{"report_id":"8aaf4cc1-41a5-449e-9f44-312833943d16","version":0,"status":"done","tags":[],"date":"2026-06-17T20:05:41Z","url":{"schema":"http","addr":"vaultsafepay.xyz","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":0,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"theajack.github.io/disable-devtool/404.html?h=vaultsafepay.xyz","fqdn":"theajack.github.io","domain":"theajack.github.io","tld":"github.io"},"title":"Not allowed","dom":{"size":18506,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"e71b0c35691501e2a6b27e0731c74356","sha1":"bf40e0bed1eb68b4a93cba1aeb9e78e522f0f9f1","sha256":"035f8d1288d3c0084869cd0acd70d02dc8a77081e276730e8286c71d39436160","sha512":"2fe70981ef96aaadf060f140c2a109d43e3b254ca09ad3f32e73b55c423e58fec0bad36c80df87ef01740b1e47e1d498a8f014e98432e826dd0c0b034ee1e321","ssdeep":"192:WniKZyNy339QQbxzAH1d6+clwnEoUSH0MWqeKgl4uoPerekgCjk:Wnn9CVRH0WRz","tlshash":"e1823056231d683ef9150291e7d53ab1163e0233961c7368b23d0075eb1d7bf24bbae9","dom_hash":"domhash060a4c45ef48f6af4476ab2920aa1ba3","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"vaultsafepay.xyz","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":0,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-22T20:05:41Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"noteworthy-lox.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"noteworthy-lox.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"theajack.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"arbitrum.drpc.org","ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2005-01-09","domain_rank":1951970,"first_seen":"2024-10-14T17:26:29.664661Z","last_seen":"2026-06-16T16:56:49.648975Z","alert_count":0,"request_count":2,"received_data":449,"sent_data":1065,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-06-14T22:19:01.724334Z","alert_count":0,"request_count":5,"received_data":104905,"sent_data":2905,"comment":"","tags":null,"fingerprints":null},{"fqdn":"theajack.github.io","ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2013-03-08","domain_rank":1222043,"first_seen":"2022-06-30T12:27:22Z","last_seen":"2026-06-16T16:32:24.874379Z","alert_count":2,"request_count":2,"received_data":29694,"sent_data":1127,"comment":"","tags":null,"fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Hexo:6.2.0","description":"Hexo is a blog framework powered by Node.js.","website":"https://hexo.io","common_platform_enumeration":"","icon":"Hexo.png","categories":["Static site generator"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]}]},{"fqdn":"public-bsc.nownodes.io","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2019-05-20","domain_rank":0,"first_seen":"2025-10-14T19:44:58.496919Z","last_seen":"2026-06-16T07:51:55.410991Z","alert_count":0,"request_count":2,"received_data":440,"sent_data":1075,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"vaultsafepay.xyz","ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"domain_registered":"2026-06-11","domain_rank":0,"first_seen":"2026-06-17T13:52:58.108796Z","last_seen":"2026-06-17T13:52:58.108796Z","alert_count":98,"request_count":49,"received_data":9960105,"sent_data":24743,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}]},{"fqdn":"bsc.publicnode.com","ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-08-16","domain_rank":3431031,"first_seen":"2023-04-05T12:56:41Z","last_seen":"2026-06-09T16:21:38.013413Z","alert_count":0,"request_count":2,"received_data":641,"sent_data":1067,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"arbitrum-one.publicnode.com","ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-08-16","domain_rank":3618652,"first_seen":"2023-07-09T07:25:43Z","last_seen":"2026-06-14T03:39:32.274475Z","alert_count":0,"request_count":2,"received_data":1597,"sent_data":1085,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"binance.llamarpc.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2022-02-07","domain_rank":2101135,"first_seen":"2023-09-18T00:31:06Z","last_seen":"2026-06-16T07:51:54.56817Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":552,"comment":"","tags":null,"fingerprints":null},{"fqdn":"arbitrum.meowrpc.com","ip":{"addr":"104.26.11.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-05-04","domain_rank":2819481,"first_seen":"2025-08-16T04:05:13.25434Z","last_seen":"2026-06-17T06:46:46.364124Z","alert_count":0,"request_count":2,"received_data":1549,"sent_data":1071,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"bsc-dataseed.bnbchain.org","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2020-01-13","domain_rank":2077582,"first_seen":"2023-08-03T06:51:11Z","last_seen":"2026-06-09T16:21:38.004668Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":557,"comment":"","tags":null,"fingerprints":null},{"fqdn":"esm.sh","ip":{"addr":"104.26.15.209","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-09-06","domain_rank":47501,"first_seen":"2020-09-23T23:39:41Z","last_seen":"2026-06-13T11:42:43.723247Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":454,"comment":"","tags":null,"fingerprints":null},{"fqdn":"bsc.drpc.org","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2005-01-09","domain_rank":2964008,"first_seen":"2023-11-21T22:39:48Z","last_seen":"2026-06-16T07:51:55.389711Z","alert_count":0,"request_count":2,"received_data":449,"sent_data":1055,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-06-14T22:22:05.140579Z","alert_count":0,"request_count":1,"received_data":10819,"sent_data":550,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"noteworthy-lox.xyz","ip":{"addr":"104.21.11.153","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-06-08","domain_rank":0,"first_seen":"2026-06-08T14:54:56.894128Z","last_seen":"2026-06-17T06:46:45.889429Z","alert_count":2,"request_count":1,"received_data":4618729,"sent_data":473,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"arbitrum.gateway.tenderly.co","ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2020-05-11","domain_rank":0,"first_seen":"2025-08-03T10:23:07.270939Z","last_seen":"2026-06-17T06:46:46.037626Z","alert_count":0,"request_count":2,"received_data":1188,"sent_data":1087,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]},{"fqdn":"bsc-rpc.publicnode.com","ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-08-16","domain_rank":2142410,"first_seen":"2024-05-08T23:22:55Z","last_seen":"2026-06-16T07:51:54.242285Z","alert_count":0,"request_count":2,"received_data":641,"sent_data":1075,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"arb1.arbitrum.io","ip":{"addr":"172.66.171.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-01-03","domain_rank":513999,"first_seen":"2021-05-28T20:40:01Z","last_seen":"2026-06-16T13:32:58.982802Z","alert_count":0,"request_count":2,"received_data":1169,"sent_data":1069,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"arbitrum.llamarpc.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2022-02-07","domain_rank":3027975,"first_seen":"2023-12-02T14:30:00Z","last_seen":"2026-06-16T16:56:49.764772Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":553,"comment":"","tags":null,"fingerprints":null},{"fqdn":"rpc.ankr.com","ip":{"addr":"152.236.9.75","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"domain_registered":"2007-04-23","domain_rank":541361,"first_seen":"2021-10-24T12:41:06Z","last_seen":"2026-06-14T13:00:54.298Z","alert_count":0,"request_count":3,"received_data":1455,"sent_data":1613,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"vaultsafepay.xyz/","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"3689b279d89ca1284cbf58c1c6ff069c","sha1":"b5e0efd576fce45d9e7c7f8c89ee7c1c4c6fe0dd","sha256":"6461f69a05d49fa67edfe8351dc0ec696ac1ce3230aa0b88b64122b5ea5226fc","sha512":"052a2ced1e31f3082583338fc9851a9aab1c04c8a0963e7ff696aa373241a0816064da776d760f6b5ae033734860c2b2a8028eba1fc900f6014ff7dd2b61df37","ssdeep":"","tlshash":"10318eaf7afa127059ab33771beac7ac223a80075503d5b83e6c86505f60a552978bd0","size":1710,"data":"","first_seen":"2026-06-17T13:53:06.449745Z","last_seen":"2026-06-17T20:06:00.578396Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"eval","is_inline":false,"md5":"f1b9dcb0abf9016c8c059ac244524317","sha1":"b23dbbe0c94bb45f6343006d36dd2048bfa63349","sha256":"3c855f16a6e35b5f9c15e51eddbacc70f4d391eda28cb06ea083ee9033134059","sha512":"c34cf44e5c767f7d98f9861f95c2f46e81fdcb088eeeaf5e23e69efe87a601c0e37cffce71a8010efecd4f004d4aad157e3a19452fe39c74a66bdf9052308852","ssdeep":"","tlshash":"5e80002b2c830e22e8200e2a3820000820b880280822203002b320ba800022388e0030","size":28,"data":"","first_seen":"2026-06-17T20:06:00.579061Z","last_seen":"2026-06-17T20:06:00.579061Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/js/1.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"07c1644339fc260ccc37a7c241b38f07","sha1":"3c0a9dd35de4430b5fa84a28099f616c753e7462","sha256":"632e08c63deed77a8a18e17faf2d653c47a4d81a7d083f4f3bbb52d2794fd7fd","sha512":"29d02c224b5cdda8451323e3ff84d528051e0598f48e0d722b4cb44d433f0c8d20076a3dcc2db5133a4578af10662c576e62e5c92e99c315a6f1ca509fdb16b5","ssdeep":"","tlshash":"fa71ac9e750230bb843773b69fab91c9fb70106b0142c61a3ebc95851fb246457b2ece","size":3764,"data":"","first_seen":"2026-06-17T13:53:06.428145Z","last_seen":"2026-06-17T20:06:00.567457Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/js/3.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"0bcde523e425d107c31a9c07f3f74ce1","sha1":"899bfbc66426315c4454c7b72b0f2c9a3b457627","sha256":"c0c75bf327ef38f0b15209b428672aa6c1e4f8376801a1f31f544a8c0a8846be","sha512":"e026756b077df5b24ee29592ca1a02fc62f7cce0f1705f2fd713780329bef9189e19db931d804576a656c045aa936d3109d95252ab6d078e714f2ddb137070b3","ssdeep":"192:cGVMyHnapfppjJ1qIG23Vr/RaGbM3rdmwHzEU4Q6rWh4Q/eC:cGkpfjradHwUzhv","tlshash":"3422f46da76433b6447b73b7ef8aa5a8f7a124570002c7253e6cc9c00f758505ba5eac","size":10203,"data":"","first_seen":"2026-06-17T13:53:06.366567Z","last_seen":"2026-06-17T20:06:00.551957Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"Function","is_inline":false,"md5":"b002db22bab3b76e1862e4adced8608a","sha1":"42006fd1f193edc1fc8d707624cb63699874f67a","sha256":"8f4e1f9d8e27d7ef11d577734cbfd500733eac2a6f67488771c70102acde05ef","sha512":"3807f8db0c9ed41018b1fe0adf979c34ea3ccbad75b668e958306e932051a1324d88d71d30024a2f098b7e0d1ec54316fe921989f2b9ddf367d7741850e9a03c","ssdeep":"24576:CkpZ8mkmK8O6i3DMU/TlainkdgpFMVi6g1/zhmf9dj5oix+081aL93TqJPzrb6GT:Ckf8mZriTM5Uy3j4dxWGl4YYpKWwIstt","tlshash":"77064c832043900671fd65f86e51040af4be9ea3fa8d382563b5b8efa56ce51dde1cd8","size":3884228,"data":"","first_seen":"2026-06-17T20:06:00.58138Z","last_seen":"2026-06-17T20:06:00.58138Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/js/4.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ee27bdde3cda165839ee24b477cdca8","sha1":"0e3832891b235f8c965b23cd9aace7595ac4bfce","sha256":"26082cc74019b7d7476142fad3ab0869ef2d2f688396f66d8621e45fbb475af6","sha512":"bcc5f563f5c8d0e6200ae8574bed55ee20bad7c882272f7f2a48354a46a16402f1d4bc68b2150ff74f2d2c5de0573fbeae32eabd584ecf6fae231d876140a500","ssdeep":"768:SB1Thg1fsfWnCr4b7Q/itdaWVVEL5azIIZ:GVefsnr4/Q/itdZVEGIIZ","tlshash":"ca13a73b9259284f7077b32da528667afa14a27fb68002573d3cb12c1ffe8545114ebe","size":43778,"data":"","first_seen":"2026-06-17T13:53:06.341181Z","last_seen":"2026-06-17T20:06:00.557838Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"Function","is_inline":false,"md5":"d3988d5b72521df52e8dccf505ebd7bb","sha1":"15be08409b7704a6e229428dfb0f0f1a618a0071","sha256":"e55a62b3bdcefd9adcd845b61047cc5c03dcfc11c399390ff5cfed7554a32ad5","sha512":"e7504d0196a5afe01180d74249d063acecde481a1e7c669e03187116368614ec98b735e726d21181bca83586b8202e6aa86dc87a772f4ac30561ea9884d148c9","ssdeep":"6144:DZRZaMGVIUWTJ+gWvuX9AjWtxKOKK0Q+xycpz:DZ9GVIp+RvuxtxKOKVQ+xycB","tlshash":"66f4651c06f30323879271edec79717cb52148059a994ebf2f952867ff34db6e0a291a","size":723195,"data":"","first_seen":"2026-06-17T13:53:06.454536Z","last_seen":"2026-06-17T20:06:00.582934Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"noteworthy-lox.xyz/AaY1qjSxTIgsDOhNzw0l4.js","fqdn":"noteworthy-lox.xyz","domain":"noteworthy-lox.xyz","tld":"xyz"},"ip":{"addr":"104.21.11.153","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"191dd0b82d4d2880cae0ee4d1771a8dd","sha1":"127a5313752b8be842e88506c0590b344ac0322b","sha256":"fa374c642cfb0b85c9f8984feb999af41f7851788a1aaf60dcf1c8f91ae1e2ce","sha512":"81585e0a03c30ba8f7a1d380cf94765516ad2eb9de8092e15c270260d2468a769014aebef6e090bb589f0b4ab4889b960f8f60a52b7262f5283e267925766b43","ssdeep":"49152:XraKUFZPaV6Of54SCosK3jQdxWGl4YAJKwwIM5C:XWKUF7W3jQdxWGl4YM6C","tlshash":"df269e832053900671fd65f86e51040af4be9aa3ba8d382473b5b8efb56ce50dde1dd8","size":4617944,"data":"","first_seen":"2026-06-17T20:06:00.584909Z","last_seen":"2026-06-17T20:06:00.584909Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"theajack.github.io/disable-devtool/404.html?h=vaultsafepay.xyz","fqdn":"theajack.github.io","domain":"theajack.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"faa6920f9f868c77b68832cf33cf4a8b","sha1":"66f04a7c944bfd3e43abff14a701238e46d5c45c","sha256":"4f92a833075632e17676f264a5052fea4d17833e7920c3ef5995ad6765046b4d","sha512":"3391b5c511d4bbd428d6c0cdd349db4020466496011f1e081c0395108cd80c1f76eb98a26bbb1c400f57df047ee954cce774eb9ae86cfead29466972bc30550f","ssdeep":"","tlshash":"0df061855493c0a86877747d898ea26c30738453290dcf107d2c6c009fa1efe417c3d8","size":508,"data":"","first_seen":"2026-06-09T16:23:38.425899Z","last_seen":"2026-07-23T01:27:37.191392Z","times_seen":108,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/js/2.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"b5211ae037db9368bd63b5ad8a40ebcb","sha1":"725c2d306bd9c37d984c94ad4ffb4f6eff488d4c","sha256":"8a6f227269025386bbccdc582e2459428339413f0cef318d8b3b344a9211cea8","sha512":"f343cd7b1ff07975bbe8ef5b0f3e2d5326b9fbc56647278c720f5512d1c5bf7fa2978196df4a9b04773f821dc67bf21e29dd10ce8c18d43be36bfba4ab1aab39","ssdeep":"3072:rEtlB8bwd1TOZZPdU5+CVjAPzxj7co0lPc0TOp:I/B8bwd1odT","tlshash":"29e3b42fdbb92e2704b9369fa12caa7bf044133f9385016f327cea6c6fb5d605164416","size":147708,"data":"","first_seen":"2026-06-17T13:53:06.343089Z","last_seen":"2026-06-17T20:06:00.562458Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/assets/react-navigator-boost.