{"report_id":"6b71c163-b36f-493d-809b-afc51d38a99b","version":0,"status":"done","tags":[],"date":"2026-09-21T19:15:45Z","url":{"schema":"http","addr":"hoodpay.lol/","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":0,"asn":396982,"as":"Google LLC","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"hoodpay.lol/","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"title":"Hood Pay — The spending layer for Robinhood wallets","dom":{"size":19558,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17862)","md5":"dbe94317b070ec92dc7b6612c07483de","sha1":"c8d8bd647c6c9d4aaabe26ddbecdca2e0db657a2","sha256":"617bb71c3db37f5dabb9e63f8f16049c031ac00841b87bc24e860cc9401d60fb","sha512":"1cdec7fd9de2d2185c974224f909c25562cae41eb2662e3b6d2794bdf2e0065c53c0fe53c194a3f5df7fb0fa6ddaa6f97be9046c65cbe48fdeac2ccdf662dd46","ssdeep":"384:n6tiyl8XYYVVaXaWmKQWqS8XXXS5m2MIL8WFc2Cv7uMlueQlNGmEgavpJRIV+jv:6l8ocVUHmKpqS8XXXS5m2MIAoc247uMn","tlshash":"b092dc72f166083e163f49c6e3b6536b74eaf20dd60a901177fc43a84bd9c98ed23489","dom_hash":"domhash369e22c4d08619cbb6dd4a7da6349b21","first_seen":"2026-09-21T18:50:38.680648Z","last_seen":"2026-09-21T19:16:00.237558Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"hoodpay.lol/","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":0,"asn":396982,"as":"Google LLC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-26T19:15:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"hoodpay.lol","ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2026-09-20","domain_rank":0,"first_seen":"2026-09-21T18:50:34.480921Z","last_seen":"2026-09-21T18:50:34.480922Z","alert_count":26,"request_count":13,"received_data":3816430,"sent_data":9026,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-20T22:43:34.841753Z","alert_count":0,"request_count":1,"received_data":10940,"sent_data":557,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-20T22:43:37.149177Z","alert_count":0,"request_count":6,"received_data":134024,"sent_data":3302,"comment":"","tags":null,"fingerprints":null},{"fqdn":"i.replit.com","ip":{"addr":"35.201.95.58","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2011-09-02","domain_rank":0,"first_seen":"2026-08-31T10:29:25.781607Z","last_seen":"2026-09-16T02:10:57.22183Z","alert_count":0,"request_count":2,"received_data":6044,"sent_data":983,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}]},{"fqdn":"t3.gstatic.com","ip":{"addr":"142.250.178.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2013-05-06T20:15:36Z","last_seen":"2026-09-20T09:44:13.711839Z","alert_count":0,"request_count":2,"received_data":2538,"sent_data":1171,"comment":"","tags":null,"fingerprints":null},{"fqdn":"t2.gstatic.com","ip":{"addr":"142.250.178.68","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2013-05-07T00:09:56Z","last_seen":"2026-09-19T02:04:45.194777Z","alert_count":0,"request_count":3,"received_data":6560,"sent_data":1764,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn.simpleicons.org","ip":{"addr":"104.21.86.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2013-02-04","domain_rank":3051679,"first_seen":"2022-10-26T04:03:48Z","last_seen":"2026-09-21T11:30:19.31623Z","alert_count":0,"request_count":7,"received_data":12137,"sent_data":3791,"comment":"","tags":null,"fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"i.replit.com/script.js","fqdn":"i.replit.com","domain":"replit.com","tld":"com"},"ip":{"addr":"35.201.95.58","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3c5c69689503fcb6227ba5e54dffb141","sha1":"b23c650c90318c6a629f1f9e2539b31dc2c42b8c","sha256":"1ad1145d19d4558c20f5469ca4a5fc50a1a46f860858c9c91bfcd56fd29a522a","sha512":"f32e31f1726b530d2e7fab27e14db15909dbdfc2db3257cdf29c9b93866049ec1eeaf05373333bbfc63bdea8b0153d267b272f2c6b0080ba2c50e19c4b4a397e","ssdeep":"96:5hkivaqIDvN+5sH8y1TB/7a+45zAx8QfqNGvCKabPane8Ew3EFB4:5hkQaqmANy1TB/u+iAx5ik6Kcce8Ew3J","tlshash":"5ba13ce1f152b4b62bba9cd291742221b2361bb1f8428094e97d1c975e3d18b647ff2c","size":4655,"data":"","first_seen":"2026-06-26T19:34:37.316581Z","last_seen":"2026-09-21T19:16:00.266079Z","times_seen":1146,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/assets/index-Dxvivvyg.js","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"00792050d221e2f016a8203de3f5f39e","sha1":"432e1ce69c55b678b542fbb08761a8522b992291","sha256":"49a21faf416ccf08b7324cbde86cba3b2fa23b2e5c9e178facde582f8d41ebbe","sha512":"0f733277fbba0425ce3e610efa9f539d7a35efd25d765ec810cba60ce0be469f61d3827c7c9ca23d07d1f2d09357591cb593b6d1af05d673fc8d322043cf3d68","ssdeep":"3072:HP0AEPg289RV922jy4aftcxE/Tt6MmlCtPtivMf2zLhYqg0fWR248V8S6uasmzws:HPwImJ36Nh48V8SkxzwIJezYN","tlshash":"ef745cd4719ab366af7345d400bf110b71292d25a40d88a0b178fcb667b808a75bbffd","size":363810,"data":"","first_seen":"2026-09-21T18:50:38.719005Z","last_seen":"2026-09-21T19:16:00.246102Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"hoodpay.lol/assets/index-C4DE9O5B.css","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:20.449Z","timestamp":1790018000449,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /assets/index-C4DE9O5B.css HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-length: 32662\r\ncontent-type: text/css; charset=utf-8\r\ndate: Mon, 21 Sep 2026 19:13:20 GMT\r\nlast-modified: Sun, 20 Sep 2026 02:03:29 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 0f883a57061e9389e7e98fbf5d0cff22\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32662,"size_decoded":33064,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (32661)","md5":"e5d55b4ca53e615703409db01da65be1","sha1":"49ef4668aaf473053590d424775abef7882a7abf","sha256":"a9b330c7977a980eadcb921d914e7dea2fc7cd02896c0a666f12e010c40a2152","sha512":"fead8d1824a098dc2ddd73c51d07d0257a366142ea4b7102beb16bdf6d2ccf9cb6d9fe53c2f7bc94b474ff0bca662428c22603b52df7e392b40bd14bf80e63e7","ssdeep":"384:87V/5N1vIvckVNbuVcpdVT6NRolFC9xK8rVJ/cWX1AvUYLZcH0brvwYLPk:e/n8VuGdR6NRbQEVXlqLZk0fvjLc","tlshash":"13e26451f360f1387c7be8b1eb98569f7418f723d86287e8f942b11448cb5f22b65a09","first_seen":"2026-09-21T18:50:38.713034Z","last_seen":"2026-09-21T19:16:00.238889Z","times_seen":2,"resource_available":true,"data":null}},"time_used":432,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=DM+Mono:wght@400;500\u0026family=Manrope:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:20.885Z","timestamp":1790018000885,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css2?family=DM+Mono:wght@400;500\u0026family=Manrope:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Mon, 21 Sep 2026 19:13:20 GMT\r\ndate: Mon, 21 Sep 2026 19:13:20 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10256,"size_decoded":1475,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"80411304daccecd87769e72b017b5651","sha1":"01f95d7ec6773d03bca918a0390ba41d1d0bdfdb","sha256":"8c740e8e490ebaa17eb72cb37a132f1dff2d9997615ed5e792811c7b3b79c3be","sha512":"64a08fe42d2c4b8fab5f28f22c869573c39a813a34cd1191fd8e0078de3f67c7e929ad3481a4b65c6380bcc3f6a93f345d6dbfabd501ada219e599686870efe1","ssdeep":"192:kMXH0w/JDEV3WW89RJ8rV3118+4JlOV3MM8b/JGNV3TT80s:7wU+ME02w","tlshash":"c722ca90006be804eb470cd577ce7e3aad4e61567441c5ba5bfe1cd8addbd222320b5e","first_seen":"2026-09-06T11:55:50.164543Z","last_seen":"2026-09-21T19:16:00.241025Z","times_seen":9,"resource_available":true,"data":null}},"time_used":85,"timings":{"blocked":0,"dns":0,"connect":16,"send":0,"wait":36,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/api/transactions","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.028Z","timestamp":1790018002028,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /api/transactions HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 2\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\netag: W/\"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w\"\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 6aad196f79f2471ee7e98fbf5d0cff3f\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2,"size_decoded":404,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d751713988987e9331980363e24189ce","sha1":"97d170e1550eee4afc0af065b78cda302a97674c","sha256":"4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945","sha512":"b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af","ssdeep":"","tlshash":"c7100000000000000000000000000000000003000000c0000000000000000000000000","first_seen":"2023-03-08T00:02:47Z","last_seen":"2026-09-21T22:31:50.643631Z","times_seen":327932,"resource_available":true,"data":null}},"time_used":611,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":611,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.413Z","timestamp":1790018002413,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://hoodpay.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 24836\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 15:57:43 GMT\r\nexpires: Tue, 21 Sep 2027 15:57:43 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:08:28 GMT\r\ncontent-type: font/woff2\r\nage: 11739\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24836,"size_decoded":25648,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24836, version 1.0","md5":"938c6e8019b69313372c47dbb7a7c930","sha1":"b42951014c5eca12749d87a4706caf22dc4fe081","sha256":"a30ddcd349703aff7464c34bef3fffdff405ee50c113440d7c8693c02d210972","sha512":"5537c005cd8f321f26fe67f6292b3ec14e88ff4b2365311628dbbe4753e01e568f6881b9f2e7d71e8e6b2c261ed25f372829dd28f89f865ce574b4e1fec29614","ssdeep":"768:3KQaj5c95F1QmIwa55Go1COpZLpkkM46CU+YIC:ahj5cXow65xCM5pkkM468YB","tlshash":"a2b2f105ee49b3d4b276f1fcfa802884179282f27dabda8f3f2015981dd8e5b8d45320","first_seen":"2025-06-02T20:09:41.98255Z","last_seen":"2026-09-21T20:54:05.33987Z","times_seen":47097,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.015Z","timestamp":1790018002015,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://hoodpay.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 24836\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 15:57:43 GMT\r\nexpires: Tue, 21 Sep 2027 15:57:43 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:08:28 GMT\r\ncontent-type: font/woff2\r\nage: 11739\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24836,"size_decoded":25648,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24836, version 1.0","md5":"938c6e8019b69313372c47dbb7a7c930","sha1":"b42951014c5eca12749d87a4706caf22dc4fe081","sha256":"a30ddcd349703aff7464c34bef3fffdff405ee50c113440d7c8693c02d210972","sha512":"5537c005cd8f321f26fe67f6292b3ec14e88ff4b2365311628dbbe4753e01e568f6881b9f2e7d71e8e6b2c261ed25f372829dd28f89f865ce574b4e1fec29614","ssdeep":"768:3KQaj5c95F1QmIwa55Go1COpZLpkkM46CU+YIC:ahj5cXow65xCM5pkkM468YB","tlshash":"a2b2f105ee49b3d4b276f1fcfa802884179282f27dabda8f3f2015981dd8e5b8d45320","first_seen":"2025-06-02T20:09:41.98255Z","last_seen":"2026-09-21T20:54:05.33987Z","times_seen":47097,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":32,"send":0,"wait":32,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmmono/v16/aFTR7PB1QTsUX8KYvumzEYOtbQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.022Z","timestamp":1790018002022,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/dmmono/v16/aFTR7PB1QTsUX8KYvumzEYOtbQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://hoodpay.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 14988\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 16:03:29 GMT\r\nexpires: Tue, 21 Sep 2027 16:03:29 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 17:11:10 GMT\r\ncontent-type: font/woff2\r\nage: 11393\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14988,"size_decoded":15800,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14988, version 1.0","md5":"c4598219c4b8a5667e824d99b06100b4","sha1":"f425382cda708c7fd291568aa9681537e9596ce3","sha256":"9964608a849396bd00c4bfd7034afe03486469dcf20b4f6b8cbdfdd310369951","sha512":"cd776311d8459b366e0da070c084cfd7e3756e4cd3a35a4aab81510270e5b0c5b432225f1677f243b7f33cc691eb1f9b3fae90fbfd9238d91ca886c2ef76e513","ssdeep":"384:IquHCgBoDey5mnWYndHqLcsJDa00ti/dklCHLs9:IquHS5ITHqha00ti+liLw","tlshash":"3662c011158a8ce8affd98204b85198a70d270d9addff752863042d1ca3879c3f77d87","first_seen":"2025-06-03T07:55:52.413726Z","last_seen":"2026-09-21T21:48:42.474809Z","times_seen":3063,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":25,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.replit.com/api/send","fqdn":"i.replit.com","domain":"replit.com","tld":"com"},"ip":{"addr":"35.201.95.58","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:24.182Z","timestamp":1790018004182,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"i.replit.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 16:05:51 GMT","end":"Tue, 15 Dec 2026 16:58:44 GMT"},"fingerprint":{"sha1":"B2:A6:FF:C2:CB:AC:A7:7E:50:06:34:07:8F:4F:F8:12:E5:1A:D4:06","sha256":"52:B1:F7:22:3E:22:71:C4:95:B5:BE:72:74:0D:8A:F3:89:20:AC:C4:38:AA:94:D2:B7:2F:F0:2D:AA:CD:E5:7A"}}},"request":{"raw":"OPTIONS /api/send HTTP/1.1\r\nHost: i.replit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type,x-umami-hostname,x-umami-website-id\r\nReferer: https://hoodpay.lol/\r\nOrigin: https://hoodpay.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, DELETE, POST, PUT\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 86400\r\nallow: OPTIONS, POST\r\ncache-control: no-cache\r\ncontent-security-policy: default-src 'self'; img-src 'self' https: data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; frame-src 'self' http: https:; frame-ancestors 'self' ;\r\ndate: Mon, 21 Sep 2026 19:13:24 GMT\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch\r\nx-dns-prefetch-control: on\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":685,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-21T22:48:24.473719Z","times_seen":18591654,"resource_available":true,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":20,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-21T19:13:18.131Z","timestamp":1790017998131,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: private\r\ncontent-type: text/html; charset=utf-8\r\ndate: Mon, 21 Sep 2026 19:13:20 GMT\r\nexpires: Mon, 21 Sep 2026 19:13:20 GMT\r\nlast-modified: Sun, 20 Sep 2026 02:03:29 GMT\r\nserver: Google Frontend\r\nset-cookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA; expires=Wed, 