{"report_id":"75aa9807-c8a6-4734-9592-5c9683d5ecd8","version":0,"status":"done","tags":[],"date":"2026-07-12T21:01:40Z","url":{"schema":"http","addr":"refund-hub.online","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"64.29.17.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"refund-hub.online/","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"title":"QuickRefund Hub - Tax Refund Workflow Platform","dom":{"size":12503,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (12503), with no line terminators","md5":"b04ab798d9a70f19628683cb168a129b","sha1":"1b0842f7d29152ac37aa5f05cb35dbdda472a158","sha256":"281061e01a6c06bdd67299ca2330fe7b05fb4ef9bebaac1de1a3b30712e69c93","sha512":"0c5c08a8133a7205fb6418787691c5506cde3b7756a449ccd89a6da57f06750f22f3deec33a69c6744fab98e49fbd925cee7025b24d9280589825b6368f27871","ssdeep":"192:GGXBqjU9jXzdZRGw5InKTnpU8NvGzjdjp+AGwqYe4Soq60Nq++sWir+ZjZ1cL:PXl9jXzdZRGCRp/pG3djp+Af0frkZqL","tlshash":"7342b7222165163f502b47f8f6a2b77892aed38ad51b843cf1bc52f25bc2dd8dd67240","dom_hash":"domhasha54ed9c3ceb3a67922fd259b8bd8b509","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"refund-hub.online","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"64.29.17.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-16T21:01:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"refund-hub.online","ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2026-07-10","domain_rank":0,"first_seen":"2026-07-12T12:00:52.549887Z","last_seen":"2026-07-12T12:00:52.549887Z","alert_count":13,"request_count":13,"received_data":641480,"sent_data":6348,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"refund-hub.online/assets/DemoLayout-Dh52R-Lm.js","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8c2b7301deb774b1978fb312a6541952","sha1":"b12302b85ee4895c3c569ff532823b6ac5702e90","sha256":"875bd6a475d75784edf55a65030e3612aa6370286fc9c60ad2be280a5ca20e9d","sha512":"3294e6345834e75d9949805adb5e86ddf1e848f219e6f5d64b590f6f34412460b50e2ac47edcebdd4be5f78efac85831f8d96c39897df822d70728318c0e326a","ssdeep":"192:FfV0+y8wRipHOXoOe4tgw9fhnE1OdcQB9ydUQVQ70TomHWr:FV0+y8wIO4v4tgw81Odrca70TJu","tlshash":"4b22b7cab28176e8a1a701bd959f800cf67e8554d80f0538f0b274353d649eea7b6fc9","size":10276,"data":"","first_seen":"2026-07-12T12:00:56.251753Z","last_seen":"2026-07-12T21:01:41.869676Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/assets/arrow-right-BFKh0WXz.js","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e03a30734d6dc231c4d4f2ee3799a377","sha1":"74672813e2839dcedbe98770b67ccdde759ddf92","sha256":"e3d64cb75fa54e770732a5df2691428bb3a2a74b7c4302331d9091a83450935e","sha512":"8b6ba48fbcd9317a23172690aa2196cb67782d898601cbb73a0448dcdd0093fda873d0dd0ec2689fef60bc09d5669581d1b5f24021dc4765b6cb1071d30b4bfa","ssdeep":"","tlshash":"b6c08c0f5cc813b0884133d5c84e79114a521aec93e785047215b2be06921d6646ef30","size":159,"data":"","first_seen":"2026-07-12T12:00:56.252721Z","last_seen":"2026-07-12T21:01:41.870923Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/assets/routes-Bt8IuPJ9.js","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"73b4f6ac5bd898e490bf900a0b27938e","sha1":"452d3b9e18011e41b7f33977368ea22fda3fca09","sha256":"0854eb7da0b8076ed0b5c260521e05cf0f8ab060d3d6f2e7ec5ab2b019378611","sha512":"53058cfdf199133ef57aa3108fdd8c38c47873174fe78df63e15cd66e6edcf95f00ac99c64aeb671c4c19d0b9ceaa8ebc56101da8b31f7b1d91d0dab795b85cf","ssdeep":"96:DuZx/e4SnabY3irSzehdC2p4V2Zp3grCcEVRAVFJGdDiXSGKXcK:AZe4Sp3irSqymgrfEVRAVbGdDiXSGWcK","tlshash":"dcd1541ba59a66ec643704b8721