15N5EWURgMHjGTgkkidWPu6jqLPWViW%2FAqpf0ot0gKlt0gULe%2BvKCbbzBq58K2ivKze%2F42vb%2BA%3D%3D\"}]}\r\ncf-ray: a3f4330e497ca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 56060\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56060,"size_decoded":56782,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"a9678ca125bc2e39620eaa5bfa10e578","sha1":"1146ec298a82885f89f238460d3c58130d717949","sha256":"7fbae9b5bb69a8761a8ef4b82bccd3ea5203a893fde8cf39b411d49100b0cb92","sha512":"43cd930b579138ddad47cce5e0b50de1a46189ca6391c13acd7421172e0f171bfc61ecdde407a82d8269e90d29bc938b4512a8d5e25a5273be0441257fc015e4","ssdeep":"768:+m1f3usfkl3aTLKatBuJ8p/GVcIfH8N37cappCDzbaITBEu/nUa+Ow7ex:Z1JkFaTLpBuutGVcIfcN7DCDD1+Xex","tlshash":"0c4301b69b5c9e69cd4db9b082b56dabb01c3eee08a901417fed90080b955dbcd40b71","first_seen":"2026-09-22T20:45:26.323449Z","last_seen":"2026-09-22T20:54:21.310902Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_27.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.013Z","timestamp":1790110410013,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_27.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DFOlVXN6DowqvQehzKx%2F4v6WpLglfC7GTy76UZR0Gons1eZmE8M6la11MK55dehMwjF14B9dlHt8Fp1iTPda3vJHTPRxcZNf3P%2FWVaYbhX1tWCjZdlojXdpaFnKqGIGjoixtKnOmfA%3D%3D\"}]}\r\ncf-ray: a3f4330e999ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33508,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 399x399, components 3","md5":"a05db18f7e01e1d8c408bc06392aab22","sha1":"60a944fe4bcc0fe84a7094efbbfc7442784e814f","sha256":"c0d9243e6a659d4de8bb793409bc750f54716ee41385964bafb96f5635f04de0","sha512":"683ef9cdf0a8e193599c46be546314694d0dc62749c0e8047e300d4e7085f5b466b4caf7f0b58997279896e50e89025892d785a10282c102120ac0df6cde1734","ssdeep":"768:5fIiUZzpBsn3AtpwDCH6OBn2QvgrpjlJmld:5hwWwnwDCaOBnnINzmld","tlshash":"d3e2cf432e84994deb6d13f4bc060b15fb923d91b06afc0bf79e5d88139c4b56a326d4","first_seen":"2026-09-22T20:45:26.300508Z","last_seen":"2026-09-22T20:54:21.311666Z","times_seen":2,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/chirp_500-s.p.1uhf2wlav09eb.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.844Z","timestamp":1790110409844,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/chirp_500-s.p.1uhf2wlav09eb.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"aec8-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bySrcBjW60n3sZync2YeU5NXCOOpjLUSdF9BRCL9ceVZtZbkc5Er6RhEvy%2B%2BhNwUJLD3FBxl8Zjxm19tldk6D%2BuSCx08bca0266YQI8HNP%2Fia2t7exJD%2Bz2FjoaE0rEUlEpHbtkKuA%3D%3D\"}]}\r\ncf-ray: a3f4330d88efa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 44772\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44744,"size_decoded":45545,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 44744, version 1.0","md5":"22898c3b88ef29da6a41c302510f28b4","sha1":"f9cc37a5977f1163068a0a73d289ae2431a7fb82","sha256":"29bf369dc4c1b989f933e482f76b961acc5478bf48800547b18d6cc6b9b9dd91","sha512":"f270ed67a28469b36694a7600187a07ab8fa82877d3a52bbb442c6344091e3ed815ffec90238605fadba4685dad0f5ef0fc9145ead8ff38ed21969a4f6a5ef72","ssdeep":"768:dxszm2WHLjjPNDTCw4nY1ljkbpYNdt2gN8BHcVegXUPaMaU+GRquWGvJvaivBHFE:nc+5DTCi1Fkb8dQgN81chXUPaMUGRbv0","tlshash":"c7130101adfb73dee7857b743b860b65f8106646b7d259fc20e365ca05d7a2fb2200a4","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-09-22T20:54:21.264222Z","times_seen":3783,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/chirp_700.p.2ipqzzc7oyrxx.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.848Z","timestamp":1790110409848,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/chirp_700.p.2ipqzzc7oyrxx.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"afd8-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0%2BBp6J1LMd8Z2ZDyyJoyQyTi3Bp8ArJnHcJ5zU1C8ozBEc2cFiAJskzd1hryKSpMI%2FPHdYqV2W5NjbRjb%2FNn%2F%2FTtFJiXr1J%2FMsjHrvQIc%2BjujvntrDCfPBjrLwNYf6%2B7F7xY%2F3HDoA%3D%3D\"}]}\r\ncf-ray: a3f4330d88f2a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 45044\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45016,"size_decoded":45825,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 45016, version 1.0","md5":"05fb8f8991f2c79721c71285bb6863cd","sha1":"289fcc339daa8f24f432b6d8d78e776566cb4cc6","sha256":"c385d866c78cf2c91ab9dc834291fa49f806aa0805840ebf3bbd1b41e33f55b6","sha512":"65c793b5e1f772f6714c29f0b041e38965711a9828bf3ed1ef40516d841b924b1b192f9eb02186025abda84eec5c5fd15f65b335201d9f7fd2cf2387cca394a3","ssdeep":"768:95nDfv+GmbHY6PoZYahtmlIV4r2rKf9m07kMiqDnX3kpa:95Dfv+GmbHY/RhmIVjrKfX7AcX2a","tlshash":"fa1302c811225df3af3ff4381425768f70648afd22e0b63790e96a77728b957a908d10","first_seen":"2023-04-07T07:37:13Z","last_seen":"2026-09-22T20:54:21.270911Z","times_seen":4244,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/blknoiz06.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.935Z","timestamp":1790110409935,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/blknoiz06.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"2214-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nElXfXXAe9OereCh9jKRwL6s3rFaj5u37%2BSHWxlh63VAPouNzp2oCwYKxr54dRHX1azcyfR6gr29xBFV05bYBE8zVqayveFBCV%2Bsge4%2B6cGoTmPRDqC9H6BiSD8u0%2BvYglwZxejOvA%3D%3D\"}]}\r\ncf-ray: a3f4330e195aa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8724\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8724,"size_decoded":9439,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 200x200, components 3","md5":"a85aac4d1ac72df07c8f1ec662d3194b","sha1":"c470385cd3b901da87197670c4acc450cfc333a0","sha256":"6401569f19226b9804fa3ce2eb6c9e9882cd79c6dea5081ccd8f2cbbd5b36608","sha512":"9c0962db57dd675891f0346ba4d0618c422075e1dd5ae9dd0d9548f9b5d10a6a4b67fc9d7b5c895eb01cf405f0819702b4cd5df7b952869c3c2d9252824c0d69","ssdeep":"192:fsYpr11z52/mScg+yXBAgkZcC5es5mPXrVn0uxREd+:Ew11zA/mlglXB5IcC5LgXrVfl","tlshash":"5302bd0ad25ec3c0f058693916666a0714e0f3f2c4acafb61703af6aac8085565bda60","first_seen":"2026-09-22T20:45:26.231678Z","last_seen":"2026-09-22T20:54:21.312331Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/cb3a406d-bb3f-45e0-8742-4c659093102e.webp","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.939Z","timestamp":1790110409939,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/cb3a406d-bb3f-45e0-8742-4c659093102e.webp HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"2de-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iz9B1gha03LeMZou%2FzWGg1ORsKUEVUqY2h%2B6ubHe4cT38n4KHrC95Rz5R9%2F2FUC54v7Bcwyo%2BFMHMS6BK3%2FuOyy2ruycsHWORgQRK%2FNJBguQLmnee%2F2RZdb7GRtiiyd1LoaTS6GTGw%3D%3D\"}]}\r\ncf-ray: a3f4330e2962a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 757\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":734,"size_decoded":1528,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6ad24223bbcbd6812265925ebe4ff342","sha1":"6461486fbacc2c22c3aae8044711223a4baa6c52","sha256":"309e1d9ab9427ee2123ad54937e63fb9d29124a7dbd2a9a8566cbc31a53b5832","sha512":"f937dcb51520c82d94d37f6abe9515718a7edb819471393ebc84d18ecff2e3835cb37cca1d8854d8df833ab14b250ac846a06d51923a6721cab8ed1b1eb275cd","ssdeep":"","tlshash":"c90160766bfcfb959dc78eb4012a848ce32da4886c82490919d6c30d2c08322c221c2b","first_seen":"2026-09-22T20:45:26.341582Z","last_seen":"2026-09-22T20:54:21.312931Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/5a86f836-5952-45d5-b585-c4df8bb3bb3e.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.969Z","timestamp":1790110409969,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/5a86f836-5952-45d5-b585-c4df8bb3bb3e.