{"report_id":"74ec8670-1ddd-441c-ab53-2b5df767857d","version":0,"status":"done","tags":[],"date":"2026-08-19T23:08:33Z","url":{"schema":"http","addr":"paytrust.click/","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"104.21.35.8","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"paytrust.click/","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"title":"Trust Card","dom":{"size":33105,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (30459)","md5":"0a1d007bc273ee19f583122fe0b8a277","sha1":"80d422945dda1d2f9db831d78fdd11457fde7d1b","sha256":"7e1693399d157d2139f0295f93592191f85375e8e6b8dfd7941ce8ce2d652c8c","sha512":"3546fd4c70348a3d87fa65d549f35470ac03f5f6099082acac6187c2309896c5b28b6dd253875c23592a79063ba28a7a94667592f5e38eb876cd0c5197eb46e7","ssdeep":"768:GGZqZC+McVyhjyeWaw1oBSPiBpj/TPjJN1A4HwZTIIoA:DEVyhj3WamoDcIIoA","tlshash":"a3e2863412151d3f27134ad4f7e1bb7951ade34aca27895cb3bc01b32fcacd8899a685","dom_hash":"domhash194c40eecfaa912bab3140ee64117501","first_seen":"2026-08-19T23:08:40.024982Z","last_seen":"2026-08-19T23:08:40.024982Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"paytrust.click/","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"104.21.35.8","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-23T23:08:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"paytrust.click","ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-19T22:38:05.910229Z","last_seen":"2026-08-19T22:38:05.910229Z","alert_count":27,"request_count":27,"received_data":7857337,"sent_data":13180,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-16T22:23:57.509837Z","alert_count":0,"request_count":1,"received_data":15846,"sent_data":538,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-16T22:20:46.906465Z","alert_count":0,"request_count":5,"received_data":246720,"sent_data":2865,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"paytrust.click/","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"034bd9aaaf7da282271487f74981630b","sha1":"e7b54645f864d99b9bbbfbe47070c304e045a74e","sha256":"040a3b8cb9b28250321e1a47ccd727c16b4e59c2588f4dd03df2db2833170baf","sha512":"f7dfbb85803a6f398f47c82b844cff0910da6cb9f8a68c73dbca44506fcce3a70271e005b8f45a32d0caae4910480c1074c5d7c53ae68357d80f7dc06e09c688","ssdeep":"","tlshash":"ecf0dc9f2c43a45737fe2639c767aa6b2b62070278c2d815ba41c4643fd49d61c42dce","size":479,"data":"","first_seen":"2026-08-19T22:38:11.294423Z","last_seen":"2026-08-19T23:08:40.06774Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/assets/index-zXMmog4c.js","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d2e1b8fbb72739dfea1f0d3c3417cd3a","sha1":"d59467c5fcb1b32b7125f14948210e12d6ccd52e","sha256":"b5db2346a2b142bf74d32b77da94a656fc691b786c45bc75d6af35095b22d471","sha512":"78aa7784489dd6588d3b0679473c514106dde486ea80f4fe263180c83216d0fea3bfeb8d79989f71af84ea5cfc80befb5926b1452562b43f07a4377065c84f0e","ssdeep":"6144:WEihW/M95vsNaXfo8P+QeDsJgE50cRoqfyCjaLHnUZg2YF:Kh1FuDsJgE50cRosyCaLHUBYF","tlshash":"6ba48ee83294b161579342a6805f0a0a733954b5ac4ec538b560feef35f0489d1bbfbe","size":479466,"data":"","first_seen":"2026-08-19T22:38:11.288867Z","last_seen":"2026-08-19T23:08:40.036132Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/sweep-flow.js?v=61","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c7655661461fe74e59a9680a06621210","sha1":"9fd5930fd9cc4ca9d6b282c2b4e8f20e7a6811f5","sha256":"e294b1755cbc301c612147da68f8d22d968c5afe6c429852beda8da3b2259dcf","sha512":"ce7a2b82fd94fed4bd03ffe0e07e4ca321b7a4272bc222f07ddd44f8949dfb0ae1411c7a6454bb0b072fdb4b569bc0ac78079f499a15fb73c6aad43e8ea49b0a","ssdeep":"384:DGuRcDLTyDPyw5oJ2q1TcJYb7O1Zma2gA+5ITIvpxwPamB:DGbcvUPaq","tlshash":"32b2c76e68d720a94663703d8b9fa0183a359457388fca107c9cc5606fe4738dbb6bdd","size":25660,"data":"","first_seen":"2026-08-19T22:38:11.274211Z","last_seen":"2026-08-19T23:08:40.049781Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/card-flow-i18n.js","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"459709e84c80976c63927e5646230424","sha1":"c25ad15fe6878669b3cb143dd96079713b9cc769","sha256":"c5fb0fda4472d73005a54fab085f6c607f4c731db7a3e2c40f7240f55b3efb5b","sha512":"8aef6cbf86ed41d2e27f7c9430e86a30b0474336bf61229e62f9bc3d2e5cb78f0b2a74771c2627e5568b92e0f737f74843ba31027578d2d65c7b4307da02abc7","ssdeep":"768:EUOPT8DWjV1oIqxlKq1nAHz9zwvTT+ZlNFpeF4x:EUOPT8DWjVFqxhVAT9zwP+/NFYFS","tlshash":"33c2b7584b5810fd0282935960426747222ea1fb8f44759d37acd6b92f4f1afb0fe1af","size":28194,"data":"","first_seen":"2026-08-19T22:38:11.238532Z","last_seen":"2026-08-19T23:08:40.038202Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/card-flow.js","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"49f42696a9810bfa85988a5958a79c13","sha1":"67eef260d8573f2eeac0b468d9cb006957f8d956","sha256":"beccf6d09e623d6f3e388d510ae07632883dfb15ddb07ccac7d7c900cb19d049","sha512":"98fc481e580529f6c5a13beb00db1f75c362fb68dfe468ca60b6f9ca80b1abdc2d702a5c00ea74264d5d9c1c2515220049ca0bc13d19a69fb88b0e204fbd3bde","ssdeep":"384:9Vz70OOsNDUZN+XEHl+alC+KNexC+Jos5tvvzxaK0mVAlrosJltU0zPNKPK++w0S:/fP1DHnzKi3x/Vb6f","tlshash":"f3d2e82811f8193d0223119d876b61173536e683ea8ec509774c47b21fdacaae9bb3dd","size":30310,"data":"","first_seen":"2026-08-19T22:38:11.290408Z","last_seen":"2026-08-19T23:08:40.064735Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"paytrust.click/benefit6.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.311Z","timestamp":1787180880311,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /benefit6.