{"report_id":"94b02ceb-257f-4624-8d5b-97bc89d2e0af","version":0,"status":"done","tags":[],"date":"2026-10-11T11:28:47Z","url":{"schema":"http","addr":"xn--pay-bitrefll-fgb.com/","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":0,"asn":214351,"as":"Femo It Solutions Limited","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"title":"Bitrefill Checkout","dom":{"size":11528,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (9860)","md5":"698a525676168814c3efc015c808c033","sha1":"e3ea9e630dcf279dce0a5193f853dfb5311c13ab","sha256":"fc9f5c1add0c14c4ff26505a307ba1fa9bbb206a8f14b0066fa5c1d48cf2d7b1","sha512":"04dd8dc8f7534c1a9ad722e1c5493c3d4a8c35653daef93297b1bc22ef98653fc14fbf238f94b572e7a4e3b5d9fa411df33ac925a38259f1850dcb2d0466d864","ssdeep":"192:yN5Wn4K4EK4qWS2CXDQnnbVmp8qrZCBMr5u775yRiXbcigI7PZr:yzhExqWS1gV08q0BJZykgigI7PZr","tlshash":"9032c7bd140141ab5623c9be9b50fa5cb005a34acf559a09ebf99216fac2eeb48c443c","dom_hash":"domhash3947585979b9772c57afcae25daca4b0","first_seen":"2026-10-11T11:28:56.733519Z","last_seen":"2026-10-11T11:28:56.733519Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"xn--pay-bitrefll-fgb.com/","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":0,"asn":214351,"as":"Femo It Solutions Limited","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-15T11:28:47Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"xn--pay-bitrefll-fgb.com","ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":9,"request_count":9,"received_data":630099,"sent_data":4309,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-10-04T22:46:21.559025Z","alert_count":0,"request_count":4,"received_data":197380,"sent_data":2332,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-10-04T22:47:16.540786Z","alert_count":0,"request_count":1,"received_data":10792,"sent_data":540,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"eu-assets.i.posthog.com","ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-01-23","domain_rank":169009,"first_seen":"2024-02-28T08:06:29Z","last_seen":"2026-10-10T20:15:27.375054Z","alert_count":0,"request_count":6,"received_data":705550,"sent_data":3044,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"eu.i.posthog.com","ip":{"addr":"3.40.4.210","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2020-01-23","domain_rank":102660,"first_seen":"2024-02-20T15:34:02Z","last_seen":"2026-10-10T01:09:25.865016Z","alert_count":0,"request_count":2,"received_data":866,"sent_data":974,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/assets/index-LJ_OEKN1.js","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"32a32d86b0907857c47917e621d63be4","sha1":"ba8b4b3b4394efa408546664b15bbde4edcf251d","sha256":"4aadb67f48ea371965c2f6e70abbc7d232f0ae5d1f80114c4c76dab5c63b134c","sha512":"61e2df2635d85c7120fb6801462f9d725da0971f9d561c9a9c16c5fcfbcbe6a751aa7e428f7adc5441dc8e8d27de4c6a0d838f17b54879b1bde6b4de325cafb3","ssdeep":"12288:ynePHFqh+UJFnIilzLSSYVWcwL8pHdvabDKtLxqzZyHr:ynePHFqhTJFnIilzLSSYVXpHdvJNWZyL","tlshash":"66c48dda7384237927e301e871d95641f32d966cb226c5f0aaad44152bc3df8633b7ac","size":586712,"data":"","first_seen":"2026-10-11T11:28:56.738631Z","last_seen":"2026-10-11T11:52:24.092228Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/array.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c493c31d294ede9feec9db966bafd666","sha1":"e405049e1c95f7d8872766c8f00bc83df7775856","sha256":"da634b4a8200eeb2224620cbbfc23b35669b603a7a9b2cba15af25653ca77586","sha512":"4edab742a3a5aa4ea47d93f940720b5d9309a3edc5ff23e3434b7183c6641eabe93b5c0723c25bf0f19ccadc50c4c11b954b93a3e20705fb29ff1013c5bf72ef","ssdeep":"6144:JmocGCapmynMbqxZrUKQ8gwv7l7BbEw61eimh0kfRVs:/cdal8IUKQwv7ps","tlshash":"f264d9daf7a6d02607f698e5d0374123e72d3a093149c06cf16f5cca394d68aa276f39","size":331659,"data":"","first_seen":"2026-10-09T20:51:28.708848Z","last_seen":"2026-10-11T13:47:31.834211Z","times_seen":132,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/array/phc_uxjE5cAhUj7fPUJhKhSGJY7cFpPXvfuqgrZcSbGBSP7e/config.