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"52a8-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=06lsgirUZ2CX9FrPuDU9SGpiTHeMhQe%2B7W9M2mfo0xVYgPYsqJDB7nZaJ%2B6CKr2xsK8ARXhW8jd2eUelyrZertdA4qYk7JHr7cpxGzsg4%2FVb1C3daGIDAuMuO8MoLk55lkpDgxmW6A%3D%3D\"}]}\r\ncf-ray: a3f4330e597da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21160\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21160,"size_decoded":21874,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"d7c5f701b4529150925a1938e6d38cd2","sha1":"43e0574a85da2af8ff6625ed74cdc16e4db14715","sha256":"e95956b114eee794bf1ce743439f90ce4cf6997ee150f4d63e36aa9b03f28c84","sha512":"42a7f4e1091a4d1fdcb66ab270c0c22942610dce7d282354cb333113c89b28153fff5430c76c8f9710c7d5777c537e567c4520c66e98a13b7cf945b4f9da82a9","ssdeep":"384:sJxqJjA1LZeeX/58ipWakuCXobGHf22RN4UnH1oIlJsT4BYi3HsHfhy:+2A7eeJpWak5XOgOHUnHGIlJs4BYi3Hp","tlshash":"8892e1e5335699f3faec1f34aa81ed87d713dc621020566b97c58cea3bac1dc84a4340","first_seen":"2026-09-22T20:45:26.248948Z","last_seen":"2026-09-22T20:54:21.313553Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_23.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.999Z","timestamp":1790110409999,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_23.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"300e-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gayhS1B8ASv632r0dym5JE72Wve4gvnph3BWXrxtJpQnnZm3rf4b7AsJaG4Qqcp9tB6dtcLcaSPzTGFkFbak97YABp%2FFQn6fS368sH%2BPI5qMod%2FzL%2BLMTZVW2S7bszqCTk1T2HbQ9Q%3D%3D\"}]}\r\ncf-ray: a3f4330e8996a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12302\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12302,"size_decoded":13018,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"600ff4b30544b7adc38eb976a35ef661","sha1":"457d8cec48863c180587b1e6c09c626d9d8cdbcc","sha256":"a73b95ea10969103f2b7ffd44837f80eba130edf527a42cd3171fd2c56da27a6","sha512":"9549af674ddcc3acbf922f40619e1d4ea64dfba19a66cc66bd42ee053f8ac889a7edb96298dffa60df30ddb0e3adfcc99fb9a688079ed66a6df2503e81b232a7","ssdeep":"192:srKXXFyFKiGSFRH5z1WtRW6tci7e7569AcFpW6lBBzmUZm:s2XFWKiGCZ+RW6Ze7I9AUllBBaUZm","tlshash":"e3429e3d3fac8045e81c55f72c9027679e39b9244a1b27a37bce2d8b5f4ac8188d7043","first_seen":"2026-09-22T20:45:26.227052Z","last_seen":"2026-09-22T20:54:21.31418Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/image_2.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.382Z","timestamp":1790110410382,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/image_2.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"2e2-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c22gI4bPpKupwq%2BcxnJyJ5k%2BPzJN3Ba50OCnY27n%2Bi8Bdm02913V3er9D1kcZ29n9VYtss2Xdz1VEJwcyMzDgWJZc78LrPnp6w2%2BoAI9m4Pr99tKhoRRHjgt8On08TZ2GKg4vJpOrw%3D%3D\"}]}\r\ncf-ray: a3f43310ea26a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 738\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":738,"size_decoded":1450,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"3d2724dd30674d331a7f5bf88b4588d1","sha1":"e5b514a1f63eee9d458e0da43a47f55beb63335f","sha256":"1025f8b8b8f93f52412dbea97dc5cb94bd6c667f5f079e600643ec6a3fbc628f","sha512":"6f8535f2ee10e35becf8c30f6bd3b3fb1247faa37dd01c9c74818fe4cc25760193cdb51703aa8433ba1b449f887ea513d6086c1bf6e9b514a41e1953f8d2131d","ssdeep":"","tlshash":"f501651c4b506a2450a6922f7147c750c705b710813efbce6e1ccdac1540fc8a2a63f6","first_seen":"2026-09-22T20:45:26.367737Z","last_seen":"2026-09-22T20:54:21.315365Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_18.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.982Z","timestamp":1790110409982,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_18.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"46d8-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oMPMCC1mayq6koKxewdTwP7gVbTpg1UXubfp4yEQaQ6TMi7p5ezJ1GF2ac5uc634tPt7ru7TpKKV7w4EXe%2FDyyTj0T%2FKUOu2LUPN2aYk0QiqBW4kq2sklmY1wV8BsbpVA7JQjbzh5A%3D%3D\"}]}\r\ncf-ray: a3f4330e6989a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18136\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18136,"size_decoded":18848,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 213x213, components 3","md5":"cc0533dd294a444f9a42f911d2a77a94","sha1":"469ee33aed9e6fed86d6e6e49b1b28996bb4b9ed","sha256":"2105cf008995312e20a50f41178bbcfd030c4457fb5a75e717807bcf897a865f","sha512":"6acb9d2372714b82b136ef2a3dc7c3a71d7e71157806fbbc9930b28b375711c716e002890af18dd668c0c5d4b20039fa1e16e59aebfc7b8167f4f10ba851099d","ssdeep":"384:swGZnGRiGUwyAf2z/gR7um9vZ1OQZTcixQy9ipj:1GRGFyGmc7u4bOT5pj","tlshash":"0082cf49264a280ac99d02b7646163b8cfdebf0b87c54bedf72cc67e27155938f0c169","first_seen":"2026-09-22T20:45:26.332173Z","last_seen":"2026-09-22T20:54:21.316187Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_20.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.988Z","timestamp":1790110409988,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_20.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"46d8-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bLdhe6GVLC91t8A320t244Dv6gXi6Tn4L4yyoOZQmI2GmeJU6keeBh9XVm0US8uKebpJO3KV3%2FddzedRCJvm%2Bek0lQQ0tcJ1137AEH%2FB%2BmUErm48yJJWZg6D1cBAQZIGtgYWqyzsyA%3D%3D\"}]}\r\ncf-ray: a3f4330e698da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18136\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18136,"size_decoded":18852,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"a492b5b14b4c45c269fd6553e12dfe41","sha1":"1d39fa7eeade42ac9f8dcf4f7510c084ddb0207d","sha256":"ac8357f043a13f63375a9b328b3ca28d4c4e1cbe7d985ce9efb264bc9ce9aba7","sha512":"25bd7245898ea623679c0204120eafcc749a0dcc9e51be4a795d6e2ada63f7e83479d410c652ea5af281890ec8ba7627d02b4f3ddd7402ebde6e726e89ee74f0","ssdeep":"384:sUOJAym9Ndka1DQcNfeQfaAHXeVyBF7t1t5aUUX6XiQlfx3RX:lbym9Tka9GQf/uVyBFpnVUsZlfxBX","tlshash":"0d82e0721ec0d0a8f50f99383c90d77bd702de540faa6756714f09aa17b8480ae5dbf1","first_seen":"2026-09-22T20:45:26.327023Z","last_seen":"2026-09-22T20:54:21.31685Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/taste.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.914Z","timestamp":1790110409914,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/taste.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1034-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pKwIwIRI3yU3YcoIcBXK8yoAi%2F9CCMOZCWWO9%2FdAyqgFhzbm0RxtGMRNXTDmr%2FpGsYv13WuzWtN6kG7%2F8QoAJZV0Fd%2F32cFORHuHsFQZ9lZsdKnFuhVmap50BgUaQE0p%2B8lXR9my7A%3D%3D\"}]}\r\ncf-ray: a3f4330df939a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4148\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4148,"size_decoded":4867,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"1970ca18429c7a2d08a6e9290b0ad566","sha1":"24452c0345bfe198296b5cca4792144ac420bc9c","sha256":"df691f813d386ff4e716173e357885495248506c85ca761fe744a300408f077f","sha512":"637045d47908c508024f70c143aa147e81dce5e39bf9f8a7930ea059d388620df8378c0c305162aa1b0a6718c45b1b396247fdd46bec7e29c2b6a6a762c05557","ssdeep":"96:emzuUpnojpTOcQArsW8t5eUCQiWobAX3tTzEPyhEy3:1umnoj570KUCQiWobAe6hEy3","tlshash":"8f816d36ec0380c5ecf3c33cbbdc7d3826444de3b16ae2407a68580626fb2855f06552","first_seen":"2026-09-22T20:45:26.278117Z","last_seen":"2026-09-22T20:54:21.317537Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/foxdog.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.918Z","timestamp":1790110409918,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/foxdog.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"b4a-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yClNVTmb%2FWyXEMBYiIRB9RBA7GT%2FQT1h5aqZDclari5s61bnsPqogdYqrt5xTymdWL0O%2FjpMm3RVcqdiQ2YUXqdr3uicDeIaiYVD11tCBwtyUNYeR6HNjnqoGAQoONbVXKkuDgx7pw%3D%3D\"}]}\r\ncf-ray: a3f4330df93fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2890\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2890,"size_decoded":3602,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"698636ea17abdc2a4c0bf706b3dada12","sha1":"9356d8ec9147f7bee7f11abe33437afc671705e1","sha256":"529b0ede01bb88887a70a06c9bd91c7e198380cc3d14f98440ff112783dc4285","sha512":"0c673f9599706e112e7bb84a31f8ead0c95e5b0069ecc9b59932997828a8717ab96e605c07e444df2f142282a3918f07fd1fcb2736b2adb52798c987c4394c48","ssdeep":"","tlshash":"47515ccb9cb89fdbee594172e475b748238888fa31464c38528930ac49a351f8fa5528","first_seen":"2026-09-22T20:45:26.347375Z","last_seen":"2026-09-22T20:54:21.318168Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_21.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.993Z","timestamp":1790110409993,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_21.