21-Oct-2026 19:13:20 GMT; path=/\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 0546e06702672ee6fee6c2a3ca08e9a5\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"GAESA","value":"CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA","quoted":false,"path":"/","expires":"2026-10-21T19:13:20Z","raw_expires":"Wed, 21-Oct-2026 19:13:20 GMT","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA; expires=Wed, 21-Oct-2026 19:13:20 GMT; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]}],"data":{"size":1758,"size_decoded":2519,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"2966ee3d1cf770d6cddb76954a53e6a6","sha1":"c620018d244c98bf432980a6b1ea0688af8a4bf3","sha256":"0caa8293021c745c5394f734a273a019c5e826a5e4f88122b5a6322618f0e108","sha512":"eeece73d12e3e655523ea7de95533f03397bde5c8db9d157f4e2fbaf8314171a76de752c8389c111b41501d48f9835bdda54169b079d5de80be75f385d70f806","ssdeep":"","tlshash":"403124a78690c81417208324e8c2b058cc5ad583d788fc9578dd20ad8fd1fe5c6f36f6","first_seen":"2026-09-21T18:50:38.700998Z","last_seen":"2026-09-21T19:16:00.245107Z","times_seen":2,"resource_available":true,"data":null}},"time_used":2134,"timings":{"blocked":-1,"dns":113,"connect":12,"send":0,"wait":1973,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/assets/index-Dxvivvyg.js","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:20.447Z","timestamp":1790018000447,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /assets/index-Dxvivvyg.js HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-length: 363810\r\ncontent-type: text/javascript; charset=utf-8\r\ndate: Mon, 21 Sep 2026 19:13:20 GMT\r\nlast-modified: Sun, 20 Sep 2026 02:03:29 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 2896d6fddada8210e7e98fbf5d0cf3ed\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":363810,"size_decoded":364220,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (54878)","md5":"00792050d221e2f016a8203de3f5f39e","sha1":"432e1ce69c55b678b542fbb08761a8522b992291","sha256":"49a21faf416ccf08b7324cbde86cba3b2fa23b2e5c9e178facde582f8d41ebbe","sha512":"0f733277fbba0425ce3e610efa9f539d7a35efd25d765ec810cba60ce0be469f61d3827c7c9ca23d07d1f2d09357591cb593b6d1af05d673fc8d322043cf3d68","ssdeep":"3072:HP0AEPg289RV922jy4aftcxE/Tt6MmlCtPtivMf2zLhYqg0fWR248V8S6uasmzws:HPwImJ36Nh48V8SkxzwIJezYN","tlshash":"ef745cd4719ab366af7345d400bf110b71292d25a40d88a0b178fcb667b808a75bbffd","first_seen":"2026-09-21T18:50:38.719005Z","last_seen":"2026-09-21T19:16:00.246102Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1463,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":372,"receive":1091,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/favicon.png","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:21.991Z","timestamp":1790018001991,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-length: 217136\r\ncontent-type: image/png\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nlast-modified: Sun, 20 Sep 2026 02:03:29 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: fce2ec92dd5aafa2e7e98fbf5d0cfa62\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]}],"data":{"size":217136,"size_decoded":217525,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"ea6d0cf689d65b7f174f2d22c5fa8e87","sha1":"04271c2922b089dc82c5ff8f13b507aa26fdde9c","sha256":"4d9b0189bb5bd21c9804cda0b3f04c231dbabc6938820d28e333b05b4a8ed0d7","sha512":"e3d79b027e3869a62b78c0f16de934561b17dbbdcfaf072401acbd7ac4c7b479def25771045051824df7b5e547678e843ff6f1dcc583aea5d5599df5a33b3f16","ssdeep":"6144:jYuA5vgFEigtFDRtmrlEm43+6unTf9zWDHF11U4PH+D8:7ApgF/ApRtmr63+6YTf9yDHF/U4PeA","tlshash":"332412b918071290f46f0f8f174f97ed2b40f9268fd38b5a850f41c4b50a989d6f66ea","first_seen":"2026-09-21T18:50:38.694469Z","last_seen":"2026-09-21T19:16:00.246979Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1052,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":332,"receive":720,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/assets/hoodpay-card-hero-v2-BS_NFOJf.png","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:21.992Z","timestamp":1790018001992,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /assets/hoodpay-card-hero-v2-BS_NFOJf.png HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-length: 1404277\r\ncontent-type: image/png\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nlast-modified: Sun, 20 Sep 2026 02:03:29 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 1df711d08b083266e7e98fbf5d0cf265\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]}],"data":{"size":1404277,"size_decoded":1404667,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGB, non-interlaced","md5":"fbf8a2cbe40270c0f69e65b757f949eb","sha1":"1975864dbe4b7cd2a9fb29ef97ad4a16af2a7f01","sha256":"787f3d8899c0b98df28b273d7085b62a7bd95105cb7c1474a6283b2aa6e4f115","sha512":"23b8ca4792d4e2d0319803743e39b8d13995db3ee966fb8b4b3b31d70326f6785b0409905fd943693dac1cb55babe12d75daf7c9fa8e20835cc99071d4524e2e","ssdeep":"24576:MAuK9MBEv+wLtOcEhBHeqSmINJe1QMc7AmndeVbwklnOozHaE7ATiAV:2iMBEv+MOcEhB+qSrQmM49eVbwklnxHa","tlshash":"072533d6e8c898b2d87b683264d9fdd16254f3f762b114485007ea5e3188bf2f1a17bc","first_seen":"2026-09-21T18:50:38.7028Z","last_seen":"2026-09-21T19:16:00.247812Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1832,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":1496,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/assets/hoodpay-checkout-DCZL9WVJ.png","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:21.993Z","timestamp":1790018001993,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /assets/hoodpay-checkout-DCZL9WVJ.png HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-length: 1743645\r\ncontent-type: image/png\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nlast-modified: Sun, 20 Sep 2026 02:03:29 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: fa837f11694651fde7e98fbf5d0cfc01\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":1743645,"size_decoded":1744035,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGB, non-interlaced","md5":"623cde8b108d8e381d35174bb8df04de","sha1":"a5a02d5e9ac1ccd8db9364c430e4cd617a85685e","sha256":"161a071bf724d78c00aa39a11e1d275c11e69affb6d3f42839b87627647c27b0","sha512":"1a3e958c802c60ee2753b8cdc9a306a773a4a7cfc95f9a3800afb870f2591ec42cb465c46293928c2fc6e9ae9b1d8e0a399a599bbe0777a306a121503e6321fe","ssdeep":"24576:+UrxJFBPuQFckNoFz2NsHLw5DDPSyqfn8Z4Eh:+UrVB9Fc1z2Nsrw57qEZ7h","tlshash":"9225235ae89c4db0cb8370394e29d78b78c3395325edc7cd50479aa6834b503395abbe","first_seen":"2026-09-21T18:50:38.683647Z","last_seen":"2026-09-21T19:16:00.248726Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":374,"receive":1788,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"t3.gstatic.com/faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=amazon.com\u0026size=128","fqdn":"t3.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:23.313Z","timestamp":1790018003313,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=http://amazon.com\u0026size=128 HTTP/1.1\r\nHost: t3.