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8f707927813585c5ebb8fd11435ac58e","sha1":"3a495f7e89ae1715d3fa436b6449af78775c312e","sha256":"2ad7ca9f0d2b9636f93db2cae65ee43ee68f24e915540bc19644ff061c55c259","sha512":"30a4fa78271f94aedf24c827a0b918493ae3869f398d8de445cd26bb7cddc70212ed6b3df696c75ae6d40aa908f420949ec8abb374899fdc132c16156ede4b4c","ssdeep":"","tlshash":"4421c22d296915b584cd4325ba867d05affe012721186c6cf8dc4b44b6ff5de5642b03","size":1273,"data":"","first_seen":"2026-10-11T11:28:56.744431Z","last_seen":"2026-10-11T12:03:33.345324Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.7/web-vitals-with-attribution.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f307dda0085b0102293f29712c9b6ebc","sha1":"21c48a92f7f05f66fa12c3ce6ff076ff8af4cf09","sha256":"df8028288765a10318afacaff5a27f678394f74ce8354bab7ebbb318bc0463c8","sha512":"4c75f477c5caae400e3a73f597fb2b77f0039b7b516e5ddc4d3785c189fdfd5993c5bd3850e37067e06647211957f296b4ae8e7d81bf9bd85c4794fcd5a7faf3","ssdeep":"768:5pjbwohpXmrRVNk6Ze0RrQDVungn1z4Vugj2pkPQCiTZaDestI0TznVEN9SGtgmv:3jJc5boFzI7p8","tlshash":"52c2a7e2a592203822fb86e782734223773a765270c590dc65ff9f8259661c723e7f35","size":27027,"data":"","first_seen":"2026-09-10T08:27:10.542171Z","last_seen":"2026-10-11T12:52:50.193807Z","times_seen":2437,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.7/dead-clicks-autocapture.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"577c388f3cdbf2dd61ed0381bbf43f14","sha1":"15442a21e3cc3f8da6d1fb44a69c9fec608e7f23","sha256":"1d0b2faf5145fc6c24e30287e186741dee00d1fedc75c1d063e3cd874b5b0b03","sha512":"fa0fcad8739b975e893234697c0239dc2e3515be06bf43af398ee4289fc7e7f18df5c84e596a7cb5e2fb3e586955bd14d73dfabf987dcb73a00212c6005b0e6a","ssdeep":"384:J6v6HNqqkoOVy0EEg2pykwEMQ5+sHzMm+rQ4eT50Fy05Qnna7lMS/zW6xTVubVnD:J6v6H8fEE5p0ENXMm2eT5z05ona7OSqT","tlshash":"afb2fb987650b37126db59da80bb0512e2293544b04b8468f26edcc73cf979271ebf3e","size":23896,"data":"","first_seen":"2026-10-09T20:51:28.756012Z","last_seen":"2026-10-11T13:23:14.806501Z","times_seen":228,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.7/surveys.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"92d0d71b448a0c86b77328dc587078f6","sha1":"d861a0ffe6a18dce316acaaf8b34192ba5960472","sha256":"daf2e5f40411a852751012da24e375cb46d349584b7c210f659a8528136a020d","sha512":"6f36b2c081c5687af2c94ca4137bce70aaf9da8a5b726144b92bd910a31a5f9c0c9b515e91e2317382e346a6c20f50978b363ab17876d899a5020a68ebdae466","ssdeep":"1536:h9T42BGqfYXEEN6deHDClW2c08+YyXWP2JfmNJHHKEH2:hF7BGqXeDClWo+ZDH9H2","tlshash":"75a34a95ea41f06d42fb84a950bb4842f33d7b06fa4d8854b05b4cd43cd2989a3aff79","size":101658,"data":"","first_seen":"2026-10-09T20:51:28.561141Z","last_seen":"2026-10-11T13:23:14.821305Z","times_seen":258,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.7/posthog-recorder.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a84580d3f11de3975c6bf45b239bdb54","sha1":"a61485943353851eca06dbcce5ac9f2eecc46d75","sha256":"760cea537041972b7cec446408d1299141c0420e2b4faf7816e1865dcc98a620","sha512":"25da4d94656b979e1d4feadce90260aff847c075b1a4009c253d656da5447052c68276a69fbebb7b48a9c19dd0a9bdbdf4f639e777dcfc98a901e4e728071589","ssdeep":"6144:HXVgnHzA72trUEzBOpDRf7tGdTqAgBwtA9hU:HXazA7mrUEz4p9twqAcwtA9hU","tlshash":"7a242cda77a6703257ea5596c0770102f2353a09308b80a4f2ad9cda387d5c7a1b7f7e","size":215386,"data":"","first_seen":"2026-10-09T20:51:28.677212Z","last_seen":"2026-10-11T13:23:14.760722Z","times_seen":155,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/config.js","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"dd0bb0b681dd646bcffdd1030421caa2","sha1":"c736b5ae4c472ee1a94ca83914b699d858dba945","sha256":"95e2caecfd9c3f2bbae2ca498bd10ab28649fd9bde9cab6e957e6ca79f273c47","sha512":"69b546946e1690b2762cc99a08e6c3915517f5be38d2f42937beafcee73df25938d08325c2681d9a9a1855053ea28a05de14de24ca7e77482b77b2b2d353c03f","ssdeep":"","tlshash":"0af0dcb32626603a5ac8b144d5ed0f8c776331078cccb8603e6c00085b1c60fa535ed0","size":456,"data":"","first_seen":"2026-09-06T12:49:39.644121Z","last_seen":"2026-10-11T11:28:56.736646Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.7/web-vitals-with-attribution.