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"a601-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fZflcmtBsluj7Z75xeh7nvuROJo4i3%2Fd7%2BpDWa5TgxqjTP87Ql0yWp8CogIpFKz9MPo0WgVJ8ym9XUatuJWk3Ue9IdbJNA%2BJgSwbCuXD29RmdsVpd7yuovHCw%2FhmIYmDxK%2F%2B0FbE2g%3D%3D\"}]}\r\ncf-ray: a3f4330e7991a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42497\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42497,"size_decoded":43217,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"de14b7275ae4243f0d1f39c633183fe6","sha1":"09a1a15b31f08c4a932df3744e1143a8aec7bfe1","sha256":"a1c6192142c916b7ab60edfd3effaae81a0a42ca9697b73c4a8b0cbb968b127b","sha512":"87662164a1d812df402f6ea387c7ef3325f8cbac7b3c08bc6e4528de01b42f068e97156cb0fe05a3c31f9802ae91622c5ceabd483538da794bc91df3d118f559","ssdeep":"768:0jiw3e3F+Ch+aXVugzhjpelUK2UDpMqwlfx4KW7uWuR:qje4CrVl1K2UlMxxcCWuR","tlshash":"4913e18eab0c692efea1a07c3488be407c368f7444f6af573dfd963e17588558619206","first_seen":"2026-09-22T20:45:26.361152Z","last_seen":"2026-09-22T20:54:21.318786Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_33.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.010Z","timestamp":1790110410010,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_33.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"46d8-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CWe6%2BOBglVA4t2shCgDGic2NFnwbJ0FlurMgQeW6AQEwT%2Bn0JtMW5RKL%2BibjdB4%2F3rU4WCV6FKeSaW%2BJ8pd5AZLZUd2vGoNrJx8My85fhC2RBhsQnlikCGAFnCOZZB%2B2M9O9oIFegQ%3D%3D\"}]}\r\ncf-ray: a3f4330e999da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18136\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18136,"size_decoded":18856,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"ebc5882a1bda59de95d460b7436a5c33","sha1":"6b174d0bccbd47f69cd523b9eb9f760040c32a06","sha256":"1d9e1800b3cbd1e1ecb55c942155bd07ad93fe36d7f7958c69aae0149e0942f6","sha512":"2363ea8eb2c0de5a3b9618d13945b29c398d059746c881f653256570bab6a1acff7ed1eaeaad1ad2cb11901715c7890e97b1a1d063851314b1fc34d175b40ffa","ssdeep":"384:srwY7hYYVtaCw/tZua7TI3PY/s5xM8kT7i3a24Ghj1:iwY7JVApu4iYCTQnq","tlshash":"6f82bfa103818f80eced0f30e9717be9bf360a458d867594bd4c2c496ffd15c8da8296","first_seen":"2026-09-22T20:45:26.320636Z","last_seen":"2026-09-22T20:54:21.324306Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/clyons.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.930Z","timestamp":1790110409930,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/clyons.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"49d-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QtThpJ9lSXKaykwmauBsYPJj1VYRGd63HiwXBBRMfgETdCg4HGPsbFUmH8doTQkQOPsnXYJlPJO7tAmdlunKSkKrCBw49Osz90stONkeQtTt3W4URpZIuFidmDHshhOHIMGyfXNqKg%3D%3D\"}]}\r\ncf-ray: a3f4330e1957a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1181,"size_decoded":1887,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 48x48, components 3","md5":"ad210f608a72d287174e6571ed8d7201","sha1":"f352e07915ad6d7181384c79bc4f6e2bc7d53062","sha256":"a19145084bfa70501c8e935d468c3616aab3fbee9a8ce6e078fba1932b35e2e9","sha512":"14441fd9ba43a27f99e0d51c123f436022a192bd7dda05cf620722085640089666fe7e038f1e7c4b5b84c180c376df3e50019bf272e9e38690d01b4bda3ab490","ssdeep":"","tlshash":"7e21c609dd238af2cc450174ebe5331823c5a4672898c98543d930ce86df447eb48b49","first_seen":"2026-09-22T20:45:26.348299Z","last_seen":"2026-09-22T20:54:21.325383Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_2.webp","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.964Z","timestamp":1790110409964,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_2.webp HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"6006-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=risJy8PaMeMD5i8oDggv2PrzRU3jAQxqZSba8jCw%2BJNtnMTAULIf0FqU6dlU%2F5YW7yMqaQIq5x5KbIEV%2FixsXtbN%2FjvgqIplyfNUZbuwBvUCeuWPgQ6HLIDPvO3r9VGTueDMCojcyw%3D%3D\"}]}\r\ncf-ray: a3f4330e4979a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24460\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24582,"size_decoded":25228,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e93a9db86475c443b76fa0e6dee020ab","sha1":"82362208a9794d9ecf615591e76dc534e5b58ddd","sha256":"bd39a3ff1ca0bfe10ebd45cf97cd19850aba70033d6412cb65eaf397dde9af4f","sha512":"01a4736125eb5d49cd9d28af76f6417377812da22b4a9d7a4fc88666ba490b8a0ad40d815c5828533263bbb3e10c24ed232b987c245f260e821ec507170937ce","ssdeep":"768:4Aq8VEa5m9qUatTWyycNZmTo4aFhhe7QK:Fqyx5mAzQKgTozU7QK","tlshash":"13b2e0476f9123e8e63867bd7d007c4ae119e6bed5e42528f025778a0d04ae88912f6e","first_seen":"2026-09-22T20:45:26.349528Z","last_seen":"2026-09-22T20:54:21.326085Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/icon.svg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.704Z","timestamp":1790110410704,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/icon.svg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1157-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/svg+xml\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IsSyvtS5nWaoWibg6AVPHw0LBgNK16tUW4tL5JM%2B4wgTiez2x%2FQWoQ%2BhP1JTnQofFxpbZP1clfaCqY9HbxL2LadkvbVainTI9P1AnTplBchHbDAcJrhgngGU0vjvqKnIjGdbSz01%2Fw%3D%3D\"}]}\r\ncf-ray: a3f43312ea95a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2122\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4439,"size_decoded":2895,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7fd189339cac2fd3a08d8cd3b7daf035","sha1":"e7d2bf1d4187d7b021dd6ae4ef367207b4f0db9f","sha256":"7fe42e316e420721f072658b55e45cc97dce29315fcfe41f4217b2dd236a215b","sha512":"ac39da2f5e3da625f1915bd73bba8aac92340e3c96d789fec9a34f29e3a111279644434b517686c3bc81210389e5ab117ddd662778acdbacfe0d20a84c46fd6a","ssdeep":"96:nWvFYH1xJ3+3sAEoAVwxljnSUC6Wgh32ssKZBFuvtTDjk:nlTJ3+6/wxljSUU+1sKZYvk","tlshash":"9991dbcee7826eec0dd985915827a3812f47783f9f9682b1c046d3f2b8398550986e1f","first_seen":"2026-09-22T20:45:26.261058Z","last_seen":"2026-09-22T20:54:21.32672Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/sama.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.903Z","timestamp":1790110409903,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/sama.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"ad8-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w10GusfNy4898qh5SFxQQeO8mjsBL1C66ypYDucn%2BuNHM1h1WAPv5O2jeZjAuPXiLUukbbXd5mG3Y9kAT9jgMdjmbvSXXuynF%2FWfz50Mw4tcXb2yl1XbmYy4lHm12Zv2ySaqTjwMqA%3D%3D\"}]}\r\ncf-ray: a3f4330de91ba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2776\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2776,"size_decoded":3486,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"7211b27340ef99316518e0c5026ca822","sha1":"e692c8d9354d709703a4a60cece5e9ebea6c2373","sha256":"39bfa4d6c658943ae0875321d2b195968b7dc8c512ca9a34955a7b810bc10249","sha512":"e41c4319cfcb1e4af2b65b4e0fe40db0b715039d5745d56d31de12a81bdf99f662469327776562d50efe1cd6726b01ed5cdac5295f336bc610ec6c0a40c48eb4","ssdeep":"","tlshash":"c7515ed33e078144fc167b7af795ff0bb157158f9195478a0f68e09301692c62b26b84","first_seen":"2026-09-22T20:45:26.358732Z","last_seen":"2026-09-22T20:54:21.327306Z","times_seen":2,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_2.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.908Z","timestamp":1790110409908,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_2.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"70be-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iruLy8OnrkJchd0%2BA%2F7uldFm2nLlw45EUSFg6QcB2pSYCxNa0nFR52v4YWaOfFiGHkCAh3yYfTAfWgpW5geHQ6XILuftyRMNrUwCirFhTTj%2Fk3t4Mij0a4m46REPWjQdQcsTq8wK%2BQ%3D%3D\"}]}\r\ncf-ray: a3f4330de91fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 28862\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28862,"size_decoded":29578,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"d0cb2cd38c1be56d16ff207c4736d735","sha1":"d9634c71d1effe3147071b310f6acfe82df2b2ac","sha256":"82297a4101f8335af1674905d4e34eb2346b84da1f1d9833fadb4d01822dc889","sha512":"66e165847ed37b246252b6ffadf7440734f88b78bc7f8f4b6f554b74753c8d3e44fd97005e8c02f7db22406bf110457413f5bc0d85ea3171be60594d0b6c50a9","ssdeep":"768:GPW7wwbue+kIMoucefWfndvx0CW4YEr4p/3HlpiEkbm:GPW7F1+kIMLBfx4YEr4Pki","tlshash":"bad2e1a73afaacd0d7bd6ab41d53d7201a7d19f1454abf40a98879901339ec0c6ee134","first_seen":"2026-09-22T20:45:26.267797Z","last_seen":"2026-09-22T20:54:21.327983Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/mortgage.