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ad-1bce\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:41 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IfMIS7D3yePv5kjsngYsorXS0hW8IPjYDxdWZYiMa0F0hvMiihvV0PRcxDdDboJVdCLnONnZiPV%2FRng46BfHd0Wv8kBfQrVnJH52%2Bpu5u8nb%2FoO9hm2yCPBm1NoTWY1exg%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155efc5b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7118,"size_decoded":2722,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"09a9977bfe977ac4e405eb0ba43f07d2","sha1":"90d4b8bb58683e2076e248a67759331f883befbf","sha256":"278edfd8be3da161082664057cfb31bf4f2c416238b9380f47427495c9d69db3","sha512":"52020259721f5b96b18870d0ec8710418ea7798a64b3a2aff1956f8daa105a0fd3dc60a951d81122c1a456f6413911bd9feb8d24b65f02f21a81af60c5983ab0","ssdeep":"96:cqhVKlr2fNV0338FAFfIDzIZrCfhUYa44VHH5ObSGmEOQa44VdbJQXiCKX9V4id1:BZNqnUmNJ5Ob3RuZ5jvqW","tlshash":"83e10cca3758497cbd369382eb02b27a606a44e317c4e630cb32593d285191e9dbfed5","first_seen":"2026-02-11T15:17:55.588479Z","last_seen":"2026-08-19T23:08:40.028521Z","times_seen":75,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.438Z","timestamp":1787180880438,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:53 GMT","end":"Wed, 28 Oct 2026 20:43:52 GMT"},"fingerprint":{"sha1":"91:24:44:08:3E:65:60:72:3B:18:06:E2:82:7E:C0:8F:97:46:5D:B2","sha256":"71:59:B7:BB:3B:E8:E0:81:C8:B6:24:A3:57:11:62:47:10:A1:3D:E4:38:30:54:27:2E:19:C8:96:02:25:52:DD"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700;800;900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 19 Aug 2026 23:08:00 GMT\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15162,"size_decoded":1524,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"b8d3b4b9d4ee8cae44e2afcef48e7a93","sha1":"ea3c361f22fa31fb8612dd2ca30f1ac7ba03f75b","sha256":"7c966efd5a04f87920e8cef5c332c73b0d529b21c46fa312ff0020047d882c35","sha512":"7418cc24da4237fed57bbd3e92618985c30c29ab320908f146d0fe954c6a49e179007537480bfc7f2bf76e76a47da055c6cb6fb2744991e0c3a471c88fc06f08","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGfNx0NO3kCxHYNCbOO3L+:vXuM0p2+g7GQK","tlshash":"c2628892002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-11T12:17:30.699497Z","last_seen":"2026-08-20T00:41:09.143108Z","times_seen":4676,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":2,"connect":15,"send":0,"wait":35,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/favicon.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:01.149Z","timestamp":1787180881149,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:01 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216af-4be\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:43 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V%2BYVbbdwlX3kskIXxn6j0ULBNOw8C46ZbfkXq5NFfOathNU1%2FPqlTxUbDHWDU8VKp5cnDvKXmmpuxnItQlBpDvBwN5GswNISKHafQ%2F6XqS4QWAKIy0DDJKcn84np4bqF3g%3D%3D\"}]}\r\nage: 1838\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd15b2825b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1214,"size_decoded":1096,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f3d6c2b61ac4510ae8fa2419438c5d33","sha1":"f1dd28d44da59cd85b6dac1ffcb26182c63e589e","sha256":"62c830b2a83ee7f9be93d00e9b5e2c267d3a936cf52cc18831c7f640aa71ef20","sha512":"d3cb6a1d552db27b38f5255e6d1ed71c375c4cd4b263a03f60035cf6bdf810b830b9864fb806468e046bde52a763a5d055dc6b5e03d0130dba548dee78a4e0dd","ssdeep":"","tlshash":"65217f17bb5adb37e699c14ce804d4a4116ac1dba9c1c391d2e5ef0f14586c32d0ebc1","first_seen":"2026-08-19T22:38:11.287435Z","last_seen":"2026-08-19T23:08:40.032337Z","times_seen":2,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/css/wc.css","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paytrust.click/","date":"2026-08-19T23:07:59.967Z","timestamp":1787180879967,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /css/wc.css HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: text/css\r\netag: W/\"6a8216b3-788\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:47 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vTOyPZg4IER73rG8SHQJCJ1FdjSpz5SwSil8PBtVpPqFijgLHCJEvkXq6uClEJM%2FILlAsui1nTcMIvLCIOt7yIJ%2B%2BAoQVLk%2FetEh6gENs87%2BcsUOdfCW4s%2FdYXLB4AI3QA%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd153cf71b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1928,"size_decoded":1528,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"60a9f3abd602c3ef5a66e021a55f1994","sha1":"4a0f0d134ec7045bc69514537563a0f2dbe5e772","sha256":"f262512ef3e1ae76ac23c4d53b2e0b0eb340bb7237b2e0e95dc44d392b584bca","sha512":"1546bb2d4755ce8bdcf28659b88dbfcb7cf7a1be96316fd182d9057cadabf7d556d400b35909948f1eaec40d6d55f9d6d39db5827f412401c9e4dac8b4725664","ssdeep":"","tlshash":"8b41a6863b2a0410362384a435e25f58233d9602971bdffd6be1305cdec41e8f2b7398","first_seen":"2026-07-18T17:42:15.177912Z","last_seen":"2026-08-19T23:08:40.034845Z","times_seen":4,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/assets/index-zXMmog4c.js","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paytrust.click/","date":"2026-08-19T23:07:59.971Z","timestamp":1787180879971,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /assets/index-zXMmog4c.js HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:07:59 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a8236a3-750ea\"\r\nlast-modified: Sun, 16 Aug 2026 22:16:03 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rDoh1LhNKj%2FXxaIK9UFmE8fs7eFY3xvZmn8AsAGtQJgFIhcEjpp%2FkJ7AraB%2BTZoU1GaCkSeoTeP%2B5qCLV71n2f6uNsv8P5hCaVqngqWfwu1vhc6Ayn6ym5mlRsF3pRwtHw%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd153cf75b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":479466,"size_decoded":157525,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (43071)","md5":"d2e1b8fbb72739dfea1f0d3c3417cd3a","sha1":"d59467c5fcb1b32b7125f14948210e12d6ccd52e","sha256":"b5db2346a2b142bf74d32b77da94a656fc691b786c45bc75d6af35095b22d471","sha512":"78aa7784489dd6588d3b0679473c514106dde486ea80f4fe263180c83216d0fea3bfeb8d79989f71af84ea5cfc80befb5926b1452562b43f07a4377065c84f0e","ssdeep":"6144:WEihW/M95vsNaXfo8P+QeDsJgE50cRoqfyCjaLHnUZg2YF:Kh1FuDsJgE50cRosyCaLHUBYF","tlshash":"6ba48ee83294b161579342a6805f0a0a733954b5ac4ec538b560feef35f0489d1bbfbe","first_seen":"2026-08-19T22:38:11.288867Z","last_seen":"2026-08-19T23:08:40.036132Z","times_seen":2,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/card-flow-i18n.js","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paytrust.click/","date":"2026-08-19T23:07:59.983Z","timestamp":1787180879983,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /card-flow-i18n.js HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:07:59 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a8236f1-6e24\"\r\nlast-modified: Sun, 16 Aug 2026 22:17:21 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sWtdIuhPP82XW2glfbIPYzcQoFsu0LUd8Y0GteSCfST9F%2BIczmvUUAbJYFbwbFqMX%2BiopI6ArJtoPDuX5cnpPmyM0QsV22QUhjCUWDZ%2FTDnRE%2Bl0IFJqKgUV5kNf0QjkHA%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd153ef77b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28196,"size_decoded":9645,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"459709e84c80976c63927e5646230424","sha1":"c25ad15fe6878669b3cb143dd96079713b9cc769","sha256":"c5fb0fda4472d73005a54fab085f6c607f4c731db7a3e2c40f7240f55b3efb5b","sha512":"8aef6cbf86ed41d2e27f7c9430e86a30b0474336bf61229e62f9bc3d2e5cb78f0b2a74771c2627e5568b92e0f737f74843ba31027578d2d65c7b4307da02abc7","ssdeep":"768:EUOPT8DWjV1oIqxlKq1nAHz9zwvTT+ZlNFpeF4x:EUOPT8DWjVFqxhVAT9zwP+/NFYFS","tlshash":"33c2b7584b5810fd0282935960426747222ea1fb8f44759d37acd6b92f4f1afb0fe1af","first_seen":"2026-08-19T22:38:11.238532Z","last_seen":"2026-08-19T23:08:40.038202Z","times_seen":2,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/benefit4.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.305Z","timestamp":1787180880305,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /benefit4.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ad-1e7e\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:41 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cXuOEN8FTqiYwHkx7m3XvfEHhtqwxCnvmr2YDDRi%2Fl8z6eqN8nthUJ%2FGRsOn0T6PYc2Wys0jjxuazGDpFrkx5Czi6Fk46qOHm77N71sOfDYXXFTGqPwpEPI46gTCurp%2F6Q%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155efc0b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7806,"size_decoded":3500,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1ce1bf382bdf03988579a134d40f3921","sha1":"e1ff829a2f0d8f5321d84d908e3cb93dab905bea","sha256":"127bdc6794f588cdc3bf94ab39138ed933ff68a8befe013421ec234002b351f0","sha512":"485bc45d14c71c02ece687f12b949a4636f09a2f5849e3f5834b86ad5a12d1f56b5f737ea56e8e402807c51777801598d9043fc352cc76b4f01e7ec3983e9886","ssdeep":"192:7o1T487sgBAXx+o1T48caSJkfVOBgHMLM:k1TNSXN1TCEYBBM","tlshash":"2cf185dd376856f5f85ac2e2ef12a038301b44bb56d0d620c6666e7c342a04dccbf6d5","first_seen":"2026-02-11T15:17:55.648367Z","last_seen":"2026-08-19T23:08:40.041145Z","times_seen":75,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:01.474Z","timestamp":1787180881474,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://paytrust.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 19 Aug 2026 13:10:41 GMT\r\nexpires: Thu, 19 Aug 2027 13:10:41 GMT\r\ncache-control: public, max-age=31536000\r\nage: 35840\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49344,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-20T02:24:38.044905Z","times_seen":261959,"resource_available":false,"data":null}},"time_used":91,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":30,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/coin-2.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.298Z","timestamp":1787180880298,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /coin-2.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ae-1b5dee\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:42 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C8YaChGITyFJuiWL0lzFQepn0%2F01nCG8CLIPWd%2BwQc3aD%2FNStEWJy%2Bnm0dIZIA5JXl3i8LV06ublApMuerAQWOQo%2FuBzV71tkGYVXBf2iFoKxZ8sdbjAOlCHmff3QoLeIA%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155dfbbb28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1793518,"size_decoded":1332787,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"679dcc59d1ea87802e916859080e6aba","sha1":"5af66ce9537d54796c53a52f689d7e93881f83b9","sha256":"a116d33afa3d2361896caa270db16978e68ead2bed979e0b5cdc6834421ee203","sha512":"6f457c81a67d1fa297759a25e6a630816ba5a51bc85ddd637d78163665a50cb6f0fca73e336c0542d5b725daabda216788fb8ecb1716d7846f876c22bb46fda5","ssdeep":"24576:J3nW0FZBu8LVyNHsOMuaiUZqtSHgGM7djEHLG:VfuyyP8FgFhB","tlshash":"b1252371eaa8cd6c5918c651b07e1ac48ef08de3cfcd6e8073393276a18df19856dc5a","first_seen":"2026-02-11T15:17:55.590228Z","last_seen":"2026-08-19T23:08:40.04325Z","times_seen":72,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":116,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/benefit1.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.306Z","timestamp":1787180880306,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /benefit1.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ac-70fc\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:40 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EwHCMQ7kUeFK%2BP%2Fvtup6P6gFlpvfxsxoFKh22HSvsQTbEYPFZixkSQnuf7bd0mUZ%2FediCbzPwvt7bqQcBnJVt%2F4UHq1bzfmjKUdOOX92ZVtv1X7rGpNKVCjmoP9Ws356oA%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155efc1b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28924,"size_decoded":9849,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c2b45b63af2e789e308494b1c39eb30b","sha1":"a515a2b4874b574c8b8867806098e4f9911e4f11","sha256":"c4db6bb328ef78023c9182449c928af831feb01021d4bccd650b6d0c354c12d6","sha512":"bbdc3a13ac7aaa13973bac44c15f9e33b8a381ee94405a669b4069dd61649a7f94d92d6714555f7d52daf70b6576bdc93d93d439f3ad0dc0598310acb63b2d08","ssdeep":"384:C4qAlAemnXq21Ig9JX5k5Z0XLeeUUUoULEsfqEqklflsKcPez:C4qxemLPDGCMhN","tlshash":"60d2c7ee37140cbafc16d3eaeb0220bd502b54bb6ac55720c6299b29344685dde7fdc1","first_seen":"2026-02-11T15:17:55.635436Z","last_seen":"2026-08-19T23:08:40.044206Z","times_seen":81,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/benefit3.