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.911Z","timestamp":1791718088911,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/1.438.7/web-vitals-with-attribution.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 11 Oct 2026 11:28:09 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a48d8507afd7dfec-OSL\r\ncf-cache-status: MISS\r\netag: W/\"f307dda0085b0102293f29712c9b6ebc\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-version-id: 5iAS8ZBaIWVqMEdjTrWnYzHlRo71EDIx\r\nlast-modified: Fri, 09 Oct 2026 20:47:56 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: 7FHCh78q080pJBy0yq1ik1drFbVvWmoOKH8b0AlHN2KSc2DInYyYzJVlSuRoyvVpxmsyGu8nQ+MvRUIDI8xkqvnNJpO6lcMu\r\nx-amz-request-id: 6RXKZ1X6MBZMQS2T\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27027,"size_decoded":7957,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (26971)","md5":"f307dda0085b0102293f29712c9b6ebc","sha1":"21c48a92f7f05f66fa12c3ce6ff076ff8af4cf09","sha256":"df8028288765a10318afacaff5a27f678394f74ce8354bab7ebbb318bc0463c8","sha512":"4c75f477c5caae400e3a73f597fb2b77f0039b7b516e5ddc4d3785c189fdfd5993c5bd3850e37067e06647211957f296b4ae8e7d81bf9bd85c4794fcd5a7faf3","ssdeep":"768:5pjbwohpXmrRVNk6Ze0RrQDVungn1z4Vugj2pkPQCiTZaDestI0TznVEN9SGtgmv:3jJc5boFzI7p8","tlshash":"52c2a7e2a592203822fb86e782734223773a765270c590dc65ff9f8259661c723e7f35","first_seen":"2026-09-10T08:27:10.542171Z","last_seen":"2026-10-11T12:52:50.193807Z","times_seen":2437,"resource_available":true,"data":null}},"time_used":205,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu.i.posthog.com/i/v0/e/","fqdn":"eu.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.40.4.210","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:17.211Z","timestamp":1791718097211,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 16 Nov 2025 00:00:00 GMT","end":"Tue, 15 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"99:B5:42:B0:EF:B1:77:97:C3:FF:B8:89:87:B5:A3:F4:32:08:FE:27","sha256":"BF:C3:D3:B1:0B:53:D4:58:C2:A8:1F:37:4C:D0:F6:A2:F8:E0:1E:BB:05:FA:53:84:BA:CC:BF:1D:78:D1:F7:A5"}}},"request":{"raw":"POST /i/v0/e/ HTTP/1.1\r\nHost: eu.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: text/plain\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nContent-Length: 1215\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1833,"data":"\u001f‹\b\u0000\u0000\u0000\u0000\u0000\u0000\u0003½VYoã6\u0010þ+†‡\u0016ˆ\u001cR¶\u000e{ŸÚmwÑ큠IÐv‹‚ ¨‘ÄX\u0026µ\u0014å#Aþ{‡’\u000f9ñv‡\u001a†\rÍIÍ|óq\u001e=^K¶€­7÷êR°vsÿc(¾+ïîãüúî]ùsyóöÝ_±xS_ÿ¹ÊÛ\u000f…y/nÒ·ßß\\Çà]z)·¢ôæ?zm+3ŒA(§\u0001O\u0013?\u000eCîÇÓ)øIN¹OÂTDI@Ó$ËÐ\u000fV ,š_¬!e+iyÕ ´6º\u0006c%4ÞüÑ»Ðøçý!U¦×N‹Ïl\u0005¦‘Z¡œ\u0012'J\rêÀàó\u001bi ×\u001b'Ì`%\u00050»­\u0001\u0015?@³°ºv\n+—ð •“Þݾ\u001eJ˜Îó\u0006ðD\u0004…¢5\u0006ÇZS¡eimÝ̯®6Ê÷k¾õSi1SUùy‘Ž…^^¹8¥nÜë|ÌƙÔܖŠ/]òÎÅð5kñìŒ\u0017}-~Õ\u000f²ªøU8\u0026£ov¯=úívDɘ¼\u001a¡ š¾\u001am܏YÍéd:\u0026ߎނX諀P‚_:Ú\u0015áªÓ\u000eês¬\u001bj\u0006⊫¢Åü˜\u001d”wãÑ±\u001acÊMgâô0\u0000Š• ‹\u0012MI0=J×2³ˆ\u0007\u001a$®+\tëZ\u001bûÜø ?5¯dŠY\u0010\u0011^ÿ0ìöx:IƱSH…§³¬C[©ï‹ˆ–\u000fR•Ëû\u0007\u0015î[Š!