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.924Z","timestamp":1790110409924,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/mortgage.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"dca-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Aa%2ByMILyGpHJN3zel0pKbJmrX2i37FJHuOsESTqJt8I%2FNu%2BNAsnBg%2FQ%2BxHHeU9Tvl%2FLeYVkTMSfxegHa%2FwW%2F85HA4GwF28ngPfiPFlQnqD%2BSoh3ZeKb95%2FgFUMupo%2BU%2FZ84gZkq4Hg%3D%3D\"}]}\r\ncf-ray: a3f4330e0951a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3530\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3530,"size_decoded":4260,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 96x96, components 3","md5":"d9eb53502033af2ff6fec64dce9732f8","sha1":"1eb3cdc035b53244d6dc2a6d2b3b4fd940ae640b","sha256":"f8181cd580b1373cbfeaf0a207adeaff669208fb5913134a222d0171c986acf6","sha512":"0763a2806eecbe83a019473d30dd833b098500268a8360bd286d974459417a0f67ed6288b4830858c97e76028a4e2d28cfc5a5d812085c3cf0b1e118ca68d6d6","ssdeep":"","tlshash":"99712c1cb69dc9c2d70e76b45f7636c53119ec6d85cbd2051df6203944e13ea4c1ac6b","first_seen":"2026-09-22T20:45:26.3085Z","last_seen":"2026-09-22T20:54:21.328942Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_5.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.945Z","timestamp":1790110409945,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_5.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xZngyu0%2FYmyo7gtFPSYjD%2FSQTTWmtshPmDUqQPgi40r2gLvsyKMJE3vRvKGIS0rCx%2BXIJ7uZ4GtVvIhp3WTqCtElDe1j%2BKGg9TjIw4bapNPkTaDT29nvz%2B1KGJ9dViEPh0Y65q2ytw%3D%3D\"}]}\r\ncf-ray: a3f4330e2969a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33514,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"9d07a9a98a0602fe97be958129adf2b9","sha1":"a754389aae74e5fb8d2a554ea5d59103c67a35c7","sha256":"b7c331e5fa8f04b5693521d5425af497471e7b9ffce0a8d7c5f1bca77ad2b61a","sha512":"6d49a19dc8747388fba47cf82ca297b5d8b824ec4b80d5b4c5fc044c9c8a9184a09f2e927422ed4a18f05138ca5f23c062e5573ba5de510837a5e789bbe4d0e4","ssdeep":"768:Z7GRZNxJxlFJiamXIk683FJOcOwQiTL+YjQYv3OlnW:YTbflIIkH3F7h+YkK3OlW","tlshash":"07e2e07748f91d80f28eb579221c0a2c2a8358547b5f461fb49ec09ca33dfd1ea1a637","first_seen":"2026-09-22T20:45:26.343087Z","last_seen":"2026-09-22T20:54:21.329653Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_35.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.023Z","timestamp":1790110410023,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_35.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1173a-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RniW5OAL%2Bt4Vj6WVawttuktWuIEQ3iSpU8ORGfVz6AtGrL6TLx7UUdDF9xhVb4nzHzPiWvW5416rQVdeU%2BC6E4TwHPnnPtg41LN5DKn4kvz59xoKBpSYQmQXZTK7MTraLmNSMGONQg%3D%3D\"}]}\r\ncf-ray: a3f4330eb9aaa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 71482\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":71482,"size_decoded":72195,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1164x388, components 3","md5":"c25ead709b93e42b4502ea6974bb2309","sha1":"8efe82ee4348bc940d5ff645003cab03d14448dd","sha256":"92f9dbe97ba5dd807d8035cddd10f2dfba86858a82b0589335bebcc069ab8e0e","sha512":"255eb5756b6320315940b4bb0322d3190954ae925f37c51d0f60bdedf12792a9002d5371913c05940d1d514fe1f902e3c811c27c091b13dc623d125abd80de5c","ssdeep":"1536:Raq7uQNax32iwV3Vp2slm0IOGvqTs2vjECcN/zUhWUO6aw5:Z7Daxr272em0MvFCjlt66d","tlshash":"676312763648699cfd5e9d630343538ec107b15da0c1f6a28d51e07aea9c38baf8e093","first_seen":"2026-09-22T20:45:26.321601Z","last_seen":"2026-09-22T20:54:21.330365Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_38.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.027Z","timestamp":1790110410027,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_38.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"612b-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RqTwdv9rZhujytzvG4bdE6Dh2nbnUNugwpN0WQ5WuHVfO73V18462SZEkayu0VWtRhcgv0fP6xEz3X%2F%2Bkt1eAcbzZ3UdP7CMGz2GWUMWMV4vcVqzdicexWmaEey1l%2FELmCPuFILGKA%3D%3D\"}]}\r\ncf-ray: a3f4330eb9aba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24875\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24875,"size_decoded":25589,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 399x399, components 3","md5":"33cd41280e82810e2367425bb78cae70","sha1":"b5e161d2313fc36282bc634ab02efe1ea7132c5b","sha256":"74eb63a8ce2610748618650d994d398483c766be884ebc16a17f2e2ecd63f851","sha512":"1362942e371728af369488b22782136aaabebd34c90be4d926b6e2b86df752da557ce1b6910c97e7d3ec695b286a0fe3e3f133adcaf448a95a197324a180f1e9","ssdeep":"384:smQNeCsdH77BdpnBRVxPFC1di3IyRirNyv17nzFcn+Xn:lQTeH77BdvPx4ji3IairNytbmn+X","tlshash":"bab2e0035733e772ec1c0ef5e718c36261215ea5c09c9b16b80dae5d9b88167aba96c3","first_seen":"2026-09-22T20:45:26.288894Z","last_seen":"2026-09-22T20:54:21.330989Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_46.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.039Z","timestamp":1790110410039,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_46.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"23ef3-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3Ua5REi5%2FQUVtDD9Txd6bCa0oFhqJY5Q3zmXLECS62NfOEFiDOw%2BxpnR4MviXExYat9vTKqQQjd4wPKQnGK0V4FtnDXNN77acnCAUqsuhtiiZtPxoWqVqJDq3Ku2Y9HP4La3jOXrCQ%3D%3D\"}]}\r\ncf-ray: a3f4330ed9bda0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 147187\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":147187,"size_decoded":147901,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1023x341, components 3","md5":"2718ed051c9386d3e48a18ab44546d3d","sha1":"40118d5185ac2ee3058823184fc16b4630305573","sha256":"b3ca877ed69aeaa9e38a68197c3381cd00dfadac78b2c75e811b51d3c4978010","sha512":"a15e6876ce52a43d5966aebb1f183379f2429241b40ec95332ad0288c9a7d0b35431bedc969be4f471199809884f80097e20c5186cd947be9342acd64fb30763","ssdeep":"3072:VgMZOjspOBdHSSbMUZR6Y4vBMIGqTuUIHS5jOXp4E9QsrIaCb:DZO4W3OrPZKRHSROZ4E9QsrINb","tlshash":"f5e313759caa1c52b2dc07dd8e0ea9b40d39f3c20578f39763a35c8dd3a2976a7c0486","first_seen":"2026-09-22T20:45:26.351893Z","last_seen":"2026-09-22T20:54:21.332088Z","times_seen":2,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_1.webp","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.958Z","timestamp":1790110409958,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_1.webp HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"532c-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0VIcjeLpUGsz5qiptXTdkCiFkt1fQNW%2BFhLbEFYVYmQqrgest8TF636ZS4hESCsJaJOPTlKhmWBwMqZ9mYmKCDibPGonQ5PYOyQpaO5GCKZAFE6xggAaPAWrRTvndXT8My%2Bmu4LfYw%3D%3D\"}]}\r\ncf-ray: a3f4330e3974a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21315\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21292,"size_decoded":22079,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 256x256, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c4d5d1efd84731cfaa51324c51017c9c","sha1":"d547ee76e26b5e321a12aa60d293e81b05e37c81","sha256":"6982a3c3ed7c29ff0d7f783279d48c337bdc717ebbf50413f4ddde8d5b8739e1","sha512":"02323eeb46d301e96a95e3c35c9280c02e5d07ecfce4eceb9de681a74c4d4842851b9614a0b7cb439797e6a61e9b0679ab92e712dd99301d54db0103e6baaf3e","ssdeep":"384:UdBSIK4JdhHyXuI62f8eAQfbLuyWpCkmKfyYayz4lD5TZgipoUDsg:S+C+uI62UeAQTiyWA0qYaycBeUDsg","tlshash":"69a2e03dce974db4c4afbd2061a5c5538b216157cdfb4803e2a30bb3d7e9604bb1aa10","first_seen":"2026-09-22T20:45:26.315379Z","last_seen":"2026-09-22T20:54:21.333202Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_36.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.024Z","timestamp":1790110410024,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_36.