fc409321fc86ce61b487af9fc70723b414d8ea27b84","size":6461,"data":"","first_seen":"2026-07-12T12:00:56.26082Z","last_seen":"2026-07-12T21:01:41.868575Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/assets/index-BYnssy3U.js","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0f34d37f285e45ed44c51c54392e69de","sha1":"679d21dbaea9177bed96036aa7ee3b8f26db237c","sha256":"c5be1949496e89db70d404f2eede79c4ceeb0cd93bfb2ff7a263f655e633bf70","sha512":"f5394723883a1677f066a8863e03d3e3ec682ac62f65dfded4b76b7efa7b09bba32f76be039e9abb8e6f24525399e35e9b283161596241d1854474e380121ddf","ssdeep":"6144:Zg5I2NrnwYUch4mjkd3mKQ+sNVoOYR5KJMUs/FgBJ4D:2hcbmKjyCiBJ4D","tlshash":"d9743be832a6b2221bd756b6407f1506b33518672c0d4420b224fdef76b188995fbff9","size":346309,"data":"","first_seen":"2026-07-12T12:00:56.250292Z","last_seen":"2026-07-12T21:01:41.879431Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"refund-hub.online/assets/styles-BSVFIpRy.css","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.846Z","timestamp":1783890073846,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /assets/styles-BSVFIpRy.css HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-disposition: inline; filename=\"styles-BSVFIpRy.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: W/\"4ba12fbff807fe5b8cd9ba4a3132029c\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vszrp-1783890073850-2b6c143789f9\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":83063,"size_decoded":15226,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65470)","md5":"4ba12fbff807fe5b8cd9ba4a3132029c","sha1":"df630cff6a3d66378f5a8fa0e0bd29d85dd51013","sha256":"49fe651ad09e1be34c5e9d4ded2933d2b1ff093924939448f5319b552ae0b79c","sha512":"95d6beb164b4065ece2eddb331c6124dfea901500b4a6ea6b97d079e5deedee48aba407e073691eb248f610b1fc0123b1ce72fb871eeac61401682631a257765","ssdeep":"1536:Ar8ZYh+tq0yAET50w+8Ck54ZoD2fwfEaUvvlpaGSsMq+WDhXX78EKXbs988R988q:Y8ZYh+A0yD50w+8Ck5RD2fwfPUnltMqm","tlshash":"c583d9a0b239d53f7c37a4f9938cb49c5119b0c0dd3546e9fe16a12216c3bf2adab614","first_seen":"2026-07-12T12:00:56.259408Z","last_seen":"2026-07-12T21:01:41.86705Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/assets/routes-Bt8IuPJ9.js","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.850Z","timestamp":1783890073850,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /assets/routes-Bt8IuPJ9.js HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-disposition: inline; filename=\"routes-Bt8IuPJ9.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: W/\"73b4f6ac5bd898e490bf900a0b27938e\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::pfnxl-1783890073854-e95d3e10a921\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6461,"size_decoded":3069,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (6461), with no line terminators","md5":"73b4f6ac5bd898e490bf900a0b27938e","sha1":"452d3b9e18011e41b7f33977368ea22fda3fca09","sha256":"0854eb7da0b8076ed0b5c260521e05cf0f8ab060d3d6f2e7ec5ab2b019378611","sha512":"53058cfdf199133ef57aa3108fdd8c38c47873174fe78df63e15cd66e6edcf95f00ac99c64aeb671c4c19d0b9ceaa8ebc56101da8b31f7b1d91d0dab795b85cf","ssdeep":"96:DuZx/e4SnabY3irSzehdC2p4V2Zp3grCcEVRAVFJGdDiXSGKXcK:AZe4Sp3irSqymgrfEVRAVbGdDiXSGWcK","tlshash":"dcd1541ba59a66ec643704b8721fc409321fc86ce61b487af9fc70723b414d8ea27b84","first_seen":"2026-07-12T12:00:56.26082Z","last_seen":"2026-07-12T21:01:41.868575Z","times_seen":2,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/assets/DemoLayout-Dh52R-Lm.js","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.852Z","timestamp":1783890073852,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /assets/DemoLayout-Dh52R-Lm.js HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-disposition: inline; filename=\"DemoLayout-Dh52R-Lm.