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"fa8f82794d02619eccd073495be9621a","sha1":"29a8aad0232d9258c678a02bad5cbf8b437e27f7","sha256":"e5d4286e10145791ec19e5ed53d10e573efb9d08270cfb8183b340884fa37ef3","sha512":"f062b1174f889c5645bf5889ec25243133edddce0195a5e5284f939495ab096f3c052b3d55ecc9f323960319f375b242e1421b0147d8a711569d6e5556e2c92f","ssdeep":"6144:sGUXwAuXAF8/Mh5+pfMPY9iUmYhAjEtxKOoa0Qy/sOpz:1wF7GMgIatxKOoFQy/sOt","tlshash":"e2f4411d02e20227939271ddec7835bcb56144049e994dbf6f9128ebff34db6e091a2b","size":751389,"data":"","first_seen":"2026-06-17T13:53:06.387036Z","last_seen":"2026-06-17T20:06:00.530064Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"eval","is_inline":false,"md5":"9e925e9341b490bfd3b4c4ca3b0c1ef2","sha1":"c2543fff3bfa6f144c2f06a7de6cd10c0b650cae","sha256":"1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408","sha512":"1f4be9bd3c61e621ef43bb2e0a2d7836786f730e4e0e6aa546899bceab0571904dfc6efc94c1324b1a22ae446f0a995b533054b1dbd09d0cda03e0985786d59a","ssdeep":"","tlshash":"2a30000000000003000c00000000000000000000000000000000000000000000000000","size":4,"data":"","first_seen":"2023-03-07T01:03:43Z","last_seen":"2026-07-23T09:22:25.56429Z","times_seen":782095,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"[ EL CE ] : ok","filename":"https://noteworthy-lox.xyz/AaY1qjSxTIgsDOhNzw0l4.js line 20 \u003e Function","line_number":0,"column_number":0},{"level":"log","text":"[ EL ] : Installation started","filename":"https://noteworthy-lox.xyz/AaY1qjSxTIgsDOhNzw0l4.js line 20 \u003e Function","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj44 class:HTMLDivElement contentDomReference:map[browsingContextId:3 id:0.9267160168378303] extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[attributes:map[] attributesLength:0 isConnected:false kind:DOMNode nodeName:div nodeType:1] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj45 class:Date extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[timestamp:1.781726718625e+12] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj46 class:Function displayName:me\u003c/\u003c/value/this.func extensible:true frozen:false isAsync:false isClassConstructor:false isError:false isGenerator:false location:map[column:11976 line:3 url:https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs] ownPropertyLength:4 parameterNames:[] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj108 class:Array extensible:true frozen:false isError:false ownPropertyLength:51 preview:map[items:[map[actor:server1.conn0.watcher16.process7//obj109 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj110 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj111 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj112 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj113 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj114 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj115 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj116 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj117 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj118 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object]] kind:ArrayLike length:50] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj180 class:Array extensible:true frozen:false isError:false ownPropertyLength:51 preview:map[items:[map[actor:server1.conn0.watcher16.process7//obj181 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj182 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj183 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj184 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj185 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj186 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj187 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj188 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj189 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj190 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object]] kind:ArrayLike length:50] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj252 class:Array extensible:true frozen:false isError:false ownPropertyLength:51 preview:map[items:[map[actor:server1.conn0.watcher16.process7//obj253 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj254 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj255 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj256 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj257 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj258 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj259 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj260 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj261 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj262 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object]] kind:ArrayLike length:50] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"warn","text":"You don't have permission to use DEVTOOL!【type = 6】","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj263 class:HTMLDivElement contentDomReference:map[browsingContextId:3 id:0.9267160168378303] extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[attributes:map[] attributesLength:0 isConnected:false kind:DOMNode nodeName:div nodeType:1] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj264 class:Date extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[timestamp:1.781726718625e+12] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj265 class:Function displayName:me\u003c/\u003c/value/this.func extensible:true frozen:false isAsync:false isClassConstructor:false isError:false isGenerator:false location:map[column:11976 line:3 url:https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs] ownPropertyLength:4 parameterNames:[] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"log","text":"map[actor:server1.conn0.watcher16.process7//obj327 class:Array extensible:true frozen:false isError:false ownPropertyLength:51 preview:map[items:[map[actor:server1.conn0.watcher16.process7//obj328 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj329 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj330 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj331 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj332 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj333 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj334 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj335 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj336 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object] map[actor:server1.conn0.watcher16.process7//obj337 class:Object extensible:true frozen:false isError:false ownPropertyLength:500 sealed:false type:object]] kind:ArrayLike length:50] sealed:false type:object]","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0},{"level":"warn","text":"You don't have permission to use DEVTOOL!【type = 6】","filename":"https://esm.sh/disable-devtool@0.3.9/es2022/disable-devtool.mjs","line_number":0,"column_number":0}]},"http":[{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/cta-banner.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.717Z","timestamp":1781726714717,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/cta-banner.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 10502\r\nLast-Modified: Tue, 07 Apr 2026 19:07:52 GMT\r\nConnection: keep-alive\r\nETag: \"69d55608-2906\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10502,"size_decoded":10747,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e34a0d2ddecc4eca36af15326e3ef4cc","sha1":"27158ef8abf4724643ad911ed1091688e6d2ba40","sha256":"1fe123414ca02e7118d90c20c5ef90f15d45ce6dbeb6820a44d89498319a20de","sha512":"90db61f4078563bf7f118b99c3927ca8410b4062f977ffaa49f72c2733e67b1fe0c0b570030fb4133d92ceef7888ce08242e72495fe3beea03ad413df2944edb","ssdeep":"192:sXxy6K0CCGDMdkLeLEIwy5HpYpE72KPJesp:MxtXQIwepfJesp","tlshash":"e1221dde33148cbcfd268ba2eb03737822275ab30a996780cd371a79155551ea93fdc4","first_seen":"2026-02-11T15:17:55.649184Z","last_seen":"2026-07-18T17:49:20.696085Z","times_seen":52,"resource_available":false,"data":null}},"time_used":491,"timings":{"blocked":447,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/cn.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.722Z","timestamp":1781726714722,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/cn.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 745\r\nLast-Modified: Tue, 07 Apr 2026 19:10:24 GMT\r\nConnection: keep-alive\r\nETag: \"69d556a0-2e9\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":745,"size_decoded":983,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"338eea6f11bbc636451f3ad04853688d","sha1":"1675a379ca319a65b61971baca0117d80524aa98","sha256":"ea5ce489b7293fdc2b16ad9d5709870769d91a0d46bc745ef7f132e059018ee0","sha512":"3781472e4a09f9f6dbf698953ab88f9683534537f63079a3b64a563b9db25398f374dcc3199bf59a6dc85e7f550fb08da7b5eb09ba801abe41e2c289b05fdd8e","ssdeep":"","tlshash":"1401b5e5902c49acc903732132c9a131fcb766cb6c39c12ed1c0cfa08194c32607a25a","first_seen":"2023-07-07T16:55:45Z","last_seen":"2026-06-17T20:06:00.520792Z","times_seen":50,"resource_available":false,"data":null}},"time_used":550,"timings":{"blocked":509,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/badge-atm.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.737Z","timestamp":1781726714737,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/badge-atm.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 3140\r\nLast-Modified: Tue, 07 Apr 2026 19:06:12 GMT\r\nConnection: keep-alive\r\nETag: \"69d555a4-c44\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3140,"size_decoded":3383,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"06ce6117830392d3c28b39a1d804fc91","sha1":"41b99e63a780f8c82ed2df7e0c580a160d854fff","sha256":"421076356a41c30f90b1c534c96f8722d7162b39cf0dc3f8219aa59060f72065","sha512":"e986578de58f51fd06671fb74f8853c8811b4d2b8902c925796198a609bf8cd742683b7fa17d82fcc47b23379e312c05a83d97c15a62e5cd12328ced6377a2df","ssdeep":"","tlshash":"6751a56477d8d235e000eabcc30fd07839068dcaa516c0d09be22d4add2549e8cbdde7","first_seen":"2026-02-11T15:17:55.585193Z","last_seen":"2026-07-03T02:35:45.456161Z","times_seen":66,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":149,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bsc.drpc.org/","fqdn":"bsc.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.950Z","timestamp":1781726719950,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Jun 2026 23:01:08 GMT","end":"Sun, 13 Sep 2026 00:00:59 GMT"},"fingerprint":{"sha1":"7F:E5:3C:EC:15:AC:2B:17:FE:8B:3B:16:E4:25:9A:40:37:43:63:45","sha256":"DF:D3:75:05:E3:1C:E5:C2:B8:D6:2A:66:75:39:9A:D3:91:D6:86:E7:7B:11:D6:84:3E:A1:0F:FF:79:47:06:19"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-17T20:05:14.055Z","timestamp":1781726714055,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: text/html; charset=utf-8\r\nLast-Modified: Mon, 08 Jun 2026 14:49:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a26d682-17830\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96304,"size_decoded":20738,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (871), with CRLF line terminators","md5":"db6106a54e554e37ffd61f2387f10743","sha1":"a30e054967fef70e3128abaa72240409d67b315c","sha256":"b6ba5defdea701375c83b9185f1e70cf52d4adecabe55bb96544a8d4856ac95f","sha512":"2f85b3f8be4db14c7a456acfcc027b22631a80d163ae9391178be161c4fb92cea6535f453d1d8df8eef3dc3a4ba34b9f68ae1608fe2ee7d4bc9c5c5b1c9f3a2d","ssdeep":"768:SyL8Qnwa/6I+WJ/qhfCkrDcnT5xg9ZU/V6:bIQnHOOF6","tlshash":"dd93a435bad06676017383d89a2b62a8f9a26047e646510433fd77b35fb3ec3e81741e","first_seen":"2026-06-17T13:53:06.42158Z","last_seen":"2026-06-17T20:06:00.526494Z","times_seen":3,"resource_available":true,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":69,"connect":43,"send":0,"wait":85,"receive":0,"ssl":48},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rpc.ankr.com/bsc","fqdn":"rpc.ankr.com","domain":"ankr.com","tld":"com"},"ip":{"addr":"152.236.9.75","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.947Z","timestamp":1781726719947,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"shark.multi-rpc.com","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 11:08:04 GMT","end":"Sun, 16 Aug 2026 11:08:03 GMT"},"fingerprint":{"sha1":"75:83:7C:84:77:DB:95:45:36:E5:E8:67:BD:D3:E5:85:52:4F:E8:FD","sha256":"B1:12:8E:9C:C2:F1:B2:5A:70:44:5F:46:ED:1F:40:D2:99:24:1D:0C:C1:85:19:9D:E3:34:0B:15:6B:DA:C9:B3"}}},"request":{"raw":"POST /bsc HTTP/1.1\r\nHost: rpc.ankr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 17 Jun 2026 20:05:20 GMT\r\ncontent-type: application/json\r\ncontent-length: 229\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client,client-sdk-version,client-sdk-type,client-target-api-version,x-ton-client-version,x-client-name,x-client-version\r\naccess-control-max-age: 1728000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":229,"size_decoded":859,"mime_type":"application/json","magic":"JSON text data","md5":"42e136a22281d105bd21fa496816706c","sha1":"bc02950079004b0d4f4bea3888dfd4517cddeeff","sha256":"ede226c79ae326ce9e4b099e9f4dbb4e3d7807da2b793bdfadfafeeb84d7175a","sha512":"a41403da8b9e698eb2823bbe0925160b68682c55d4c64e5c8b27193f8fd8bf4fd118179d26eadb446ed41c2c9c12d46523b6f5094caadaae8a03ba3c1d6bade5","ssdeep":"","tlshash":"33d02313c6470537e34f4633371567c4f559705071105f1b4e1c0315024f97b0255351","first_seen":"2025-04-07T11:34:31.00119Z","last_seen":"2026-07-22T08:33:36.653329Z","times_seen":2992,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"binance.llamarpc.com/","fqdn":"binance.llamarpc.com","domain":"llamarpc.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.951Z","timestamp":1781726719951,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: binance.llamarpc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/assets/react-navigator-boost.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.699Z","timestamp":1781726714699,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /assets/react-navigator-boost.js HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Mon, 08 Jun 2026 08:26:22 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a267cae-b77c5\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":751557,"size_decoded":208766,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (46746), with no line terminators","md5":"fa8f82794d02619eccd073495be9621a","sha1":"29a8aad0232d9258c678a02bad5cbf8b437e27f7","sha256":"e5d4286e10145791ec19e5ed53d10e573efb9d08270cfb8183b340884fa37ef3","sha512":"f062b1174f889c5645bf5889ec25243133edddce0195a5e5284f939495ab096f3c052b3d55ecc9f323960319f375b242e1421b0147d8a711569d6e5556e2c92f","ssdeep":"6144:sGUXwAuXAF8/Mh5+pfMPY9iUmYhAjEtxKOoa0Qy/sOpz:1wF7GMgIatxKOoFQy/sOt","tlshash":"e2f4411d02e20227939271ddec7835bcb56144049e994dbf6f9128ebff34db6e091a2b","first_seen":"2026-06-17T13:53:06.387036Z","last_seen":"2026-06-17T20:06:00.530064Z","times_seen":3,"resource_available":true,"data":null}},"time_used":304,"timings":{"blocked":97,"dns":0,"connect":0,"send":0,"wait":83,"receive":124,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arbitrum.meowrpc.com/","fqdn":"arbitrum.meowrpc.com","domain":"meowrpc.com","tld":"com"},"ip":{"addr":"104.26.11.