ã\u0019iBfÓ1þ»\u0003f\u000b–ÉÆ2Qr¥ÀuVdª\u000f(­ä•|à\u0016“±Þß\u000bH\u0010ù”ø”ÞR:\u000f’9IÆÉ4zï\u003c„V¹,Z\u0003\u0019k iö^ºµl‰˜Å´îsé¹|R‰Ýa\u000f£\u0011‘\u0019ñã4¦þ,ËÁŸ\u0006bFsšdA\u003c\u001dÀ÷K|DépÐö‰T[UC‘Zé}¼g*m2lô\u0019\u0005bxé\u0026àŒª\u001f\u000e±}¡àKÝ:\u001c÷â\u000bÞZ-xm±J®î\u003c­ºj\u0019ì)kd†%ÎqèárH\u0001\fÔ\u0019;kÚgf¼ªô\u001a͖`\u0014Í!'l\u0004Ô]\u0013÷™Ï\u0006Ü'΀gLTR,þ;s\u0006i[°\\\u001aDOŽ™X£xݔÚv]o,_ÖGÀ%³`\u0012îñÖ9ÂƂr i˜ƒš;u©]s›­\u0012¥ÑJ·\u001d½}ÜÃ¥é‘åx\u0003rÀ\u00168λÈpޅõ\u000eR©\n–é%—êT»G)\u003ecϝ\u0015ž\u001a‡È\u0000oºù:*\u000eÓ\u0000Ž§‡UóúšíxûÑÛ1\u0019ÊÐjÅ«ÖÍ\u001cM¢KÏà\u0018©\u0002u…Ö.D\u0006•å{e\u0007ê\u0015\u000eÖ¡Z4Šü$\fƒhBÈ,!\u001dœ\u0015_É¢›Æ۞Ãw\u00028Ñý”ut}\u0014ÜýþËgòõÑçÆÕá¶\u001bù¯£þ³\u0010 1\u0019Týù$sáÇ\u003c\tý\u0014ÂÌ\u000f\u0005\tH\u003eI\u0026QÏ{ëŽø?éƒ\u000e\t\u001aåÞÓË.ôÃê\u0005¨¯»ÝwD‡¨Ìy[ÙfO‹$ô'ÄûßÞp\b{c¶ìü\bœ³ùÔ@ô¶_pџ:~Ƶêð|\t8μºâÛ~À\u0018ÒZQ8\u001a²Ü¶®ì{ÁžIÏúVR-ÂòŠ\u0017_\u0019\u0001\u000bñyž'Dқqaå\nΆ•Ê‚Q¼bi›çnµ\u0000Ut÷\u003e9gWmS:*F\u000eê§ò…‰1\u000eñØ_mŽt\u003e´rµþÐB\u000bƒ(5.3nóxy³†x³F™×{èÏH\u0012åY’O仍%rp†=‘¹ÄW?$ÃUU`g\u0019î«È ¸#é\\Vƒ»Å­/Ȅ€MYJG´\u000eƒ®^Ý8b½f³§\u0013òx¹pP·º÷ÞÓ?—^ãPÁíY³x\u001c)šý\u000b™·\u000e§Ë\u000b\u0000\u0000"}},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 11 Oct 2026 11:28:17 GMT\r\ncontent-type: application/json\r\ncontent-length: 15\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: https://xn--pay-bitrefll-fgb.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 31\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15,"size_decoded":433,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-10-11T13:47:37.981457Z","times_seen":58349,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/config.js","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.192Z","timestamp":1791718088192,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitrefll-fgb.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 17:55:37 GMT","end":"Thu, 10 Dec 2026 17:55:36 GMT"},"fingerprint":{"sha1":"16:FF:71:B4:3E:38:F8:6B:B6:A0:E9:4A:9A:34:0A:1D:71:5D:6A:FE","sha256":"33:01:E0:34:9A:32:2E:DA:EF:FC:C7:BD:6D:F1:61:1F:7B:C7:A9:05:89:6D:AA:36:84:45:57:F5:07:89:9B:43"}}},"request":{"raw":"GET /config.js HTTP/1.1\r\nHost: xn--pay-bitrefll-fgb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 11 Oct 2026 11:28:08 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 456\r\nLast-Modified: Fri, 28 Aug 2026 21:53:32 GMT\r\nConnection: keep-alive\r\nETag: \"6a92035c-1c8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":456,"size_decoded":722,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"dd0bb0b681dd646bcffdd1030421caa2","sha1":"c736b5ae4c472ee1a94ca83914b699d858dba945","sha256":"95e2caecfd9c3f2bbae2ca498bd10ab28649fd9bde9cab6e957e6ca79f273c47","sha512":"69b546946e1690b2762cc99a08e6c3915517f5be38d2f42937beafcee73df25938d08325c2681d9a9a1855053ea28a05de14de24ca7e77482b77b2b2d353c03f","ssdeep":"","tlshash":"0af0dcb32626603a5ac8b144d5ed0f8c776331078cccb8603e6c00085b1c60fa535ed0","first_seen":"2026-09-06T12:49:39.644121Z","last_seen":"2026-10-11T11:28:56.736646Z","times_seen":6,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/assets/index-LJ_OEKN1.js","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.197Z","timestamp":1791718088197,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitrefll-fgb.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 17:55:37 GMT","end":"Thu, 10 Dec 2026 17:55:36 GMT"},"fingerprint":{"sha1":"16:FF:71:B4:3E:38:F8:6B:B6:A0:E9:4A:9A:34:0A:1D:71:5D:6A:FE","sha256":"33:01:E0:34:9A:32:2E:DA:EF:FC:C7:BD:6D:F1:61:1F:7B:C7:A9:05:89:6D:AA:36:84:45:57:F5:07:89:9B:43"}}},"request":{"raw":"GET /assets/index-LJ_OEKN1.js HTTP/1.1\r\nHost: xn--pay-bitrefll-fgb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 11 Oct 2026 11:28:08 