{"report_id":"56ca3885-279b-4b81-ba89-eebc175ad60d","version":0,"status":"done","tags":[],"date":"2026-07-31T16:13:25Z","url":{"schema":"https","addr":"ttkpay-master.vercel.app/1/","fqdn":"ttkpay-master.vercel.app","domain":"ttkpay-master.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"ttkpay-master.vercel.app/1/","fqdn":"ttkpay-master.vercel.app","domain":"ttkpay-master.vercel.app","tld":"vercel.app"},"title":"Programa de Recompensas TikTok – Ganhe até R$950","dom":{"size":34322,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1793)","md5":"17c97f0d9e06cb3d5f1d12f660103222","sha1":"5a509fe6486213a67d0a57cb09f0cae64ef181cc","sha256":"e9091d882b76ef20e46ea71c3cf98d273054ce654c60f82d8d020bde1b34b4fb","sha512":"c5472dc32930f249a411cec1be88d2de3f2c6c2096711ccba67095e35aea015b83ec8ded91c66cb862c312acdca1dcefa8199a71ac785b499ee8d8e03d636e16","ssdeep":"384:B8RGVtol1IaXFV4FRP42RC16su/TPY/H4HTB4QmKY4t8+RJ/EMKdevM6N8i9Me:GRyaXFV4FRP42RQu2YzB4QgSJ/EMK2Ke","tlshash":"d4f22aba63d311b0741397b46bbf6216316780138a09c934bfdc97a88fc5adc98776d8","dom_hash":"domhashd0fb30b4b2ba086598b124c4fd549ba6","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ttkpay-master.vercel.app/1/","fqdn":"ttkpay-master.vercel.app","domain":"ttkpay-master.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-04T16:13:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"ttkpay-master.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"ttkpay-master.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"ipapi.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"ipwho.is","ip":{"addr":"104.20.44.133","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-01-29","domain_rank":18239,"first_seen":"2020-06-08T11:52:47Z","last_seen":"2026-07-28T13:18:34.094659Z","alert_count":0,"request_count":1,"received_data":944,"sent_data":469,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.utmify.com.br","ip":{"addr":"104.26.10.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-11-07","domain_rank":1350186,"first_seen":"2024-02-12T18:06:21Z","last_seen":"2026-07-28T16:18:53.816684Z","alert_count":0,"request_count":2,"received_data":61814,"sent_data":965,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"tracking.utmify.com.br","ip":{"addr":"172.67.68.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-11-07","domain_rank":1674326,"first_seen":"2024-08-31T10:04:06Z","last_seen":"2026-07-31T16:12:59.098994Z","alert_count":0,"request_count":2,"received_data":2722,"sent_data":1176,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"ttkpay-master.vercel.app","ip":{"addr":"64.29.17.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-31T16:12:58.513577Z","last_seen":"2026-07-31T16:12:58.513577Z","alert_count":4,"request_count":2,"received_data":37040,"sent_data":948,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"ipapi.co","ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-07-30T01:51:08.032267Z","alert_count":1,"request_count":1,"received_data":2495,"sent_data":474,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ttkpay-master.vercel.app/assets/tracking.js","fqdn":"ttkpay-master.vercel.app","domain":"ttkpay-master.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"75e4fe1605ad62418da6f601d5190584","sha1":"bdc528c3c31fc4b84324a008b23b37c6c908928f","sha256":"3c8810ea992efd3cf2e17e7d384851bc3df7f15f30ce36b9d6dc092cbef676c5","sha512":"48ed69b58935600e44163f1d983f9f8d3dbb060dedbb237c61d7eb5a3c1a5b9f68fd4507ce5cad75ccc3f73ea196db8b18189c281dd27408218e6345445cac32","ssdeep":"","tlshash":"9351f1b9288110317a72c1bdeb3ba624366b701f340ed2513a8db6144fedf499615efc","size":2554,"data":"","first_seen":"2026-07-31T16:13:03.290722Z","last_seen":"2026-07-31T16:14:33.17135Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.utmify.com.br/scripts/utms/latest.js","fqdn":"cdn.utmify.com.br","domain":"utmify.com.br","tld":"com.br"},"ip":{"addr":"104.26.10.