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-location: https://www.amazon.com/favicon.ico\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"media-favicon\"\r\nreport-to: {\"group\":\"media-favicon\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/media-favicon\"}]}\r\ncontent-length: 658\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 16 Sep 2026 22:31:51 GMT\r\nexpires: Wed, 23 Sep 2026 22:31:51 GMT\r\ncache-control: public, max-age=604800\r\nage: 420092\r\nlast-modified: Tue, 18 Aug 2026 14:39:32 GMT\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":658,"size_decoded":1492,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"8d52c6b172b109030a10e9e00ed7db8b","sha1":"6fbd9638fce0de7c21450796fa4f5347d7316bb0","sha256":"7e67fb8e6c43002e09c7d363f3b158a716dc09f4043cc058bcc01b206bbd097d","sha512":"1061a0a9a49b6ea106d553d7afbdf5d2dc4171d57661c60030040af771360a23a3eb733c7f81385a1764426ed834de1025c19f5b6d64e77e11eeab1b040ecaba","ssdeep":"","tlshash":"7b0123e394b88e79cc52e697a6150c72f8226f22a92b748b0c905ff32d515d208642b2","first_seen":"2026-06-18T13:20:50.424435Z","last_seen":"2026-09-21T19:16:00.249545Z","times_seen":75,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":2,"connect":15,"send":0,"wait":17,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"t2.gstatic.com/faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=google.com\u0026size=128","fqdn":"t2.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.68","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:23.319Z","timestamp":1790018003319,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=http://google.com\u0026size=128 HTTP/1.1\r\nHost: t2.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-location: https://www.google.com/images/branding/product/1x/gsa_android_144dp.png\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"media-favicon\"\r\nreport-to: {\"group\":\"media-favicon\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/media-favicon\"}]}\r\ncontent-length: 2326\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 16 Sep 2026 21:08:00 GMT\r\nexpires: Wed, 23 Sep 2026 21:08:00 GMT\r\ncache-control: public, max-age=604800\r\nage: 425123\r\nlast-modified: Tue, 17 Mar 2020 17:44:59 GMT\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2326,"size_decoded":3198,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit colormap, non-interlaced","md5":"9d8c66f03b56f170e5f7fd66c59eb9f0","sha1":"4d11ecdfcb27d58edc36f143edd5f569dd21bdde","sha256":"07e659b8dad50a8dcd5cedea1f521c94530286826207524937337fb47f337085","sha512":"26ef3fafce7bb75e010fdc280769a1695eb7a30915248982e9b760cb55f74043d00208f03a40fbf67554ca556b2eaca10255fcec6d04dfdbfcd59a7baae02f6e","ssdeep":"","tlshash":"8741181888601634de905e899e7cb88cb404ec6fae5c883a31a5b02ede730e1a45528e","first_seen":"2026-04-27T21:04:00.496267Z","last_seen":"2026-09-21T19:16:00.250203Z","times_seen":9,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":15,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.simpleicons.org/palantir/F3F5EF","fqdn":"cdn.simpleicons.org","domain":"simpleicons.org","tld":"org"},"ip":{"addr":"104.21.86.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.403Z","timestamp":1790018002403,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleicons.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 07:26:27 GMT","end":"Sat, 12 Dec 2026 08:26:24 GMT"},"fingerprint":{"sha1":"5D:DC:AA:EA:5A:47:AE:39:31:CE:3C:5A:40:A6:80:6D:49:73:60:D7","sha256":"20:72:9B:91:1A:D4:8D:B7:50:B4:E5:85:7D:12:5B:FB:A5:90:A8:AA:79:E8:D2:E2:5E:18:8D:FD:55:17:1C:EE"}}},"request":{"raw":"GET /palantir/F3F5EF HTTP/1.1\r\nHost: cdn.simpleicons.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=31536000, stale-while-revalidate=604800\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nvia: 1.1 fly.io, 1.1 fly.io\r\nfly-request-id: 01M32P67H5CYS16SWC179MM414-arn\r\nlast-modified: Mon, 21 Sep 2026 19:13:22 GMT\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VZMyrklQNsSBEBhzwmUh2ch%2B9J00LKF62MhmvSSOeHVokwhNSOtBOMGnEKfM0LIjh%2FvqlD%2FgnBDxF%2F03ii9AL6sb7UApLiH2dQCWM9cxYs9KLvCgXlMFTxea0rdcc0Nqxi84f15j\"}]}\r\npriority: u=5,i\r\nvary: accept-encoding\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: a3eb630328bfdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":302,"size_decoded":1166,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4b7e13d7ce29a2876b5d691ea83e7a6d","sha1":"e2d706ff65cf3c8701c2d3cc9d0834fa02a2b9a7","sha256":"abaec3a60eb9cb0e54f1ce6bd5160fd29c907a8f2a0dbad7f1b7d138eff7c9b8","sha512":"05b965121e4dda2b18237a9be9d5db29aef24504708ccc368ef92614408a22789f429a2454e7bde229a6441ebc0b11994ce8c624be097b41e94171c63a07b081","ssdeep":"","tlshash":"1ce02c78474c049e7acac3e0b26a3a08a39c10b8b1d844b8e8dcd0f0649b898cc03019","first_seen":"2026-09-21T18:50:38.697338Z","last_seen":"2026-09-21T19:16:00.250849Z","times_seen":2,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.simpleicons.org/spacex/F3F5EF","fqdn":"cdn.simpleicons.org","domain":"simpleicons.org","tld":"org"},"ip":{"addr":"104.21.86.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.405Z","timestamp":1790018002405,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleicons.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 07:26:27 GMT","end":"Sat, 12 Dec 2026 08:26:24 GMT"},"fingerprint":{"sha1":"5D:DC:AA:EA:5A:47:AE:39:31:CE:3C:5A:40:A6:80:6D:49:73:60:D7","sha256":"20:72:9B:91:1A:D4:8D:B7:50:B4:E5:85:7D:12:5B:FB:A5:90:A8:AA:79:E8:D2:E2:5E:18:8D:FD:55:17:1C:EE"}}},"request":{"raw":"GET /spacex/F3F5EF HTTP/1.1\r\nHost: cdn.simpleicons.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=31536000, stale-while-revalidate=604800\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nvia: 1.1 fly.io, 1.1 fly.io\r\nfly-request-id: 01M32P67H42JFF7E8HV1JW58BQ-arn\r\nlast-modified: Mon, 21 Sep 2026 19:13:22 GMT\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u5Q1VdapMXj52ncH%2FTZJXj1D12Y%2BjYddaefylNSk91lqL5fDIYY0qxXFqLaMC4jqCl4VEfzBGr%2BpzxLfykhT8FB44ZLm7WyB4UaiZNeO3MKPQ%2FAu0NYzcGJT8HkYvIumLweg0snz\"}]}\r\npriority: u=5,i\r\nvary: accept-encoding\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: a3eb630328c3dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":338,"size_decoded":1201,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d452c30c918049b53711cef828ca466b","sha1":"25888516453b322c71c311c7c1f9a46af3fd6839","sha256":"ef1f232fc7ee7a29ada714f40b97bdb4b36f563dd5c6390fb97400f31f19ceea","sha512":"c8611e9223c357e7374fe7a7f94f494b1f0b2e9fa93973ebce5fcea996400d395ec65160bef738c8f691be5f2601d63797d5aee7b8fa4759026c74c64845adcc","ssdeep":"","tlshash":"f5e026f249c82718aa94df95ff657ea2346a7a6e85da1238d6d103190026cb0d2c8eb1","first_seen":"2026-09-21T18:50:38.698527Z","last_seen":"2026-09-21T19:16:00.251745Z","times_seen":2,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"t3.gstatic.com/faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=amd.com\u0026size=128","fqdn":"t3.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:23.326Z","timestamp":1790018003326,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=http://amd.com\u0026size=128 HTTP/1.1\r\nHost: t3.