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6abd18f1-8f3d8\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":586712,"size_decoded":214302,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (42312)","md5":"32a32d86b0907857c47917e621d63be4","sha1":"ba8b4b3b4394efa408546664b15bbde4edcf251d","sha256":"4aadb67f48ea371965c2f6e70abbc7d232f0ae5d1f80114c4c76dab5c63b134c","sha512":"61e2df2635d85c7120fb6801462f9d725da0971f9d561c9a9c16c5fcfbcbe6a751aa7e428f7adc5441dc8e8d27de4c6a0d838f17b54879b1bde6b4de325cafb3","ssdeep":"12288:ynePHFqh+UJFnIilzLSSYVWcwL8pHdvabDKtLxqzZyHr:ynePHFqhTJFnIilzLSSYVXpHdvJNWZyL","tlshash":"66c48dda7384237927e301e871d95641f32d966cb226c5f0aaad44152bc3df8633b7ac","first_seen":"2026-10-11T11:28:56.738631Z","last_seen":"2026-10-11T11:52:24.092228Z","times_seen":3,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":59,"receive":87,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/array.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.486Z","timestamp":1791718088486,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/array.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 11 Oct 2026 11:28:08 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a48d85052f87dfec-OSL\r\ncf-cache-status: MISS\r\netag: W/\"c493c31d294ede9feec9db966bafd666\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-version-id: s8hmA43HJIr4RhW7AmYZ0CuqS35PKMQN\r\nlast-modified: Fri, 09 Oct 2026 20:49:10 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: Vh2W/XOmnhUBHuo4EXjuNvya9LeCxolog5hGav+g7AZUOHytQR/KUax3me3YBxx8DJ/8xAUIFYpS6hxIt15ttmfJh5PzqOWX\r\nx-amz-request-id: J6XHGG3J5N7V4H91\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":331659,"size_decoded":106367,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65530), with no line terminators","md5":"c493c31d294ede9feec9db966bafd666","sha1":"e405049e1c95f7d8872766c8f00bc83df7775856","sha256":"da634b4a8200eeb2224620cbbfc23b35669b603a7a9b2cba15af25653ca77586","sha512":"4edab742a3a5aa4ea47d93f940720b5d9309a3edc5ff23e3434b7183c6641eabe93b5c0723c25bf0f19ccadc50c4c11b954b93a3e20705fb29ff1013c5bf72ef","ssdeep":"6144:JmocGCapmynMbqxZrUKQ8gwv7l7BbEw61eimh0kfRVs:/cdal8IUKQwv7ps","tlshash":"f264d9daf7a6d02607f698e5d0374123e72d3a093149c06cf16f5cca394d68aa276f39","first_seen":"2026-10-09T20:51:28.708848Z","last_seen":"2026-10-11T13:47:31.834211Z","times_seen":132,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":87,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.522Z","timestamp":1791718088522,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:55:52 GMT\r\nexpires: Tue, 05 Oct 2027 15:55:52 GMT\r\ncache-control: public, max-age=31536000\r\nage: 502336\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-11T13:42:11.526528Z","times_seen":313234,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":27,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/array/phc_uxjE5cAhUj7fPUJhKhSGJY7cFpPXvfuqgrZcSbGBSP7e/config.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.851Z","timestamp":1791718088851,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /array/phc_uxjE5cAhUj7fPUJhKhSGJY7cFpPXvfuqgrZcSbGBSP7e/config.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 11 Oct 2026 11:28:08 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=300\r\nvary: Origin, Referer,origin, access-control-request-method, access-control-request-headers, Accept-Encoding\r\naccess-control-allow-origin: https://xn--pay-bitrefll-fgb.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 2\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nlast-modified: Sun, 11 Oct 2026 11:28:08 GMT\r\ncf-cache-status: MISS\r\ncf-ray: a48d85074ea1dfec-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":1273,"size_decoded":1281,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1073)","md5":"8f707927813585c5ebb8fd11435ac58e","sha1":"3a495f7e89ae1715d3fa436b6449af78775c312e","sha256":"2ad7ca9f0d2b9636f93db2cae65ee43ee68f24e915540bc19644ff061c55c259","sha512":"30a4fa78271f94aedf24c827a0b918493ae3869f398d8de445cd26bb7cddc70212ed6b3df696c75ae6d40aa908f420949ec8abb374899fdc132c16156ede4b4c","ssdeep":"","tlshash":"4421c22d296915b584cd4325ba867d05affe012721186c6cf8dc4b44b6ff5de5642b03","first_seen":"2026-10-11T11:28:56.744431Z","last_seen":"2026-10-11T12:03:33.345324Z","times_seen":4,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-11T11:28:07.360Z","timestamp":1791718087360,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitrefll-fgb.