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8dd66cc0aa8428537cd8258d211afec4","sha1":"366ce9cc7a1cb9ee6908c14bcf18ad0edb7bdf77","sha256":"d58a0651391fea6f2538b1e81138bb458e0418b37bc73b445b34bd9100d67f7e","sha512":"93963dff2b741eeac105a4f00887eadc73699410c74f16da2f4c2b8f579a5d58e008eb64b00e9cd72bf247eff8ba1bccdfc8d665aa9d34743625a88f3ebdb026","ssdeep":"384:4PszukMaPJEukW1pEavsOj7ZudQ9e49d3NURxeCiHDFzIlM+urGc2ecbsbSdla6t:uszukMaPJEuYEsOj7ZudQ9e49d3NURx3","tlshash":"d49298a4f1a5909412b24cbf40b75232f22cb735b145c180a54f5d89345eeeb63e3d7b","size":19506,"data":"","first_seen":"2026-06-23T14:07:39.965421Z","last_seen":"2026-07-31T16:14:33.172038Z","times_seen":116,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","fqdn":"cdn.utmify.com.br","domain":"utmify.com.br","tld":"com.br"},"ip":{"addr":"104.26.10.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"611eeea7da0cd1054700c3faf569bc5e","sha1":"fe61be1a7a8458bfb3f1a30df79ef27e468a3caf","sha256":"556b8a4cd8e1e8e59c24b60546244689b4e6495324957d4827ac1f04912123b8","sha512":"a25017b3548b4a87a8630bf0d748226dd9f2e69329f6bd8b271c3b7763a0195edae19599ebbc3673ab74d13aebfd01f11731596afc04b061679ebe67196f7df7","ssdeep":"768:K1s8TD5fI1b8tWH0FfCmr3GRZklmZZ9quBM5Uq9zKqDBXWpFcZkv/rxToKQ8ElvX:Etnjfz6RYJio+/VoZPKtyZ0A434","tlshash":"1d039685ea9bd45407e388a6c8771136f32c3a3f616a8450d13badd67c28bda7323d35","size":40502,"data":"","first_seen":"2026-06-25T02:39:20.597934Z","last_seen":"2026-07-31T16:14:33.170642Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ttkpay-master.vercel.app/1/","fqdn":"ttkpay-master.vercel.app","domain":"ttkpay-master.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"7c25eb6b0ec58ccceb7a8819fdd63c33","sha1":"b48f42de655655f1c210983260d3e4d3847a778b","sha256":"55b19a0d711df9628a5314cec110c550fae088baac5b71af934fd78ab83d3f27","sha512":"42a8d1a294a30dae0267238235c6b123c81634145dcf363ff040634a151077969c28d448156e7fe1dd4790ee369a032aa72ad2e80c24648f10ce13db3c0cefd4","ssdeep":"","tlshash":"f31198fb314200374f6a186a473fd5b835e716501aa694451b0ec8f2a4bce86c4678b0","size":1012,"data":"","first_seen":"2026-07-31T16:13:03.29962Z","last_seen":"2026-07-31T16:14:33.173711Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ttkpay-master.vercel.app/1/","fqdn":"ttkpay-master.vercel.app","domain":"ttkpay-master.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"1ebb77eeb3a98443d2155f8a5b16f91e","sha1":"ed8c8f18a34af16fc4a214f51098c123602736ce","sha256":"2508445b31d4ee74b74d1190b94e26ae0c610270289447b6f16021084a5c5722","sha512":"74aef185d4759bd22ce0b250cc124312660234d63111ebe35b1159364a3638e17004019343438db208f9be9b7c2557667feb4169494e296886342bdf86c6b89b","ssdeep":"192:6Mz/txACJ3HP3UCb36gI4tgMbs6VEtB0vM62M8i9M7nfw:6+RJ/EMKdevM6N8i9ME","tlshash":"2a02515fb6c321a05fa7613b5bafd20530b640031849dc28be4ed6484fe8f6da5b9ad4","size":8995,"data":"","first_seen":"2026-07-31T16:13:03.30126Z","last_seen":"2026-07-31T16:14:33.174334Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Tracker tiktok version 1.0.0","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":40427},{"level":"log","text":"Tracker.inited?:false","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":29779},{"level":"log","text":"error on getIpv4NetworkError when attempting to fetch resource.","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":6603},{"level":"log","text":"error on getIpv6NetworkError when attempting to fetch resource.","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":6603},{"level":"log","text":"buttonsmap[actor:server1.conn0.watcher17.process7//obj32 class:Array extensible:true frozen:false isError:false ownPropertyLength:3 preview:map[items:[map[actor:server1.conn0.watcher17.process7//obj33 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.7616027027031607] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:btn btnAcessar] attributesLength:1 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object] map[actor:server1.conn0.watcher17.process7//obj34 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.2479027370226271] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:notif-close