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"dc9e-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nusGT3Hk%2BUTIeIEIzt3yahs9znqUmd%2FV6k0uG59F00YFElPMHCQnWd2F%2Buw8Kw1VIR3SICLQZhmtYAA0bhKdsul7blitaHixcZ5vRPLZTKJ7ULXYwYJ8QR%2F%2F8jDwQiVW3LLDEfGmcA%3D%3D\"}]}\r\ncf-ray: a3f4330eb9ada0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 56478\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56478,"size_decoded":57196,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x499, components 3","md5":"9bd0f15c5c6c7b0ef70f504348481f65","sha1":"252cbad6d52be1acfe1353e21675bec850464659","sha256":"60bb0693cb641bac433b955c39407c15b18a8052467fb8a38055f1cad20d5bae","sha512":"501db0205df40c4aa5991cf17b85d91a8d9bb69d38ab5e5baaab59b09e82476b26ee5f3626152bb7bcea879d56d0e4fed940416cdfd728f95520dc7275b0233b","ssdeep":"1536:YT76WHtlUkcGYxkmsNTiKiGooiI9cck3XFL:YT76WN+kcGiQWI9cck31L","tlshash":"3043e06103669305ee2c47b5bf4fb2a494325c8e552a5803e34e0628ef7d3f8665e8fd","first_seen":"2026-09-22T20:45:26.328211Z","last_seen":"2026-09-22T20:54:21.333852Z","times_seen":2,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/5a3afff5-7d23-4b4b-9709-05b5fd480b15.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.047Z","timestamp":1790110410047,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/5a3afff5-7d23-4b4b-9709-05b5fd480b15.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"d625-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RZMpBLTYU2wSkFFYrAcbE73b4hmVQD%2BY7RsI5jDy027oVQPtVun%2BQP0Jc8hMWCGMz1NMa8aKnLPRBo6vYiGZmDTMZoatOWVxP4xkw7%2FTTd0ZrcfA8Ife2kS35QKuqXxc1IUP2SXCGQ%3D%3D\"}]}\r\ncf-ray: a3f4330ed9c3a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 54821\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54821,"size_decoded":55534,"mime_type":"image/png","magic":"PNG image data, 281 x 260, 8-bit/color RGBA, non-interlaced","md5":"32221b20e1326df761e1e7591b6c053e","sha1":"1c1154dd1cfb8f1bd497da574d59c9381801414d","sha256":"a159fe4d206cbc49910a84dd9d8e00f4b5501cfea8f0ee07884dfc535cb7658a","sha512":"f09358f5a6d415ed812c5d87a75ef9bd66384d59b48c7616e227a65c96f9f0e5074f6e41d97373d4c6a9a68d84a133589ec314573bbf3ed4477ab92697b74b4d","ssdeep":"1536:+8mWLM4fmXnQ/uWNkBdCfzLD8u9uSSrpgGmaA6cVKurr:+8B44f+krv8uUSUM0cQir","tlshash":"9533f13eceb6237e0845c5169de57be256aa6bb4a782dcc4103f634c413179f3a584c1","first_seen":"2026-09-22T20:45:26.32917Z","last_seen":"2026-09-22T20:54:21.334888Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/109cdebd-de42-40a2-83bc-c33765587bb6.webp","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.998Z","timestamp":1790110409998,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/109cdebd-de42-40a2-83bc-c33765587bb6.webp HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1df0-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/webp\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bPA7nD%2BzxxcobtSucw0r4jVjSUW0rFIqHl0BFNXU0zXTt2VzcrNUISEVtQdR76HjmEfQHn%2B87RBAGn8CIXxIpJ9ctbguFlyYdA1ER0SrSZlHMqhcpkHLNZQU9lqcUvSlP1NR49SMrg%3D%3D\"}]}\r\ncf-ray: a3f4330e8997a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7363\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7664,"size_decoded":8126,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dd5aab7bed09d1b4bddf121cb45328ba","sha1":"1ae213c70b1b030bc10e17fa9e4951233fc6019d","sha256":"7cecf79e8ebea5bd3d9b34adc608f9e39bea87ab5a736ec66e933504167d8eb0","sha512":"356202fa841ee9b28ba94cf9fd0c712eeebc38aebdcce8c55d932fd4b8dab30530b98b9021013d3799d108696aaa9f99dbb0438166a8fe4610bc95c00d370c35","ssdeep":"192:fwb2pOkWn67a8SCam6Jt/lW/qVS/NgSgPvcjhKNx4:fwb2pOj62Fm6DEx/NgSgEKNS","tlshash":"67f19ff7d2341b84c0442478b5931bd5e63b9c1ee3672e94e05e055dd21828a6e2ebce","first_seen":"2026-09-22T20:45:26.362159Z","last_seen":"2026-09-22T20:54:21.336151Z","times_seen":2,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_47.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.041Z","timestamp":1790110410041,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_47.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5PJOvGQEceYABmf8JG%2BAl72sOERRLwLabGUkq9uOtJIVb32mr%2BCut6h5g6cGSZTG8MvBhqfg8tFVN8kdZKYmcGlHDtP8FfFXBXAzbES79eKYQ86%2BQQwMIedEuany%2FM9dJICgwZZ%2F%2Bg%3D%3D\"}]}\r\ncf-ray: a3f4330ed9bfa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33516,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"a85d576ae0e957723a8c0392de2e898c","sha1":"774bf261996d61ce278df5f8f7567ab1ba6232f7","sha256":"a9e70c600c0aa67c447a5c6a917a0f37ef7e5315a694ed48f1d2e03520dbbfd6","sha512":"6c7fd526cc4940ffc4d9a811b9d2d9df2cccb781da18649b19f203f079693fcb6dd9d9ed3d98a4eafd37d7f7fc0c49c4b61a50b52b3925006a0be269907d3340","ssdeep":"768:8tpYLHtMD0Nc3eDoX1WZPZvJzCgDE2+SWxLU7S:CwtMEDeWNVEPW7S","tlshash":"d3e2f1a5038d6b5be1292f30ec09c368db0f9c3b2a2c161b768fd65d17247c4ed54ae6","first_seen":"2026-09-22T20:45:26.289948Z","last_seen":"2026-09-22T20:54:21.336871Z","times_seen":2,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_49.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.043Z","timestamp":1790110410043,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_49.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"300e-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sa0C30lz0RQHa0467FmR8luuPeol1RVw94zlg6Of22GVUPCbtYsfQeJxIPzHP25%2BHPXgpf0IE9nrQo4DTJ3lmQtDH0TRy7rdNvT7loXrw6VEhDoUW3Ebbb7PGaROB1%2F8ZZNCTeF8Ag%3D%3D\"}]}\r\ncf-ray: a3f4330ed9bea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12302\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12302,"size_decoded":13014,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 399x399, components 3","md5":"e221a130f4d2ff59f14c7cafaba07ee1","sha1":"ee8d3ede50e25ff252e0cac20267855b2f5ccd3d","sha256":"a11afaa29bad93877445405201230b814b3f97ea54b0c613d4e4042a59fcb859","sha512":"84d15a870bf9ba2c63928b265f201a03b85e473598f3732ca9aeefa960059935bedd128356d22b8f278673f33901f087fb38bed282eb095262912f40a46837a0","ssdeep":"96:X894vFm6/2dgLMnYdU5obPRnXERmWFBb4slAnBaSvwycrJ0ZcI3RNKh/:sbaYgLj25OZUAWHb4slABaSvwyZrhC/","tlshash":"3b426e614a4d46c2d81e37b59c20d711a6367f22d6de97a7f9dd842c3f1c0b9aa880c6","first_seen":"2026-09-22T20:45:26.25339Z","last_seen":"2026-09-22T20:54:21.337853Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/vladtenev.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.899Z","timestamp":1790110409899,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/vladtenev.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"e12-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XmQIoy42bQO81zqjfSDEqt362KZ37UNs175dlbOdrqDFGLZJ0DBs3DWn0KOGxHkeXg%2Fo92l%2FqtEc7%2FTImcRQP%2F8TnCCja%2B938%2F8Zj6N7txtxJR%2BGDr%2BkWRkOMVlNm3wmmJlecbUEzw%3D%3D\"}]}\r\ncf-ray: a3f4330dd919a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3602\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3602,"size_decoded":4324,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 200x200, components 3","md5":"7e11515c7f07ada37d166b8328c667d4","sha1":"3fafbb704cebc552448250914ea68f6a6b3897f9","sha256":"58953596542a608808804bbe7336ca33527f372d33f43fd7195d2ea6990837dc","sha512":"0e163d407f2e9f410dc1938c6d795e4ab810e6f32c529c6eeadda2b86ff64522f230f1869f08845d2e2ca9389bcee6697b964fab3c286ff7c740570b281d403b","ssdeep":"","tlshash":"5e715d8c77a5c4e2ef3ac1b5d6b86e201f028c43e574624d6703e949eef61d4c661f64","first_seen":"2026-09-22T20:45:26.346401Z","last_seen":"2026-09-22T20:54:21.338904Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/nD58-PCn.php?s=%2Fipfs%2FwA515KIszW8vSvETbspBUAb2cb87241434924ddb834d6c3538ecb1%3Ft%3D1790110409820","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.910Z","timestamp":1790110409910,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /nD58-PCn.php?s=%2Fipfs%2FwA515KIszW8vSvETbspBUAb2cb87241434924ddb834d6c3538ecb1%3Ft%3D1790110409820 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript; charset=utf-8\r\ndate: Tue, 22 Sep 2026 20:53:32 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0Qe8YVBQPbn6h2nZCuhNYQC9GFk0t4bAPBy4ml%2B3WMb%2BnQ%2Fr%2BLqDaNr1HvI3F5T41uo8O122SPFYtq5bZoCtpJlvrK44xYP4XWluQzFZE7u7JO0XpQzEsGYT77KGSMOzYf%2B7Peueiw%3D%3D\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: a3f4330df92da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":645585,"size_decoded":124412,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7b8623999684fc94e9537761557ba0dc","sha1":"931dcb290564b74ed3611eb5c53b9800e302e097","sha256":"990ace56667f47ce3fe1de915149ce2ba88711c825466cda62e3a1e94ed576c9","sha512":"eabb3d98db3cdeb624f50d38a89a38b3825fd3b532666b3a09ee5277ed0a55954468e0f8d60ca1c5cae701ba1f6de28e649c338825cc35ba3314deaa7e947439","ssdeep":"6144:ch5gDwrq9NWCEiox3Ti/1gFQZDeoV5oMPNFppHSyyA:cs8q9NWCEiox3Ti/ESVPHSyyA","tlshash":"f0d4cbd0b34a56bbd8d6b2b7043349afdfa82d06064b188bd2e7dce4725470791d89bc","first_seen":"2026-09-22T20:54:21.340015Z","last_seen":"2026-09-22T20:54:21.340015Z","times_seen":1,"resource_available":true,"data":null}},"time_used":2234,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2146,"receive":88,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_14.