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: W/\"8c2b7301deb774b1978fb312a6541952\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::lrfvp-1783890073856-6d9fa67c99f8\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10276,"size_decoded":4676,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (10276), with no line terminators","md5":"8c2b7301deb774b1978fb312a6541952","sha1":"b12302b85ee4895c3c569ff532823b6ac5702e90","sha256":"875bd6a475d75784edf55a65030e3612aa6370286fc9c60ad2be280a5ca20e9d","sha512":"3294e6345834e75d9949805adb5e86ddf1e848f219e6f5d64b590f6f34412460b50e2ac47edcebdd4be5f78efac85831f8d96c39897df822d70728318c0e326a","ssdeep":"192:FfV0+y8wRipHOXoOe4tgw9fhnE1OdcQB9ydUQVQ70TomHWr:FV0+y8wIO4v4tgw81Odrca70TJu","tlshash":"4b22b7cab28176e8a1a701bd959f800cf67e8554d80f0538f0b274353d649eea7b6fc9","first_seen":"2026-07-12T12:00:56.251753Z","last_seen":"2026-07-12T21:01:41.869676Z","times_seen":2,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/assets/arrow-right-BFKh0WXz.js","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.858Z","timestamp":1783890073858,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /assets/arrow-right-BFKh0WXz.js HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-disposition: inline; filename=\"arrow-right-BFKh0WXz.js\"\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: \"e03a30734d6dc231c4d4f2ee3799a377\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vszrp-1783890073862-011dd80a03e0\r\ncontent-length: 159\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":159,"size_decoded":711,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"e03a30734d6dc231c4d4f2ee3799a377","sha1":"74672813e2839dcedbe98770b67ccdde759ddf92","sha256":"e3d64cb75fa54e770732a5df2691428bb3a2a74b7c4302331d9091a83450935e","sha512":"8b6ba48fbcd9317a23172690aa2196cb67782d898601cbb73a0448dcdd0093fda873d0dd0ec2689fef60bc09d5669581d1b5f24021dc4765b6cb1071d30b4bfa","ssdeep":"","tlshash":"b6c08c0f5cc813b0884133d5c84e79114a521aec93e785047215b2be06921d6646ef30","first_seen":"2026-07-12T12:00:56.252721Z","last_seen":"2026-07-12T21:01:41.870923Z","times_seen":2,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/KRA.jpg","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.866Z","timestamp":1783890073866,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /KRA.jpg HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"KRA.jpg\"\r\ncontent-type: image/jpeg\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: \"cbaa7ad868d61d32021a64d94aaf42c1\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::lrfvp-1783890073870-73adf1bb86fb\r\ncontent-length: 13626\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":13626,"size_decoded":14136,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 447x447, components 3","md5":"cbaa7ad868d61d32021a64d94aaf42c1","sha1":"f58ecf5e117f88c46152b74131d30876776dbff9","sha256":"43ccf816f2567bd5c44b4c2bb36f860567051cb38bbd7a7f93d4d146d2e1b930","sha512":"2ea598f483a2215cec0be74692729a7896e6f0fb85da8bdc5d9df25e8d44e3c793e3955895ddddfd6b3526b5c97d6902815f2acd9f78c164bcecd3dbf8a8d276","ssdeep":"384:etGtuByKiVe8wR7hf+4mG76Uu226aXs13G53wfKIsLLChW0:eAuByKEe51N+VGtuqwKGIaR0","tlshash":"e552d0b773bf188bd88cf3394402665371722578fb4b65c3384685f5aac6a3106239c8","first_seen":"2026-07-12T12:00:56.253651Z","last_seen":"2026-07-12T21:01:41.872752Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/lg.png","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.954Z","timestamp":1783890073954,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /lg.png HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"lg.png\"\r\ncontent-type: image/png\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: \"09467463f5e3130d0325c3046f3ed142\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::6vb7d-1783890073959-2fb63465c468\r\ncontent-length: 39028\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":39028,"size_decoded":39536,"mime_type":"image/png","magic":"PNG image data, 447 x 447, 8-bit colormap, non-interlaced","md5":"09467463f5e3130d0325c3046f3ed142","sha1":"5bce2d25f8bed4d7c20f8e83f1fba665c3324a1f","sha256":"a15ec24aa09ec7868cc93d53fc8c09adea47216a7071be2b609d195ac5a68400","sha512":"53be9652df5992471604f86b85c6018cb004fd7a07bdb79af617f39f1cabc6cab32057597e5a6c0d6631f067c9e0cb969673621ea1acd5ef442cd45ac2a6bd36","ssdeep":"768:rkG8e+GHoroKSK/MIjHRubFH7KhArupjCOPhDjB/9eoUuLuHb:rr4SKUCxuV7KhArWjCAZBgoU6uHb","tlshash":"0703e1df2256243e5fb30812415630f5f817576ae8732daf2c86e9a9a41d8b1d03ad1f","first_seen":"2026-07-12T12:00:56.257189Z","last_seen":"2026-07-12T21:01:41.87565Z","times_seen":2,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/lg.png","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.956Z","timestamp":1783890073956,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /lg.png HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"lg.png\"\r\ncontent-type: image/png\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: \"09467463f5e3130d0325c3046f3ed142\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::bdzf9-1783890073962-95c4eb086a14\r\ncontent-length: 39028\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39028,"size_decoded":39536,"mime_type":"image/png","magic":"PNG image data, 447 x 447, 8-bit colormap, non-interlaced","md5":"09467463f5e3130d0325c3046f3ed142","sha1":"5bce2d25f8bed4d7c20f8e83f1fba665c3324a1f","sha256":"a15ec24aa09ec7868cc93d53fc8c09adea47216a7071be2b609d195ac5a68400","sha512":"53be9652df5992471604f86b85c6018cb004fd7a07bdb79af617f39f1cabc6cab32057597e5a6c0d6631f067c9e0cb969673621ea1acd5ef442cd45ac2a6bd36","ssdeep":"768:rkG8e+GHoroKSK/MIjHRubFH7KhArupjCOPhDjB/9eoUuLuHb:rr4SKUCxuV7KhArWjCAZBgoU6uHb","tlshash":"0703e1df2256243e5fb30812415630f5f817576ae8732daf2c86e9a9a41d8b1d03ad1f","first_seen":"2026-07-12T12:00:56.257189Z","last_seen":"2026-07-12T21:01:41.87565Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T21:01:12.718Z","timestamp":1783890072718,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nage: 0\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::iad1::vszrp-1783890072832-d12b84b36dac\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13755,"size_decoded":4734,"mime_type":"text/html; charset=utf-8","magic":"data","md5":"9c71045f5a9476e5d4ff2fe3840ffad0","sha1":"bf8768bd8c797c2e8d88f0836e6d03e3c8656cd5","sha256":"6efd14b6afd1558f6599bae84cceda22def1632b7a64fa048c1ab3b5c668a0ba","sha512":"fac8ba77044ef99111fb6dfe29198d8eba62e8745f157a4fb5d0b86ca1a78cf367e77fae10c2e179daa6b24fa93cebc13af4fe287a96f0c068dd60516e925e6d","ssdeep":"384:Lcx9jXzdZRzMp/pG3djAF1m0frkZqSMS4/8:L+9jDdjzM5Y3djAF1lfg9MS4k","tlshash":"0152c5232155153f507b47f8f262b72852ae938be50b883cf1bc52f25b82ed9cd67250","first_seen":"2026-07-12T21:01:41.877406Z","last_seen":"2026-07-12T21:01:41.877406Z","times_seen":1,"resource_available":true,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":69,"connect":2,"send":0,"wait":13,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/assets/index-BYnssy3U.js","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.848Z","timestamp":1783890073848,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /assets/index-BYnssy3U.js HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-disposition: inline; filename=\"index-BYnssy3U.