{"report_id":"4de56559-78a6-4fe3-bf72-f0f5e8025d73","version":6,"status":"done","tags":[],"date":"2026-02-19T15:41:43Z","url":{"schema":"https","addr":"safepaybtc.org/","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":0,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"final":{"url":{"schema":"https","addr":"safepaybtc.org/","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"title":"SafePayBTC | Bitcoin Escrow Payment Service","dom":{"size":12899,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"4ec7fe730a07149937bae87853369ecb","sha1":"d6fb58170b73c5370d6c6eb16a1062460e843c9b","sha256":"f672715f41ee051c3482b1dc21acff0f85eb7054cba7584398e1ce7c11197334","sha512":"7150add3c3cecdae9763723d5cf03b4638b4558aee1439039ae835afc9854a8847170b265b57f8a762f5bb3b10f130ab78a2a4047ea79e6495532e9415dc21a9","ssdeep":"192:mOBgVfpoCpYfbI/o4Z157O8uad4vl4dJ1hdD28SPH:2XSfbI/F15q5vq98H","tlshash":"424263a064f62573409380d0fde6af23ff95c507ca2b414572bc07d26fdbc4a8a67a88","dom_hash":"domhash8ef99da18fb5e7ec09c895c3574a155c","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"safepaybtc.org/","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":0,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-26T15:41:43Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"safepaybtc.org","ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"domain_registered":"2023-07-18","domain_rank":0,"first_seen":"2026-02-19T15:41:43.944446Z","last_seen":"2026-02-19T15:41:43.944446Z","alert_count":0,"request_count":17,"received_data":460970,"sent_data":8638,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/background.jpg","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.327Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/background.jpg HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/assets/css/site.css\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:22 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 5688\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:08 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5688,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: \"U-Lead Systems, Inc.\", baseline, precision 8, 160x160, components 3","md5":"1d320b820271e8a89f6f2782016f4a15","sha1":"f8a4950d2ecdeb3cceb641f4db791e168ad1dd59","sha256":"71bfab3540bac427ba69e2f2598637754df268526636b5556501274eb08542af","sha512":"624239d2933582d0d91c3c73b737441834b44f0a080ad20b1416aa0e4c007ab84ae1348236f1faaf3a8ed303e5f2f7066ea7d60260d4e13e5863163c50f102f5","ssdeep":"96:P9EzEC26U/pqs0zHGhhZm0/6Ra1dxFPYxZ5hZDeagq+2+4yW2vd2wOwfUsb0Uy9:P+ZAiu6gI7BDeRqj3yWM2wOw5AP","tlshash":"45c19d2ce75e41207155f0c64a351257c877e2cb57d9498fc62472abebcc2f1ab08a8a","first_seen":"2026-02-19T15:41:46.412665Z","last_seen":"2026-02-19T15:41:46.412665Z","times_seen":1,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":86,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/css/site.css","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.203Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/css/site.css HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: text/css\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:29 GMT\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2943,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"d0a2d8ec1908a66588e4c2c1981497fd","sha1":"c232b2bae07be78226d025a31b31ce438b587f60","sha256":"12e174f02d8f60fe7617f57e792c52e10ae21fa46e7a4801247cd15d4d45ab69","sha512":"3fb170a88b309401890333cba777541cacf6a9bbaaf41a4f87696294e9a625af0fbb3a0c7659bef46c5d18c000bf620560aae9d68aebc5615ce3635823aca4c8","ssdeep":"","tlshash":"2951bf8bdb8270473137aabdabf20351ef6d405386058a7977e972a45f700a85022fcc","first_seen":"2026-02-19T15:41:46.413481Z","last_seen":"2026-02-19T15:41:46.413481Z","times_seen":1,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/steps/inspection.png","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.208Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/steps/inspection.png HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 24571\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:00 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24571,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"2ea0b02c3432a4d22fc0a716c2973bad","sha1":"06e494a17b6b5f4e5fc937ec01416c62f9d80539","sha256":"ba440c285489443e0bc15cce64f0e6607a8b18e77f8f33ecc49ed9f28ebcdc40","sha512":"5faf8361a425d3bb9dad8b304b4e8a66c20175c92547f6fb0456ed385eece068c94d1e9eef09b248f0791450eee804eae7c1f4b1ebaae5f770f84a384a0a386f","ssdeep":"192:WSDS0tKg9E05TRWkicd35GwLkAlA4VOfOPAWBKRMkNZqF6CINuVuD701GmY:5JXE05ficd35RGOOiAWBXSVJYuDw1GmY","tlshash":"f4b29e20acf07081d589b9310ed92142bd7a5a8797526d08ffec9c8f9f20fa64c9f096","first_seen":"2026-02-19T15:41:46.414268Z","last_seen":"2026-02-19T15:41:46.414268Z","times_seen":1,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/dispute/2.png","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/dispute/2.png HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 5553\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:49:55 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5553,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"6873e90aa5460e9735ac67cfa194d9e9","sha1":"e39bb088e1d14860759a49855f3f76cecde21d5c","sha256":"7d866f20113680fe2aabe4ab9c73c715299c33c0f1731437144e9dc3e9a86f13","sha512":"e65dfae702c580f1e6e70eae4c0c301079a080456c14b8ba2406b1bdd0c92ee02f8c9065023884d2fe0a9f64bca75dbf7529591a2c344730d28c5ced1ecbdc58","ssdeep":"96:OwUWIVdGi8zXeauVeB/iEwN2gVTTmDJJXdnK2TLx72t6weqn8vs+xlcUgSVEwMzu:OwUW0dwzeaugNFwogVTTAXXdn3Lx6tbo","tlshash":"b6b16ca07b80621b07a026b751dc33ecf17c62cf11004a9e19f9af67f8a6870c5927b9","first_seen":"2026-02-19T15:41:46.41501Z","last_seen":"2026-02-19T15:41:46.41501Z","times_seen":1,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/dispute/3.png","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.214Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/dispute/3.png HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 4988\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:49:57 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4988,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"1e798cc30b461d17f1018122c22ae74f","sha1":"ef3efd8524cff3448a022ced9dbdf074acb43092","sha256":"b7eda572ae95fed9318565cc5f376776db10b2c6adb6faeb88852f663c2e8e54","sha512":"1fcfb45d0c57027d29991a365ccdb91aeda75f11c8c49b415689b03344a8d71229c46d427f108e603772c054d1f89e3779d1591742577afa3b8c7781c9d7feb9","ssdeep":"96:r+2FWm5Sbh1bGSYhaAwmh+nv+JzmYgiVYtH0V2z8Qspgb/Fsd3xt384fm:r3oVbsgvWyiVYd0EqgbS33382m","tlshash":"eaa17d832bc6a98f164d1fbb3751f05cd67ffa82a2022ca99814bd36de420ddd6961c0","first_seen":"2026-02-19T15:41:46.415927Z","last_seen":"2026-02-19T15:41:46.415927Z","times_seen":1,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/fonts/fontawesome-webfont.woff2?v=4.7.0","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.340Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/assets/css/font-awesome.min.css\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:22 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 77160\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:17 GMT\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":77160,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 77160, version 4.459","md5":"af7ae505a9eed503f8b8e6982036873e","sha1":"d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c","sha256":"2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe","sha512":"838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892","ssdeep":"1536:/MkbAPfd1vyBKwHz4kco36ZvIaBfRPlajyXUA2jVTc:L0nXnHdfRVEAS2","tlshash":"7d7302e63b6c4943e03d6460708abe9f104b3ab42fe057e5c876db7f2722992b71552c","first_seen":"2023-04-05T03:30:47Z","last_seen":"2026-07-28T08:39:50.271478Z","times_seen":524307,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/dispute/1.png","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.212Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/dispute/1.png HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 3511\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:49:56 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3511,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"eb2174a5f66acc4d0359e6357e19c6f3","sha1":"095d8ab0112a689e1804c427483a8becc8647684","sha256":"90e9b50c7e04286c8d6dcce780d53d79be9ad077550e74f570ac24860b3b3294","sha512":"c4b621699d9ef6fd4eee48cab3833d7a8947aff4f49f12db26d11b2ebc550087fe9a0c5434829b74f6058ee095ba2f97457b6752f1b4bf39485d698c5d87f391","ssdeep":"","tlshash":"21716e1589ed6f55c660c96b97d73f248422a9ff8937e761c070b06bf9540256fc4402","first_seen":"2026-02-19T15:41:46.417062Z","last_seen":"2026-02-19T15:41:46.417062Z","times_seen":1,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":164,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/css/bootstrap.min.css","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.200Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/css/bootstrap.min.css HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: text/css\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:27 GMT\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":117132,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65367), with CRLF line terminators","md5":"9d738da51f5eae22c2ac603d4bd23902","sha1":"b1b07d1054c145e3ddf4598780bccbfedf543a0f","sha256":"e8c46274dd795ed343aac01351311f1e6f707078e3f64bd72f2c2a979a806c88","sha512":"e6c090cc611b8557e66ea55fd9f0aae60255edce8eb4598c3a5b6c90213ad9f479a57902c8063ddd1589ff729b9955c353065c5836661351f99e654c553fb391","ssdeep":"768:1yIGxw4vyBQWlJxtQOIRFHlgmyITm8qAlSFKbv2ctBDIq50Qfu8psYvS1Fz:Qw4aL9IRFHlgmK8pPb5qQfpC","tlshash":"5db3d8a0f21031ea7333c55a71d0ed872219a153e66b4eb7f22f25d84f856ca1673f1a","first_seen":"2026-02-19T15:41:46.418144Z","last_seen":"2026-02-19T15:41:46.418144Z","times_seen":1,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/css/font-awesome.min.css","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/css/font-awesome.min.css HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: text/css\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:28 GMT\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31004,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (30837), with CRLF line terminators","md5":"a0e784c4ca94c271b0338dfb02055be6","sha1":"88af80502c44cd52ca81ffe7dc7276b7eccb06cf","sha256":"820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c","sha512":"97149632c15eb33690273abfa78636ad0471999363e11bf59ca61a4de32444e6f299db3b80d52b2e9437c645ec235fa8d3b8c20dcc350dbb9e175f12b3849a64","ssdeep":"384:/Hu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8Z:/wlr+Klk3Yi+fwYUf2l8yQ/e9vC","tlshash":"3dd241e8e54c01d66731c48bff81b36862b6fb3dd5854da9f01f290c29d226522c5fba","first_seen":"2023-04-05T11:31:05Z","last_seen":"2026-07-28T05:50:23.943704Z","times_seen":18610,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/steps/payment.png","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.206Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/steps/payment.png HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 30118\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:02 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30118,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"b54997c96bafb17f5f13d711f246c96d","sha1":"d4c9642f900a822a6df0e3248147ef3ba95671a2","sha256":"3a966adeabbba5db823a05b48c4822b8edeadabf187991ede33e5d11fb29b04f","sha512":"aeff036496482bd16c87d1d498294c3122a64318c387f974be395e22b8652b523238e31e4690883932a881ef4ab7d683cd19263e7ed3821232d24f0ba61a6f44","ssdeep":"384:5JXE05fibC9A35E3Ki+SLqCaN07ykyhi2T:r35fi0Ki+wqCaNWVw","tlshash":"32d2ae5dfdf0b2a4819865712ecc01955eb29adbee816d887acc0cce6f01b96ce57087","first_seen":"2026-02-19T15:41:46.419408Z","last_seen":"2026-02-19T15:41:46.419408Z","times_seen":1,"resource_available":false,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/captcha.php?rand=%27.rand().