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.965Z","timestamp":1790110409965,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_14.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NHQklOaYybAYi%2Fbq0oxxtYs9GOsPi6QBzo1rYaZ5u%2F9rmyjTfMTAcjNFEAJC0gOwgrnvOiI2rQNw7ia8gv1fAkLqXq6kyxTbmxtGN7zIL13l37Fq22Ay41%2F6hY%2BOLAWNiHkLYj2NpA%3D%3D\"}]}\r\ncf-ray: a3f4330e497aa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33512,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"a49d5ebf62b8036e2c1c74c9d233a1e9","sha1":"5afdf6977a6a9fe51c23d5853e6e3ccd1180dafe","sha256":"f472768444e46247d3d0ac9eb93f7832639b62026075c1c1ef3e4aa82014e6a5","sha512":"82827c36356140b3466c7fde1afe9920f187b5ec55215644526eabac3fdcdbf3837e65904c2afcf643d82aa854757b620386469c7e458024203c8ded3415cc48","ssdeep":"768:phiAxlXc/IHkEDpIykOSsYxTsGqJIkp9HlN/H1:pYUlMiLJeVqzlXV","tlshash":"60e2e09e136c21bfc96c8b7114d84b39e388d85981d96332b19e209fef191ab4834dd9","first_seen":"2026-09-22T20:45:26.296379Z","last_seen":"2026-09-22T20:54:21.342279Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/9d084605-453d-4278-ab1a-650248f0450f.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.995Z","timestamp":1790110409995,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/9d084605-453d-4278-ab1a-650248f0450f.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"e3b93-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2IKG284U7i2Nlu4CEMYIhyvwLNkAt1bzo0keeTj3ohdXb7b07araAMqkj6KY%2BLu3U%2FeLS6XiRq2kTroED59plA9qGNWRP5PVIeJHV7jQxl%2BB27D1BO75iFy%2FVVQCCds1oV3J3kiGBg%3D%3D\"}]}\r\ncf-ray: a3f4330e8994a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 932755\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":932755,"size_decoded":933472,"mime_type":"image/png","magic":"PNG image data, 1254 x 1254, 8-bit/color RGB, non-interlaced","md5":"6e452e6a5fd64b3379fc077315283ecf","sha1":"49039383485812f6583633eb5de541e3924adc7f","sha256":"9f482de55c9eaea36e092b968972f2d37e003eab10907637c7fb6b14b09c2282","sha512":"9593459a5d4bcb4a7d8c33241abbc260fb6e4e34f2f7862b4bbdf14351883c4ae7971f8f4b5f0560214e187764657a4c41885ae59ce8224e7ec9a4f9360871e7","ssdeep":"24576:bVawGrwwgXdLzM47vdFmKmUJfKdUV0e6f9i8Pd/i:bMkbdvLpmtdK7g9i8F/i","tlshash":"ed15235b8ed09047c01f697845fbccde86d5106176a82f1e3e3c8d260a157dba2eb1ee","first_seen":"2026-09-22T20:45:26.304352Z","last_seen":"2026-09-22T20:54:21.34309Z","times_seen":2,"resource_available":false,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":156,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/4d15af4d-cdec-413f-b215-64266f814128.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.014Z","timestamp":1790110410014,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/4d15af4d-cdec-413f-b215-64266f814128.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"7d32-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tZnIBNp7Q0Zzp8IDRUQP2Qrf8N1sNWMNDpBkb%2FWb5e37LWU8kznMwZuGa5A%2FCRcRWSu3Uzfi1%2FNGYaMgfBtB14xb3JUfHlarnXW4Fa6WRub%2FjhtKi8Uih37RdGDPnxx%2BmRlOwTHspg%3D%3D\"}]}\r\ncf-ray: a3f4330ea9a2a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32050\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32050,"size_decoded":32768,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"59aa1dd1dff811c08ad9fc143cf6d528","sha1":"76ceca38d09560831011e26523e759dae7ec54a6","sha256":"55aa0df3910d28085da799ac3cadd7eae894e51e3f158a8261a4e3ffdcbef016","sha512":"6b7ffcbfe244c73d1a7af75de9a49bea66dce42180516cf147b923b109ffdaf7b7b1c05cc3ad2644a26ba284591edbc88a2d43381cc5be160b5d353a635e2d2e","ssdeep":"768:phiAxlXc/IHkEDpIykOSsYxTsGqJIkp9HlN/HN:pYUlMiLJeVqzlXt","tlshash":"e1e2e09e136c21bfc96c8b7114e84b39e388d86981d96332d1de209fef191eb4834dd9","first_seen":"2026-09-22T20:45:26.365292Z","last_seen":"2026-09-22T20:54:21.343969Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_40.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.031Z","timestamp":1790110410031,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_40.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1ce2d-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0oZhu1PoC%2FmsUsYRe6mNXMczd3F6jUY0SXdv0xk3ZwaonYrOhEW9DKN9OhW%2FmVvvtOssAIMHk3AXeJfXHZdZTTF7yzYvrf%2FoAzDAw6grZjIfEWg%2B%2BYaDhw7EjpSFAetHKSencAJS5w%3D%3D\"}]}\r\ncf-ray: a3f4330ec9b2a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 118317\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":118317,"size_decoded":119037,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x500, components 3","md5":"cb1df2c579c5a501197cfd6f50c1694d","sha1":"3d378cf84a64733b0f4ae224538ca66c0ceb847a","sha256":"f5c5829a4221c1f3692bbe5589c873e9c9de9e03205ef05d4e3a7d0a9b04777f","sha512":"37717241bcc916a445de98dcbeeffea950eff924215c8a5cf5d58aa59b872f44d5381ae781ddc04176fe11906d838e13290d4cbb13ed77a72b3efb13c73bf589","ssdeep":"3072:BL3kpgzc/Jc3oCCz8+YSJbiO97sj8mv9/mAoSUy/AKLkP8UY3o:OomJc3Bk8+YI7obl/roSR/pLDO","tlshash":"27c3123b55159cfec43b943d975af012602129641fcaeff5babf19a9b16030b6e70142","first_seen":"2026-09-22T20:45:26.336496Z","last_seen":"2026-09-22T20:54:21.344612Z","times_seen":2,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_11.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.956Z","timestamp":1790110409956,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_11.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QujxV%2BzfDNgGpww%2FnntfXm47FRof985ebG3ExtGVjcuJnPgKFwWXD%2B3fIQjgc1uQYm3SGJQ8A3VnXgshPFgAH3CsgTP0e6cTsnanGFAlUSDEeV7RwJ3aJR8gWgtyAQhNNOisKqktaQ%3D%3D\"}]}\r\ncf-ray: a3f4330e3973a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33510,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"7916a3d8b9560122da45a1c43a9dc38e","sha1":"cea016822b09f43603afa0b4833abc8e44e9ed6f","sha256":"30b28f5799cff21af83825f7f4bc9b38bb05c4a73af953b79e912ba42209f826","sha512":"e647e573d9e058280c2fecd688e107ef371f9bffafeab8746ddcdd7b0c0fb017ff0a63b012b14616c80bbcf8af30892fc1376f7f8d3e92207f36930c71453813","ssdeep":"768:DCupNnE1eCexTRyZrg6UIXMwYnhU+nCPz80:DCINYjexTI5Tyjh0","tlshash":"3ce2e1fea2631fc2c07d91ba05a762ca27a8671d6cd7a2a9744c485f9f1d04e417f341","first_seen":"2026-09-22T20:45:26.344231Z","last_seen":"2026-09-22T20:54:21.345533Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/9f6e513c-ff35-4495-b042-cb8c58c6ac6b.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.960Z","timestamp":1790110409960,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/9f6e513c-ff35-4495-b042-cb8c58c6ac6b.