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.307Z","timestamp":1787180880307,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /benefit3.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ad-171a\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:41 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qcg9paHbnCzy0nass0paZdQZdLZyF%2B6B%2F%2FWnmVKDo9xKipjQuFh3lw3xUTwrnBictdd0xBnFFpGfzrAOIsU%2BsZk0SkHeMJe9qXV31Q3DCHHPRpLz1cb376vOeWNdLMxNTw%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155efc2b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5914,"size_decoded":2101,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cf29f6b43683fa8462f27d6b643cc872","sha1":"0ca16d391a77d59bebad3d80ad8392d714b16465","sha256":"0cd370c7deeb7481811226d092c3854796df2a5fb58390f5298483bb22f8aede","sha512":"f44ca85002088eaf763b07480166e2593ba5485223000ee566104f5591cb18088d45696cccf9a7182dfd53582d7ca7f5e757de252a9ae452b28fc3ef182ce1ea","ssdeep":"48:bx0B6A+Ld2JJZdLXj3fALg3XLRDYL/atJJZUYb0ENQ+F5HgUBVJAohL8SLbFX88t:qBJJZpDFTJJZhBlGCZfvcUmckJiUcBcQ","tlshash":"c8c121aebb68dc37f559d3eeca01e139115641ab7580c260c1a8ef1f14164e6ae2fac4","first_seen":"2026-02-11T15:17:55.633592Z","last_seen":"2026-08-19T23:08:40.045056Z","times_seen":81,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/benefit2.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.308Z","timestamp":1787180880308,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /benefit2.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ac-346b\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:40 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CDe%2FKnQk%2F4n9GUBmSi4jFnz4Q2OSbXfj0StCq7LMSVgiWzMWJ02IExu0LBHehiWlBlK%2BcKOJaB3r37JohcZFI50wgSKzvq8sqhXFq0BYGvN4H5GTT%2FDQ%2B4puH4vTxqbc%2FA%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155efc3b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13419,"size_decoded":4407,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1a4bf8d0dd48561b2b531f16994573da","sha1":"9e5547a87fcf112dfb398bfb61ebc00e7025558b","sha256":"5884f2c20f92ec8866d09edda61027e0ce2e6666e0bf45b6ecad192bfde48f1d","sha512":"dd50bd6762d7dcb5290f02d8dadd26426d47dc6820979ed38a4ff0e7122fb6ceaf1318792ec2666d6d5f35d414e8fcd83eaeb6eccb19023556e1489870d8a1e0","ssdeep":"192:35nvZrCCypp07LmxZRkaVuVefXg9NT4X4w3RM7GKcmxZnefXgykaVut8:3pxr2pO/m6aAm2eX4wh4GfmE2aA2","tlshash":"665294ce33188dfcf95297d6d30371a9316680f75a8192a4ca361e3e244648edd6bec1","first_seen":"2026-02-11T15:17:55.632619Z","last_seen":"2026-08-19T23:08:40.045906Z","times_seen":81,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:01.472Z","timestamp":1787180881472,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://paytrust.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 19 Aug 2026 13:10:41 GMT\r\nexpires: Thu, 19 Aug 2027 13:10:41 GMT\r\ncache-control: public, max-age=31536000\r\nage: 35840\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49344,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-20T02:24:38.044905Z","times_seen":261959,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":24,"dns":0,"connect":0,"send":0,"wait":37,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:01.477Z","timestamp":1787180881477,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://paytrust.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 19 Aug 2026 13:10:41 GMT\r\nexpires: Thu, 19 Aug 2027 13:10:41 GMT\r\ncache-control: public, max-age=31536000\r\nage: 35840\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49344,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-20T02:24:38.044905Z","times_seen":261959,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":22,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/api/landing","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:01.502Z","timestamp":1787180881502,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /api/landing HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://paytrust.click/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 502 \r\nretry-after: 60\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Wed, 19 Aug 2026 23:08:01 GMT\r\nx-frame-options: SAMEORIGIN\r\nserver-timing: cfExtPri\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: a2dcd15d6878b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6402\r\n\r\n","headers":null,"cookies":null,"status_code":"502","status_text":"Bad Gateway","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6402,"size_decoded":6856,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (396)","md5":"21ec9fa0525f5c60c08f442bbcde68d2","sha1":"7b3c4158ef8b84a3d119281bd5d35f4caad8dd32","sha256":"70ef636558734872fb4214ef5e3e61f4a18f3bab35bd7142008be1c9c7efd15a","sha512":"129daf5295494f353c83603113b29fc340895ccae89b3fb8df94ee611783c0e9931348d37957cf720ca2573b84f4d2054f3da37ed57e26c66d59a81a26bc158b","ssdeep":"96:1j9jwIjYjyDK/D9KUnnG4Fh8/G4Fd5R424FH+skKmtmni37RJl1aQxP:1j9jhjYjWK/Brnel6JVMn37vlAeP","tlshash":"c9d13271b1b512b610e382933595eb1ab9e0c613dbef4594b3dcc2731f9ee81a943294","first_seen":"2026-08-19T23:08:40.046738Z","last_seen":"2026-08-19T23:08:40.046738Z","times_seen":1,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/sweep-flow.js?v=61","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.283Z","timestamp":1787180880283,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /sweep-flow.js?v=61 HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a823693-645f\"\r\nlast-modified: Sun, 16 Aug 2026 22:15:47 