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.216Z","timestamp":1781726715216,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"meowrpc.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Jun 2026 17:34:32 GMT","end":"Tue, 01 Sep 2026 18:34:19 GMT"},"fingerprint":{"sha1":"78:4A:BA:FF:8C:0B:6A:C6:ED:79:41:C4:76:F9:F8:BF:73:62:59:82","sha256":"B7:3B:89:BB:B9:D1:2E:D6:73:1E:CD:1B:A5:D3:D9:21:43:F6:C5:57:71:93:11:42:0E:54:A9:E7:B4:CB:08:47"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: arbitrum.meowrpc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 17 Jun 2026 20:05:15 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: *\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oMIG7en0WPe%2BWwCJDbDlVp7s7igF8vIxHomfFD8zp9zQc%2BM6buRTFgbFxII%2Ffwq4VYf1gBnVWW7iTLlIQbUytgqhOciwzVPMhZ2suFQDXfScetRV7mmIsqdQfOwJ3yZ60V66RpTF\"}]}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a0d4ab02bafe0883-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":98,"size_decoded":716,"mime_type":"application/json","magic":"JSON text data","md5":"e46902157aa64abcdc41f29ace8b171a","sha1":"b959cf3eceb9eee47817435a4c36f0792aa15811","sha256":"36edf520b814be5fc0d5360dc0f6ae1e9ed28f47bcc63fe6ede8285bfe2ce982","sha512":"49d1d832b1949ee103d35f061172658ef17bc4970391dca16e61aabfce51f02db86daa7cbe9d7657265e1ebf17916c347233226eedfe065aacadabc4409ce6c5","ssdeep":"","tlshash":"c5b01220514e2b30715a49067e0d394d57f099f104507f031c0c8a09250951790c2130","first_seen":"2026-02-05T07:43:22.648531Z","last_seen":"2026-07-21T08:07:44.994635Z","times_seen":197,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Wix+Madefor+Display:wght@400;500;600;700;800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.684Z","timestamp":1781726714684,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 25 May 2026 08:38:19 GMT","end":"Mon, 17 Aug 2026 08:38:18 GMT"},"fingerprint":{"sha1":"4D:E0:8E:62:2F:B2:3D:28:5D:7D:B5:8D:C5:3A:72:E4:EE:AB:7D:93","sha256":"AE:0B:4F:B5:B7:41:E5:0C:70:C0:E1:2A:F9:DB:AD:A8:64:94:F3:70:6D:38:1C:8A:8A:CA:52:96:5C:D8:5C:87"}}},"request":{"raw":"GET /css2?family=Wix+Madefor+Display:wght@400;500;600;700;800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 17 Jun 2026 20:05:14 GMT\r\ndate: Wed, 17 Jun 2026 20:05:14 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10135,"size_decoded":1369,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"72bf8c047485c2c55a2773f5c5072af9","sha1":"8088ded0888290380851d3f8474cbfe1d27a060c","sha256":"e7943f515c816ef31d9427cf5e351badc4dc0109b0bce75625086a678ff4e5b0","sha512":"4c4541a41de7113a49730cdf81c0d66d1455542a775254a808b5672ff682fe840c23aa1c0c5d143573670ca65c1f76a873c9ccd4333e7b0f4341eb267467520e","ssdeep":"192:ZqpP4EMr8q6P/rMElqXPiOMNGqwPRNMOHq1PkYMfR:Et8Qk/oioB+","tlshash":"2322dcd0081b8440da475dc633cebf3bad6e2601646586bdaffd18989cdee255398f0c","first_seen":"2025-09-28T12:46:50.523554Z","last_seen":"2026-07-23T01:03:33.354062Z","times_seen":122,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":35,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/benefit6.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.716Z","timestamp":1781726714716,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/benefit6.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 7118\r\nLast-Modified: Tue, 07 Apr 2026 19:07:04 GMT\r\nConnection: keep-alive\r\nETag: \"69d555d8-1bce\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7118,"size_decoded":7362,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"09a9977bfe977ac4e405eb0ba43f07d2","sha1":"90d4b8bb58683e2076e248a67759331f883befbf","sha256":"278edfd8be3da161082664057cfb31bf4f2c416238b9380f47427495c9d69db3","sha512":"52020259721f5b96b18870d0ec8710418ea7798a64b3a2aff1956f8daa105a0fd3dc60a951d81122c1a456f6413911bd9feb8d24b65f02f21a81af60c5983ab0","ssdeep":"96:cqhVKlr2fNV0338FAFfIDzIZrCfhUYa44VHH5ObSGmEOQa44VdbJQXiCKX9V4id1:BZNqnUmNJ5Ob3RuZ5jvqW","tlshash":"83e10cca3758497cbd369382eb02b27a606a44e317c4e630cb32593d285191e9dbfed5","first_seen":"2026-02-11T15:17:55.588479Z","last_seen":"2026-07-18T17:49:20.693805Z","times_seen":68,"resource_available":false,"data":null}},"time_used":670,"timings":{"blocked":629,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/phone-5.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.738Z","timestamp":1781726714738,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/phone-5.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 211470\r\nLast-Modified: Tue, 07 Apr 2026 19:05:10 GMT\r\nConnection: keep-alive\r\nETag: \"69d55566-33a0e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":211470,"size_decoded":211717,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3868b22ca7f77068f2edba51cb879f5d","sha1":"fe91e29b99959eb88558f4e78bece76ce23bd0fe","sha256":"4e58e1a299c1ce83b1695fe172ef5ffe3196da11e66ba6a2c28c79ce0451235f","sha512":"6b25bd1312de3bfa16ea450f081e27a0167c46cf4ff73cbfd5e5401875213dadb431d69c81d431b87e08ce9128b330cb1f6579ab2e322ee597325b95a101496f","ssdeep":"6144:7W7gNT/WbJNlDDxTtYOGwj4WYIUZVbeucmj:isJ/WbNxZYOmn6s","tlshash":"1324d0334547fdefbb278dd8e11a62209dddba93d684d24caf8458c126fb428cc615b8","first_seen":"2026-02-11T15:17:55.63009Z","last_seen":"2026-07-18T17:49:20.681509Z","times_seen":76,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":149,"dns":0,"connect":0,"send":0,"wait":83,"receive":128,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arbitrum.drpc.org/","fqdn":"arbitrum.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.226Z","timestamp":1781726715226,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Jun 2026 23:01:08 GMT","end":"Sun, 13 Sep 2026 00:00:59 GMT"},"fingerprint":{"sha1":"7F:E5:3C:EC:15:AC:2B:17:FE:8B:3B:16:E4:25:9A:40:37:43:63:45","sha256":"DF:D3:75:05:E3:1C:E5:C2:B8:D6:2A:66:75:39:9A:D3:91:D6:86:E7:7B:11:D6:84:3E:A1:0F:FF:79:47:06:19"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: arbitrum.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\ndate: Wed, 17 Jun 2026 20:05:15 GMT\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: https://vaultsafepay.xyz\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: a0d4ab0269c60883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":449,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":8,"connect":30,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/kr.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.726Z","timestamp":1781726714726,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/kr.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nLast-Modified: Tue, 07 Apr 2026 19:11:00 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d556c4-768\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1896,"size_decoded":2168,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"0f9d9d2797d5a0791e41cfc5e5784604","sha1":"0032f9dbcdcc76df13170401585d930e546410be","sha256":"5dde4b9ec8f2db19ee4547f99dc297176ba890a430dce6b8764f16207587847f","sha512":"592a04abc23ce124fd8bb16a1126c159ce3425c7f00224bbe30d99f86d2431bac6f976bcd64d953b668cebcd37b6d8733954e734472f524c48e8443540b59a49","ssdeep":"","tlshash":"f1411bdf570ab4c915a578a4bfc1e4f9e339007de749d844d61a310d8be9509840f4f7","first_seen":"2023-07-07T16:55:45Z","last_seen":"2026-06-17T20:06:00.534862Z","times_seen":79,"resource_available":false,"data":null}},"time_used":587,"timings":{"blocked":544,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/tw-iso-27701.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.742Z","timestamp":1781726714742,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/tw-iso-27701.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 122269\r\nLast-Modified: Tue, 07 Apr 2026 19:07:58 GMT\r\nConnection: keep-alive\r\nETag: \"69d5560e-1dd9d\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":122269,"size_decoded":122516,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6f8689bb04971f4d6e76dc89c99f55ee","sha1":"54830cbb3c5861e40d6120f2aaefea33f50710b9","sha256":"64d18eaae43c517e1b8017ad4dd8a8b7fabbd16e4d6bb549601b67dc9a7f4a06","sha512":"41133dc486b0f44ca09cbbac63efadd877813d10b19747a24a561b6328f33651cde639fc3e436de053606a12562aa080b5f2820bb589e4260b2db1615c33d4a5","ssdeep":"3072:V11E6spEKe8XOoRcmjpSZY/BvFTWgO0PgKFdXJj:xVDKDXOoRc0SZkBvNW90PFpj","tlshash":"9cc30270c7a9ecbb0b3d0191269f65a341d51403a75e08d27fa1af26ceed2419ece17b","first_seen":"2025-04-02T11:53:22.939917Z","last_seen":"2026-07-22T11:06:57.645082Z","times_seen":69,"resource_available":false,"data":null}},"time_used":321,"timings":{"blocked":190,"dns":0,"connect":0,"send":0,"wait":43,"receive":88,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/tw-gplay-icon.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.745Z","timestamp":1781726714745,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/tw-gplay-icon.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nLast-Modified: Tue, 07 Apr 2026 19:08:20 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d55624-565\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1381,"size_decoded":1658,"mime_type":"image/png","magic":"PNG image data, 96 x 107, 8-bit colormap, non-interlaced","md5":"7a46b63c45c17c244241728c85a7a6cc","sha1":"032f6674e8f7e5bb35a1957115f1cd36180deae5","sha256":"af275cb2f2c130144463274fcffd554bc85b5df999febf70d5aac1bfdcd624fd","sha512":"3bde1ba62f17b49ae22cd641387142e33534c79646ab3cfe38e88072a9f300cc2da80a3580b0ba05d69d167d484149f8254e86ed29bcbb5f181fd94fa155ee1a","ssdeep":"","tlshash":"5221b8cf325a4239996e9c7020850b5f8d8564e3193d61bcc82b885d4d49f6eee45730","first_seen":"2026-03-13T05:02:39.374984Z","last_seen":"2026-07-23T08:34:36.925481Z","times_seen":60,"resource_available":false,"data":null}},"time_used":443,"timings":{"blocked":401,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arbitrum.meowrpc.com/","fqdn":"arbitrum.meowrpc.com","domain":"meowrpc.com","tld":"com"},"ip":{"addr":"104.26.11.181","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.236Z","timestamp":1781726715236,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"meowrpc.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Jun 2026 17:34:32 GMT","end":"Tue, 01 Sep 2026 18:34:19 GMT"},"fingerprint":{"sha1":"78:4A:BA:FF:8C:0B:6A:C6:ED:79:41:C4:76:F9:F8:BF:73:62:59:82","sha256":"B7:3B:89:BB:B9:D1:2E:D6:73:1E:CD:1B:A5:D3:D9:21:43:F6:C5:57:71:93:11:42:0E:54:A9:E7:B4:CB:08:47"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: arbitrum.meowrpc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 17 Jun 2026 20:05:15 GMT\r\ncontent-length: 0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\naccess-control-allow-headers: authorization,content-type,dnt,keep-alive,user-agent,x-requested-with,if-modified-since,cache-control,range,x-api-key\r\naccess-control-allow-origin: *\r\nallow: POST\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RBsP%2BcKFHzET43DdzQidrv7CkJoWPSfELzuba2pr8Y547kn6WebQ5A2zXkn0SBPr76Jc4ChCiUecA%2BAEJ3RsboE%2Bbgpeag9cuRnW5ua3WkNvQ5IMyWWkj%2BILI4nqpz6D7O%2FE2r88\"}]}\r\nserver: cloudflare\r\ncf-ray: a0d4ab0279f50883-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":815,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":12,"send":0,"wait":28,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc.publicnode.com/","fqdn":"bsc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.952Z","timestamp":1781726719952,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Jun 2026 01:05:04 GMT","end":"Mon, 07 Sep 2026 02:05:00 GMT"},"fingerprint":{"sha1":"39:B4:D5:B4:26:71:60:64:13:47:CC:54:ED:BC:AD:E1:33:77:19:00","sha256":"65:A9:40:31:FB:2A:25:C7:3B:B6:B3:F0:4E:96:B9:08:CE:FC:27:5A:F6:DB:32:E8:7E:64:C7:51:34:DA:93:85"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET,HEAD,OPTIONS,POST\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 172800\r\nallow: OPTIONS, POST\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers\r\ndate: Wed, 17 Jun 2026 20:05:20 GMT\r\nx-envoy-upstream-service-time: 0\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: a0d4ab1fbed00b69-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":641,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc.drpc.org/","fqdn":"bsc.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.955Z","timestamp":1781726719955,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Jun 2026 23:01:08 GMT","end":"Sun, 13 Sep 2026 00:00:59 GMT"},"fingerprint":{"sha1":"7F:E5:3C:EC:15:AC:2B:17:FE:8B:3B:16:E4:25:9A:40:37:43:63:45","sha256":"DF:D3:75:05:E3:1C:E5:C2:B8:D6:2A:66:75:39:9A:D3:91:D6:86:E7:7B:11:D6:84:3E:A1:0F:FF:79:47:06:19"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\ndate: Wed, 17 Jun 2026 20:05:20 GMT\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: https://vaultsafepay.xyz\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: a0d4ab1fcb060883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":449,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":6,"dns":2,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/css/style4.css","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.691Z","timestamp":1781726714691,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /css/style4.css HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 07 Apr 2026 11:40:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d4ed2c-7a7e\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31358,"size_decoded":8672,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"6f9d228f381cda208ac0abda67fe5307","sha1":"8eea74fe2cfa1b6d496a27da28683e0eefabd76a","sha256":"9a9705e42f1e72bff11a91aec37c5d80284d5590bf88e02667c812d2ddcc1251","sha512":"b152c0096f821ac0869b929f5e1a969532527d8f769ff2d43eeba60b8d06fcb53e343e5965fe198a895f5eba7a609fac2a614d029d8e55bdb555abdf98fa3dfa","ssdeep":"192:ziSmSGtI15oWvHM+t1oH8yCt6v/HhXGfdU29V3SmxvxX1a9JPtXnEIKlhg3aTCrz:z0F4VOqlh4QdB98nTDVN6IZADUA8","tlshash":"97d27319db212245b937d779afb25a95f7495013ab0202bebfdc62088fba158d530fcc","first_seen":"2026-06-17T13:53:06.385082Z","last_seen":"2026-06-17T20:06:00.537155Z","times_seen":3,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":-1,"dns":0,"connect":41,"send":0,"wait":41,"receive":0,"ssl":46},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/coin-3.