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 17:55:37 GMT","end":"Thu, 10 Dec 2026 17:55:36 GMT"},"fingerprint":{"sha1":"16:FF:71:B4:3E:38:F8:6B:B6:A0:E9:4A:9A:34:0A:1D:71:5D:6A:FE","sha256":"33:01:E0:34:9A:32:2E:DA:EF:FC:C7:BD:6D:F1:61:1F:7B:C7:A9:05:89:6D:AA:36:84:45:57:F5:07:89:9B:43"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xn--pay-bitrefll-fgb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 11 Oct 2026 11:28:07 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 443\r\nConnection: keep-alive\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nETag: \"364-65cb3e5e27fa3-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":868,"size_decoded":753,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"281c54ce4d7a844431d079ebec069570","sha1":"d12fcc7dd075007aeeb7830048ee6fa0de236afe","sha256":"5d675e9689a85da6c9404cf792c450507bfa103984ec0de239ddc00ff7f37dd5","sha512":"e67abd0ab231dcbc938771b305db38100e655594c468a60081d754f3e775766c2e42aee0a15ea1fccd05f229286b6b37092ba9776304d139b816288eb3208946","ssdeep":"","tlshash":"76111e975cd0c809131006966c91f419ed83928b8b089ca8b5fb40fc8f597c64dcb998","first_seen":"2026-10-11T11:28:56.746184Z","last_seen":"2026-10-11T11:52:24.089716Z","times_seen":3,"resource_available":true,"data":null}},"time_used":372,"timings":{"blocked":-1,"dns":243,"connect":29,"send":0,"wait":36,"receive":0,"ssl":64},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.514Z","timestamp":1791718088514,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:55:52 GMT\r\nexpires: Tue, 05 Oct 2027 15:55:52 GMT\r\ncache-control: public, max-age=31536000\r\nage: 502336\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-11T13:42:11.526528Z","times_seen":313234,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":0,"dns":0,"connect":29,"send":0,"wait":18,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.521Z","timestamp":1791718088521,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:55:52 GMT\r\nexpires: Tue, 05 Oct 2027 15:55:52 GMT\r\ncache-control: public, max-age=31536000\r\nage: 502336\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-11T13:42:11.526528Z","times_seen":313234,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":22,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.524Z","timestamp":1791718088524,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:55:52 GMT\r\nexpires: Tue, 05 Oct 2027 15:55:52 GMT\r\ncache-control: public, max-age=31536000\r\nage: 502336\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-11T13:42:11.526528Z","times_seen":313234,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":32,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.7/surveys.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.906Z","timestamp":1791718088906,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/1.438.7/surveys.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 11 Oct 2026 11:28:09 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a48d8507afc3dfec-OSL\r\ncf-cache-status: MISS\r\netag: W/\"92d0d71b448a0c86b77328dc587078f6\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-version-id: .hqcILGKCB44i6ZKhGFMnZHi8cIDzCwb\r\nlast-modified: Fri, 09 Oct 2026 20:47:56 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: q4X7QvTZoz3wYB1Fm4YyOiNx52WCm0gDE18WWvZlELC/h0Ui+B6UzscXhCO0qgnUG4H+FzRBECLAkaIG2v5X+1v2DP8Ipm6f\r\nx-amz-request-id: 