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QFlLX97HnRNg3VUSfxPkpVdPdOgBrXjqgI1x5sJgupa1vvfCBSTh0TYdRZxGM0uJEtr6sQgdJcipiqCOB3abHmfSIDTDTSz4edH8n9tV6JuIptoYFy9gQjMiFXQddneipA%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155cfb6b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25695,"size_decoded":8701,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"c7655661461fe74e59a9680a06621210","sha1":"9fd5930fd9cc4ca9d6b282c2b4e8f20e7a6811f5","sha256":"e294b1755cbc301c612147da68f8d22d968c5afe6c429852beda8da3b2259dcf","sha512":"ce7a2b82fd94fed4bd03ffe0e07e4ca321b7a4272bc222f07ddd44f8949dfb0ae1411c7a6454bb0b072fdb4b569bc0ac78079f499a15fb73c6aad43e8ea49b0a","ssdeep":"384:DGuRcDLTyDPyw5oJ2q1TcJYb7O1Zma2gA+5ITIvpxwPamB:DGbcvUPaq","tlshash":"32b2c76e68d720a94663703d8b9fa0183a359457388fca107c9cc5606fe4738dbb6bdd","first_seen":"2026-08-19T22:38:11.274211Z","last_seen":"2026-08-19T23:08:40.049781Z","times_seen":2,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/assets/trust-logo-BFahXSns.png","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.292Z","timestamp":1787180880292,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /assets/trust-logo-BFahXSns.png HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Sun, 16 Aug 2026 22:16:05 GMT\r\npriority: u=5,i\r\netag: \"6a8236a5-1231f\"\r\naccept-ranges: bytes\r\nage: 1837\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JrRA1fUIjvs1Hg69Bp85jgwQbCsqEVwPvzApIqT7%2FZvYpHVTd5Bs9hXAHszFUVks9JVUb5WTu95r%2BDlQtFGJo54s4LTIokpQJ%2F8HNTl0eGv3sGfk3%2BfR0kBVCpJ8l93H2A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2dcd155cfb7b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 74527\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":74527,"size_decoded":75201,"mime_type":"image/png","magic":"PNG image data, 1026 x 291, 8-bit/color RGBA, non-interlaced","md5":"9a969ea9c3dcc8038aefe69162a40b2e","sha1":"781c9a8d74702911ffc34de0831b8b88cb3d212f","sha256":"dfa7fca3bcc8a996cf626bb2f1ad89c47ef918affb0b26e391e1634319b1ec41","sha512":"02ad1e96b18b6fe08f9a6c143b1fb4f90cf3351824f455f36fe9e6f267c9cd4bf15ccc4d5287e5b3d1576f6417976b6feada815cd3dd4f1cb59dc45da323cd9f","ssdeep":"1536:lM2rjbPNeQUjWFiGVFO21LHOSHhhxSWWMsgp7QbGyYQD02TaBQRjM5h:lM2rN2sbsSLuSH5xWbbGyY802e+M","tlshash":"1173f18ce6b2a45c9ed0745b87860660db2d11f663d2b9a4b0d1e7085cdb93fdc21e8f","first_seen":"2026-07-18T17:42:15.204265Z","last_seen":"2026-08-19T23:08:40.051567Z","times_seen":4,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/phone-6.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.303Z","timestamp":1787180880303,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /phone-6.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216af-7bcbd\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:43 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2TgxtbZM12cS1SJ86wfweEZwwvIe8IOE4xBUCUeELotiZ%2BUV5gec8b5%2BxKOfwKEPUMy%2BB2YsnvC0Xjm2XMR6fND1Ji3qG5tNd4eYYVyFNRcTtCBwPE9IkIdUhT8O2Yiahw%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155efbfb28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":507069,"size_decoded":372919,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d98f60d0f1e584c5a31a48e2771e2ff9","sha1":"64986489ae3eee8af3180db20370fd3a512d93c8","sha256":"ef154187de3d627f4596396bac0c41502996cdf2273959b3b583c06ba24a69e4","sha512":"7054312977ae826d988fb9976759d3868bafb2ab6c02174ccb4ae7800f41af83b9d188c586df09218ce3883d894fa96756bd16bab2dcd103657c04e0d1990e23","ssdeep":"12288:eFFFFF2YsSm6y+9xyzwisudXPg7aj51G/5YKn9nTJ6oQjPYtF:eFFFFF2YsSm6y1M9uRBG/5T9TukF","tlshash":"6eb41330bbb29ed958014b3435688707ece4798926dcc9d48b9dcacb66ef73d8c5182d","first_seen":"2026-02-11T15:17:55.594612Z","last_seen":"2026-08-19T23:08:40.052496Z","times_seen":65,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/api/events/visit","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:01.693Z","timestamp":1787180881693,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"POST /api/events/visit HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://paytrust.click/\r\nContent-Type: application/json\r\nContent-Length: 420\r\nOrigin: https://paytrust.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":420,"data":"{\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"platform\":\"Linux x86_64\",\"pageUrl\":\"https://paytrust.click/\",\"referrer\":null,\"hasTronWeb\":false,\"fbp\":null,\"fbc\":null,\"utm_source\":null,\"utm_medium\":null,\"utm_campaign\":null,\"utm_content\":null,\"utm_term\":null,\"fbclid\":null,\"eventId\":\"9f1831f8-c500-4636-b0e7-7fe0ca7b9096\",\"sessionId\":\"353f0006-af8d-4acf-ac29-a9949b7ac12c\"}"}},"response":{"raw":"HTTP/3 502 \r\nretry-after: 60\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Wed, 19 Aug 2026 23:08:01 GMT\r\nx-frame-options: SAMEORIGIN\r\nserver-timing: cfExtPri\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: a2dcd15e9889b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6402\r\n\r\n","headers":null,"cookies":null,"status_code":"502","status_text":"Bad Gateway","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6402,"size_decoded":6856,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (396)","md5":"aa58be1953a3058afa72f0cc589b7339","sha1":"3574821bba31857c74e9251699c4f23b2560b177","sha256":"d2ed90f62182c26c3928fa7d7c1417854089d1258b2b784f58df0f6df76bc0ce","sha512":"5231bf444cdfce97a8ab1a2264f0bd171db3f906a75374db7d67cce93ea590b1ac4ddcfad1958e6d174ecbea4c5a96e6186195f8ef7721c6fb0c01288118188b","ssdeep":"96:1j9jwIjYjyDK/D9KUnnG4Fh8/G4Fd5R424FH+skKmtmnij7RJl1aQxP:1j9jhjYjWK/Brnel6JVMnj7vlAeP","tlshash":"61d14371b1f512b610e382933595eb1ab9e0c613dbef4594b3dcc2731f9ee82a943294","first_seen":"2026-08-19T23:08:40.053453Z","last_seen":"2026-08-19T23:08:40.053453Z","times_seen":1,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/assets/index-BLG9OfPR.css","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paytrust.click/","date":"2026-08-19T23:07:59.973Z","timestamp":1787180879973,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /assets/index-BLG9OfPR.css HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:07:59 GMT\r\ncontent-type: text/css\r\netag: W/\"6a8236a0-7dd1\"\r\nlast-modified: Sun, 16 Aug 2026 22:16:00 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6vhVtkh%2Fh6B8RPGz4clMm8cam4JUnhT7DcAZt56q0aF427Y8ZQ71eP0jEitN%2Bz2kpqUjE0Gb6idaczeOrE6PXxbIJytCTJVKYWtLsASW3%2FzVYwod1NkSOLxRO36KYYgw7w%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd153df76b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32209,"size_decoded":7583,"mime_type":"text/css","magic":"ASCII text, with very long lines (32208)","md5":"c53f4a3d7359a23a959e9215a82da572","sha1":"62691e1f4bf6c9f48dd2133f628d5d3672be52cd","sha256":"20c45569f9b13be4607f2021538fe7045329b44d81b77ad2d231a7b1a5395356","sha512":"5349df05917fb69e7f6a73923e2a2b508a7972f623bf69eae921f88f591a9fcd2c009c4d5e93dbc27e76f52b5d3a262cae5e6e7dcf61536107d6b689e10ac4f4","ssdeep":"768:QhlmPhDu0+GD8Vfr+0o+XvfrFLFuY0Xj6Si1K:/g0+GD8oeXpLFcmSik","tlshash":"94e271a4b326c87fac2364f6e76c788cb6197181de7556e4fe42221266d73f00d8ab14","first_seen":"2026-07-18T17:42:15.23983Z","last_seen":"2026-08-19T23:08:40.055566Z","times_seen":4,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/coin-3.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.301Z","timestamp":1787180880301,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /coin-3.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216af-17442e\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:43 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e7ujAwSfSCKRhCpeJ5VvkSyNjHjHGXFxiUlQEIpvgpDZZJbMjUc%2FeRz5GrBjr9g6E%2BQm41gF0cSvIyFtueo7F588fdzs354UnW7UTUCkrELTWKTIMtcFn%2FDcUNEmBdPz%2FQ%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155dfbdb28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1524782,"size_decoded":1122238,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"154b07812705f948c5f0fb9ea7f8a647","sha1":"3cd47cba0a9b1890832a8b005da438d713b6b7d5","sha256":"f7e34ebffd3f342aa7980e55ddafc647d3b5f8b3eedac37f07c27884d96bf73b","sha512":"8e9c5b98c1bd4af6e12eefaa780b7961d1b6e4c790fa9f1a989674ad01aa482e578cd629d3c48f34d8fc6006068a68a03d59446653ae82e0ddff48fc17c1dd12","ssdeep":"24576:wBF3Y6bvUpI8a4tHdGwxErQ92Y7DicZQismJ8hut2f7vH:wBF3ZO9kwxd7tsjH","tlshash":"512501726ecaac8f1f889828f1df8ed65f6c573784096eb114133f475a5860a53dc88e","first_seen":"2026-02-11T15:17:55.579705Z","last_seen":"2026-08-19T23:08:40.056389Z","times_seen":68,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/benefit5.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.309Z","timestamp":1787180880309,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /benefit5.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ad-3417\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:41 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Af%2Bn%2F32H5nsTrEH2ApfOKyEhGRExXUAezoTmylwvbn3FGdWqBqYrxtk6tgLvnirQGcCJh1gDAssJHSCtvwRUoH6SpUX3IYImmU4RYfpZxqtUAueRUt8HeNFFDpKNxyxtXw%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155efc4b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13335,"size_decoded":5374,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"59713ef77a363413e687273f3c145458","sha1":"c85e8654571a7cd077a5e1b33776ae5d12289298","sha256":"70ab05b92fc860eadd89931c47f692666948dd7c27717968c09661f534791e96","sha512":"78a5ac9cb055867ac0399a25cff36de30a53b14a3ff3a69973cce6d2aac5ebbedb66fc48bc997414b907f4d00df0a49407da83246199803bbfb4ceade5fff0d4","ssdeep":"192:W9KM8HsKM8HmHna3jP7U0KSq0cS0XVcBqhdqvrXqVNdxn8DD1SHSfWnznyH:kintzjUTRXV4q3RxnUD162WnQ","tlshash":"9052b6dd33a44ab8f42287e1d703a1b5205e60f7aa95a370cb656f7a245615ecc7bcc0","first_seen":"2026-02-11T15:17:55.650976Z","last_seen":"2026-08-19T23:08:40.057164Z","times_seen":75,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/css/card-flow.css","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paytrust.click/","date":"2026-08-19T23:07:59.969Z","timestamp":1787180879969,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /css/card-flow.css HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:07:59 GMT\r\ncontent-type: text/css\r\netag: W/\"6a8216b3-4196\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:47 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QOEQxJRAe8wsXjNJBZNaVTkmxNNKMgpeKAF0kaKF9wTs2f0aiO3baXq0O2tUEiYWqTdyxdkq007exIFf6U4Lv9zKFh4ddJmGE44WUrJjiNVDNIYM1OqE0HCY8GhMcDEmIg%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd153cf74b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16790,"size_decoded":5001,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"56c4ffab4e5e3a9d9222b7ea60d224a9","sha1":"c8e24ecd01c9cb49d5d35492a2c666c06e72c18c","sha256":"6fc4d4245a2787e0c5d9b5f80d1951fa464c45c15920188c811ed0a13ba4c4cb","sha512":"9a646b6a63c50b3343602d2918bce06aecb69c8a00c6321c9e4a702601f1a0a78c101f1d2ff9683d483a1057c0ca8dfa0a55d015c3d4d405235e7385e15efa2a","ssdeep":"192:RkT1Vb2oKbqctiuaDEg2Iq/u12BLdB9ir5yIp5j6CnzXjepV4Pj+ibBsWuOotUZH:iKqkFgnYxors0XDCV6vlvo0J/","tlshash":"8772539367661524782bdca43a539f8773dd8643e58acebc9be0201c8ec91ed2572f4c","first_seen":"2026-08-19T22:38:11.265345Z","last_seen":"2026-08-19T23:08:40.057959Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/coin-5.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.302Z","timestamp":1787180880302,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /coin-5.