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.708Z","timestamp":1781726714708,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/coin-3.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 1524782\r\nLast-Modified: Tue, 07 Apr 2026 19:05:44 GMT\r\nConnection: keep-alive\r\nETag: \"69d55588-17442e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1524782,"size_decoded":1525031,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"154b07812705f948c5f0fb9ea7f8a647","sha1":"3cd47cba0a9b1890832a8b005da438d713b6b7d5","sha256":"f7e34ebffd3f342aa7980e55ddafc647d3b5f8b3eedac37f07c27884d96bf73b","sha512":"8e9c5b98c1bd4af6e12eefaa780b7961d1b6e4c790fa9f1a989674ad01aa482e578cd629d3c48f34d8fc6006068a68a03d59446653ae82e0ddff48fc17c1dd12","ssdeep":"24576:wBF3Y6bvUpI8a4tHdGwxErQ92Y7DicZQismJ8hut2f7vH:wBF3ZO9kwxd7tsjH","tlshash":"512501726ecaac8f1f889828f1df8ed65f6c573784096eb114133f475a5860a53dc88e","first_seen":"2026-02-11T15:17:55.579705Z","last_seen":"2026-07-18T17:49:20.693302Z","times_seen":61,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":413,"dns":0,"connect":0,"send":0,"wait":44,"receive":88,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/benefit5.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.715Z","timestamp":1781726714715,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/benefit5.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 13335\r\nLast-Modified: Tue, 07 Apr 2026 19:07:04 GMT\r\nConnection: keep-alive\r\nETag: \"69d555d8-3417\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13335,"size_decoded":13580,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"59713ef77a363413e687273f3c145458","sha1":"c85e8654571a7cd077a5e1b33776ae5d12289298","sha256":"70ab05b92fc860eadd89931c47f692666948dd7c27717968c09661f534791e96","sha512":"78a5ac9cb055867ac0399a25cff36de30a53b14a3ff3a69973cce6d2aac5ebbedb66fc48bc997414b907f4d00df0a49407da83246199803bbfb4ceade5fff0d4","ssdeep":"192:W9KM8HsKM8HmHna3jP7U0KSq0cS0XVcBqhdqvrXqVNdxn8DD1SHSfWnznyH:kintzjUTRXV4q3RxnUD162WnQ","tlshash":"9052b6dd33a44ab8f42287e1d703a1b5205e60f7aa95a370cb656f7a245615ecc7bcc0","first_seen":"2026-02-11T15:17:55.650976Z","last_seen":"2026-07-18T17:49:20.687493Z","times_seen":68,"resource_available":false,"data":null}},"time_used":656,"timings":{"blocked":615,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/in.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.731Z","timestamp":1781726714731,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/in.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 614\r\nLast-Modified: Tue, 07 Apr 2026 19:11:28 GMT\r\nConnection: keep-alive\r\nETag: \"69d556e0-266\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":614,"size_decoded":852,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"8c86c142d144ddfac334ddad141f1165","sha1":"ac6d46123c95f32343f2c0faecbe5025363e27b9","sha256":"926db4109627849be32f7f52856011a71fb896254d5b0a575f1f095ca66f911b","sha512":"fea6ce595d49be68bb5d9f59568d4731eeff55bac0fe497e3fb868a258af08909d76395cdb8f24a60fab1ed46b17a9e7ae5aeaf5d037b0e3209018d88844254f","ssdeep":"","tlshash":"caf00cf35bad2978ca30126442089b31663a49ea06fc70a5a6e8fc084b1c8ec2049222","first_seen":"2023-07-07T16:55:45Z","last_seen":"2026-06-22T02:34:28.5835Z","times_seen":75,"resource_available":false,"data":null}},"time_used":612,"timings":{"blocked":571,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/tw-ft-brand.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.718Z","timestamp":1781726714718,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/tw-ft-brand.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 2314\r\nLast-Modified: Tue, 07 Apr 2026 19:03:04 GMT\r\nConnection: keep-alive\r\nETag: \"69d554e8-90a\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2314,"size_decoded":2557,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"11a5749b11fe77300f539cd6786b4d41","sha1":"92c30c1074f14707c41f9fbb95a0a0ac57e90ecc","sha256":"e62d434ac6f22189707643df5f2f3f940cf55eceea75310b640ec2341ed732fa","sha512":"eabd83e42b13d82a620bd88d09a74fe8db48da48092b97c9afb0d4ddd8ccbc472569e6caca0eac772c8061ecc02f353fb7e10e171722b9df780c3df72d562e5a","ssdeep":"","tlshash":"a441619faf19ceaa8ec487bdf0895af53339d1d3f9928740e3185d0f14882555c4eac2","first_seen":"2026-05-03T10:00:14.065956Z","last_seen":"2026-07-03T02:35:45.436962Z","times_seen":16,"resource_available":false,"data":null}},"time_used":453,"timings":{"blocked":408,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.036Z","timestamp":1781726715036,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 25 May 2026 08:38:18 GMT","end":"Mon, 17 Aug 2026 08:38:17 GMT"},"fingerprint":{"sha1":"C4:91:D1:0E:C2:A8:68:24:7B:00:2B:4A:EB:42:41:E0:29:E2:4E:A0","sha256":"68:29:56:08:39:D8:99:7B:20:CC:14:D3:4F:4D:D2:55:68:A6:27:DC:52:E9:7B:CF:CE:6B:D3:13:BC:97:65:C1"}}},"request":{"raw":"GET /s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 20168\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 16 Jun 2026 07:33:32 GMT\r\nexpires: Wed, 16 Jun 2027 07:33:32 GMT\r\ncache-control: public, max-age=31536000\r\nage: 131503\r\nlast-modified: Tue, 09 Sep 2025 19:01:14 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":20168,"size_decoded":20981,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20168, version 1.0","md5":"522d38acc1ead0c7da21d3ba79d0eaff","sha1":"59a46bfbdc80831077638a1cce91a8cc0741df55","sha256":"19bf2f2f1eaa10b2a047a8a1e624a1e12008ab5e3c50ad199ac968f8324f5f4d","sha512":"217c8fabd912111f70eaa137c08e7978c96db1413a24a9b991367c095743ff4c2472689b0844fea5689c0e4ba64fcb6033af290ce4b088b47fb0b5c93c55bee5","ssdeep":"384:1A7fA3fQ9rk9PB3eHoUo+B/3tYih7DuO+u+O7jZl8q:yG+4f3eHHrtuO+uLNqq","tlshash":"7292d010aac1597f8bb7627b54d2123f83b65cd671184204077fde179bbbf9d880c4a5","first_seen":"2025-09-13T01:03:08.574109Z","last_seen":"2026-07-23T01:03:33.355996Z","times_seen":440,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":23,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"noteworthy-lox.xyz/AaY1qjSxTIgsDOhNzw0l4.js","fqdn":"noteworthy-lox.xyz","domain":"noteworthy-lox.xyz","tld":"xyz"},"ip":{"addr":"104.21.11.153","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:16.266Z","timestamp":1781726716266,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"noteworthy-lox.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Jun 2026 06:57:49 GMT","end":"Sun, 06 Sep 2026 07:56:39 GMT"},"fingerprint":{"sha1":"DB:74:6F:94:75:02:7C:E6:BC:B0:7B:9C:CC:4B:65:10:1D:D4:2E:21","sha256":"11:DE:20:78:C9:21:8B:67:CD:B9:F4:8A:20:C6:EA:C6:D2:35:95:87:2C:61:16:18:B8:AF:BF:91:52:7A:4E:50"}}},"request":{"raw":"GET /AaY1qjSxTIgsDOhNzw0l4.js HTTP/1.1\r\nHost: noteworthy-lox.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript;charset=utf-8\r\naccess-control-allow-methods: GET\r\nlast-modified: Wed, 17 Jun 2026 20:00:17 GMT\r\ndate: Wed, 17 Jun 2026 20:05:16 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"191dd0b82d4d2880cae0ee4d1771a8dd\"\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5uvRximhNpFG4ER6dyNTzxHGn%2Bjr%2FUd6trMd4%2BEbwEW2LF82%2BrSf7BSmHlznDZdAWjCkcwxPJ6Qwoe6ZnXfhHG0AHNfoIQB0p9himUAMDm4lsd953rInL8Rb1SlBB1wanmK0FtE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a0d4ab092a5b569d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4617944,"size_decoded":748572,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"80c73074fa4ebba664664698f8d14ded","sha1":"d0dfe4a21e5462fa0ee6cac0fb55d39d1a73b375","sha256":"7c2762eb0e73f9f1f51f6c05c4129e665f8ca6519ab101811f1f22d75a4462bf","sha512":"537a9c6795e65804e610139972f8374f983dddd181327c89f369704fb2301689baacc435ce45041198becd4147bbda2eb0566b99e0bc17176b18cccf2b2f2bad","ssdeep":"12288:XrvuPfvxkUKxSZz8SiJ18a6Ofo8OEdmxId89Tg6hUvR4FMRU4NShx+d1vc7eKJSE:XrviZkUKxSZPa1v6Ofo8OE4SCmUMV0B","tlshash":"c5355d523222b022436a51b45d361c49f13ae9b9ac4d142cb674ecffbdbc5809ee6f74","first_seen":"2026-06-17T20:06:00.541755Z","last_seen":"2026-06-17T20:06:00.541755Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1387,"timings":{"blocked":-1,"dns":60,"connect":12,"send":0,"wait":502,"receive":812,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"noteworthy-lox.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"noteworthy-lox.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/css/style.css","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.687Z","timestamp":1781726714687,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 07 Apr 2026 11:37:50 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d4ec8e-4ce\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1230,"size_decoded":804,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"ce7ac56adc4a30db8c999242885c1082","sha1":"b0c2cb1047bc6d02e9de2d754c202f4f1842003e","sha256":"103d3cb49f4f76b7b5c09dd7937cadb6cce3974b7542bd8fa40eda942c874d7b","sha512":"9b0131d6655a5aba1a1f6e2bbbdbb7def6d3f202430f3bc4eb921520ebb0e679dda112cf1ace4c705f2ada88f196e4e9af59a4a1266e5e73aef9e8b80a2f8dac","ssdeep":"","tlshash":"5921d90c5405169a6331cfa333ea0319fe1810978b165a1abeec52a51ff622806f0f98","first_seen":"2026-06-17T13:53:06.361205Z","last_seen":"2026-06-17T20:06:00.543816Z","times_seen":3,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/es.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.728Z","timestamp":1781726714728,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/es.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 996\r\nLast-Modified: Tue, 07 Apr 2026 19:11:16 GMT\r\nConnection: keep-alive\r\nETag: \"69d556d4-3e4\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":996,"size_decoded":1234,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"1817004ca5ac952f74b3bdbe81b27326","sha1":"01fcff3a55337502974b54ae94a20b50bb33b23c","sha256":"631fe6d4b693c3e43a4e797fcd4102bf8a25a7f6931079358d4c0d5a1924f7b1","sha512":"e8a403f99710e539c78d9498ee7ae44b7e6579524eeeafe8748e6b67fa75887b698799c6c0e6c2c20a6a34f884a0a4e83681a8084bad8e9d49341998f55a5335","ssdeep":"","tlshash":"441165af80e61ddd142bc78264948a75d893c05f26115c8a4911bf2ea9f3b4e693ec27","first_seen":"2023-05-28T13:52:24Z","last_seen":"2026-07-17T21:22:56.65537Z","times_seen":105,"resource_available":false,"data":null}},"time_used":590,"timings":{"blocked":549,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/ns-img-563.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.735Z","timestamp":1781726714735,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/ns-img-563.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nLast-Modified: Tue, 07 Apr 2026 19:06:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d555b4-3e716\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":255766,"size_decoded":254401,"mime_type":"image/png","magic":"PNG image data, 614 x 816, 8-bit/color RGBA, non-interlaced","md5":"a89501617aca939539a5e83c81a4504d","sha1":"b1ca953f9dfd4360f2d40be12ad54f0f240a77d2","sha256":"f74f261b4218c590fc250ba83142b83b86277090508c9fd952c6f45e36e15e7b","sha512":"9ec7efd409e46ffda7dfcfc9dc8a0f9c185781f52c4d3dbcb47023b5e98fc061c6845c3c5f037be6b3cab9ed634907e664ead9eaac324e5f77f2169a768bcf19","ssdeep":"6144:vSJuGtYRSDZk+w3eABapzoUu4M+P2AaA9Ag3HzxsX:vuuxitpBzoUy+P2/A9lHFsX","tlshash":"6144238b9d53e39c72207bf52d0bdcb1954326aa6d0b95b1cd22097dc5ca2c20efad53","first_seen":"2026-06-17T13:53:06.440422Z","last_seen":"2026-06-17T20:06:00.54514Z","times_seen":3,"resource_available":false,"data":null}},"time_used":416,"timings":{"blocked":322,"dns":0,"connect":0,"send":0,"wait":49,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/badge-gpay.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.736Z","timestamp":1781726714736,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/badge-gpay.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 3858\r\nLast-Modified: Tue, 07 Apr 2026 19:06:12 GMT\r\nConnection: keep-alive\r\nETag: \"69d555a4-f12\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3858,"size_decoded":4101,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"144cd7f5e058ae369c19542a08627e7a","sha1":"c7f8d5051e0744b7c01af5dc769487ec50bdb4d7","sha256":"a798f68230bc09009c9a87e0275d3495252a903910eb8556166b334a75841067","sha512":"17f295ffaec8488432a9919472c78e1d8c735a4b621e1a4a99c8d0eab77dcc29e3849a5bae9c8a54d783099bb46ad02c578786cfd48d65310554ae2319c4b200","ssdeep":"","tlshash":"ab81b8187729c6bee040e5e9960bf818248b69c77a10c1adc3a15c0fd4a490d8defecf","first_seen":"2026-02-11T15:17:55.618549Z","last_seen":"2026-07-03T02:35:45.492959Z","times_seen":66,"resource_available":false,"data":null}},"time_used":401,"timings":{"blocked":359,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/tw-chrome-icon.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.744Z","timestamp":1781726714744,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/tw-chrome-icon.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 1347\r\nLast-Modified: Tue, 07 Apr 2026 19:08:16 GMT\r\nConnection: keep-alive\r\nETag: \"69d55620-543\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1347,"size_decoded":1590,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"79fca17ee02c6a9ef4fa8c3e5b92d2f7","sha1":"29af52cfe0b67ef76689ea31eb07f2b9dd331ee8","sha256":"8fa509024366efa92d183119909c3602f13550669850982ee32b3fef32fefbd0","sha512":"988e58622b0a309791e528d18b21e37b5e526c33e90a5c5acf2d47e56583c2c254ee9f4c7a8be47b47b378364f5afdfe4116a3f536215696a868b670cf68db90","ssdeep":"","tlshash":"7921fc7de0eeb93bf68f83f0cad8f4d0922825d811a8417ce284672b7890ac63500dd7","first_seen":"2024-04-26T19:43:23Z","last_seen":"2026-07-03T02:35:45.433049Z","times_seen":54,"resource_available":false,"data":null}},"time_used":415,"timings":{"blocked":373,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/fr.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.723Z","timestamp":1781726714723,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/fr.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 175\r\nLast-Modified: Tue, 07 Apr 2026 19:10:32 GMT\r\nConnection: keep-alive\r\nETag: \"69d556a8-af\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":175,"size_decoded":412,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"ca7991644678ec0b18d0598952fd4e91","sha1":"a22b6747db8f6928c9479eab7d14d946902010ea","sha256":"0d18cb7c10d7ddd9dde5239e7381d193642d0aa7bca3b583df5a04d0fbade488","sha512":"d1171f53d175f273ae2bfe8ef11846af62b34875ccb7053f06d757730211787cebf9f90d869d09b7dbbb74dfb7aa8d7392b5a19d48091b9fb68c9dd497ac29ac","ssdeep":"","tlshash":"f1c092a3a7522eebcd8aa2f283a846f08cba886cd9212d5aa103b172159521020c950a","first_seen":"2023-07-07T16:55:45Z","last_seen":"2026-07-11T23:21:28.023471Z","times_seen":108,"resource_available":false,"data":null}},"time_used":550,"timings":{"blocked":509,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/benefit1.