6RXNAJ8SF742DK70\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":101658,"size_decoded":34356,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"92d0d71b448a0c86b77328dc587078f6","sha1":"d861a0ffe6a18dce316acaaf8b34192ba5960472","sha256":"daf2e5f40411a852751012da24e375cb46d349584b7c210f659a8528136a020d","sha512":"6f36b2c081c5687af2c94ca4137bce70aaf9da8a5b726144b92bd910a31a5f9c0c9b515e91e2317382e346a6c20f50978b363ab17876d899a5020a68ebdae466","ssdeep":"1536:h9T42BGqfYXEEN6deHDClW2c08+YyXWP2JfmNJHHKEH2:hF7BGqXeDClWo+ZDH9H2","tlshash":"75a34a95ea41f06d42fb84a950bb4842f33d7b06fa4d8854b05b4cd43cd2989a3aff79","first_seen":"2026-10-09T20:51:28.561141Z","last_seen":"2026-10-11T13:23:14.821305Z","times_seen":258,"resource_available":true,"data":null}},"time_used":192,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.7/posthog-recorder.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.909Z","timestamp":1791718088909,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/1.438.7/posthog-recorder.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 11 Oct 2026 11:28:09 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a48d8507afcedfec-OSL\r\ncf-cache-status: MISS\r\netag: W/\"a84580d3f11de3975c6bf45b239bdb54\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-version-id: S2Ebc8QvjswOfavTuwEFep0qHMBidEuz\r\nlast-modified: Fri, 09 Oct 2026 20:47:55 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: MKuVk0j3c5Is6BZULTVEH+ujJPR5Eey4VvDQEjUA2xzH7721vYkp0PmDIRp/VBuvj/V32Zv+tnapMVUUskHrVDidTNST/u/V\r\nx-amz-request-id: 6RXZY5VSEH63SE85\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":215386,"size_decoded":68864,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a84580d3f11de3975c6bf45b239bdb54","sha1":"a61485943353851eca06dbcce5ac9f2eecc46d75","sha256":"760cea537041972b7cec446408d1299141c0420e2b4faf7816e1865dcc98a620","sha512":"25da4d94656b979e1d4feadce90260aff847c075b1a4009c253d656da5447052c68276a69fbebb7b48a9c19dd0a9bdbdf4f639e777dcfc98a901e4e728071589","ssdeep":"6144:HXVgnHzA72trUEzBOpDRf7tGdTqAgBwtA9hU:HXazA7mrUEz4p9twqAcwtA9hU","tlshash":"7a242cda77a6703257ea5596c0770102f2353a09308b80a4f2ad9cda387d5c7a1b7f7e","first_seen":"2026-10-09T20:51:28.677212Z","last_seen":"2026-10-11T13:23:14.760722Z","times_seen":155,"resource_available":true,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.7/dead-clicks-autocapture.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.910Z","timestamp":1791718088910,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/1.438.7/dead-clicks-autocapture.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 11 Oct 2026 11:28:09 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a48d8507afd0dfec-OSL\r\ncf-cache-status: MISS\r\netag: W/\"577c388f3cdbf2dd61ed0381bbf43f14\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-version-id: 76EK3VqDkrVncmuDWqzsuyKUiPyOB6Ga\r\nlast-modified: Fri, 09 Oct 2026 20:47:54 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: AVvGN3o2Omdbky32IRby0NVepsbunUYRuPeVRa9R7VVdH6kF5SJwWYPgBFKCUoBCXt22OnlgNoRzvZCOjVHBbE8MicQgpZ0k\r\nx-amz-request-id: 6RXT6F6KBF70DW01\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23896,"size_decoded":9648,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23844)","md5":"577c388f3cdbf2dd61ed0381bbf43f14","sha1":"15442a21e3cc3f8da6d1fb44a69c9fec608e7f23","sha256":"1d0b2faf5145fc6c24e30287e186741dee00d1fedc75c1d063e3cd874b5b0b03","sha512":"fa0fcad8739b975e893234697c0239dc2e3515be06bf43af398ee4289fc7e7f18df5c84e596a7cb5e2fb3e586955bd14d73dfabf987dcb73a00212c6005b0e6a","ssdeep":"384:J6v6HNqqkoOVy0EEg2pykwEMQ5+sHzMm+rQ4eT50Fy05Qnna7lMS/zW6xTVubVnD:J6v6H8fEE5p0ENXMm2eT5z05ona7OSqT","tlshash":"afb2fb987650b37126db59da80bb0512e2293544b04b8468f26edcc73cf979271ebf3e","first_seen":"2026-10-09T20:51:28.756012Z","last_seen":"2026-10-11T13:23:14.806501Z","times_seen":228,"resource_available":true,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu.i.posthog.com/e/","fqdn":"eu.