id:notifClose] attributesLength:2 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object]] kind:ArrayLike length:2] sealed:false type:object]","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":7984},{"level":"log","text":"response for 6a6988b8708d497b4bc1408e: ","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":20281},{"level":"log","text":"buttonsmap[actor:server1.conn0.watcher17.process7//obj36 class:Array extensible:true frozen:false isError:false ownPropertyLength:3 preview:map[items:[map[actor:server1.conn0.watcher17.process7//obj37 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.7616027027031607] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:btn btnAcessar] attributesLength:1 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object] map[actor:server1.conn0.watcher17.process7//obj38 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.2479027370226271] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:notif-close id:notifClose] attributesLength:2 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object]] kind:ArrayLike length:2] sealed:false type:object]","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":7984},{"level":"log","text":"response for 6a6988b8708d497b4bc1408e: ","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":20281},{"level":"log","text":"buttonsmap[actor:server1.conn0.watcher17.process7//obj39 class:Array extensible:true frozen:false isError:false ownPropertyLength:3 preview:map[items:[map[actor:server1.conn0.watcher17.process7//obj40 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.7616027027031607] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:btn btnAcessar id:888e27ef-d13a-8e61-d323-7539cd764f35] attributesLength:2 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object] map[actor:server1.conn0.watcher17.process7//obj41 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.2479027370226271] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:notif-close id:notifClose] attributesLength:2 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object]] kind:ArrayLike length:2] sealed:false type:object]","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":7984},{"level":"log","text":"buttonsmap[actor:server1.conn0.watcher17.process7//obj42 class:Array extensible:true frozen:false isError:false ownPropertyLength:3 preview:map[items:[map[actor:server1.conn0.watcher17.process7//obj43 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.7616027027031607] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:btn btnAcessar id:888e27ef-d13a-8e61-d323-7539cd764f35] attributesLength:2 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object] map[actor:server1.conn0.watcher17.process7//obj44 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.2479027370226271] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:notif-close id:notifClose] attributesLength:2 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object]] kind:ArrayLike length:2] sealed:false type:object]","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":7984},{"level":"log","text":"buttonsmap[actor:server1.conn0.watcher17.process7//obj45 class:Array extensible:true frozen:false isError:false ownPropertyLength:3 preview:map[items:[map[actor:server1.conn0.watcher17.process7//obj46 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.7616027027031607] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:btn btnAcessar id:888e27ef-d13a-8e61-d323-7539cd764f35] attributesLength:2 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object] map[actor:server1.conn0.watcher17.process7//obj47 class:HTMLButtonElement contentDomReference:map[browsingContextId:3 id:0.2479027370226271] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:notif-close id:notifClose] attributesLength:2 isConnected:true kind:DOMNode nodeName:button nodeType:1] sealed:false type:object]] kind:ArrayLike length:2] sealed:false type:object]","filename":"https://cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","line_number":1,"column_number":7984}]},"http":[{"url":{"schema":"https","addr":"cdn.utmify.com.br/scripts/pixel/pixel-tiktok.js","fqdn":"cdn.utmify.com.br","domain":"utmify.com.br","tld":"com.br"},"ip":{"addr":"104.26.10.