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-location: https://www.amd.com/content/dam/code/images/favicon/favicon.ico\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"media-favicon\"\r\nreport-to: {\"group\":\"media-favicon\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/media-favicon\"}]}\r\ncontent-length: 183\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 20 Sep 2026 12:07:59 GMT\r\nexpires: Sun, 27 Sep 2026 12:07:59 GMT\r\ncache-control: public, max-age=604800\r\nage: 111924\r\nlast-modified: Wed, 29 Nov 2017 12:34:19 GMT\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":183,"size_decoded":1046,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"97f14e652f571882b3054684db61592c","sha1":"41b378ca22b904e65b70206bb581d24713e31b10","sha256":"4add9abf7e637b5422ceff3d9e8d74abd5b1c44992196bed40564da97227c998","sha512":"799bf80b459a41022e63be9f11b60ce0393b9a1c234d1c80e710259a5a682589696f5c719cdbb33e63637d48877faca991d506c452ca65d2c8318d8ad556885f","ssdeep":"","tlshash":"36c022f131633c69a38a433b2304c64298b664e000801844390572b404de700582c899","first_seen":"2026-03-03T13:52:08.110728Z","last_seen":"2026-09-21T19:16:00.252665Z","times_seen":6,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":0,"dns":0,"connect":16,"send":0,"wait":16,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/api/stats","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.025Z","timestamp":1790018002025,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /api/stats HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 90\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\netag: W/\"5a-Xhb7PqdO4FPXgYRgdNP05EbTKi8\"\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 411d3fb405fdb157e7e98fbf5d0cf8d5\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]}],"data":{"size":90,"size_decoded":494,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"c43ca2fd6f63502b565ed19e5a5dd1e7","sha1":"5e16fb3ea74ee053d781846074d3f4e446d32a2f","sha256":"09054139346e93710ab7ea8f8b7d1917510740a8757e214061f91557ea2e6e85","sha512":"11c1987d8531b3acefc93e67099cb1d0b623a1651cd8bd8bd4317e91316076cae9c1ec99cf39b534294115aa7ce917525216d0ce5602460eb9eaf387cd302c7f","ssdeep":"","tlshash":"d9b00249d34d25d57bf1d7d755831173055911951d1411aec9d881c515015231711501","first_seen":"2026-09-21T18:50:38.691017Z","last_seen":"2026-09-21T19:16:00.254588Z","times_seen":2,"resource_available":true,"data":null}},"time_used":612,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":612,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/api/stocks","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.027Z","timestamp":1790018002027,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /api/stocks HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 2954\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\netag: W/\"b8a-5svHfpPKDlhGOMa2WTxCiWjdsoY\"\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 305f3c8df38715d2e7e98fbf5d0cf40a;o=1\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2954,"size_decoded":3365,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"224c9169b4f708e5ad89f90d35cbaaf2","sha1":"e6cbc77e93ca0e584638c6b6593c428968ddb286","sha256":"88be5ce825feb1b14785a64a9dc18960effe18e8795146cd989c9b33685f76d7","sha512":"eea63612554f35d9600566892b46ef62e8519e0030c85310529e67a4b1b4644250b285304a78cdfc26507a741fc9669c63da4b7131dfb78c4b09aebbf4809cdf","ssdeep":"","tlshash":"d751ccff29cdcd2d45c940c2b1d3795b4244ab76e28bbd1ed213650b25e62f8056b1bc","first_seen":"2026-09-21T18:50:38.707553Z","last_seen":"2026-09-21T19:16:00.255568Z","times_seen":2,"resource_available":true,"data":null}},"time_used":347,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/api/config","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.031Z","timestamp":1790018002031,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /api/config HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 53\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\netag: W/\"35-tcELeKuj/bh/rKt2t3hd24ti3tE\"\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 0336fb32b479c5ace7e98fbf5d0cf5a9\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]}],"data":{"size":53,"size_decoded":457,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"2dd517e06e5085041b3dc8666b229ded","sha1":"b5c10b78aba3fdb87facab76b7785ddb8b62ded1","sha256":"58492a912812055f9169aff8a20c3a0c1350bcaae915389f7235e851f49ec930","sha512":"9ef0e2c7ecd86d3466083f18b326ba75f93b51e3a21122477ada89f78275698f6db5fc68da92ae3e51d3bdd74cf5d78fcfa08870c28d318e1eeda5e20febb99c","ssdeep":"","tlshash":"2990021a7c6064115a3424d9960d280908173a04404220204454211044104647707781","first_seen":"2026-09-21T18:50:38.704597Z","last_seen":"2026-09-21T19:16:00.256488Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1024,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1024,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.simpleicons.org/intel/F3F5EF","fqdn":"cdn.simpleicons.org","domain":"simpleicons.org","tld":"org"},"ip":{"addr":"104.21.86.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.398Z","timestamp":1790018002398,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleicons.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 07:26:27 GMT","end":"Sat, 12 Dec 2026 08:26:24 GMT"},"fingerprint":{"sha1":"5D:DC:AA:EA:5A:47:AE:39:31:CE:3C:5A:40:A6:80:6D:49:73:60:D7","sha256":"20:72:9B:91:1A:D4:8D:B7:50:B4:E5:85:7D:12:5B:FB:A5:90:A8:AA:79:E8:D2:E2:5E:18:8D:FD:55:17:1C:EE"}}},"request":{"raw":"GET /intel/F3F5EF HTTP/1.1\r\nHost: cdn.simpleicons.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=31536000, stale-while-revalidate=604800\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nvia: 1.1 fly.io, 1.1 fly.io\r\nfly-request-id: 01M32P67H562KHTAP4QTX4GA6J-arn\r\nlast-modified: Mon, 21 Sep 2026 19:13:22 GMT\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5YdBzAqDKQUIZm5eGG70xR33%2Bt1ADtU2S5qKsE9bcSj7JE1IDVohpuw10MSek914Cmnl3BPf2DDbPhABzml%2FLKfdbSVFCI5d%2BK%2FrEXetoyEcbVxF1WI86PYZkWxthH7Lb4NAOGVM\"}]}\r\npriority: u=5,i\r\nvary: accept-encoding\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: a3eb630328c0dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1832,"size_decoded":1925,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c92e7bc2897473c42cc4cb1a9896427a","sha1":"551a4fe3a34491cd1447f21b4c354a1e1f228f5d","sha256":"73484fb6853fe5fe4bbdd83393614d077c6fceff4bbb15a44cfbdf0ae225f4ae","sha512":"a8c3bc89e7845166de88b16049f2ca611363efdd3b1fdafd2d90d0a933b9e88a31bb284fde17fced3a0f1135c7ba4642b3ae5a138651cc37db9769d95a593540","ssdeep":"","tlshash":"d53151e6031483ccfa8fe67eab2eeca8b31f41ab7890c4084e4f47995487586ed17c50","first_seen":"2026-09-21T18:50:38.69605Z","last_seen":"2026-09-21T19:16:00.257444Z","times_seen":2,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":1,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.simpleicons.org/meta/0866FF","fqdn":"cdn.simpleicons.org","domain":"simpleicons.org","tld":"org"},"ip":{"addr":"104.21.86.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.401Z","timestamp":1790018002401,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleicons.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 07:26:27 GMT","end":"Sat, 12 Dec 2026 08:26:24 GMT"},"fingerprint":{"sha1":"5D:DC:AA:EA:5A:47:AE:39:31:CE:3C:5A:40:A6:80:6D:49:73:60:D7","sha256":"20:72:9B:91:1A:D4:8D:B7:50:B4:E5:85:7D:12:5B:FB:A5:90:A8:AA:79:E8:D2:E2:5E:18:8D:FD:55:17:1C:EE"}}},"request":{"raw":"GET /meta/0866FF HTTP/1.1\r\nHost: cdn.simpleicons.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=31536000, stale-while-revalidate=604800\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nvia: 1.1 fly.io, 1.1 fly.io\r\nfly-request-id: 01M2XWJKGS1F63KBM1WEKAPQ6A-arn\r\nage: 161074\r\nlast-modified: Sat, 19 Sep 2026 22:28:47 GMT\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O5o%2B%2BbRWlINRYipNyT1LMweY2y0MsqG0Y9ZfyRgO8J1gErch4DrtKfa%2FHajOLzSXDqPcCOsCsbLCrD5gdEcwn7%2F%2FZWl0tCOcufO6OJVnZJMClslVLMPT6hyx5TcRO%2BqXuI6cJgiP\"}]}\r\npriority: u=5,i\r\nvary: accept-encoding\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: a3eb630328bedfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1339,"size_decoded":1711,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a4d6947d11019d014c98e230005afd98","sha1":"47c66a721bd1678da1e4245c3119bcd6dd1d92a7","sha256":"bd0e76c68aa4af5b07e874c70a8318677f0d19610c764fadb4f7823d0cc7e21d","sha512":"52e23674c46a28ed7714b6d1ca0c228779860708e5ad397aa0ce2418262b14e48c935e4c870b390088e1dd15a177641ee88378572cf62f68e02a7e4e22415243","ssdeep":"","tlshash":"9a21f1da0330d18ca9cb9886ee213dd9725ff47e7da752c4da4cca9502c3ec8a946d14","first_seen":"2026-05-06T08:22:18.204343Z","last_seen":"2026-09-21T19:16:00.258381Z","times_seen":6,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/favicon.ico","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:23.262Z","timestamp":1790018003262,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-length: 15086\r\ncontent-type: image/vnd.microsoft.icon\r\ndate: Mon, 21 Sep 2026 19:13:23 GMT\r\nlast-modified: Sun, 20 Sep 2026 02:03:29 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 67f9f44737c054d8e7e98fbf5d0cf6db\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":15086,"size_decoded":15464,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"08c07eb48cae7e44d1975d1b38117204","sha1":"862fcc59ddc98cfaee0dee3ec9ce7730c04fcf4f","sha256":"d0236541eb5cd065f6b59f05d7bf51b2311f286f6977173e55176a6544852a59","sha512":"3443222c8c31d89935a47f9d3c7a69e28c8f85dfea48c5ced2f8c2a734f438a08a0e3fb28267e06dc0f797b01811a8527dce5bb51b0e537a630803e4caf2a86d","ssdeep":"192:HPFPJqng+kEs9rpPM9DlKiKKKrfHZGp2vxuAWb7HPKgZFiH:vFPJqwEsczKiKKKrfHIp2vxuAWb7SwF4","tlshash":"e46221501ed0d84bf354c83ec0e0dfbdab7866791f8a86935dba999e631d37c2ca0112","first_seen":"2026-09-21T18:50:38.689471Z","last_seen":"2026-09-21T19:16:00.260162Z","times_seen":2,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.020Z","timestamp":1790018002020,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://hoodpay.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 24836\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 15:57:43 GMT\r\nexpires: Tue, 21 Sep 2027 15:57:43 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:08:28 GMT\r\ncontent-type: font/woff2\r\nage: 11739\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24836,"size_decoded":25648,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24836, version 1.0","md5":"938c6e8019b69313372c47dbb7a7c930","sha1":"b42951014c5eca12749d87a4706caf22dc4fe081","sha256":"a30ddcd349703aff7464c34bef3fffdff405ee50c113440d7c8693c02d210972","sha512":"5537c005cd8f321f26fe67f6292b3ec14e88ff4b2365311628dbbe4753e01e568f6881b9f2e7d71e8e6b2c261ed25f372829dd28f89f865ce574b4e1fec29614","ssdeep":"768:3KQaj5c95F1QmIwa55Go1COpZLpkkM46CU+YIC:ahj5cXow65xCM5pkkM468YB","tlshash":"a2b2f105ee49b3d4b276f1fcfa802884179282f27dabda8f3f2015981dd8e5b8d45320","first_seen":"2025-06-02T20:09:41.98255Z","last_seen":"2026-09-21T20:54:05.33987Z","times_seen":47097,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":27,"dns":0,"connect":0,"send":0,"wait":38,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.simpleicons.org/apple/090B08","fqdn":"cdn.simpleicons.org","domain":"simpleicons.org","tld":"org"},"ip":{"addr":"104.21.86.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.394Z","timestamp":1790018002394,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleicons.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 07:26:27 GMT","end":"Sat, 12 Dec 2026 08:26:24 GMT"},"fingerprint":{"sha1":"5D:DC:AA:EA:5A:47:AE:39:31:CE:3C:5A:40:A6:80:6D:49:73:60:D7","sha256":"20:72:9B:91:1A:D4:8D:B7:50:B4:E5:85:7D:12:5B:FB:A5:90:A8:AA:79:E8:D2:E2:5E:18:8D:FD:55:17:1C:EE"}}},"request":{"raw":"GET /apple/090B08 HTTP/1.1\r\nHost: cdn.simpleicons.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=31536000, stale-while-revalidate=604800\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nvia: 1.1 fly.io, 1.1 fly.io\r\nfly-request-id: 01M32P67GSQ48TVMCC44CA0RQM-arn\r\nlast-modified: Mon, 21 Sep 2026 19:13:22 GMT\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6Iun1S8jNCO%2F6w2AUcXEofdfUcABJ6J3IWaEY02Mj9FfOgH5BFf3YeMYdT%2BhwQkEq18GTIbrewdW6dx7hA5fmE8SiCTjGZTb6TpGYyQOQSkSUNP4YAJQsweymOcI0lARjMzYeyNX\"}]}\r\npriority: u=5,i\r\nvary: accept-encoding\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: a3eb630328bddfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":665,"size_decoded":1349,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1758ca4f23e3fc286d5eba189c911585","sha1":"1df8ed4a07ff6d9df7372ca6b11d83fd2962961f","sha256":"dbd47de94af97deec0cdd035924e88b9b976838df216480fdaa0e1522a41c56a","sha512":"28dbaaa5386ccccd79068cd9e3904fbc66801281a2ce54310c36dbe3c0ee39c9a45a243cfbf6d0725113fbc42fc36e61169d382c11a842ebb4b6ebe4dcd53073","ssdeep":"","tlshash":"2b0123ed17b4c54581eda958feb3ed48560af0fe1af090dc494d4f450093bd1f002a80","first_seen":"2026-09-21T18:50:38.708879Z","last_seen":"2026-09-21T19:16:00.261097Z","times_seen":2,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":6,"connect":20,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"t2.gstatic.com/faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=oracle.com\u0026size=128","fqdn":"t2.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.68","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:23.325Z","timestamp":1790018003325,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=http://oracle.com\u0026size=128 HTTP/1.1\r\nHost: t2.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-location: https://www.oracle.com/asset/web/favicons/favicon.ico\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"media-favicon\"\r\nreport-to: {\"group\":\"media-favicon\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/media-favicon\"}]}\r\ncontent-length: 1243\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 06:54:00 GMT\r\nexpires: Mon, 28 Sep 2026 06:54:00 GMT\r\ncache-control: public, max-age=604800\r\nage: 44363\r\nlast-modified: Wed, 09 Apr 2025 01:17:51 GMT\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1243,"size_decoded":2096,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"c0b040cbdaa454051f2c4e88e99e8f59","sha1":"6f17cad963e2917ff96d579418271508e2269cc4","sha256":"c20c4ae2ebd375a3262e14609f3cc9de36ea5ff0481b7c3fd5b9ebb0983a2460","sha512":"a53a09ba1ac46f4fcc12898d16e87ce0304bb7286beed8dec4af6b569f2965f9616dd753c0d7cfb4babe28628a895f72cd8d1394fed89d653f2b46f6a3746412","ssdeep":"","tlshash":"6d21b7dd9015cd4f1c33067540069da9596beadc719e7bec4074793f74caa621d01857","first_seen":"2026-04-03T17:35:47.57439Z","last_seen":"2026-09-21T19:16:00.262042Z","times_seen":13,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":15,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmmono/v16/aFTU7PB1QTsUX8KYthqQBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.023Z","timestamp":1790018002023,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/dmmono/v16/aFTU7PB1QTsUX8KYthqQBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://hoodpay.