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ae-9f5f1\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:42 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b6HH7l%2FldFu6HBL1CKgjMkd8Sk%2FVltyRhE1WihfaKeC9mzKpZXe9e9V0fDQZmY%2FkM7QOstct6fF%2BWtJ8fi6YqKki7fZTyVwWQoV6FYm5sZpeBQcphWH9vgmuMpQ0XcTw%2FA%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155dfbeb28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":652785,"size_decoded":489977,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1acce58393b8d5f1c6385c697a24ce06","sha1":"0b48578d14a22345b3940aa0b2d29ccbc546167a","sha256":"f1dbf46ff029294134b06f60fd4eddad1137d2c942abff449e62fa6bb060eb19","sha512":"96b9ec645765af648719350ef4ef6fd9bbce0e29714ce80d50b25c5ae2c34da320900f340b2cc27967d4fc481cd55e9f9cd36d4e1912f843581679dffce30478","ssdeep":"12288:2EL4JuXNMFrS0Ghr7LF1uB2IyTA84fNCuLEJ20IFbvsXsMHFQ:uJudwhs7LF1uB2X141eJJIFbvsXsi2","tlshash":"cfd423218ca71e3f46e5424960db0f4a524187f2c0b2ddc869ebaa679bbbf074447df0","first_seen":"2026-02-11T15:17:55.591499Z","last_seen":"2026-08-19T23:08:40.059515Z","times_seen":68,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:01.467Z","timestamp":1787180881467,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://paytrust.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 19 Aug 2026 13:10:41 GMT\r\nexpires: Thu, 19 Aug 2027 13:10:41 GMT\r\ncache-control: public, max-age=31536000\r\nage: 35840\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49344,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-20T02:24:38.044905Z","times_seen":261959,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":2,"connect":31,"send":0,"wait":19,"receive":49,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/coin-1.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.300Z","timestamp":1787180880300,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /coin-1.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ae-1b5dee\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:42 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MbN7Kbuc%2Fc2Woj5ud2rAxoP9i9aaWpnd8znszRuVzPeBzJDYMsEaoSj5JhO0gZx4tj3oz5KgCPDSENfhs%2Byu%2Bqqo3gnAdN%2F2RkTf%2BO1x%2BjhNZbILUIWR58Yf8H%2BCF9CvgQ%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155dfbcb28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1793518,"size_decoded":1332762,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b8010fb3f37959329af30771296fa662","sha1":"58713455d38aee27a070785f50376c4a8c9e721e","sha256":"01c8a476cfadf19e594674877e4d7f97d72138b773bf9c5d26e2ed751ede6989","sha512":"a6dab64d93a1b02d9f0a45482786a8777e2d39a765d11901c6f92a53a8ffc4b40e2bee0df5007c60a8f8fc39e44fed9eae17bf40b31cb2e34e881215fa363fcc","ssdeep":"24576:D3nW0FZBu8LVyNHsOMuaiUZqtSHgGM7djEHLG:bfuyyP8FgFhB","tlshash":"0f252371eaa8cd6c5918c651b07e1ac48ef08de3cfcd6e8073393276a18df19856dc5a","first_seen":"2026-02-11T15:17:55.647458Z","last_seen":"2026-08-19T23:08:40.061053Z","times_seen":66,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":77,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/trust-3d.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.312Z","timestamp":1787180880312,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /trust-3d.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216b0-308d4\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:44 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JcJVzzraoYeS3NJnavIdIjYqglrmc%2FsEqR%2BAIc5K028g7s1c6OC744vkKmmJ%2Blt1hY2195Cu%2B03U0PUtOe0Qh%2BuPyUgtszY8h3ejr8LHCC1Ks09zCVVa5OMGPx%2Fo5etOxw%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155ffc6b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":198868,"size_decoded":150034,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d6b416e21b6eb6802ef0eb49df77e2a3","sha1":"702da2208a3c46ab97e56c090aac208174054631","sha256":"f3406c7d3b9ec1ae7b41f49533d2986658c0d9a9e139e10fa57135501e613c38","sha512":"bc61f6172655197df8de1d9693e786ef36daf50c424598f4bbd6d3f19f3c0b849ddd010168c75cd343159090bbf8ecaea0dfa656fd51b7a83aa6130e8c814586","ssdeep":"6144:X7wj0Hgf5ocXCDli9Smpr/JpVDs98mVhTaiTo:Mj0w5ox40CpVDs9Fa","tlshash":"8e1412889faa999ec1cc203583ea0596bc2d20c33ec7dbeef63570d492cca555294d72","first_seen":"2026-02-11T15:17:55.603515Z","last_seen":"2026-08-19T23:08:40.062023Z","times_seen":77,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/cta-banner.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.313Z","timestamp":1787180880313,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /cta-banner.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216ae-2906\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:42 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JfNH8%2Ff9qICZxCU7LuNg72WFdj%2BC4Ti3kOAtrIvsKRmogG7qJ7KcyliL5uiucGgN5viWUkM6tGaF2WtOf%2BGLGw4jp%2BDiRKPN6UrEindQAc70Azxbonhyy94Si929v1iPSg%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155ffc7b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10502,"size_decoded":3912,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e34a0d2ddecc4eca36af15326e3ef4cc","sha1":"27158ef8abf4724643ad911ed1091688e6d2ba40","sha256":"1fe123414ca02e7118d90c20c5ef90f15d45ce6dbeb6820a44d89498319a20de","sha512":"90db61f4078563bf7f118b99c3927ca8410b4062f977ffaa49f72c2733e67b1fe0c0b570030fb4133d92ceef7888ce08242e72495fe3beea03ad413df2944edb","ssdeep":"192:sXxy6K0CCGDMdkLeLEIwy5HpYpE72KPJesp:MxtXQIwepfJesp","tlshash":"e1221dde33148cbcfd268ba2eb03737822275ab30a996780cd371a79155551ea93fdc4","first_seen":"2026-02-11T15:17:55.649184Z","last_seen":"2026-08-19T23:08:40.06277Z","times_seen":59,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:01.470Z","timestamp":1787180881470,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://paytrust.