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ttkpay-master.vercel.app/1/","date":"2026-07-31T16:12:54.928Z","timestamp":1785514374928,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"utmify.com.br","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Jun 2026 07:45:33 GMT","end":"Mon, 28 Sep 2026 08:45:16 GMT"},"fingerprint":{"sha1":"51:4F:A1:F8:68:8E:FA:5C:3C:8F:12:21:7A:1D:3B:04:86:77:BF:C3","sha256":"8E:17:33:13:2D:A1:8E:74:9A:32:3D:E2:B5:4A:3E:17:20:00:5E:4E:B6:CF:24:07:6B:70:BE:7E:85:0C:E6:00"}}},"request":{"raw":"GET /scripts/pixel/pixel-tiktok.js HTTP/1.1\r\nHost: cdn.utmify.com.br\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ttkpay-master.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 31 Jul 2026 16:12:58 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Mon, 22 Jun 2026 17:34:52 GMT\r\nserver: cloudflare\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\netag: W/\"611eeea7da0cd1054700c3faf569bc5e\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 0eb659b3177cc8c6d47a4ad42c31ad9e.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P4\r\nx-amz-cf-id: XU5T1EWfo9y4imfxRT7iVqeOVSNBlWQjMpm2AxX564VXE3olf36Owg==\r\nage: 28\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QM4MitytJbJUUX4M7nzB2RZUTX30Z93SBrmgVC32uY5Icm6ZsZQ0ZFbggRvNrudbJ3u%2F7T25TaXpDd6MHD7bpRs%2BFuXN4VbP7mh5SMRBM9LYIk%2B6Kv8DofnnRtnopGTWOLzi\"}]}\r\ncf-ray: a23de33f1fd123eb-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40502,"size_decoded":10202,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (40495), with no line terminators","md5":"611eeea7da0cd1054700c3faf569bc5e","sha1":"fe61be1a7a8458bfb3f1a30df79ef27e468a3caf","sha256":"556b8a4cd8e1e8e59c24b60546244689b4e6495324957d4827ac1f04912123b8","sha512":"a25017b3548b4a87a8630bf0d748226dd9f2e69329f6bd8b271c3b7763a0195edae19599ebbc3673ab74d13aebfd01f11731596afc04b061679ebe67196f7df7","ssdeep":"768:K1s8TD5fI1b8tWH0FfCmr3GRZklmZZ9quBM5Uq9zKqDBXWpFcZkv/rxToKQ8ElvX:Etnjfz6RYJio+/VoZPKtyZ0A434","tlshash":"1d039685ea9bd45407e388a6c8771136f32c3a3f616a8450d13badd67c28bda7323d35","first_seen":"2026-06-25T02:39:20.597934Z","last_seen":"2026-07-31T16:14:33.170642Z","times_seen":12,"resource_available":true,"data":null}},"time_used":3167,"timings":{"blocked":-1,"dns":3,"connect":2,"send":0,"wait":7,"receive":0,"ssl":3155},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tracking.utmify.com.br/tracking/v1/events","fqdn":"tracking.utmify.com.br","domain":"utmify.com.br","tld":"com.br"},"ip":{"addr":"172.67.68.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ttkpay-master.vercel.app/1/","date":"2026-07-31T16:12:58.152Z","timestamp":1785514378152,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"utmify.com.br","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Jun 2026 07:45:33 GMT","end":"Mon, 28 Sep 2026 08:45:16 GMT"},"fingerprint":{"sha1":"51:4F:A1:F8:68:8E:FA:5C:3C:8F:12:21:7A:1D:3B:04:86:77:BF:C3","sha256":"8E:17:33:13:2D:A1:8E:74:9A:32:3D:E2:B5:4A:3E:17:20:00:5E:4E:B6:CF:24:07:6B:70:BE:7E:85:0C:E6:00"}}},"request":{"raw":"OPTIONS /tracking/v1/events HTTP/1.1\r\nHost: tracking.utmify.com.br\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://ttkpay-master.vercel.app/\r\nOrigin: https://ttkpay-master.vercel.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\ndate: Fri, 31 Jul 2026 16:12:58 GMT\r\ncontent-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\nvary: Access-Control-Request-Headers\r\naccess-control-allow-headers: content-type\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kADWEi%2FhrczAcUqPBhSBpZQZNlgnmhEwdlkFS4nEmYhyjtTOJWZzClQSErv%2FRgdApu4MAWbikdrV%2BufAQFp0gy4I3MX6NVRek2tU1Kh4UoEbP%2BQTlxEldMKHj2sDABlf9x81DXWD4NQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: a23de33f89d3b51b-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1360,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-31T21:32:40.290356Z","times_seen":17640949,"resource_available":true,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":2,"connect":1,"send":0,"wait":208,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ttkpay-master.vercel.app/assets/tracking.js","fqdn":"ttkpay-master.vercel.app","domain":"ttkpay-master.