%27","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.216Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /captcha.php?rand=%27.rand().%27 HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:22 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3425,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"data","md5":"4deff053b76cb789c0da8551aff7b338","sha1":"381bb34754babafb634b5ffaa26c4d6cd5d4798c","sha256":"49925b4a0389eee1dcf03aba992108daac1350242abe52b7f9055c7510fca4b6","sha512":"be5eb9f99cf26bb46c7d307e2cba602984623bba5dcfa0af87d418878d0daf49d51cda124c567d1c37cf0c524b5f2da0661e4d967860aed0d657b1ba7cd149dc","ssdeep":"96:S1827P2TsZ6MfwSgtzgX4jP8rvKQQc+W6/lHRk6C/LxJmI:S182PisoFNgI78rvKQQP/lxk6+FUI","tlshash":"e5a14cc6c240d3e3b7940b68a0b61d1886c6664af0b19ad5cafc864a4a7d6b432bf900","first_seen":"2026-02-19T15:41:46.420225Z","last_seen":"2026-02-19T15:41:46.420225Z","times_seen":1,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":215,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/favicon.ico","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:22 GMT\r\ncontent-type: image/x-icon\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:49:48 GMT\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":894,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel","md5":"8aa5d9eb9abdba59d605eca959fa3345","sha1":"caf26f6c0f0c2b6d5561e54c60c6fdeacf76ad74","sha256":"8edd78c8fb0d8f977b84f794d4b9a1f79c9e0c0c8c05ed8da6c3ba26ba5fe137","sha512":"9ca40f236399b3ee031ac1a2f355294da76af64f98c9266dd9c5daab8da4f77eb8e64dd93800abdbce6ae4561289d0fd6b6f7a905015b851a183d0530a293f30","ssdeep":"","tlshash":"3e110e04124cca72cc743bb44c390994ea4c3a8a3eb0f21f4268b053f763ef33102449","first_seen":"2026-02-19T15:41:46.421272Z","last_seen":"2026-02-19T15:41:46.421272Z","times_seen":1,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/handshake.jpg","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.330Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/handshake.jpg HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/assets/css/site.css\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:22 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 52612\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:10 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52612,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x674, components 3","md5":"5795bd25f5c63dc4c3f6a6a8d52da56b","sha1":"575e26cea2b4ee22be36db817b8e77db0bfe39a1","sha256":"5e92b9ec18bff823d7fc2f2f357ecf991f1f582b87b0729c6864d5089d7f82d8","sha512":"d69516492a517e0cd2ab45ac9a0eab84cc32f8d0329ef2afc6e65f6032f01bbb78674256c2e9a78b43cff5596baa64f09f72656af494d14d4560d721099a492e","ssdeep":"1536:ZEa8s6GfgI/5xsAB2tgItsHZICc5EbLXOSLmslZ3yMO:ZEaQGYCYCv+H5EXOSLmcZCD","tlshash":"bb33023adb105a45fde8523c168b16842b11dec93987e7ab1763290fd1bb23588a9f43","first_seen":"2026-02-19T15:41:46.422494Z","last_seen":"2026-02-19T15:41:46.422494Z","times_seen":1,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":83,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-19T15:41:21.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994; path=/\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13236,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"ec5c3eb5c381835dbb1ed7614654b8b1","sha1":"4d3d4c4ba2bf1da01ed67238dcf7039953d31c0c","sha256":"ba227344344166deeb479fff0f45f93455373ac14a9646e9e139d2f3335ce427","sha512":"327edcc1adc722fc5deb483560cca98bf9ba41a11fa6307e263d16f0d14f37ae0385426f50174612abda3d1bf8272a7d09cb25b19e5f0de1c826c94b8d82a650","ssdeep":"192:3NkrIsisFyRDaT4TETEnTWh9GoTqJYzK0K5P0P00kNzCUt:s0dmwcIvoT2OAlt","tlshash":"f4525f7064d128334173c0d0aea6af66ffa58147c72b920576bc17c36ff7d098aa3a84","first_seen":"2026-02-19T15:41:46.42356Z","last_seen":"2026-02-19T15:41:46.42356Z","times_seen":1,"resource_available":false,"data":null}},"time_used":391,"timings":{"blocked":151,"dns":34,"connect":53,"send":0,"wait":86,"receive":0,"ssl":64},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/steps/handshake.png","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.205Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/steps/handshake.png HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 27437\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:03 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27437,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"63eca8db9c9420366fbbf79a269b4eb1","sha1":"f92a4f3030f231778579d565749de1be2088edb1","sha256":"eb0f117cd0eb8faa93dc89358110ccc2d6cd0b60fa5cd2691a2115c53ca203f1","sha512":"fb0222017ba7c3c8252d24c643e5570ee4374a6995717add9f7277797271a0430af24f5636e8b3dd39d9b9a30f75b6dee6f12dfe2f44a6b9d37c2d01ab475a56","ssdeep":"384:5JXE05fi+35RbqqrUvhtGxK2MuazuXk5N4J7x2V:r35fiCNUhtGxp4uwd","tlshash":"a2c2af92ecb173966499f5301cdd28119db202cba6c28d09f9de8c975f21fa71c2f099","first_seen":"2026-02-19T15:41:46.424425Z","last_seen":"2026-02-19T15:41:46.424425Z","times_seen":1,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/steps/delivery.png","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/steps/delivery.png HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 26012\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:04 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26012,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"7e37dbc9e8aa5e24282d9b7902b34b47","sha1":"ca31c8318ff0a9b70b6051b24357e33b29ec8537","sha256":"84fa634dc805300f8b981c0688a81f33d8021cfebd57c01ab5547e47811a74f4","sha512":"3bfa05b50aeae90b36258e2342e4c3a95004060b75635684e19041bc018594f0baf00a9cb9d4f30d660131724e2d7c19d78955921e6ac54193ee5f4c18ebb362","ssdeep":"384:5JXE05fi0s359UMu3A52DRH8ASrCh7SiWJmXvW9j:r35fiBv5e7SPj","tlshash":"0ec27c29fcf1f59aa019b3322cd921425e652587c8505f81faec56cf9f04fa6cf6b045","first_seen":"2026-02-19T15:41:46.425475Z","last_seen":"2026-02-19T15:41:46.425475Z","times_seen":1,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safepaybtc.org/assets/images/steps/release.png","fqdn":"safepaybtc.org","domain":"safepaybtc.org","tld":"org"},"ip":{"addr":"185.165.170.10","port":443,"asn":200651,"as":"FlokiNET ehf","country":"Iceland","country_code":"IS"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepaybtc.org/","date":"2026-02-19T15:41:22.210Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safepaybtc.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 18 Jan 2026 11:09:27 GMT","end":"Sat, 18 Apr 2026 11:09:26 GMT"},"fingerprint":{"sha1":"7F:C7:17:0E:2A:16:66:09:C0:17:E5:56:1B:66:4F:11:D1:1E:1C:86","sha256":"81:2F:DE:46:1D:1E:99:37:43:63:91:17:66:C4:FB:87:3C:E9:BA:A7:7F:5D:CA:86:35:2E:47:DD:70:91:5D:4B"}}},"request":{"raw":"GET /assets/images/steps/release.png HTTP/1.1\r\nHost: safepaybtc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepaybtc.org/\r\nCookie: PHPSESSID=d02e291a3e398720aa34f67fa8277994\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 19 Feb 2026 15:41:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 28560\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nlast-modified: Sat, 11 Mar 2023 14:50:01 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28560,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"04ad5d6237739bf24ec5fb259ff0f9ac","sha1":"63d219fc30c620e7bc5127ecbc329e0fd5ee1bdd","sha256":"688b7582cf6fc742df375b648eb2da7fecab7927d9fef598e0a627ad108cf080","sha512":"bb37b53b58080411c990beab52be45fd9712ba4d8b5b686aaf71004169eef563849583a6f524c1bec25c6fb780830a4a76bee17182e7b16574725f971567c12c","ssdeep":"384:5JXE05fi/435G0ghEw+1COn0bc6O9/LSyQTmNpFZ:r35fiZuntH9/LSyQTmr","tlshash":"bed2bf34ccb0b16ee548f8300ec925859e266e439580ae987add1cdf5f16f8e6d9f053","first_seen":"2026-02-19T15:41:46.42628Z","last_seen":"2026-02-19T15:41:46.42628Z","times_seen":1,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":164,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}