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.741Z","timestamp":1781726714741,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/benefit1.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 28924\r\nLast-Modified: Tue, 07 Apr 2026 19:06:48 GMT\r\nConnection: keep-alive\r\nETag: \"69d555c8-70fc\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28924,"size_decoded":29169,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c2b45b63af2e789e308494b1c39eb30b","sha1":"a515a2b4874b574c8b8867806098e4f9911e4f11","sha256":"c4db6bb328ef78023c9182449c928af831feb01021d4bccd650b6d0c354c12d6","sha512":"bbdc3a13ac7aaa13973bac44c15f9e33b8a381ee94405a669b4069dd61649a7f94d92d6714555f7d52daf70b6576bdc93d93d439f3ad0dc0598310acb63b2d08","ssdeep":"384:C4qAlAemnXq21Ig9JX5k5Z0XLeeUUUoULEsfqEqklflsKcPez:C4qxemLPDGCMhN","tlshash":"60d2c7ee37140cbafc16d3eaeb0220bd502b54bb6ac55720c6299b29344685dde7fdc1","first_seen":"2026-02-11T15:17:55.635436Z","last_seen":"2026-07-18T17:49:20.695276Z","times_seen":74,"resource_available":false,"data":null}},"time_used":232,"timings":{"blocked":190,"dns":0,"connect":0,"send":0,"wait":41,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theajack.github.io/disable-devtool/404.html?h=vaultsafepay.xyz","fqdn":"theajack.github.io","domain":"theajack.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-17T20:05:19.933Z","timestamp":1781726719933,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /disable-devtool/404.html?h=vaultsafepay.xyz HTTP/1.1\r\nHost: theajack.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: GitHub.com\r\ncontent-type: text/html; charset=utf-8\r\nlast-modified: Sat, 17 Jan 2026 15:12:08 GMT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: W/\"696ba6c8-484c\"\r\nexpires: Sat, 06 Jun 2026 06:48:45 GMT\r\ncache-control: max-age=600\r\ncontent-encoding: gzip\r\nx-proxy-cache: MISS\r\nx-github-request-id: 72CE:32F72F:CD8A0:E3BFB:6A23C074\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Wed, 17 Jun 2026 20:05:20 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-bma-essb1270048-BMA\r\nx-cache: HIT\r\nx-cache-hits: 0\r\nx-timer: S1781726720.991726,VS0,VE109\r\nvary: Accept-Encoding\r\nx-fastly-request-id: 9cfdb0b27fa25f2c261368e4a09ab8492311963c\r\ncontent-length: 4027\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18508,"size_decoded":4741,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"ba7bc124e45b5de4dabe17461eb604e4","sha1":"02aa053b950ee36fc8b02ff640904f4146726f66","sha256":"0bcecb09e566fdc81d31246835830ce9a732df9a4d6f6c1c88b54c63e253e5e0","sha512":"4ddb53e2423489fe17d133bdb9a71a233c44da3cd03b1641b958d715d02453a8cda55171ae1b9c9e70cd0de0e29f8176ab5c11db71116a7b11208e4f9b1b0dd4","ssdeep":"192:QniKZyNy339QQbxzAH1d6+clwnEoUSH0MWqeKgl4uoPYrekgCjc:Qnn9CVRH0WRr","tlshash":"0e823156231d683ef9150291e7d53ab1163e0233962c7368b23d0075eb1d7bf24bbae9","first_seen":"2025-04-28T12:19:47.400768Z","last_seen":"2026-07-23T01:27:37.14955Z","times_seen":154,"resource_available":true,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":8,"connect":10,"send":0,"wait":119,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"theajack.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/coin-2.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.740Z","timestamp":1781726714740,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/coin-2.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 1793518\r\nLast-Modified: Tue, 07 Apr 2026 19:05:40 GMT\r\nConnection: keep-alive\r\nETag: \"69d55584-1b5dee\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1793518,"size_decoded":1793767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"679dcc59d1ea87802e916859080e6aba","sha1":"5af66ce9537d54796c53a52f689d7e93881f83b9","sha256":"a116d33afa3d2361896caa270db16978e68ead2bed979e0b5cdc6834421ee203","sha512":"6f457c81a67d1fa297759a25e6a630816ba5a51bc85ddd637d78163665a50cb6f0fca73e336c0542d5b725daabda216788fb8ecb1716d7846f876c22bb46fda5","ssdeep":"24576:J3nW0FZBu8LVyNHsOMuaiUZqtSHgGM7djEHLG:VfuyyP8FgFhB","tlshash":"b1252371eaa8cd6c5918c651b07e1ac48ef08de3cfcd6e8073393276a18df19856dc5a","first_seen":"2026-02-11T15:17:55.590228Z","last_seen":"2026-07-18T17:49:20.682159Z","times_seen":65,"resource_available":false,"data":null}},"time_used":408,"timings":{"blocked":149,"dns":0,"connect":0,"send":0,"wait":42,"receive":217,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"public-bsc.nownodes.io/","fqdn":"public-bsc.nownodes.io","domain":"nownodes.io","tld":"io"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.946Z","timestamp":1781726719946,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: public-bsc.nownodes.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc-dataseed.bnbchain.org/","fqdn":"bsc-dataseed.bnbchain.org","domain":"bnbchain.org","tld":"org"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.951Z","timestamp":1781726719951,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc-dataseed.bnbchain.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"public-bsc.nownodes.io/","fqdn":"public-bsc.nownodes.io","domain":"nownodes.io","tld":"io"},"ip":{"addr":"172.66.145.77","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.953Z","timestamp":1781726719953,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nownodes.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 May 2026 03:29:14 GMT","end":"Sat, 08 Aug 2026 04:29:11 GMT"},"fingerprint":{"sha1":"FC:86:CC:AE:CD:57:74:97:D8:3A:25:3B:27:36:B0:7A:B4:04:63:4F","sha256":"05:5D:E0:7C:4D:70:40:BC:B5:C0:BD:2D:A1:F6:9B:4F:B0:C4:7C:54:4B:BA:A0:EA:2E:A6:BA:35:9A:2C:77:E3"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: public-bsc.nownodes.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\ndate: Wed, 17 Jun 2026 20:05:20 GMT\r\ncontent-type: text/plain; charset=utf-8\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Authorization,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,api-key\r\naccess-control-max-age: 1728000\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a0d4ab1fefcf56ab-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":440,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":1,"connect":4,"send":0,"wait":44,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/video/IMG_2303.MP4","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.047Z","timestamp":1781726715047,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /video/IMG_2303.MP4 HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16,"size_decoded":193,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text","md5":"4845f01eaa8068384625e302e9a4eb05","sha1":"fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87","sha256":"8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41","sha512":"bb58f2438524b518b19f2b74c5d598460735958f77c310ba3710520d1d88ce7975449977c9965dbca87cd6a824c8ab82e56bea6d571d79594079f0a0ea404d77","ssdeep":"","tlshash":"4160000c03030f0c00c0c03ccfc00030000c03000cc033f00000c00c000000c3cc00fc","first_seen":"2023-03-13T05:02:59Z","last_seen":"2026-07-23T07:08:05.957686Z","times_seen":11822,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bsc.publicnode.com/","fqdn":"bsc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.945Z","timestamp":1781726719945,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Jun 2026 01:05:04 GMT","end":"Mon, 07 Sep 2026 02:05:00 GMT"},"fingerprint":{"sha1":"39:B4:D5:B4:26:71:60:64:13:47:CC:54:ED:BC:AD:E1:33:77:19:00","sha256":"65:A9:40:31:FB:2A:25:C7:3B:B6:B3:F0:4E:96:B9:08:CE:FC:27:5A:F6:DB:32:E8:7E:64:C7:51:34:DA:93:85"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/js/3.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.696Z","timestamp":1781726714696,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /js/3.js HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Tue, 07 Apr 2026 19:19:12 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d558b0-27db\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10203,"size_decoded":2616,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"0bcde523e425d107c31a9c07f3f74ce1","sha1":"899bfbc66426315c4454c7b72b0f2c9a3b457627","sha256":"c0c75bf327ef38f0b15209b428672aa6c1e4f8376801a1f31f544a8c0a8846be","sha512":"e026756b077df5b24ee29592ca1a02fc62f7cce0f1705f2fd713780329bef9189e19db931d804576a656c045aa936d3109d95252ab6d078e714f2ddb137070b3","ssdeep":"192:cGVMyHnapfppjJ1qIG23Vr/RaGbM3rdmwHzEU4Q6rWh4Q/eC:cGkpfjradHwUzhv","tlshash":"3422f46da76433b6447b73b7ef8aa5a8f7a124570002c7253e6cc9c00f758505ba5eac","first_seen":"2026-06-17T13:53:06.366567Z","last_seen":"2026-06-17T20:06:00.551957Z","times_seen":3,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":52,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arbitrum.drpc.org/","fqdn":"arbitrum.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.208Z","timestamp":1781726715208,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Jun 2026 23:01:08 GMT","end":"Sun, 13 Sep 2026 00:00:59 GMT"},"fingerprint":{"sha1":"7F:E5:3C:EC:15:AC:2B:17:FE:8B:3B:16:E4:25:9A:40:37:43:63:45","sha256":"DF:D3:75:05:E3:1C:E5:C2:B8:D6:2A:66:75:39:9A:D3:91:D6:86:E7:7B:11:D6:84:3E:A1:0F:FF:79:47:06:19"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: arbitrum.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/it.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.725Z","timestamp":1781726714725,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/it.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 175\r\nLast-Modified: Tue, 07 Apr 2026 19:10:52 GMT\r\nConnection: keep-alive\r\nETag: \"69d556bc-af\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":175,"size_decoded":412,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"a7cf4483a592dc33674a34c628babfc9","sha1":"a2eed388449e9a24198256b8950d0de77c2e7af7","sha256":"9bf5d04c7e7828905c5830f9b132010fba7d1b78e3fe137f840b7071382c5c9a","sha512":"92425ad9c16d7ff5b47258b4e0be62eae29b47eaf9d0cc8e760f7bb9696d291ab99f2585f46af6d2f115837b5504e8520e427c990f667c9286ed6e0673a3a7dd","ssdeep":"","tlshash":"adc092f697632cebcd9aa2b742ad73a09c36c41a853239594503b171259861520ad24a","first_seen":"2023-06-17T12:52:05Z","last_seen":"2026-07-06T00:28:45.486412Z","times_seen":80,"resource_available":false,"data":null}},"time_used":590,"timings":{"blocked":549,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/favicon.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:16.102Z","timestamp":1781726716102,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/favicon.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:16 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 938\r\nLast-Modified: Tue, 07 Apr 2026 19:12:00 GMT\r\nConnection: keep-alive\r\nETag: \"69d55700-3aa\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":938,"size_decoded":1180,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"75805fccb2f17060a6de454ca75b420f","sha1":"d9dfaca4e369ffc5b636705ab93a01295a721548","sha256":"6c09966f6ad48d03d283e9af682395f0ff8ac5d843ac868114ace63a21b626f9","sha512":"3fdc81ef5b637898317e76a67b66a5f06d29fe6a9c03e7fcbae120de02e7dd960cad6175fc015ff93921dc38f2e56137347b379abbd37265380c903f189e21c1","ssdeep":"","tlshash":"25118c0bc2c8c92be678c31de809d1add2a691c356858641f26c4f1f1f362839d4b38d","first_seen":"2026-05-03T10:00:14.093115Z","last_seen":"2026-07-03T02:35:45.45787Z","times_seen":14,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/de.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.724Z","timestamp":1781726714724,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/de.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 168\r\nLast-Modified: Tue, 07 Apr 2026 19:10:44 GMT\r\nConnection: keep-alive\r\nETag: \"69d556b4-a8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":168,"size_decoded":405,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"ebc7060c1f826bd704328763899cbd3c","sha1":"affdaaa764817f04eac7b0848a45421177413164","sha256":"30fed1ec0181b3453c1a87ebbf208b7aa9c68893f552b126cae91c655cdbd364","sha512":"f82323fee6f904a3f0b15ac6755cb70ee64f388fde235b7e4903d54bcceda384214ae3c3b15164ca650fed85940554527afd82a27fc4506dca796acc9e446d25","ssdeep":"","tlshash":"05c092d78b592a78eda9b472024420a5e832482caa25818aa85698f02983c452eaa753","first_seen":"2023-07-07T16:55:45Z","last_seen":"2026-07-06T00:28:45.485909Z","times_seen":110,"resource_available":false,"data":null}},"time_used":574,"timings":{"blocked":533,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/networks/ethereum.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.746Z","timestamp":1781726714746,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/networks/ethereum.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nLast-Modified: Mon, 08 Jun 2026 14:24:58 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a26d0ba-2496c\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149868,"size_decoded":112285,"mime_type":"image/png","magic":"PNG image data, 3258 x 3258, 8-bit/color RGBA, non-interlaced","md5":"5f37d465018c42dee5b6f0e6d2803efb","sha1":"b3b3b7e2d9a067b4f3a2674d48fb6ccf0717ce8e","sha256":"a673ee9c325a88cea3d1cb8e3e35a3ae6e93f81d04ff29403431689ae1ac77cb","sha512":"5234befc48d89a71709e62de6ae4b8a4553a576fd32395a1d69acdaa6548346ac41170d6d56c7502fbdabdd8ed55f5151d48e2904cde2ff421ffc48af73369c8","ssdeep":"3072:pOofa6+aOq3Fmcv8qd2R9ZzCnAO5np79h8Tb1nsu:AjfaZv8qdg4tpz8T1su","tlshash":"89e3bf03cea3cdc8d254087c7a7e5fe93f7566b9c9491fea03789831aee9189061d0e5","first_seen":"2026-06-17T13:53:06.355349Z","last_seen":"2026-06-17T20:06:00.557008Z","times_seen":3,"resource_available":false,"data":null}},"time_used":499,"timings":{"blocked":450,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/js/4.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.698Z","timestamp":1781726714698,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /js/4.js HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Tue, 07 Apr 2026 19:25:00 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d55a0c-ab52\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43858,"size_decoded":14346,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (334), with CRLF line terminators","md5":"4ee27bdde3cda165839ee24b477cdca8","sha1":"0e3832891b235f8c965b23cd9aace7595ac4bfce","sha256":"26082cc74019b7d7476142fad3ab0869ef2d2f688396f66d8621e45fbb475af6","sha512":"bcc5f563f5c8d0e6200ae8574bed55ee20bad7c882272f7f2a48354a46a16402f1d4bc68b2150ff74f2d2c5de0573fbeae32eabd584ecf6fae231d876140a500","ssdeep":"768:SB1Thg1fsfWnCr4b7Q/itdaWVVEL5azIIZ:GVefsnr4/Q/itdZVEGIIZ","tlshash":"ca13a73b9259284f7077b32da528667afa14a27fb68002573d3cb12c1ffe8545114ebe","first_seen":"2026-06-17T13:53:06.341181Z","last_seen":"2026-06-17T20:06:00.557838Z","times_seen":3,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":93,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/trust-3d.