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ttkpay-master.vercel.app/1/","date":"2026-07-31T16:12:54.699Z","timestamp":1785514374699,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Sun, 28 Jun 2026 13:27:57 GMT","end":"Sat, 26 Sep 2026 13:27:56 GMT"},"fingerprint":{"sha1":"67:7E:08:96:CE:36:50:12:25:03:0A:77:67:C2:A8:60:CD:38:21:41","sha256":"EE:54:CB:11:F1:6C:C3:11:B3:AC:BA:E5:7F:8F:BB:03:F3:38:C1:B2:A2:0D:E7:27:22:C3:EA:FD:0D:AE:01:40"}}},"request":{"raw":"GET /assets/tracking.js HTTP/1.1\r\nHost: ttkpay-master.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ttkpay-master.vercel.app/1/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nage: 55991\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"tracking.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Fri, 31 Jul 2026 16:12:54 GMT\r\netag: W/\"75e4fe1605ad62418da6f601d5190584\"\r\nlast-modified: Fri, 31 Jul 2026 00:39:43 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::jgq56-1785514374705-8a506ed954b9\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":2554,"size_decoded":1618,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"75e4fe1605ad62418da6f601d5190584","sha1":"bdc528c3c31fc4b84324a008b23b37c6c908928f","sha256":"3c8810ea992efd3cf2e17e7d384851bc3df7f15f30ce36b9d6dc092cbef676c5","sha512":"48ed69b58935600e44163f1d983f9f8d3dbb060dedbb237c61d7eb5a3c1a5b9f68fd4507ce5cad75ccc3f73ea196db8b18189c281dd27408218e6345445cac32","ssdeep":"","tlshash":"9351f1b9288110317a72c1bdeb3ba624366b701f340ed2513a8db6144fedf499615efc","first_seen":"2026-07-31T16:13:03.290722Z","last_seen":"2026-07-31T16:14:33.17135Z","times_seen":3,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"ttkpay-master.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"ttkpay-master.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tracking.utmify.com.br/tracking/v1/events","fqdn":"tracking.utmify.com.br","domain":"utmify.com.br","tld":"com.br"},"ip":{"addr":"172.67.68.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ttkpay-master.vercel.app/1/","date":"2026-07-31T16:13:06.162Z","timestamp":1785514386162,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"utmify.com.br","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Jun 2026 07:45:33 GMT","end":"Mon, 28 Sep 2026 08:45:16 GMT"},"fingerprint":{"sha1":"51:4F:A1:F8:68:8E:FA:5C:3C:8F:12:21:7A:1D:3B:04:86:77:BF:C3","sha256":"8E:17:33:13:2D:A1:8E:74:9A:32:3D:E2:B5:4A:3E:17:20:00:5E:4E:B6:CF:24:07:6B:70:BE:7E:85:0C:E6:00"}}},"request":{"raw":"OPTIONS /tracking/v1/events HTTP/1.1\r\nHost: tracking.utmify.com.br\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://ttkpay-master.vercel.app/\r\nOrigin: https://ttkpay-master.vercel.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\ndate: Fri, 31 Jul 2026 16:13:06 GMT\r\ncontent-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\nvary: Access-Control-Request-Headers\r\naccess-control-allow-headers: content-type\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n%2FiKR3qkI5KdPvG4gANdEpjUi%2BVpTcl0XDAA2ecnmo78qUBNCkhWvYEjjssO5GBRmuEELHAjgLRs%2BvX8n2HDTXB7VqWreKlgWVfTu2%2BuxCUz47e31aQdpuDglt%2F4bxXtAXiTNqHuHdY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: a23de3718c97b51b-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1362,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-31T21:32:40.290356Z","times_seen":17640949,"resource_available":true,"data":null}},"time_used":177,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.utmify.com.br/scripts/utms/latest.js","fqdn":"cdn.utmify.com.br","domain":"utmify.com.br","tld":"com.br"},"ip":{"addr":"104.26.10.