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 19 Aug 2026 13:10:41 GMT\r\nexpires: Thu, 19 Aug 2027 13:10:41 GMT\r\ncache-control: public, max-age=31536000\r\nage: 35840\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49344,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-20T02:24:38.044905Z","times_seen":261959,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":44,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-19T23:07:59.560Z","timestamp":1787180879560,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:07:59 GMT\r\ncontent-type: text/html\r\nlast-modified: Sun, 16 Aug 2026 22:15:39 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OGRo4ug9C00UnlFni5%2F0jXjC%2BFzEzOkByHmUjkLoKby2n%2F7Ity1a%2BR66KMNrBGedFHN1neiaTuPiMZ6f4utCSGm0epzmTSgW3zG6YGUc0AMaw8l%2F5CnN9JUmD%2F2UAcD%2BRQ%3D%3D\"}]}\r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd151af5bb28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}],"data":{"size":32851,"size_decoded":7472,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (30267)","md5":"271559e57a981626a2f7cad8ffe7a578","sha1":"b89e77254dd657f06e170b49674db2f7086e7e01","sha256":"66178dcc469521dc9a121401fafb678c339c2fa0241e2a140554b315070d9b20","sha512":"f59dc068ebc1dab8889b2049fbadbf3c883d8759b2c111c6ab777f6a9119fa9a7d9511c2c1def8af935788630427d3b420df12c251832ad6b572969d04b17b8d","ssdeep":"768:KXTqZC+McJFy4l9h/1nbUPKB7ttAjJN1A4HOZTIIoA:IKJFy4l9htnTIIoA","tlshash":"14e2763411151e3f27134ae4f2e1bb7961ade35aca27895cb3bc01b32fdacd88856385","first_seen":"2026-08-19T22:38:11.272012Z","last_seen":"2026-08-19T23:08:40.063474Z","times_seen":2,"resource_available":false,"data":null}},"time_used":185,"timings":{"blocked":-1,"dns":49,"connect":14,"send":0,"wait":121,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/card-flow.js","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paytrust.click/","date":"2026-08-19T23:07:59.985Z","timestamp":1787180879985,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /card-flow.js HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:07:59 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a823698-7684\"\r\nlast-modified: Sun, 16 Aug 2026 22:15:52 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rd29OuEXwJKFVj%2F7563MkRCftbaaa3kxruuJ6%2F1fOi9LPoNP%2FJ75%2B5van3UZwVOTfFH2NzvEbWa0fxDg568C0l4ml%2BYLD79jI%2FrZyhFTdPj204db4kuafKcbqzGoXsCrtw%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd153ef78b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30340,"size_decoded":9389,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (531)","md5":"49f42696a9810bfa85988a5958a79c13","sha1":"67eef260d8573f2eeac0b468d9cb006957f8d956","sha256":"beccf6d09e623d6f3e388d510ae07632883dfb15ddb07ccac7d7c900cb19d049","sha512":"98fc481e580529f6c5a13beb00db1f75c362fb68dfe468ca60b6f9ca80b1abdc2d702a5c00ea74264d5d9c1c2515220049ca0bc13d19a69fb88b0e204fbd3bde","ssdeep":"384:9Vz70OOsNDUZN+XEHl+alC+KNexC+Jos5tvvzxaK0mVAlrosJltU0zPNKPK++w0S:/fP1DHnzKi3x/Vb6f","tlshash":"f3d2e82811f8193d0223119d876b61173536e683ea8ec509774c47b21fdacaae9bb3dd","first_seen":"2026-08-19T22:38:11.290408Z","last_seen":"2026-08-19T23:08:40.064735Z","times_seen":2,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/phone-4.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.295Z","timestamp":1787180880295,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /phone-4.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216af-51c11\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:43 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Sp%2BDiFh1LYI7AaNfPgSr7XlkpITAr24HP2UWxN1z5WdiAULT366qqXBDXPph9fGqjtTb4gCq2CTK8V3KgEb9KohFMfGvq5UT3HpBxf36pFSvev3XFR%2FZ7O5qNNjD7jFGvg%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155dfb8b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":334865,"size_decoded":249699,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fbbd3aab77cb5df884cf3a3b4aaa4c21","sha1":"c9442ec1d483e4e76b4506b5f23d9b15f1474656","sha256":"715103f9615c025f8758f7b2a514a93effc6b6ad62e508de1b6177e91d1a8763","sha512":"ff89024db537159b90d260d70735c193bd49b0b98c92352c146709198e895932cdb4ea72dd707d6b04c336590c70c34c37893fcac92f1ecca6ec96b6d76d0911","ssdeep":"6144:GUiwM0ajDICgS5J6B/oZ0+FtnK7DpyWFGLdDdPr+3CBmwvQ2tcD:GVYeZVOBQu+FoXpyW0ZrQWIX","tlshash":"3d642352de434d1ea5705d8e402ca4dcfbb809dca68064f89bd4b993c1cae62c769c7f","first_seen":"2026-02-11T15:17:55.607976Z","last_seen":"2026-08-19T23:08:40.06604Z","times_seen":69,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paytrust.click/phone-5.svg","fqdn":"paytrust.click","domain":"paytrust.click","tld":"click"},"ip":{"addr":"172.67.167.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paytrust.click/","date":"2026-08-19T23:08:00.297Z","timestamp":1787180880297,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paytrust.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 16 Aug 2026 08:34:25 GMT","end":"Sat, 14 Nov 2026 09:29:09 GMT"},"fingerprint":{"sha1":"6B:21:1B:35:BB:98:5B:0E:9F:36:95:22:56:D2:43:A1:A0:37:C4:41","sha256":"FC:7E:47:3F:E9:8F:DE:D3:A2:5C:DD:0A:24:61:A5:47:17:FB:F1:F5:F7:ED:51:C4:72:B4:17:EE:24:96:4D:6B"}}},"request":{"raw":"GET /phone-5.svg HTTP/1.1\r\nHost: paytrust.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://paytrust.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 19 Aug 2026 23:08:00 GMT\r\ncontent-type: image/svg+xml\r\netag: W/\"6a8216af-33a0e\"\r\nlast-modified: Sun, 16 Aug 2026 19:59:43 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pEPEbORAU8owMmSzOA%2BQJLcqjPl9IzsPT17dCFwUvVNAHf43T16RM1JrJLc%2FFZwJt%2FzhjF%2BH68YDNLjiJmYeg%2FZthYJeVZlCv4HyC9%2Bf%2Fo24%2FnR%2F10BgSihp3UmM9dfU5g%3D%3D\"}]}\r\nage: 1837\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a2dcd155dfbab28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":211470,"size_decoded":145960,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3868b22ca7f77068f2edba51cb879f5d","sha1":"fe91e29b99959eb88558f4e78bece76ce23bd0fe","sha256":"4e58e1a299c1ce83b1695fe172ef5ffe3196da11e66ba6a2c28c79ce0451235f","sha512":"6b25bd1312de3bfa16ea450f081e27a0167c46cf4ff73cbfd5e5401875213dadb431d69c81d431b87e08ce9128b330cb1f6579ab2e322ee597325b95a101496f","ssdeep":"6144:7W7gNT/WbJNlDDxTtYOGwj4WYIUZVbeucmj:isJ/WbNxZYOmn6s","tlshash":"1324d0334547fdefbb278dd8e11a62209dddba93d684d24caf8458c126fb428cc615b8","first_seen":"2026-02-11T15:17:55.63009Z","last_seen":"2026-08-19T23:08:40.067058Z","times_seen":83,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"paytrust.click","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}