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.733Z","timestamp":1781726714733,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/trust-3d.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 198868\r\nLast-Modified: Tue, 07 Apr 2026 19:04:24 GMT\r\nConnection: keep-alive\r\nETag: \"69d55538-308d4\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":198868,"size_decoded":199115,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d6b416e21b6eb6802ef0eb49df77e2a3","sha1":"702da2208a3c46ab97e56c090aac208174054631","sha256":"f3406c7d3b9ec1ae7b41f49533d2986658c0d9a9e139e10fa57135501e613c38","sha512":"bc61f6172655197df8de1d9693e786ef36daf50c424598f4bbd6d3f19f3c0b849ddd010168c75cd343159090bbf8ecaea0dfa656fd51b7a83aa6130e8c814586","ssdeep":"6144:X7wj0Hgf5ocXCDli9Smpr/JpVDs98mVhTaiTo:Mj0w5ox40CpVDs9Fa","tlshash":"8e1412889faa999ec1cc203583ea0596bc2d20c33ec7dbeef63570d492cca555294d72","first_seen":"2026-02-11T15:17:55.603515Z","last_seen":"2026-07-18T17:49:20.689298Z","times_seen":70,"resource_available":false,"data":null}},"time_used":316,"timings":{"blocked":272,"dns":0,"connect":0,"send":0,"wait":41,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arbitrum-one.publicnode.com/","fqdn":"arbitrum-one.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.205Z","timestamp":1781726715205,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Jun 2026 01:05:04 GMT","end":"Mon, 07 Sep 2026 02:05:00 GMT"},"fingerprint":{"sha1":"39:B4:D5:B4:26:71:60:64:13:47:CC:54:ED:BC:AD:E1:33:77:19:00","sha256":"65:A9:40:31:FB:2A:25:C7:3B:B6:B3:F0:4E:96:B9:08:CE:FC:27:5A:F6:DB:32:E8:7E:64:C7:51:34:DA:93:85"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: arbitrum-one.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 1728000\r\ncontent-type: application/json\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Origin, accept-encoding\r\ndate: Wed, 17 Jun 2026 20:05:15 GMT\r\npriority: u=4,i=?0\r\nx-envoy-upstream-service-time: 2\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ncf-ray: a0d4ab02dc4f0b69-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":423,"size_decoded":709,"mime_type":"application/json","magic":"JSON text data","md5":"1b679b2f0eeaadf2c6eb7d4372a19ff6","sha1":"c10b30995df01558764eb9d2535a9ae11ae3e879","sha256":"e816cebfcb18bbe56ac277f958463844a8bfdfdc57f637d45c5e406ebbb42567","sha512":"0ed72dfb1b44f579669a1572b86d9f46d7d0245c74c93b80e455b86c4e45b45f184cefd680a416fca05e402183bc48226ae0aada1874ac89caa2ffbb4dd8f368","ssdeep":"","tlshash":"8ae02b2100418670e8e9570bf65c7d0852637116c0c1cd57029d1c4c2e4bc917f9ea22","first_seen":"2026-06-17T20:06:00.559668Z","last_seen":"2026-06-17T20:06:00.559668Z","times_seen":1,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/benefit2.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.713Z","timestamp":1781726714713,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/benefit2.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 13419\r\nLast-Modified: Tue, 07 Apr 2026 19:06:50 GMT\r\nConnection: keep-alive\r\nETag: \"69d555ca-346b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13419,"size_decoded":13664,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1a4bf8d0dd48561b2b531f16994573da","sha1":"9e5547a87fcf112dfb398bfb61ebc00e7025558b","sha256":"5884f2c20f92ec8866d09edda61027e0ce2e6666e0bf45b6ecad192bfde48f1d","sha512":"dd50bd6762d7dcb5290f02d8dadd26426d47dc6820979ed38a4ff0e7122fb6ceaf1318792ec2666d6d5f35d414e8fcd83eaeb6eccb19023556e1489870d8a1e0","ssdeep":"192:35nvZrCCypp07LmxZRkaVuVefXg9NT4X4w3RM7GKcmxZnefXgykaVut8:3pxr2pO/m6aAm2eX4wh4GfmE2aA2","tlshash":"665294ce33188dfcf95297d6d30371a9316680f75a8192a4ca361e3e244648edd6bec1","first_seen":"2026-02-11T15:17:55.632619Z","last_seen":"2026-07-18T17:49:20.686918Z","times_seen":74,"resource_available":false,"data":null}},"time_used":632,"timings":{"blocked":591,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/js/2.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.695Z","timestamp":1781726714695,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /js/2.js HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Tue, 07 Apr 2026 11:42:22 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d4ed9e-24100\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":147712,"size_decoded":44611,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (350), with CRLF line terminators","md5":"b5211ae037db9368bd63b5ad8a40ebcb","sha1":"725c2d306bd9c37d984c94ad4ffb4f6eff488d4c","sha256":"8a6f227269025386bbccdc582e2459428339413f0cef318d8b3b344a9211cea8","sha512":"f343cd7b1ff07975bbe8ef5b0f3e2d5326b9fbc56647278c720f5512d1c5bf7fa2978196df4a9b04773f821dc67bf21e29dd10ce8c18d43be36bfba4ab1aab39","ssdeep":"3072:rEtlB8bwd1TOZZPdU5+CVjAPzxj7co0lPc0TOp:I/B8bwd1odT","tlshash":"29e3b42fdbb92e2704b9369fa12caa7bf044133f9385016f327cea6c6fb5d605164416","first_seen":"2026-06-17T13:53:06.343089Z","last_seen":"2026-06-17T20:06:00.562458Z","times_seen":3,"resource_available":true,"data":null}},"time_used":181,"timings":{"blocked":59,"dns":0,"connect":0,"send":0,"wait":83,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/benefit3.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.714Z","timestamp":1781726714714,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/benefit3.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 5914\r\nLast-Modified: Tue, 07 Apr 2026 19:06:52 GMT\r\nConnection: keep-alive\r\nETag: \"69d555cc-171a\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5914,"size_decoded":6158,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cf29f6b43683fa8462f27d6b643cc872","sha1":"0ca16d391a77d59bebad3d80ad8392d714b16465","sha256":"0cd370c7deeb7481811226d092c3854796df2a5fb58390f5298483bb22f8aede","sha512":"f44ca85002088eaf763b07480166e2593ba5485223000ee566104f5591cb18088d45696cccf9a7182dfd53582d7ca7f5e757de252a9ae452b28fc3ef182ce1ea","ssdeep":"48:bx0B6A+Ld2JJZdLXj3fALg3XLRDYL/atJJZUYb0ENQ+F5HgUBVJAohL8SLbFX88t:qBJJZpDFTJJZhBlGCZfvcUmckJiUcBcQ","tlshash":"c8c121aebb68dc37f559d3eeca01e139115641ab7580c260c1a8ef1f14164e6ae2fac4","first_seen":"2026-02-11T15:17:55.633592Z","last_seen":"2026-07-18T17:49:20.68359Z","times_seen":74,"resource_available":false,"data":null}},"time_used":633,"timings":{"blocked":592,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rpc.ankr.com/arbitrum","fqdn":"rpc.ankr.com","domain":"ankr.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.225Z","timestamp":1781726715225,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"OPTIONS /arbitrum HTTP/1.1\r\nHost: rpc.ankr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/favicon.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:16.101Z","timestamp":1781726716101,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/favicon.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:16 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 938\r\nLast-Modified: Tue, 07 Apr 2026 19:12:00 GMT\r\nConnection: keep-alive\r\nETag: \"69d55700-3aa\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":938,"size_decoded":1180,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"75805fccb2f17060a6de454ca75b420f","sha1":"d9dfaca4e369ffc5b636705ab93a01295a721548","sha256":"6c09966f6ad48d03d283e9af682395f0ff8ac5d843ac868114ace63a21b626f9","sha512":"3fdc81ef5b637898317e76a67b66a5f06d29fe6a9c03e7fcbae120de02e7dd960cad6175fc015ff93921dc38f2e56137347b379abbd37265380c903f189e21c1","ssdeep":"","tlshash":"25118c0bc2c8c92be678c31de809d1add2a691c356858641f26c4f1f1f362839d4b38d","first_seen":"2026-05-03T10:00:14.093115Z","last_seen":"2026-07-03T02:35:45.45787Z","times_seen":14,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esm.sh/disable-devtool","fqdn":"esm.sh","domain":"esm.sh","tld":"sh"},"ip":{"addr":"104.26.15.209","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:18.200Z","timestamp":1781726718200,"http_version":"HTTP/3","security_state":"secure","security_info":null,"request":{"raw":"GET /disable-devtool HTTP/1.1\r\nHost: esm.sh\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://noteworthy-lox.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/tr.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.730Z","timestamp":1781726714730,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/tr.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 624\r\nLast-Modified: Tue, 07 Apr 2026 19:11:22 GMT\r\nConnection: keep-alive\r\nETag: \"69d556da-270\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":624,"size_decoded":862,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"55542e179b69399640dae396e08bc02e","sha1":"48e81ad168d25b4ccd7917f9c1fbe64232252311","sha256":"9b474bc10465a6b16126a20770784950c8fe3e46146134110d89211a9886be26","sha512":"1e3e7781c5629f2d12be37d9ded3f11eace2be3a0b28e2f7a0f08716116d12b3980bd5e8e5642ef28e538495919efa3ee5fff5ff53c1d370cc3e2f9b61f47272","ssdeep":"","tlshash":"6ff047c7f1454188f49cfdf4dcb48369923f4b5c91521982f116399d6b66f540cac653","first_seen":"2023-07-07T16:55:45Z","last_seen":"2026-06-17T20:06:00.564613Z","times_seen":45,"resource_available":false,"data":null}},"time_used":626,"timings":{"blocked":586,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arbitrum.gateway.tenderly.co/","fqdn":"arbitrum.gateway.tenderly.co","domain":"tenderly.co","tld":"co"},"ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.213Z","timestamp":1781726715213,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gateway.tenderly.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 15 Jun 2026 18:01:31 GMT","end":"Sun, 13 Sep 2026 18:01:30 GMT"},"fingerprint":{"sha1":"9A:41:E5:34:79:91:EC:A6:18:2C:A5:9B:64:A2:94:81:A0:74:A3:57","sha256":"DD:73:B2:F2:0C:93:E6:AC:22:8B:33:E7:18:12:2F:78:95:14:EF:D9:E1:B3:D5:59:5A:73:0E:1B:07:B3:90:E9"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: arbitrum.gateway.tenderly.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\ncontent-type: application/json; charset=utf-8\r\nvary: Origin\r\nx-tdly-limit: 20\r\nx-tdly-remaining: 16\r\nx-tdly-reset-timestamp: 1781726716391\r\ndate: Wed, 17 Jun 2026 20:05:15 GMT\r\ncontent-length: 422\r\nx-envoy-upstream-service-time: 3\r\nserver: envoy\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":422,"size_decoded":810,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f7ff318ae84b7a2f4d3dee9e325d3e79","sha1":"4e261559c862ddba5448db5edf5a6af9f357c944","sha256":"5221f30f0242d8ed39f2630db5e22b236e73b7f36f24abb63c88f6cd6b678d7c","sha512":"bdda008e9cfbd99e8762ad2722e903a406e3d59958cfb9827ec5f650ac8a4bda56ac16385b2df3f2d4059c0727a44b483b443d5c525d3cadc6e5e3f7fa8ab4c6","ssdeep":"","tlshash":"cee02b61004186b0e8e9570bf65c7d0851677116c0c1cd57435d1c4c2d4bc917e9ea26","first_seen":"2026-06-17T20:06:00.565891Z","last_seen":"2026-06-17T20:06:00.565891Z","times_seen":1,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/js/1.js","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.694Z","timestamp":1781726714694,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /js/1.js HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Tue, 07 Apr 2026 11:41:44 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d4ed78-eb4\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3764,"size_decoded":1417,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"07c1644339fc260ccc37a7c241b38f07","sha1":"3c0a9dd35de4430b5fa84a28099f616c753e7462","sha256":"632e08c63deed77a8a18e17faf2d653c47a4d81a7d083f4f3bbb52d2794fd7fd","sha512":"29d02c224b5cdda8451323e3ff84d528051e0598f48e0d722b4cb44d433f0c8d20076a3dcc2db5133a4578af10662c576e62e5c92e99c315a6f1ca509fdb16b5","ssdeep":"","tlshash":"fa71ac9e750230bb843773b69fab91c9fb70106b0142c61a3ebc95851fb246457b2ece","first_seen":"2026-06-17T13:53:06.428145Z","last_seen":"2026-06-17T20:06:00.567457Z","times_seen":3,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":41,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bsc-rpc.publicnode.com/","fqdn":"bsc-rpc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.955Z","timestamp":1781726719955,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Jun 2026 01:05:04 GMT","end":"Mon, 07 Sep 2026 02:05:00 GMT"},"fingerprint":{"sha1":"39:B4:D5:B4:26:71:60:64:13:47:CC:54:ED:BC:AD:E1:33:77:19:00","sha256":"65:A9:40:31:FB:2A:25:C7:3B:B6:B3:F0:4E:96:B9:08:CE:FC:27:5A:F6:DB:32:E8:7E:64:C7:51:34:DA:93:85"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc-rpc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET,HEAD,OPTIONS,POST\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 172800\r\nallow: OPTIONS, POST\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers\r\ndate: Wed, 17 Jun 2026 20:05:20 GMT\r\nx-envoy-upstream-service-time: 0\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: a0d4ab1fced10b69-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":641,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":3,"dns":2,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"theajack.github.io/favicon.ico","fqdn":"theajack.github.io","domain":"theajack.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theajack.github.io/disable-devtool/404.html?h=vaultsafepay.xyz","date":"2026-06-17T20:05:20.202Z","timestamp":1781726720202,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: theajack.