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 14820\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 16:05:13 GMT\r\nexpires: Tue, 21 Sep 2027 16:05:13 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 17:10:03 GMT\r\ncontent-type: font/woff2\r\nage: 11289\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14820,"size_decoded":15632,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14820, version 1.0","md5":"e1ed461ac183567c761537bf3eb4a574","sha1":"1a0430d40513f1eb6d4596c552b4f58761a1a0fd","sha256":"e1896b13b2b1bb112fac2f9571bd6c40e118746e77a4511edbf43fbb41bf3e1e","sha512":"02c5f74e2a41d205b7c44981bd69a8539038668c4ffab49679825178da648d8b7a870c9c147671f92753d6fd4f55baac3f0d737a9882f6c72e296a116cb7d3c0","ssdeep":"384:ZJRKFL7Wd/jIlLKEDiqGK0qvWoLlqAJB4XJ:fR6MZqGevbBVJOZ","tlshash":"f462c0fcbabc52f7c61b2a5a11482d32201660ce7271c5109aff541ceef928ad619f66","first_seen":"2025-06-03T07:55:52.433002Z","last_seen":"2026-09-21T21:48:42.459771Z","times_seen":4080,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":20,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/api/session","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.029Z","timestamp":1790018002029,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /api/session HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 13\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\netag: W/\"d-O3i+ap2cff5bxhPRN8PyzcjObvA\"\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: e9e1b7df0f53bdf0e7e98fbf5d0cfa74\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]}],"data":{"size":13,"size_decoded":391,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6d3600a46bb738376a1514eae93988bf","sha1":"3b78be6a9d9c7dfe5bc613d137c3f2cdc8ce6ef0","sha256":"2e7fe66d0f26a4cc5aaad5f34dba496c7988c175f79b24dcfa414a1dba289c0a","sha512":"e09a82f35923dea8be19633df341b29240143f583ffb7c10fdd8acb20a9c923870e0a0dcf93bc7299ea408659db53e153d2231e0b319a082dce500bd55a15b94","ssdeep":"","tlshash":"1c600000cc0300003000000300000003030c00c303000c00c030cf0000c00303030000","first_seen":"2023-04-10T14:09:19Z","last_seen":"2026-09-21T22:51:45.241761Z","times_seen":3442,"resource_available":true,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hoodpay.lol/apple-touch-icon.png","fqdn":"hoodpay.lol","domain":"hoodpay.lol","tld":"lol"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:23.261Z","timestamp":1790018003261,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hoodpay.lol","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 01:08:50 GMT","end":"Sat, 19 Dec 2026 01:08:49 GMT"},"fingerprint":{"sha1":"FF:F2:7E:03:F8:C9:09:1D:C7:F4:49:D6:DC:F5:A8:76:25:50:75:FE","sha256":"26:13:06:C9:0D:81:54:7B:43:46:3C:47:1D:DB:BC:5B:A4:14:1C:8E:33:9E:59:94:5D:BA:0F:57:00:A7:F2:65"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: hoodpay.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nCookie: GAESA=CqIBMDBhNDFlOGMxZDBiMTc4M2Q0YWI0YmRjZjg3N2NmNTRmNzM2Y2Q4NDI5OTFlZGFjYzlmNjYyNDljMzBlMGM2OGNiZDYwZTQ4NWIzNGMyZmJiY2FmYjkyNDFjZmUxMGIwNzcyOTk1NzA5MzJhOTUyYWVlMzg3ZTlhYWM2OWQ2Yzk2Y2RlZGRjNTA1YzFmMjE4MjE4OWFjY2I2NzAwZGI3NTFhEMOpjKuMNA\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-length: 29437\r\ncontent-type: image/png\r\ndate: Mon, 21 Sep 2026 19:13:23 GMT\r\nlast-modified: Sun, 20 Sep 2026 02:03:29 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 280e27c14be50ab7e7e98fbf5d0cfba6\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]}],"data":{"size":29437,"size_decoded":29825,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"03bcaab21e73ecd1e7faadcce3b9a83f","sha1":"0c7aa3da56b1de2985c0b014bec6df71848f5104","sha256":"16b7d8036f42254568d064ec19e6abb5f0e09a29d6c632fdaa3a72ec4bbef99d","sha512":"5188baf31a7e79150da620887a5da9b9dff566f20d9f9bce9c6f12764a31214a130175bb4bd1a3b5ea9bde9f962a59d4bae6e593075d6502547ceba3322c9eda","ssdeep":"768:WLwra1gzrsV7GPKr5doxZ6OJyo3fbR+lRafnxhNqo2M:XigHo6PFEOfQ8","tlshash":"e2d2e11b696152438db9393865acca34463b234f2b15784a1f3dfbb69d1ec0f00a7eb1","first_seen":"2026-09-21T18:50:38.714519Z","last_seen":"2026-09-21T19:16:00.264439Z","times_seen":2,"resource_available":false,"data":null}},"time_used":718,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":661,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"hoodpay.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"t2.gstatic.com/faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=microsoft.com\u0026size=128","fqdn":"t2.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.68","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:23.311Z","timestamp":1790018003311,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /faviconV2?client=SOCIAL\u0026type=FAVICON\u0026fallback_opts=TYPE,SIZE,URL\u0026url=http://microsoft.com\u0026size=128 HTTP/1.1\r\nHost: t2.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://hoodpay.lol/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-location: https://www.microsoft.com/favicon.ico?v2\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"media-favicon\"\r\nreport-to: {\"group\":\"media-favicon\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/media-favicon\"}]}\r\ncontent-length: 426\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 17 Sep 2026 07:18:58 GMT\r\nexpires: Thu, 24 Sep 2026 07:18:58 GMT\r\ncache-control: public, max-age=604800\r\nage: 388465\r\nlast-modified: Wed, 29 Nov 2017 12:34:19 GMT\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":426,"size_decoded":1266,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"b61c4227f5dcd0ed5368ea1ab8a42ad6","sha1":"9e9990c3cb7c5c18005dc0a4574eaf0338a84c25","sha256":"b6ba5811173dc31f3b64c874651217571d9ac7f7e5f2533db85eb8ee9ef33b35","sha512":"06b7ad5cc366aaebf1faf010e281ea6860c0cbcef09c8d570c9c8d9ce5981fd8e5bb26aab32142e272c98c25a486b43f5f81e42cda527786090a785d60dd4355","ssdeep":"","tlshash":"84e01da451424d3fc34f8e3943460fb0ad33db974288040561a2d97c60f96424042bcf","first_seen":"2025-11-16T10:06:48.369992Z","last_seen":"2026-09-21T19:16:00.265325Z","times_seen":153,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":2,"connect":14,"send":0,"wait":16,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.replit.com/script.js","fqdn":"i.replit.com","domain":"replit.com","tld":"com"},"ip":{"addr":"35.201.95.58","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:20.650Z","timestamp":1790018000650,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"i.replit.