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"801c-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B8hgjGeD0G%2F%2B43O3VPX512qyEYva7TcE%2BJLrfaqGuKuaNA9VJ%2BXAvS4IjgUVuRsUteNQUEVbH8GaxYjE%2FFazfSr3uQZWNHSPz2VqcgX%2BDGYeRhl0rdtmWrBt55XFM9ph28KhukX0iw%3D%3D\"}]}\r\ncf-ray: a3f4330e4977a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32796,"size_decoded":33516,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"fed5c957d0d8e5dbec9a1b482394a05f","sha1":"b4f62b5f798682ddbe5dec1146bb81a34e1d180b","sha256":"14dc4d71675c430ae03fc0dfff0a3aea8b7a7086258e549e102e2bd58c32f819","sha512":"880b98ef97b610cc49cc66d106cca5548ede1ca38eeedcf7dd19b3059ed554f1cb6fed8667869e2263cff1e91ed844240fefc309ec59cb12b30965d285dca783","ssdeep":"768:23X237aKR6K9cgtMGAIxnOLVnFT7VHuQ5R:GXqWKzcuMGAIxnOLVnrHug","tlshash":"b1e2e16fa7a681d8fa2c4d7d4e4183c65b06ba3811d3cf09740f355c3fd69818e2a799","first_seen":"2026-09-22T20:45:26.318504Z","last_seen":"2026-09-22T20:54:21.279419Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/125f2491-63b7-49a8-aafd-0dc0e18516cd.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.000Z","timestamp":1790110410000,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/125f2491-63b7-49a8-aafd-0dc0e18516cd.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"19f4-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=osI1nyhgQgq7W73Dh3jiT6Q0a3AJ0PekefIYxhDRCmjb54gm2oxlTLb5DKE1H1AcCcyoNlRxWlFYWwNZVbsrHT4UVhcNobeggT9a2RqCkofBquJGhVUdl932Ea3Hlmt677rOdPnGlw%3D%3D\"}]}\r\ncf-ray: a3f4330e8998a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6644\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6644,"size_decoded":7351,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 256x255, components 3","md5":"780e5842f2a5ca98949916ffa1bb97b8","sha1":"df537a1d0e8f031bb6bfedd57d513cb8e2c401f8","sha256":"1e1d1eae9806829794cdea7ffa707433688f317e49ca8db6d5dba83420c19b2b","sha512":"d2507ddcb54191f5958a4cc5d27cbcb212a2a52643fbf6c37f898ee023efe60d2e474ef72bfa4f6d4142078f37a8f0c898ff0b5634aff0c842c04f220c814382","ssdeep":"192:Qu4pQPdIOvDUBruDK7O+jBiuvczG3gFCEUgoN2hH5kgJD:Qu4adFDUBp7OkvcNBe2/NJD","tlshash":"3dd18da5330ac611d6141b7b03263a0bc7a38c57ba9c2d668dcaba5397551f22e12e9c","first_seen":"2026-09-22T20:45:26.355262Z","last_seen":"2026-09-22T20:54:21.346172Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T20:53:29.473Z","timestamp":1790110409473,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 11:29:32 GMT\r\npriority: u=0,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xxPS0%2BIXimYRUVowFRXOSbyX%2FSgoDgTX1LauqWSQWyeABua%2B9z4pyklqqSrRFaVT1jZ183xGKSBykE33k7nqx1NKtUSRQlQjxoaasBvGF1eD1xIznzFfnP96syXE3o7xnIL8JtbU6Q%3D%3D\"}]}\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncontent-type: text/html\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a3f4330b6869a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":607088,"size_decoded":33658,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (23142), with CRLF line terminators","md5":"cadcc3a109f554f085e2f4ae17c51c91","sha1":"929ea206882f2c43abf86518e67b9e7d68d024fa","sha256":"97aab122433df5a5bc936a940c37d649ea44acf61dcce61dd49f381337f98ca3","sha512":"4a5aa6fda93b2da0f23c7e4326ed4595534ac1dc76e65ffd212a14d902cb3edc6c52e1906bdd71f3481c87bfdfee3e41b7301f0c6d6292b359ba73c711455fe5","ssdeep":"3072:99WIU3PeFqcenSMF+GwZdinKbaM7sLW+Kw7jQVr6P16m:9UnLF+GwAKba3","tlshash":"27d4d9a84261733f71a3c5fcfba6a7e9914aa70ccd27d849e2fd535625c7cc0b522908","first_seen":"2026-09-22T20:45:26.271639Z","last_seen":"2026-09-22T20:54:21.346687Z","times_seen":2,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":7,"connect":19,"send":0,"wait":164,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/js/preferences.js","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.888Z","timestamp":1790110409888,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /js/preferences.js HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 11:10:24 GMT\r\netag: \"10d-65b97b6b88800-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/javascript\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ht%2BQToroNwOObos72588cONOTe%2F0YDk1RTXsiKzgxxWpKw99GnrUt7yvs1DiLo2CPILuABYegY7G9YTfIrzGhzpibHJsDU9Rp6VNGJBtT1odAcFGcpD2JBcpk%2FB%2BCyA3vqsbEecamA%3D%3D\"}]}\r\ncf-ray: a3f4330dc907a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 206\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":269,"size_decoded":979,"mime_type":"text/javascript","magic":"ASCII text","md5":"63a4d0ccd3d1d0dc81b866c876338153","sha1":"76d16300763a313b46dbfdfd298786f9bda1fb61","sha256":"985ffdf520b81b17989211d971532a0cd4974bb6fc859e232ecf7e001ac4303c","sha512":"c096e6843392961efcd43f30a77972724f3dc261fb1db46eeffee6170deb88f859a602ea67320c47274366a0ba8aff704b3d1cb505b5b85b0653d38e180988fc","ssdeep":"","tlshash":"2cd02bb976493673418620fd781823a8f6274025312f5ad8550e5f1cf9e8fa9a282cdf","first_seen":"2026-09-22T20:45:26.263444Z","last_seen":"2026-09-22T20:54:21.347313Z","times_seen":2,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/meadgod.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.895Z","timestamp":1790110409895,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/meadgod.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"23d4-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xgZVB2KzpJk3JHzwqwpXYcAH3Pc8WOIeVAwN0uvUcvianumA9KrycxNP3OKvTwX72yk4EUv%2F%2F%2FUCnoumJGHvy5w5i6t2iYaBjLWdCXoCRywfv2xsG4ts16oTShyuT%2BSqnx%2Fb0cp5Mw%3D%3D\"}]}\r\ncf-ray: a3f4330dd915a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9172\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9172,"size_decoded":9889,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 200x200, components 3","md5":"af25dd470724b087caa1a45184060b6f","sha1":"d5e5ced4b257ddcf3997aebacb36e89eb8dd2fdb","sha256":"ea73a96255d0723dda60f49ced07795c8179890d5596c1efa32e022b4397c981","sha512":"b553fd225912aa9ede343d2c49284e37e68244e17498dd3109c3b2a1a2691374d363c6428cf1370727f5823783fbec30673a3c8cb39052931e3270f8b126bdf1","ssdeep":"192:Uzp2nM+X2pn7yYK6XNzLYg9f+r1bd8181E2dtp2:Yp2M+q7yYKuNzLYg92x2yttw","tlshash":"3f12bf570e2a97d3fdfe543368201225cd91756786cc2f0c9e11ac30b4973e2616d35b","first_seen":"2026-09-22T20:45:26.338972Z","last_seen":"2026-09-22T20:54:21.347879Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/727e08c1-2a0f-4b92-af3f-55808b3d1d97.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.950Z","timestamp":1790110409950,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/727e08c1-2a0f-4b92-af3f-55808b3d1d97.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"a00d-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aERwBl8R4r5fOlJEtw%2BqvywDwE9zEVRxTzyBVn2MuViwGuN5FSyN8jZuARNhRpLbIhQFFXQ%2BqeOyp5GBhHrqfdLFfoeT9wxUcP65YUtfZcwXhz%2FFFdzIfSHK7hKV8yqbL%2BeZCrkfGg%3D%3D\"}]}\r\ncf-ray: a3f4330e396ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 40973\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40973,"size_decoded":41689,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2], progressive, precision 8, 400x400, components 3","md5":"85653e5d7c59e5a1a3f9d3b894e2c9fb","sha1":"f5d2a23fab4725c55e8e5c4a2d8446fddfd696c2","sha256":"8eca40449f70c1b79c1debd59b1dc0ae4fe5ac9085a5fdfde7f4e018bed5b58f","sha512":"3fa6f20eea3ab75154bbc1d4a16159378b4747b9289739350abd59e556ad733be09fc1edd86525e787676003828cb182008a8a57b96513fb1eb89ba2efadd3d0","ssdeep":"768:oJdjKwsEiwR6htB3Pvt386RXI8y7SrLzJTX1Tv+Vejk1Mw7SFy83KGScW:oJhfli7ndvF86tIYL55Pw7Sc8c","tlshash":"6c03f1a21bac1109e42dd37990e377fba7f91f6378140e9b74838cfe7f65020885a542","first_seen":"2026-09-22T20:45:26.303048Z","last_seen":"2026-09-22T20:54:21.348428Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_37.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.025Z","timestamp":1790110410025,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_37.