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://theajack.github.io/disable-devtool/404.html?h=vaultsafepay.xyz\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: GitHub.com\r\ncontent-type: text/html; charset=utf-8\r\nx-origin-cache: HIT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: W/\"673d3167-267a\"\r\ncontent-encoding: gzip\r\nx-proxy-cache: MISS\r\nx-github-request-id: 68D4:3EEC69:21802:24BF0:6A32FDFE\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Wed, 17 Jun 2026 20:05:20 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-bma-essb1270048-BMA\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1781726720.209441,VS0,VE114\r\nvary: Accept-Encoding\r\nx-fastly-request-id: 89d0a43dbd64d224c74cbd5f4e7ba5bd3fdad5ab\r\ncontent-length: 3133\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Hexo:6.2.0","description":"Hexo is a blog framework powered by Node.js.","website":"https://hexo.io","common_platform_enumeration":"","icon":"Hexo.png","categories":["Static site generator"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9850,"size_decoded":3755,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (3839)","md5":"506d03c3ea58a6a54558f626707bd20b","sha1":"c12a5c64b3c488616bc0d880023fcad5229f6bed","sha256":"32a3ff5e29957de51e210199ae7e48cbb1c820c11583cb14c5422f391faad058","sha512":"e1e6b6bfcc6cd0e8d76aa1cd8e39be676757c776fd5c8edbb3471c9f295d2de021f2822c37a4175ddc7617f3acccb737fc2fe290940ed1eba7911df652b43816","ssdeep":"192:W9WBl2KLbxqvzyC/j9DlCqWrYWDHaoapa+iD5cM+SfS5SkSES5SiN+SfS5SkSESx:pBl2KLFqLyiNW7VqGwde2Ldi6q","tlshash":"1f1286b25860583b432355edb6aff36eb2b2a02bd6131d14b7bc43850fc5f94cda5a42","first_seen":"2025-04-28T12:19:47.398696Z","last_seen":"2026-07-23T01:27:37.151765Z","times_seen":151,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"theajack.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/coin-5.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.712Z","timestamp":1781726714712,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/coin-5.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 652785\r\nLast-Modified: Tue, 07 Apr 2026 19:05:46 GMT\r\nConnection: keep-alive\r\nETag: \"69d5558a-9f5f1\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":652785,"size_decoded":653032,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1acce58393b8d5f1c6385c697a24ce06","sha1":"0b48578d14a22345b3940aa0b2d29ccbc546167a","sha256":"f1dbf46ff029294134b06f60fd4eddad1137d2c942abff449e62fa6bb060eb19","sha512":"96b9ec645765af648719350ef4ef6fd9bbce0e29714ce80d50b25c5ae2c34da320900f340b2cc27967d4fc481cd55e9f9cd36d4e1912f843581679dffce30478","ssdeep":"12288:2EL4JuXNMFrS0Ghr7LF1uB2IyTA84fNCuLEJ20IFbvsXsMHFQ:uJudwhs7LF1uB2X141eJJIFbvsXsi2","tlshash":"cfd423218ca71e3f46e5424960db0f4a524187f2c0b2ddc869ebaa679bbbf074447df0","first_seen":"2026-02-11T15:17:55.591499Z","last_seen":"2026-07-18T17:49:20.683047Z","times_seen":61,"resource_available":false,"data":null}},"time_used":567,"timings":{"blocked":420,"dns":0,"connect":0,"send":0,"wait":57,"receive":90,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/badge-applepay.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.737Z","timestamp":1781726714737,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/badge-applepay.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 3121\r\nLast-Modified: Tue, 07 Apr 2026 19:06:12 GMT\r\nConnection: keep-alive\r\nETag: \"69d555a4-c31\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3121,"size_decoded":3364,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"53879fef3094056b88c848a90c691f97","sha1":"0c8ba50f490d8ad17a27628b3aed7b2772663dea","sha256":"7bf6c3f39e34e80923a1d7c20a70907d5095278a3833ca022b1fee0930435eda","sha512":"855803c8ccb427e59a4017f59373d3cd4ab66b1463f1f60c2b637e94d7f3417f81334c94adde9095f3d38a7b0104fd11584f8a57d912fc438b9eea7161ab4c78","ssdeep":"","tlshash":"3f51b351a3a9c22cf100daa5c35aac34311725cb6d19c01cc7f06f1bc9a486e0ebe9cb","first_seen":"2026-02-11T15:17:55.598026Z","last_seen":"2026-07-03T02:35:45.496031Z","times_seen":66,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":149,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arb1.arbitrum.io/rpc","fqdn":"arb1.arbitrum.io","domain":"arbitrum.io","tld":"io"},"ip":{"addr":"172.66.171.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.220Z","timestamp":1781726715220,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arbitrum.io","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 05 May 2026 15:12:06 GMT","end":"Mon, 03 Aug 2026 15:12:05 GMT"},"fingerprint":{"sha1":"D3:54:F9:E1:4F:A1:F9:48:7A:90:AD:25:77:28:AC:8B:25:9F:8A:9B","sha256":"68:2B:C8:BC:79:16:DB:47:A5:AC:06:03:88:EF:7E:35:91:D6:08:8C:3A:52:2B:59:54:D3:FD:A9:7C:A4:61:06"}}},"request":{"raw":"OPTIONS /rpc HTTP/1.1\r\nHost: arb1.arbitrum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\ndate: Wed, 17 Jun 2026 20:05:15 GMT\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\ncontent-encoding: gzip\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-envoy-upstream-service-time: 0\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a0d4ab02787756ab-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":424,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":14,"connect":2,"send":0,"wait":144,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/css/style3.css","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.690Z","timestamp":1781726714690,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /css/style3.css HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 07 Apr 2026 11:39:30 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d4ecf2-109ba\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":68026,"size_decoded":14957,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"96897d9f61a8ca3dab3032b13464fa45","sha1":"a79f5e35e8ddae4b6b0fbaf152b8563c4e1e65dc","sha256":"3554e8c5857fd5515098ad87fcbe07e4235709d4299e876456131fe7b9ceb9a4","sha512":"b1c3a85086f2e3b806a1a368ee7bfd111d6822c9fec25250566149c6adf7197a2c5d247410b5ceb3b006201770292c0a90abcca2acaf9aeef8fba37d27727ba5","ssdeep":"384:EgOHrNig6iF/FhXgB2NkJ40ulmpc5jDJDOtXO61Dhg0HgBNPEF:RO5vD0ojDOtXO61Dhg0HNF","tlshash":"bb633459ee045505b23babb8abf34a49fbac50a34b01417d7bac22494fbf19c8151fcd","first_seen":"2026-06-17T13:53:06.381956Z","last_seen":"2026-06-17T20:06:00.570468Z","times_seen":3,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":41,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/css/style5.css","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.693Z","timestamp":1781726714693,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /css/style5.css HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 07 Apr 2026 11:40:34 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d4ed32-2a30\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10800,"size_decoded":3471,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF, LF line terminators","md5":"a8a56b64590ac400d58d29aae1afe3ac","sha1":"3834479ee794bad865bc541f8ab4a26a91131887","sha256":"22698020d1511a60985224622859552f429236122fbc942b10982f548e2f1c5a","sha512":"1cab77e1b52eb98b680ecdb0f8b41f56aae1b7af1d06f650cbf59d17f777536d39124cd7466c8f0f3742db2649887c8562ea42a7b284cdfd217fb90b660431ee","ssdeep":"192:UgaiInpDvBAmyN3GCbZKVG/Z1jYbszC42WKBwWbF9GGK+TS9mTU4HLJYaIpBtB/a:stAfA8yIwfT1LJOP/2tA9iirm","tlshash":"7922a539e65210467e3a9694abf38b9ae3596093a30203fdbbec11581f371dcc161fd9","first_seen":"2026-06-17T13:53:06.372166Z","last_seen":"2026-06-17T20:06:00.571114Z","times_seen":3,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":41,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.034Z","timestamp":1781726715034,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 25 May 2026 08:38:18 GMT","end":"Mon, 17 Aug 2026 08:38:17 GMT"},"fingerprint":{"sha1":"C4:91:D1:0E:C2:A8:68:24:7B:00:2B:4A:EB:42:41:E0:29:E2:4E:A0","sha256":"68:29:56:08:39:D8:99:7B:20:CC:14:D3:4F:4D:D2:55:68:A6:27:DC:52:E9:7B:CF:CE:6B:D3:13:BC:97:65:C1"}}},"request":{"raw":"GET /s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 20168\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 16 Jun 2026 07:33:32 GMT\r\nexpires: Wed, 16 Jun 2027 07:33:32 GMT\r\ncache-control: public, max-age=31536000\r\nage: 131503\r\nlast-modified: Tue, 09 Sep 2025 19:01:14 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":20168,"size_decoded":20981,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20168, version 1.0","md5":"522d38acc1ead0c7da21d3ba79d0eaff","sha1":"59a46bfbdc80831077638a1cce91a8cc0741df55","sha256":"19bf2f2f1eaa10b2a047a8a1e624a1e12008ab5e3c50ad199ac968f8324f5f4d","sha512":"217c8fabd912111f70eaa137c08e7978c96db1413a24a9b991367c095743ff4c2472689b0844fea5689c0e4ba64fcb6033af290ce4b088b47fb0b5c93c55bee5","ssdeep":"384:1A7fA3fQ9rk9PB3eHoUo+B/3tYih7DuO+u+O7jZl8q:yG+4f3eHHrtuO+uLNqq","tlshash":"7292d010aac1597f8bb7627b54d2123f83b65cd671184204077fde179bbbf9d880c4a5","first_seen":"2025-09-13T01:03:08.574109Z","last_seen":"2026-07-23T01:03:33.355996Z","times_seen":440,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":34,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/ru.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.727Z","timestamp":1781726714727,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/ru.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 164\r\nLast-Modified: Tue, 07 Apr 2026 19:11:06 GMT\r\nConnection: keep-alive\r\nETag: \"69d556ca-a4\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":164,"size_decoded":401,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"695990a8e997087294638e1a43233c73","sha1":"edf61da7e26961fb564a9435d3ceabe77eb2aea1","sha256":"8c3c0dcfd58ce64750876a42e9bc5d505835066040bfee7c538162abdf0698d2","sha512":"a25440acf0195de7b687cd5f5cdf446654cc2878b9ac45123790d4c3110e0da718f810cbea4b4034602c14d5d746489b37479aa782914dc8d2417ce5f5d2c97b","ssdeep":"","tlshash":"d9c02b83f3d10428c804213300020965553240108a38419806a190110dd670b0457302","first_seen":"2023-07-07T16:55:45Z","last_seen":"2026-06-24T23:24:29.752049Z","times_seen":112,"resource_available":false,"data":null}},"time_used":610,"timings":{"blocked":567,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/tw-iso-27001.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.743Z","timestamp":1781726714743,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/tw-iso-27001.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 122269\r\nLast-Modified: Tue, 07 Apr 2026 19:08:30 GMT\r\nConnection: keep-alive\r\nETag: \"69d5562e-1dd9d\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":122269,"size_decoded":122516,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1b4f7f5775e2c53f88e60dda34cf7ed2","sha1":"f2800186a1b468b125b02e01652c5e79ed4c0de2","sha256":"adf8d0e9c3d2aeb3f90d78c2e9332917ccfc77066fb0d41d5e53ce2a8c572410","sha512":"32b05657bdaf578e1491547f4406318b91c721078242cbeef646fce97fd3190b22563b6960ae8d4135180fca1b888eb95b140f211347ac852a11bcf169f3c384","ssdeep":"3072:v11E6spEKe8XOoRcmjpSZY/BvFTWgO0PgKFdXJj:vVDKDXOoRc0SZkBvNW90PFpj","tlshash":"ffc30270c7a9ecbb0b3d0191269f65a341d51403a75e08d27fa1af26ceed2419ece17b","first_seen":"2025-04-02T11:53:22.935643Z","last_seen":"2026-07-22T11:06:57.661809Z","times_seen":65,"resource_available":false,"data":null}},"time_used":403,"timings":{"blocked":359,"dns":0,"connect":0,"send":0,"wait":43,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.030Z","timestamp":1781726715030,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 25 May 2026 08:38:18 GMT","end":"Mon, 17 Aug 2026 08:38:17 GMT"},"fingerprint":{"sha1":"C4:91:D1:0E:C2:A8:68:24:7B:00:2B:4A:EB:42:41:E0:29:E2:4E:A0","sha256":"68:29:56:08:39:D8:99:7B:20:CC:14:D3:4F:4D:D2:55:68:A6:27:DC:52:E9:7B:CF:CE:6B:D3:13:BC:97:65:C1"}}},"request":{"raw":"GET /s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 20168\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 16 Jun 2026 07:33:32 GMT\r\nexpires: Wed, 16 Jun 2027 07:33:32 GMT\r\ncache-control: public, max-age=31536000\r\nage: 131503\r\nlast-modified: Tue, 09 Sep 2025 19:01:14 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":20168,"size_decoded":20981,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20168, version 1.0","md5":"522d38acc1ead0c7da21d3ba79d0eaff","sha1":"59a46bfbdc80831077638a1cce91a8cc0741df55","sha256":"19bf2f2f1eaa10b2a047a8a1e624a1e12008ab5e3c50ad199ac968f8324f5f4d","sha512":"217c8fabd912111f70eaa137c08e7978c96db1413a24a9b991367c095743ff4c2472689b0844fea5689c0e4ba64fcb6033af290ce4b088b47fb0b5c93c55bee5","ssdeep":"384:1A7fA3fQ9rk9PB3eHoUo+B/3tYih7DuO+u+O7jZl8q:yG+4f3eHHrtuO+uLNqq","tlshash":"7292d010aac1597f8bb7627b54d2123f83b65cd671184204077fde179bbbf9d880c4a5","first_seen":"2025-09-13T01:03:08.574109Z","last_seen":"2026-07-23T01:03:33.355996Z","times_seen":440,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":31,"send":0,"wait":19,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arbitrum.llamarpc.com/","fqdn":"arbitrum.llamarpc.com","domain":"llamarpc.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.222Z","timestamp":1781726715222,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: arbitrum.llamarpc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arbitrum-one.publicnode.com/","fqdn":"arbitrum-one.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.224Z","timestamp":1781726715224,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Jun 2026 01:05:04 GMT","end":"Mon, 07 Sep 2026 02:05:00 GMT"},"fingerprint":{"sha1":"39:B4:D5:B4:26:71:60:64:13:47:CC:54:ED:BC:AD:E1:33:77:19:00","sha256":"65:A9:40:31:FB:2A:25:C7:3B:B6:B3:F0:4E:96:B9:08:CE:FC:27:5A:F6:DB:32:E8:7E:64:C7:51:34:DA:93:85"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: arbitrum-one.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET,HEAD,OPTIONS,POST\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 172800\r\nallow: OPTIONS, POST\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers\r\ndate: Wed, 17 Jun 2026 20:05:15 GMT\r\nx-envoy-upstream-service-time: 0\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: a0d4ab027c4b0b69-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":641,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":11,"connect":33,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/flags/en.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.721Z","timestamp":1781726714721,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/flags/en.