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Wed, 16 Sep 2026 16:05:51 GMT","end":"Tue, 15 Dec 2026 16:58:44 GMT"},"fingerprint":{"sha1":"B2:A6:FF:C2:CB:AC:A7:7E:50:06:34:07:8F:4F:F8:12:E5:1A:D4:06","sha256":"52:B1:F7:22:3E:22:71:C4:95:B5:BE:72:74:0D:8A:F3:89:20:AC:C4:38:AA:94:D2:B7:2F:F0:2D:AA:CD:E5:7A"}}},"request":{"raw":"GET /script.js HTTP/1.1\r\nHost: i.replit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-security-policy: default-src 'self'; img-src 'self' https: data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; frame-src 'self' http: https:; frame-ancestors 'self' ;\r\ncontent-type: application/javascript; charset=UTF-8\r\ndate: Mon, 21 Sep 2026 19:13:20 GMT\r\netag: W/\"122f-19efbfe1fa0\"\r\nlast-modified: Wed, 24 Jun 2026 23:36:36 GMT\r\nvary: Accept-Encoding\r\nx-dns-prefetch-control: on\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4655,"size_decoded":2970,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (4654)","md5":"3c5c69689503fcb6227ba5e54dffb141","sha1":"b23c650c90318c6a629f1f9e2539b31dc2c42b8c","sha256":"1ad1145d19d4558c20f5469ca4a5fc50a1a46f860858c9c91bfcd56fd29a522a","sha512":"f32e31f1726b530d2e7fab27e14db15909dbdfc2db3257cdf29c9b93866049ec1eeaf05373333bbfc63bdea8b0153d267b272f2c6b0080ba2c50e19c4b4a397e","ssdeep":"96:5hkivaqIDvN+5sH8y1TB/7a+45zAx8QfqNGvCKabPane8Ew3EFB4:5hkQaqmANy1TB/u+iAx5ik6Kcce8Ew3J","tlshash":"5ba13ce1f152b4b62bba9cd291742221b2361bb1f8428094e97d1c975e3d18b647ff2c","first_seen":"2026-06-26T19:34:37.316581Z","last_seen":"2026-09-21T19:16:00.266079Z","times_seen":1146,"resource_available":true,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":11,"connect":13,"send":0,"wait":156,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.018Z","timestamp":1790018002018,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://hoodpay.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 24836\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 15:57:43 GMT\r\nexpires: Tue, 21 Sep 2027 15:57:43 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:08:28 GMT\r\ncontent-type: font/woff2\r\nage: 11739\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24836,"size_decoded":25648,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24836, version 1.0","md5":"938c6e8019b69313372c47dbb7a7c930","sha1":"b42951014c5eca12749d87a4706caf22dc4fe081","sha256":"a30ddcd349703aff7464c34bef3fffdff405ee50c113440d7c8693c02d210972","sha512":"5537c005cd8f321f26fe67f6292b3ec14e88ff4b2365311628dbbe4753e01e568f6881b9f2e7d71e8e6b2c261ed25f372829dd28f89f865ce574b4e1fec29614","ssdeep":"768:3KQaj5c95F1QmIwa55Go1COpZLpkkM46CU+YIC:ahj5cXow65xCM5pkkM468YB","tlshash":"a2b2f105ee49b3d4b276f1fcfa802884179282f27dabda8f3f2015981dd8e5b8d45320","first_seen":"2025-06-02T20:09:41.98255Z","last_seen":"2026-09-21T20:54:05.33987Z","times_seen":47097,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":27,"dns":0,"connect":0,"send":0,"wait":46,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.simpleicons.org/tesla/F3F5EF","fqdn":"cdn.simpleicons.org","domain":"simpleicons.org","tld":"org"},"ip":{"addr":"104.21.86.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.406Z","timestamp":1790018002406,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleicons.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 07:26:27 GMT","end":"Sat, 12 Dec 2026 08:26:24 GMT"},"fingerprint":{"sha1":"5D:DC:AA:EA:5A:47:AE:39:31:CE:3C:5A:40:A6:80:6D:49:73:60:D7","sha256":"20:72:9B:91:1A:D4:8D:B7:50:B4:E5:85:7D:12:5B:FB:A5:90:A8:AA:79:E8:D2:E2:5E:18:8D:FD:55:17:1C:EE"}}},"request":{"raw":"GET /tesla/F3F5EF HTTP/1.1\r\nHost: cdn.simpleicons.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=31536000, stale-while-revalidate=604800\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nvia: 1.1 fly.io, 1.1 fly.io\r\nfly-request-id: 01M32P67GX0920NQKTRH2DDSE2-arn\r\nlast-modified: Mon, 21 Sep 2026 19:13:22 GMT\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F%2FCQIRkkXvg3ySyAZAbHS5KEQ65sEMKTIe2cF%2BLAW5wL6m0VH9oEb8be78%2BwIuUjFm248mWlXVAfqpNlkfgNucsGVY6FfXYvfZ2QBIlB1B0ELGkoAKeTlfu3kSWnkwj5U%2Bi7SENc\"}]}\r\npriority: u=5,i\r\nvary: accept-encoding\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: a3eb630328c2dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":556,"size_decoded":1303,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8eb704ef1666c0d7f21195267b6a376c","sha1":"3505a15bc8211415f9dd6b92a52cec8be2af70ad","sha256":"91a3775937559198e9560bdea7341f976f2e34fa004ce454dc3367e2378d1b69","sha512":"04024deff40b9939487114ff1f34b97343867ad241800bf2adf8c6953be88ee41d50fab0f7b104c10e0ef4ab9665cc05ec9b805aad00a5f93abb1288b0bc760e","ssdeep":"","tlshash":"86f026d4cb786d4ee18c4d513f6038550e7e84fbbe5185204a85cfd194566e27f0cc08","first_seen":"2026-09-21T18:50:38.685386Z","last_seen":"2026-09-21T19:16:00.266787Z","times_seen":2,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":77,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.simpleicons.org/nvidia/76B900","fqdn":"cdn.simpleicons.org","domain":"simpleicons.org","tld":"org"},"ip":{"addr":"104.21.86.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hoodpay.lol/","date":"2026-09-21T19:13:22.408Z","timestamp":1790018002408,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleicons.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 07:26:27 GMT","end":"Sat, 12 Dec 2026 08:26:24 GMT"},"fingerprint":{"sha1":"5D:DC:AA:EA:5A:47:AE:39:31:CE:3C:5A:40:A6:80:6D:49:73:60:D7","sha256":"20:72:9B:91:1A:D4:8D:B7:50:B4:E5:85:7D:12:5B:FB:A5:90:A8:AA:79:E8:D2:E2:5E:18:8D:FD:55:17:1C:EE"}}},"request":{"raw":"GET /nvidia/76B900 HTTP/1.1\r\nHost: cdn.simpleicons.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://hoodpay.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=31536000, stale-while-revalidate=604800\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ndate: Mon, 21 Sep 2026 19:13:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nvia: 1.1 fly.io, 1.1 fly.io\r\nfly-request-id: 01M020FJ4GHB6SDTGBBBC3T37X-arn\r\nage: 3243988\r\nlast-modified: Sat, 15 Aug 2026 06:06:54 GMT\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n0R7hok7k8kWNzaJQkVMQ%2Bhg3E2aOOLDa3i4rruOUsfDGGrCUXyE5HmNX%2Bwknga0fe8hrfYDjs7eva5K0gkW2NEk2FHWFf4FybVUvtFb7QGvIALH90hZTwDOjqAa8Me4CRgCOzEd\"}]}\r\npriority: u=5,i\r\nvary: accept-encoding\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: a3eb630328c1dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":896,"size_decoded":1487,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f5086437d06a7f84f703700476950c57","sha1":"cb8a2c3bd48070a05a90ac870ca57669bfe73bdc","sha256":"db04aa87719392f22aa280fa0c9086d70d9e805024749747676fea820f7b00b4","sha512":"2d601d99f010c8a2cabc3b94c18badcf7ea19d06d879c12ddbf4611a53b252ca8d7e7fe103befdd3ed95f2a296a96978c8d49ec843ed013cef10a1a3ebd3c823","ssdeep":"","tlshash":"0f1163ad8770a6cd61d50addff3a595ef62fd05116f90395c2ce971162c69cbb8008f0","first_seen":"2026-03-21T18:46:25.928595Z","last_seen":"2026-09-21T19:16:00.267756Z","times_seen":8,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}