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: W/\"0f34d37f285e45ed44c51c54392e69de\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::6vb7d-1783890073852-27696218eb5b\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":346309,"size_decoded":111106,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (43672)","md5":"0f34d37f285e45ed44c51c54392e69de","sha1":"679d21dbaea9177bed96036aa7ee3b8f26db237c","sha256":"c5be1949496e89db70d404f2eede79c4ceeb0cd93bfb2ff7a263f655e633bf70","sha512":"f5394723883a1677f066a8863e03d3e3ec682ac62f65dfded4b76b7efa7b09bba32f76be039e9abb8e6f24525399e35e9b283161596241d1854474e380121ddf","ssdeep":"6144:Zg5I2NrnwYUch4mjkd3mKQ+sNVoOYR5KJMUs/FgBJ4D:2hcbmKjyCiBJ4D","tlshash":"d9743be832a6b2221bd756b6407f1506b33518672c0d4420b224fdef76b188995fbff9","first_seen":"2026-07-12T12:00:56.250292Z","last_seen":"2026-07-12T21:01:41.879431Z","times_seen":2,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/lg.png","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.863Z","timestamp":1783890073863,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /lg.png HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"lg.png\"\r\ncontent-type: image/png\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: \"09467463f5e3130d0325c3046f3ed142\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::bdzf9-1783890073867-d3ee54bf787a\r\ncontent-length: 39028\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":39028,"size_decoded":39536,"mime_type":"image/png","magic":"PNG image data, 447 x 447, 8-bit colormap, non-interlaced","md5":"09467463f5e3130d0325c3046f3ed142","sha1":"5bce2d25f8bed4d7c20f8e83f1fba665c3324a1f","sha256":"a15ec24aa09ec7868cc93d53fc8c09adea47216a7071be2b609d195ac5a68400","sha512":"53be9652df5992471604f86b85c6018cb004fd7a07bdb79af617f39f1cabc6cab32057597e5a6c0d6631f067c9e0cb969673621ea1acd5ef442cd45ac2a6bd36","ssdeep":"768:rkG8e+GHoroKSK/MIjHRubFH7KhArupjCOPhDjB/9eoUuLuHb:rr4SKUCxuV7KhArWjCAZBgoU6uHb","tlshash":"0703e1df2256243e5fb30812415630f5f817576ae8732daf2c86e9a9a41d8b1d03ad1f","first_seen":"2026-07-12T12:00:56.257189Z","last_seen":"2026-07-12T21:01:41.87565Z","times_seen":2,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/irs.png","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.865Z","timestamp":1783890073865,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /irs.png HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"irs.png\"\r\ncontent-type: image/png\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: \"5c8c07163ec5f9cadc9be0a231bbff15\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vszrp-1783890073869-a082552b2682\r\ncontent-length: 8972\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":8972,"size_decoded":9480,"mime_type":"image/png","magic":"PNG image data, 447 x 447, 8-bit