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 680\r\nLast-Modified: Tue, 07 Apr 2026 19:10:14 GMT\r\nConnection: keep-alive\r\nETag: \"69d55696-2a8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":680,"size_decoded":918,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"440946f64cf582b15a5f58b9899aeff4","sha1":"b5b8a1a59f3d1b6842b23424ee80a9ab621391e0","sha256":"375149764b56f25ea76d1c9f185088a626eb00c84e156183efbd64809c065ff1","sha512":"5a1db8d293c6f533aa2ab6c06812e21d708d9887dfb99ef07eee5c0658fbf165eeb93a016c2d814c457f0b4e97647bfcaca783e2c50cd867aece206869002739","ssdeep":"","tlshash":"f70188c353d0799fcc3c65e4c7c5727053732d8ac912c152466154f457ce3e0d842381","first_seen":"2023-05-28T13:52:24Z","last_seen":"2026-06-17T21:03:35.053724Z","times_seen":195,"resource_available":false,"data":null}},"time_used":532,"timings":{"blocked":491,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/hero-image.png","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.732Z","timestamp":1781726714732,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/hero-image.png HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/png\r\nLast-Modified: Tue, 07 Apr 2026 19:03:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d5550a-3a5b5\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":239029,"size_decoded":239290,"mime_type":"image/png","magic":"PNG image data, 720 x 1444, 8-bit colormap, non-interlaced","md5":"09bd14e65b87268476aa08704320deaa","sha1":"54156174819e4f13750f257136a3e4f23ce80800","sha256":"5510a8f659cea0fde4eea3a5079cfde550da2f99657d5a84e2dbecbebb50c4ae","sha512":"cbb2e14f7b693618ef994de3da97208f0ea61b4e4eeb1c4e3c01e4629a3eb4ea580a29736a2154327c399b7260ff5d455fd92cbda4ffa44fd304b8d332fac20d","ssdeep":"6144:BGta1krAQTo0v+UJh0rSxg36XLEvt9S+MheLk6x:BGSiAQM0v+Ub0igWLGt9VYetx","tlshash":"2634234c9c908bd9d5cc3ba56afc7ce4ec0362576f1e0a6e4becb31a0dd2d245092b65","first_seen":"2026-06-17T13:53:06.36932Z","last_seen":"2026-06-17T20:06:00.574289Z","times_seen":3,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":233,"dns":0,"connect":0,"send":0,"wait":47,"receive":95,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.035Z","timestamp":1781726715035,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 25 May 2026 08:38:18 GMT","end":"Mon, 17 Aug 2026 08:38:17 GMT"},"fingerprint":{"sha1":"C4:91:D1:0E:C2:A8:68:24:7B:00:2B:4A:EB:42:41:E0:29:E2:4E:A0","sha256":"68:29:56:08:39:D8:99:7B:20:CC:14:D3:4F:4D:D2:55:68:A6:27:DC:52:E9:7B:CF:CE:6B:D3:13:BC:97:65:C1"}}},"request":{"raw":"GET /s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 20168\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 16 Jun 2026 07:33:32 GMT\r\nexpires: Wed, 16 Jun 2027 07:33:32 GMT\r\ncache-control: public, max-age=31536000\r\nage: 131503\r\nlast-modified: Tue, 09 Sep 2025 19:01:14 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":20168,"size_decoded":20981,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20168, version 1.0","md5":"522d38acc1ead0c7da21d3ba79d0eaff","sha1":"59a46bfbdc80831077638a1cce91a8cc0741df55","sha256":"19bf2f2f1eaa10b2a047a8a1e624a1e12008ab5e3c50ad199ac968f8324f5f4d","sha512":"217c8fabd912111f70eaa137c08e7978c96db1413a24a9b991367c095743ff4c2472689b0844fea5689c0e4ba64fcb6033af290ce4b088b47fb0b5c93c55bee5","ssdeep":"384:1A7fA3fQ9rk9PB3eHoUo+B/3tYih7DuO+u+O7jZl8q:yG+4f3eHHrtuO+uLNqq","tlshash":"7292d010aac1597f8bb7627b54d2123f83b65cd671184204077fde179bbbf9d880c4a5","first_seen":"2025-09-13T01:03:08.574109Z","last_seen":"2026-07-23T01:03:33.355996Z","times_seen":440,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":28,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arbitrum.gateway.tenderly.co/","fqdn":"arbitrum.gateway.tenderly.co","domain":"tenderly.co","tld":"co"},"ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.234Z","timestamp":1781726715234,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gateway.tenderly.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 15 Jun 2026 18:01:31 GMT","end":"Sun, 13 Sep 2026 18:01:30 GMT"},"fingerprint":{"sha1":"9A:41:E5:34:79:91:EC:A6:18:2C:A5:9B:64:A2:94:81:A0:74:A3:57","sha256":"DD:73:B2:F2:0C:93:E6:AC:22:8B:33:E7:18:12:2F:78:95:14:EF:D9:E1:B3:D5:59:5A:73:0E:1B:07:B3:90:E9"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: arbitrum.gateway.tenderly.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-headers: Content-Type\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ndate: Wed, 17 Jun 2026 20:05:15 GMT\r\ncontent-length: 0\r\nx-envoy-upstream-service-time: 0\r\nserver: envoy\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":378,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":14,"connect":16,"send":0,"wait":46,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc-rpc.publicnode.com/","fqdn":"bsc-rpc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.949Z","timestamp":1781726719949,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Jun 2026 01:05:04 GMT","end":"Mon, 07 Sep 2026 02:05:00 GMT"},"fingerprint":{"sha1":"39:B4:D5:B4:26:71:60:64:13:47:CC:54:ED:BC:AD:E1:33:77:19:00","sha256":"65:A9:40:31:FB:2A:25:C7:3B:B6:B3:F0:4E:96:B9:08:CE:FC:27:5A:F6:DB:32:E8:7E:64:C7:51:34:DA:93:85"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc-rpc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/coin-1.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.739Z","timestamp":1781726714739,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/coin-1.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 1793518\r\nLast-Modified: Tue, 07 Apr 2026 19:05:48 GMT\r\nConnection: keep-alive\r\nETag: \"69d5558c-1b5dee\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1793518,"size_decoded":1793767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b8010fb3f37959329af30771296fa662","sha1":"58713455d38aee27a070785f50376c4a8c9e721e","sha256":"01c8a476cfadf19e594674877e4d7f97d72138b773bf9c5d26e2ed751ede6989","sha512":"a6dab64d93a1b02d9f0a45482786a8777e2d39a765d11901c6f92a53a8ffc4b40e2bee0df5007c60a8f8fc39e44fed9eae17bf40b31cb2e34e881215fa363fcc","ssdeep":"24576:D3nW0FZBu8LVyNHsOMuaiUZqtSHgGM7djEHLG:bfuyyP8FgFhB","tlshash":"0f252371eaa8cd6c5918c651b07e1ac48ef08de3cfcd6e8073393276a18df19856dc5a","first_seen":"2026-02-11T15:17:55.647458Z","last_seen":"2026-07-18T17:49:20.684651Z","times_seen":59,"resource_available":false,"data":null}},"time_used":496,"timings":{"blocked":149,"dns":0,"connect":0,"send":0,"wait":84,"receive":263,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.032Z","timestamp":1781726715032,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 25 May 2026 08:38:18 GMT","end":"Mon, 17 Aug 2026 08:38:17 GMT"},"fingerprint":{"sha1":"C4:91:D1:0E:C2:A8:68:24:7B:00:2B:4A:EB:42:41:E0:29:E2:4E:A0","sha256":"68:29:56:08:39:D8:99:7B:20:CC:14:D3:4F:4D:D2:55:68:A6:27:DC:52:E9:7B:CF:CE:6B:D3:13:BC:97:65:C1"}}},"request":{"raw":"GET /s/wixmadefordisplay/v12/SZcl3EX9IbbyeJ8aOluD52KXgUA_7Ed1CVHuAg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 20168\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 16 Jun 2026 07:33:32 GMT\r\nexpires: Wed, 16 Jun 2027 07:33:32 GMT\r\ncache-control: public, max-age=31536000\r\nage: 131503\r\nlast-modified: Tue, 09 Sep 2025 19:01:14 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":20168,"size_decoded":20981,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20168, version 1.0","md5":"522d38acc1ead0c7da21d3ba79d0eaff","sha1":"59a46bfbdc80831077638a1cce91a8cc0741df55","sha256":"19bf2f2f1eaa10b2a047a8a1e624a1e12008ab5e3c50ad199ac968f8324f5f4d","sha512":"217c8fabd912111f70eaa137c08e7978c96db1413a24a9b991367c095743ff4c2472689b0844fea5689c0e4ba64fcb6033af290ce4b088b47fb0b5c93c55bee5","ssdeep":"384:1A7fA3fQ9rk9PB3eHoUo+B/3tYih7DuO+u+O7jZl8q:yG+4f3eHHrtuO+uLNqq","tlshash":"7292d010aac1597f8bb7627b54d2123f83b65cd671184204077fde179bbbf9d880c4a5","first_seen":"2025-09-13T01:03:08.574109Z","last_seen":"2026-07-23T01:03:33.355996Z","times_seen":440,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":23,"dns":0,"connect":0,"send":0,"wait":40,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/benefit4.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.715Z","timestamp":1781726714715,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/benefit4.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 7806\r\nLast-Modified: Tue, 07 Apr 2026 19:06:54 GMT\r\nConnection: keep-alive\r\nETag: \"69d555ce-1e7e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7806,"size_decoded":8050,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1ce1bf382bdf03988579a134d40f3921","sha1":"e1ff829a2f0d8f5321d84d908e3cb93dab905bea","sha256":"127bdc6794f588cdc3bf94ab39138ed933ff68a8befe013421ec234002b351f0","sha512":"485bc45d14c71c02ece687f12b949a4636f09a2f5849e3f5834b86ad5a12d1f56b5f737ea56e8e402807c51777801598d9043fc352cc76b4f01e7ec3983e9886","ssdeep":"192:7o1T487sgBAXx+o1T48caSJkfVOBgHMLM:k1TNSXN1TCEYBBM","tlshash":"2cf185dd376856f5f85ac2e2ef12a038301b44bb56d0d620c6666e7c342a04dccbf6d5","first_seen":"2026-02-11T15:17:55.648367Z","last_seen":"2026-07-18T17:49:20.694774Z","times_seen":68,"resource_available":false,"data":null}},"time_used":653,"timings":{"blocked":612,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"arb1.arbitrum.io/rpc","fqdn":"arb1.arbitrum.io","domain":"arbitrum.io","tld":"io"},"ip":{"addr":"172.66.171.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:15.201Z","timestamp":1781726715201,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"arbitrum.io","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 05 May 2026 15:12:06 GMT","end":"Mon, 03 Aug 2026 15:12:05 GMT"},"fingerprint":{"sha1":"D3:54:F9:E1:4F:A1:F9:48:7A:90:AD:25:77:28:AC:8B:25:9F:8A:9B","sha256":"68:2B:C8:BC:79:16:DB:47:A5:AC:06:03:88:EF:7E:35:91:D6:08:8C:3A:52:2B:59:54:D3:FD:A9:7C:A4:61:06"}}},"request":{"raw":"POST /rpc HTTP/1.1\r\nHost: arb1.arbitrum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vaultsafepay.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 17 Jun 2026 20:05:15 GMT\r\ncontent-type: application/json\r\ncontent-length: 206\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvary: Origin, accept-encoding\r\nx-envoy-upstream-service-time: 2\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a0d4ab037a1456ab-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":423,"size_decoded":528,"mime_type":"application/json","magic":"JSON text data","md5":"1b679b2f0eeaadf2c6eb7d4372a19ff6","sha1":"c10b30995df01558764eb9d2535a9ae11ae3e879","sha256":"e816cebfcb18bbe56ac277f958463844a8bfdfdc57f637d45c5e406ebbb42567","sha512":"0ed72dfb1b44f579669a1572b86d9f46d7d0245c74c93b80e455b86c4e45b45f184cefd680a416fca05e402183bc48226ae0aada1874ac89caa2ffbb4dd8f368","ssdeep":"","tlshash":"8ae02b2100418670e8e9570bf65c7d0852637116c0c1cd57029d1c4c2e4bc917f9ea22","first_seen":"2026-06-17T20:06:00.559668Z","last_seen":"2026-06-17T20:06:00.559668Z","times_seen":1,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/images/coin-4.svg","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.711Z","timestamp":1781726714711,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /images/coin-4.svg HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:15 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 1600050\r\nLast-Modified: Tue, 07 Apr 2026 19:05:52 GMT\r\nConnection: keep-alive\r\nETag: \"69d55590-186a32\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1600050,"size_decoded":1600299,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"adc5f2dd7b9ccfc4d80f6d7ed41001d2","sha1":"c61416c26200b090ae3effff15962ffa54a61b66","sha256":"965dd02b6c2eab2627192c84cec836092a58005b40dbfb720143dcca17158475","sha512":"ff73fa662f487f0d063a335de1964a17e1ccad04bf0bd01ff43f3e6fd3e4cb904ee697e43ce9c5aba0f67e5e9445f81a6f8a1b54e02c23573e96d481fcac8df0","ssdeep":"24576:9t8lL6KOKa8OA3PUjlSI6FkSzXB16RhBdynoC:h+MCUC","tlshash":"942512933b17ec2f421c84b470efdc135a8174bb85294df29253b7879a52a8f457eac2","first_seen":"2026-02-11T15:17:55.609398Z","last_seen":"2026-06-17T20:06:00.576134Z","times_seen":59,"resource_available":false,"data":null}},"time_used":772,"timings":{"blocked":420,"dns":0,"connect":0,"send":0,"wait":55,"receive":297,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rpc.ankr.com/bsc","fqdn":"rpc.ankr.com","domain":"ankr.com","tld":"com"},"ip":{"addr":"152.236.9.75","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:19.954Z","timestamp":1781726719954,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"shark.multi-rpc.com","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 11:08:04 GMT","end":"Sun, 16 Aug 2026 11:08:03 GMT"},"fingerprint":{"sha1":"75:83:7C:84:77:DB:95:45:36:E5:E8:67:BD:D3:E5:85:52:4F:E8:FD","sha256":"B1:12:8E:9C:C2:F1:B2:5A:70:44:5F:46:ED:1F:40:D2:99:24:1D:0C:C1:85:19:9D:E3:34:0B:15:6B:DA:C9:B3"}}},"request":{"raw":"OPTIONS /bsc HTTP/1.1\r\nHost: rpc.ankr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://vaultsafepay.xyz/\r\nOrigin: https://vaultsafepay.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\ndate: Wed, 17 Jun 2026 20:05:20 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client,client-sdk-version,client-sdk-type,client-target-api-version,x-ton-client-version,x-client-name,x-client-version\r\naccess-control-max-age: 1728000\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":596,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T09:24:24.202644Z","times_seen":17473079,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":1,"connect":24,"send":0,"wait":23,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vaultsafepay.xyz/css/style2.css","fqdn":"vaultsafepay.xyz","domain":"vaultsafepay.xyz","tld":"xyz"},"ip":{"addr":"185.107.74.54","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vaultsafepay.xyz/","date":"2026-06-17T20:05:14.689Z","timestamp":1781726714689,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vaultsafepay.xyz","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 06:15:28 GMT","end":"Wed, 09 Sep 2026 06:15:27 GMT"},"fingerprint":{"sha1":"07:64:19:CC:79:8B:F5:D8:C1:E3:EB:C3:2C:21:DE:5E:C8:17:32:E4","sha256":"9F:E4:72:E6:0C:68:3C:82:C8:11:DF:04:E1:F2:A0:BF:D7:DE:05:3C:5F:99:F2:B7:D8:B6:2C:9B:5B:32:D6:52"}}},"request":{"raw":"GET /css/style2.css HTTP/1.1\r\nHost: vaultsafepay.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vaultsafepay.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Wed, 17 Jun 2026 20:05:14 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 07 Apr 2026 11:39:12 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d4ece0-21eb\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8683,"size_decoded":2740,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"3aa2fba9e7b9438b3b3847ce9f1f59b6","sha1":"9fe823ee132f2afeb89e4242473223bff1aa4619","sha256":"a33e69ebcf8367604e1c9f2384d460932f058c2e602bf6e95d2bbd3d1cba6227","sha512":"8518bb06683ae1ca6782d90a7cf006079408345696ca90e09332503a800fd143028e0cf66253875d12398817d0ddd5897e5f2ef937dd8540f65fc7a0ab020efb","ssdeep":"192:3Ln9hr6Uj3EtJWjAw4fsN0s1ecj3aTIuI/yL:bX6G85n","tlshash":"1802ff6fd55452c6f13aefb5bfa14b56ebdc5093860202797b8c610c0fbb05982a1fca","first_seen":"2026-06-17T13:53:06.339828Z","last_seen":"2026-06-17T20:06:00.577249Z","times_seen":3,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":41,"send":0,"wait":41,"receive":0,"ssl":46},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-17","alert":"Sinkholed","trigger":"vaultsafepay.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}