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ttkpay-master.vercel.app/1/","date":"2026-07-31T16:12:54.960Z","timestamp":1785514374960,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"utmify.com.br","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Jun 2026 07:45:33 GMT","end":"Mon, 28 Sep 2026 08:45:16 GMT"},"fingerprint":{"sha1":"51:4F:A1:F8:68:8E:FA:5C:3C:8F:12:21:7A:1D:3B:04:86:77:BF:C3","sha256":"8E:17:33:13:2D:A1:8E:74:9A:32:3D:E2:B5:4A:3E:17:20:00:5E:4E:B6:CF:24:07:6B:70:BE:7E:85:0C:E6:00"}}},"request":{"raw":"GET /scripts/utms/latest.js HTTP/1.1\r\nHost: cdn.utmify.com.br\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ttkpay-master.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 31 Jul 2026 16:12:54 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Mon, 22 Jun 2026 17:34:52 GMT\r\nserver: cloudflare\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\netag: W/\"8dd66cc0aa8428537cd8258d211afec4\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 4e813bb2fe72a7a317b92ea146f692ac.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P4\r\nx-amz-cf-id: aXqGc2jVeJPUBS7ljLXhpDZhfWHAiDMUQJLYcSzzziIYaYmxzOSW2Q==\r\nage: 4888\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HMLpu5RN29h16mpoCAvEH6duqesH36HoGezEculQvrYsvv7H46aoSAniMG5IMnuDGgaWjejw48aSiKn75moEOFSbJP%2F8P9WGkTxpwoWR9ri4supK6EncNai4CcVYmWJnFpRB\"}]}\r\ncf-ray: a23de32baa6523eb-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19506,"size_decoded":6746,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (19421), with no line terminators","md5":"8dd66cc0aa8428537cd8258d211afec4","sha1":"366ce9cc7a1cb9ee6908c14bcf18ad0edb7bdf77","sha256":"d58a0651391fea6f2538b1e81138bb458e0418b37bc73b445b34bd9100d67f7e","sha512":"93963dff2b741eeac105a4f00887eadc73699410c74f16da2f4c2b8f579a5d58e008eb64b00e9cd72bf247eff8ba1bccdfc8d665aa9d34743625a88f3ebdb026","ssdeep":"384:4PszukMaPJEukW1pEavsOj7ZudQ9e49d3NURxeCiHDFzIlM+urGc2ecbsbSdla6t:uszukMaPJEuYEsOj7ZudQ9e49d3NURx3","tlshash":"d49298a4f1a5909412b24cbf40b75232f22cb735b145c180a54f5d89345eeeb63e3d7b","first_seen":"2026-06-23T14:07:39.965421Z","last_seen":"2026-07-31T16:14:33.172038Z","times_seen":116,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":1,"send":0,"wait":7,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ttkpay-master.vercel.app/1/","fqdn":"ttkpay-master.vercel.app","domain":"ttkpay-master.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-31T16:12:54.406Z","timestamp":1785514374406,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Sun, 28 Jun 2026 13:27:57 GMT","end":"Sat, 26 Sep 2026 13:27:56 GMT"},"fingerprint":{"sha1":"67:7E:08:96:CE:36:50:12:25:03:0A:77:67:C2:A8:60:CD:38:21:41","sha256":"EE:54:CB:11:F1:6C:C3:11:B3:AC:BA:E5:7F:8F:BB:03:F3:38:C1:B2:A2:0D:E7:27:22:C3:EA:FD:0D:AE:01:40"}}},"request":{"raw":"GET /1/ HTTP/1.1\r\nHost: ttkpay-master.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nage: 69431\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"1\"\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Fri, 31 Jul 2026 16:12:54 GMT\r\netag: W/\"fb2a2f974058b36da40330075781f1c2\"\r\nlast-modified: Thu, 30 Jul 2026 20:55:43 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::9l58s-1785514374445-2dbe75127f10\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33413,"size_decoded":13530,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1787)","md5":"fb2a2f974058b36da40330075781f1c2","sha1":"fa6068fcf3cfddbec0023cb3f0fac9860078d4be","sha256":"53230a3ced1ea9d4c4873c826146e4a3d1618f2ec587b53c4f162f9848dbe257","sha512":"ec6ed090d77a8cd96136416208887c3fc6d652d8c2dfb9d1fc265634b3a2c369bd89a658b794e67d55bbf74574e9f3a356386361872c373328a94ec9a8cc8c7a","ssdeep":"384:lOGVtol1IaXFV4FRP4/CHsu4P8/m4eB4QIKNx3Hi+RJ/EMKdevM6N8i9Mc:IyaXFV4FRP4/hj6FeB4Q7bJ/EMK2Kc","tlshash":"ece22aba63d301b0b51397b46baf6316316780138a09c534bfdc97a88fc5adc98776d8","first_seen":"2026-07-31T16:13:03.295794Z","last_seen":"2026-07-31T16:14:33.169874Z","times_seen":3,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":11,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"ttkpay-master.