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"300e-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Fe%2B1iGq6Sdz0TnJo7%2BdQJy%2FiugR%2BLsHCGWRgyOHSq%2FVuKE1KcS2XGrhkiqA5RoALVJUTj5l53DOrQDT85TZ6awe8CjzcbrVREBhSdnos7Bky4HCLBewCo0TrmfJjQlqjmmkzZ6KQeg%3D%3D\"}]}\r\ncf-ray: a3f4330eb9aca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12302\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12302,"size_decoded":13022,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"199ca216b40da641342af2cd0a3f0ea8","sha1":"af3c9b1bc1eebc1b6eaed63db0efc9123534c6fd","sha256":"cda858e04baf73342eb7286a59d05471671b4f22afd243fb8a65da478a03b073","sha512":"87f35544a7066b981bc917585e9997e0131d8fbd6c078352420a2bec626f28c9a7e6ff56333ee9d11da561a2c899e3e352db555fb98b791b66f8069f7fc44b9b","ssdeep":"384:ssWf2WaNBWBzk7pGauCT9mIVZgyiIB4Yjsl:QuXqQpGyxVZJP6Yji","tlshash":"9242af03ff144516decd7f30aa950bfa9b1a6f22fd619f09b59d9161cf6b040ce28941","first_seen":"2026-09-22T20:45:26.23438Z","last_seen":"2026-09-22T20:54:21.348925Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/fonts/universal_sans_display_550-s.p.1d_5desmfkuzx.woff2","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.852Z","timestamp":1790110409852,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /fonts/universal_sans_display_550-s.p.1d_5desmfkuzx.woff2 HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"9980-65b91be56a980-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: font/woff2\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3dFoPt%2BpL02Jgn1%2FcpM4dSdahibdiJ2AAGagspo9G1%2FkTuq8BWIra5YQE8CeVkI6lww2zAxFzYLlmnorD%2BclynxpFWXerDXhtOJGl2MrEDkZ10deE7kNzmljGPGxrPqnSMZd9L%2FmYg%3D%3D\"}]}\r\ncf-ray: a3f4330d98f6a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 39324\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39296,"size_decoded":40097,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 39296, version 2.458","md5":"148969f2a86deca3bfa672f0752426b2","sha1":"210e2aa4d3d2c114d1e6245644bd118b108b2a3f","sha256":"c461507f93afaf1dd722e764ec3e168752219e12a826e6007d1a34dfd442ebcd","sha512":"2d93f1d1af2f882543e24b9fe91c2a8fab9f33543d183484c48bf6c56715469dfe509a165e807b2ebc56cb32d39c3ae8f5ea28b78dfe4efe0d4ea5cf6f03ec1b","ssdeep":"768:RoNml+087lJ8mlJgKsc6iSj5x5gs90qAQ1xCXVHMHyoh031Sy:Ro00D78mlGK0x5rxAMxdHj03ky","tlshash":"9703022c19865035cf98b328252efe8886c0af5ef545e824c76484b0f5bf28bfd5579d","first_seen":"2025-06-06T16:36:33.172348Z","last_seen":"2026-09-22T20:54:21.349503Z","times_seen":83,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/underdog.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.904Z","timestamp":1790110409904,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/underdog.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"12d4-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KkbzSCNR6qOSfkZ4QiknMgQM6r%2BwVMa%2F%2B2CxhOqcUDXeyatBwGVX9kw9%2Fwkjgta5CMB2xg4M2iV3cTkyO1YCSq9v9%2BHPhsOjCSu6F2ffohu%2FSpRN2j1U2qH2gkacV8lCSGWkenZLWA%3D%3D\"}]}\r\ncf-ray: a3f4330de91ca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4820\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4820,"size_decoded":5539,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 256x256, components 3","md5":"5fd3e958f71b199b81da617d03f9d4ef","sha1":"667ef1acd3df71353ab1e64c7a6d68fef4796c32","sha256":"bb8d28c9cdbcb970c785045dc8d4cfc987c92c0d009412508864492b9b692eae","sha512":"457bae75767d7921d8e55974d92867d9a380e21c7d0f9f2a3509052f40295bac8acb09541d015c111a11cd3e2a3ec1f6a35aa91622b6ba47d3ece6333c07b9bb","ssdeep":"96:emJqiKt7WcyQQgKL6XGHAAiv/N2jZtNeDghDnV4giV9olg1JU:3zKRQNL62Hy/N29e8hjahU","tlshash":"6ba18e2e776245dedc899c321dd93c06354ebf53aec1caa14f8df1321c3369992b9984","first_seen":"2026-09-22T20:45:26.294785Z","last_seen":"2026-09-22T20:54:21.350041Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/img_6.jpg","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.946Z","timestamp":1790110409946,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/img_6.jpg HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"1892-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/jpeg\r\ndate: Tue, 22 Sep 2026 20:53:29 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7KJQbFJGfUXxeJiWtLk8mWTHzBJSdMEJU%2FbZvdKATvAyuJWmuM4sZ%2BeFlaEl5kA5E6cnP9vlU%2FGHrYCoTQZYUIPWmpgNm2bWi8vhQnfErU4G%2Bf9vTnBAlVz5X3eb1VwItloapikT0g%3D%3D\"}]}\r\ncf-ray: a3f4330e296aa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6290\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6290,"size_decoded":7005,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 302x329, components 3","md5":"5cdd64479ed2530d2f81c4987d11bc9b","sha1":"c9625e4d5e007f3998ef7af32313a51b53b2b0b6","sha256":"86820f4b69157cd71d56d45e9bc27c2f9569d4ecbad7e6c1cfe8536ff0a97565","sha512":"7003d741972461312b84da433920b102d3dccc1266cdf9a62e98438887451097c67698bcd07691d99500818a3debda335433394dab1adaf01ef724d518e40d01","ssdeep":"192:9wS51yROLdtBJc6hQV1ITwOtz6PXe4yVp4:9wSKZv+w2mm4yVp4","tlshash":"ebd18e40235e9bded9417a74a34a17e3df36bb1d677a67dad6c000099aa11c18f8841f","first_seen":"2026-09-22T20:45:26.245322Z","last_seen":"2026-09-22T20:54:21.350742Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/25ddb2db-0a93-4e74-8fe3-7edbf8ab4306.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:29.991Z","timestamp":1790110409991,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/25ddb2db-0a93-4e74-8fe3-7edbf8ab4306.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"542ed-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 550\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c4dNdW75gcD7ETfxS9F63DtgogOIidMto%2F%2B1iJj%2FiVhEva5CkY0W6AeFIrECdJKGovG9mJX2SUqxQOR5hZM9Tu7f8bcc6fB%2FDJcHLhWTAGMCM65Lv8FzuxjnH09DSmc5Nl9Nl7I5RQ%3D%3D\"}]}\r\ncf-ray: a3f4330e798fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 344813\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":344813,"size_decoded":345530,"mime_type":"image/png","magic":"PNG image data, 1254 x 1254, 8-bit/color RGB, non-interlaced","md5":"d6930724a40929bc829e0549fabe8040","sha1":"e2e404d03f7f9b2ab4ec803443dc19cb661dfedd","sha256":"9704f47f4e6bc209fa44cf5d426e977f5d0e4d9d57841573c706fa5a7e67fde2","sha512":"513958f1bd954dc95a1f5425c164d689b22afff1d68d8a4768a92d1ef6d4b1fedd3890288aa78f41b4d756d8a1ae7fd954d331153599bd589afec179fe9e8224","ssdeep":"6144:BbEub9IrwTKzzFjoezKRBzR/wTtXD2nQ3v7EDXpWZJTihPFISRBo78mx:BvJMhjo6ABzR/wUngTDZJTihdISRI","tlshash":"c97423e7ee4472c5c91b0f3049e2be759f23d2a6700b225971bda5caf8943e9270712d","first_seen":"2026-09-22T20:45:26.250124Z","last_seen":"2026-09-22T20:54:21.351361Z","times_seen":2,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usepaid-proposal.xyz/images/image_1.png","fqdn":"usepaid-proposal.xyz","domain":"usepaid-proposal.xyz","tld":"xyz"},"ip":{"addr":"172.67.143.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://usepaid-proposal.xyz/","date":"2026-09-22T20:53:30.381Z","timestamp":1790110410381,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usepaid-proposal.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 03:35:56 GMT","end":"Tue, 15 Dec 2026 04:32:10 GMT"},"fingerprint":{"sha1":"59:F3:3F:83:4A:94:AA:4E:50:71:BC:32:98:4C:10:3E:2D:54:CE:28","sha256":"CD:CB:DA:A1:14:BE:92:ED:8A:80:3B:D6:33:9F:F7:43:A3:27:12:68:6C:C5:61:6E:D5:98:E1:97:A5:6D:E5:86"}}},"request":{"raw":"GET /images/image_1.png HTTP/1.1\r\nHost: usepaid-proposal.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://usepaid-proposal.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 16 Sep 2026 04:03:02 GMT\r\netag: \"286-65b91be56a980\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Tue, 22 Sep 2026 20:53:30 GMT\r\nserver: cloudflare\r\nage: 549\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rVT7IJLeOwbTF7RVruV0aDJ4OxlFc086l5AFueeoyRd29vmMxFAxJ65%2B6B5uqEua9sbRHOKY8f%2BnaK%2BU5DbE7fyE385POypwyRO3v9fX3PvRiE8DymNpijoinQOjftss5w27XW82xw%3D%3D\"}]}\r\ncf-ray: a3f43310ea25a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 646\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":646,"size_decoded":1356,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"0fe7ba65ac7ae4076998b3a1648a69fa","sha1":"479ca3bd95df26f90a58e6683602453a87772663","sha256":"d461640712795ae68487bc8a33b0bd88d35d035ce7bf46f843c4fba9e1fe782f","sha512":"04f3c9da71a840d764f94a5c6eea2793700afb7ebbd67b7ca5db1f058ed85dd62be1ec9a786d01b9b57505095f8f5f1e0b8e1b1cc8d1fffaeb7ef42ae586b9c2","ssdeep":"","tlshash":"3ef08d6a5332d231ceca5aa299230400285320a4ab3fb830f06259f20f42cc8bb0a34a","first_seen":"2026-09-22T20:45:26.337753Z","last_seen":"2026-09-22T20:54:21.351926Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"usepaid-proposal.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}