colormap, non-interlaced","md5":"5c8c07163ec5f9cadc9be0a231bbff15","sha1":"4ace25c8f1f3a3ae551102e0483946285ece744e","sha256":"6b07306a3b79a205a8b553ebd6537d3e441d538fa45b25c846057cc6d5ed7538","sha512":"6d2921f3fe7373597f7a33e11d58d5a15e6ab75800648b2c82aae9687efd72c584383c71808d1d018528a5b9b374ce8b60008765ffb4a403ea4d9aa62cf5aa62","ssdeep":"192:WSEvZvLc7gfo+dpy2satBPVdmN3+vyQAhzfCBPOt82:NEBjcEQN2sqTvyQ+zUPu82","tlshash":"2302fcf1ef6e20539b7e6efae547d30d42d13645211d2af82071f18b2a14d8c66e3c89","first_seen":"2026-07-12T12:00:56.261658Z","last_seen":"2026-07-12T21:01:41.881861Z","times_seen":2,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/HMRC.jpg","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.867Z","timestamp":1783890073867,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /HMRC.jpg HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"HMRC.jpg\"\r\ncontent-type: image/jpeg\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: \"86b5235a11b2b65eeeaaf9ad5fb063a2\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::6vb7d-1783890073872-eb600663905d\r\ncontent-length: 20681\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":20681,"size_decoded":21192,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 580x325, components 3","md5":"86b5235a11b2b65eeeaaf9ad5fb063a2","sha1":"17d70d6590e73030aa5369a3b7ca3eccace8fa88","sha256":"af75702100e27d70883f1fffb950d36c1484c4941cc41fa614a2ef715335d103","sha512":"821c53c4862451928c184f15aa5e352122de1a07141bb14ad26c55f8afb647f6f713bf2895773fdd7d109e1d240e5238c5e53a3d85e19268ffaf3a8d7c0337c8","ssdeep":"384:+jnfQWdL2eFBKN4QVip3LxwmIH4zTJu8xmRyZlxoDtTQHe32kTDQ:+L4WdCeFgjYZTJu0RpeTDQ","tlshash":"6292cf3ab6b4d343c545fb3a7d3c9e465a2d9af7a0ba60e8b0bf0dd5d3c218104518d1","first_seen":"2026-07-12T12:00:56.255047Z","last_seen":"2026-07-12T21:01:41.886765Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"refund-hub.online/SARS.jpg","fqdn":"refund-hub.online","domain":"refund-hub.online","tld":"online"},"ip":{"addr":"216.198.79.65","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refund-hub.online/","date":"2026-07-12T21:01:13.869Z","timestamp":1783890073869,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refund-hub.online","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Jul 2026 07:04:57 GMT","end":"Thu, 08 Oct 2026 07:04:56 GMT"},"fingerprint":{"sha1":"9F:04:63:1F:9F:3F:97:55:AB:77:E6:CC:D5:87:E6:A9:CC:3F:86:09","sha256":"CC:5E:C2:3C:1A:4A:77:44:91:E2:11:6C:BB:31:8B:A5:76:48:76:38:B4:B8:83:C2:A3:50:9E:CF:12:20:94:B6"}}},"request":{"raw":"GET /SARS.jpg HTTP/1.1\r\nHost: refund-hub.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refund-hub.online/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 65956\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"SARS.jpg\"\r\ncontent-type: image/jpeg\r\ndate: Sun, 12 Jul 2026 21:01:13 GMT\r\netag: \"556107b294a263b4048410a2fd78d90d\"\r\nlast-modified: Sun, 12 Jul 2026 02:41:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vszrp-1783890073873-043e97b47400\r\ncontent-length: 14541\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":14541,"size_decoded":15052,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x400, components 3","md5":"556107b294a263b4048410a2fd78d90d","sha1":"19836dc834ce2be78a2c2a32921940bfd083d6d7","sha256":"723d4386f305d74d9a57684314bae5b6b91850a3567a34a490c3a5c7197f9dad","sha512":"ce971ca33096207e0d3933eba7036ca9884e3054dd2368ebc63bb90086db5ecf54af082baf5398b280bc08c4840957e4a4adbdd7a08cf356a498d993b7b345ce","ssdeep":"384:WBOtx9eyiuGCYG4ggiEBMiZEEvAF1kv6zpbNuND:MNyjb4fEEvpMSD","tlshash":"e162bfaacc1ea33ef846c9720105fe182225534d7c988cf599b9ef446a6cdc4accdd6d","first_seen":"2026-07-12T12:00:56.256174Z","last_seen":"2026-07-12T21:01:41.888578Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"refund-hub.online","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}