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"ttkpay-master.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ttkpay-master.vercel.app/1/","date":"2026-07-31T16:12:54.966Z","timestamp":1785514374966,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 05:11:37 GMT","end":"Sun, 13 Sep 2026 06:11:34 GMT"},"fingerprint":{"sha1":"CE:63:0D:F2:C0:D2:04:93:CA:AE:0D:AA:ED:9F:31:01:7A:BC:69:40","sha256":"0D:2E:E4:8D:BD:B6:76:95:B5:BD:B8:C5:CE:61:98:B9:6E:81:B5:4B:16:5C:C0:0C:C9:FB:54:0B:B4:A6:7C:65"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ttkpay-master.vercel.app/\r\nOrigin: https://ttkpay-master.vercel.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 31 Jul 2026 16:12:55 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: GET, POST, OPTIONS, OPTIONS, HEAD\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://ttkpay-master.vercel.app\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T91shI0ftO6x6uSP5Yrr9xlySw57GHwhmLMTN0n9DGVJ6vhWQFQ0Jr9l4GGiCNYb35PEo5XSKV8lUkVfpi4d2ZkP0Qa71oXOacXwUHZEDjXbwbOp9VVmv9rl\"}]}\r\ncontent-encoding: br\r\ncf-ray: a23de32bab601ae6-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":740,"size_decoded":2106,"mime_type":"application/json","magic":"JSON text data","md5":"56fa0cc157befab41f7ca09bcbcf6ba0","sha1":"218ffc9c9caa468ff56f9abdec6fa8b77eea1362","sha256":"56ae1d62ced9e47f11decc4556f9a81def550c64ba66d466f3e5e979b7c7f43f","sha512":"0b3072e63f5c820a9042ed809be9a4ab9d051727b474a7eaf65a3e2e4275d724dce3bc3f55b7179634fa1907bebe0f1e7b302af0ae737104e53a8517fb028323","ssdeep":"","tlshash":"3c01df68e4780f7b9cb8135870786817113462175e563a8e7bd4a74d0f8d8bf30b135e","first_seen":"2026-07-09T15:47:21.439328Z","last_seen":"2026-07-31T21:12:35.002815Z","times_seen":1033,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":0,"dns":8,"connect":1,"send":0,"wait":217,"receive":0,"ssl":9},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"ipapi.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipwho.is/","fqdn":"ipwho.is","domain":"ipwho.is","tld":"is"},"ip":{"addr":"104.20.44.133","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ttkpay-master.vercel.app/1/","date":"2026-07-31T16:12:55.221Z","timestamp":1785514375221,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipwho.is","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Jun 2026 12:07:03 GMT","end":"Fri, 04 Sep 2026 13:06:46 GMT"},"fingerprint":{"sha1":"77:EB:7C:CE:78:4C:26:90:A8:02:71:42:3E:74:A1:DB:8A:36:DD:FA","sha256":"75:C5:CE:FB:6A:02:03:43:3D:CC:04:28:F2:A6:3C:70:0E:CE:87:98:A5:3C:76:CB:C9:1F:1D:A4:1B:40:DC:99"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ipwho.is\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ttkpay-master.vercel.app/\r\nOrigin: https://ttkpay-master.vercel.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 31 Jul 2026 16:12:55 GMT\r\ncontent-type: application/json; charset=utf-8\r\npriority: u=4,i=?0\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\ncf-cache-status: BYPASS\r\ncontent-encoding: br\r\ncf-ray: a23de32d392ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":641,"size_decoded":719,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"17a54f0409296773c66bb591bfc606cd","sha1":"ebd624c5b8b41387fbac1fcf07d73c8a0cafb75c","sha256":"8fdc21f3a6a58a984593a1aa084ebcc60283b4b23c17a4ffb19c030c48d4b7df","sha512":"94f0d44154fea968c515cd70603367a5377565147b2eb3aeeeab9bc84c5ebb48f652284fd1a7c762b694198886afcb34d8627285ce7481bb8961898b585af61c","ssdeep":"","tlshash":"39f0682101dc7d0e81af438910cffd09257d6017d2c2518accfc5994c1c42ee704055f","first_seen":"2026-07-17T15:53:12.211861Z","last_seen":"2026-07-31T18:20:06.934742Z","times_seen":210,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":3,"connect":8,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}