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.40.4.210","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:11.852Z","timestamp":1791718091852,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 16 Nov 2025 00:00:00 GMT","end":"Tue, 15 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"99:B5:42:B0:EF:B1:77:97:C3:FF:B8:89:87:B5:A3:F4:32:08:FE:27","sha256":"BF:C3:D3:B1:0B:53:D4:58:C2:A8:1F:37:4C:D0:F6:A2:F8:E0:1E:BB:05:FA:53:84:BA:CC:BF:1D:78:D1:F7:A5"}}},"request":{"raw":"POST /e/ HTTP/1.1\r\nHost: eu.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: text/plain\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nContent-Length: 931\r\nOrigin: https://xn--pay-bitrefll-fgb.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 11 Oct 2026 11:28:11 GMT\r\ncontent-type: application/json\r\ncontent-length: 15\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: https://xn--pay-bitrefll-fgb.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 22\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":15,"size_decoded":433,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-10-11T13:47:37.981457Z","times_seen":58349,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":0,"dns":2,"connect":24,"send":0,"wait":49,"receive":0,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.194Z","timestamp":1791718088194,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:49 GMT","end":"Fri, 11 Dec 2026 20:01:48 GMT"},"fingerprint":{"sha1":"E3:3D:17:9C:78:F1:DE:68:C7:E6:BB:8F:08:DC:78:F3:9D:DF:F2:43","sha256":"EB:D6:1D:9A:76:0B:5A:3C:08:74:83:6D:AA:A7:F4:B3:0D:17:8F:4F:3E:6B:9C:91:6C:5B:9E:F7:08:1F:00:62"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 11 Oct 2026 11:28:08 GMT\r\ndate: Sun, 11 Oct 2026 11:28:08 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":1447,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"859ed7a809c823fc4c3b21178846441d","sha1":"d8f7f19047db4b58ff5147ae8b0ad70804263d9a","sha256":"d0db1bd8545c950185812adf96ec94bc7313a58750a86bf6f38168669e628919","sha512":"73643b482c472422817a112b606f73a53f73cc44c713377f1d0091aa08be3ed25fe003a500daa3f2953b340e79b8060b5416c11027a21dcd4d98688bb3562f14","ssdeep":"192:9NNIxO34OxvENOPCO3/NxoNNryfO3iExBONEhYO3RrxSx:vXyMopi+8","tlshash":"3b227792002ba400ab971dc263cf7f3aaece50896085d1b95ffd0dc59ceed66436876d","first_seen":"2026-10-05T17:52:09.328959Z","last_seen":"2026-10-11T13:29:47.102217Z","times_seen":760,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":33,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/ultramodule-1.0.6.js","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.196Z","timestamp":1791718088196,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitrefll-fgb.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 17:55:37 GMT","end":"Thu, 10 Dec 2026 17:55:36 GMT"},"fingerprint":{"sha1":"16:FF:71:B4:3E:38:F8:6B:B6:A0:E9:4A:9A:34:0A:1D:71:5D:6A:FE","sha256":"33:01:E0:34:9A:32:2E:DA:EF:FC:C7:BD:6D:F1:61:1F:7B:C7:A9:05:89:6D:AA:36:84:45:57:F5:07:89:9B:43"}}},"request":{"raw":"GET /ultramodule-1.0.6.js HTTP/1.1\r\nHost: xn--pay-bitrefll-fgb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 11 Oct 2026 11:28:08 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 443\r\nConnection: keep-alive\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nETag: \"364-65cb3e5e27fa3-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":868,"size_decoded":753,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"281c54ce4d7a844431d079ebec069570","sha1":"d12fcc7dd075007aeeb7830048ee6fa0de236afe","sha256":"5d675e9689a85da6c9404cf792c450507bfa103984ec0de239ddc00ff7f37dd5","sha512":"e67abd0ab231dcbc938771b305db38100e655594c468a60081d754f3e775766c2e42aee0a15ea1fccd05f229286b6b37092ba9776304d139b816288eb3208946","ssdeep":"","tlshash":"76111e975cd0c809131006966c91f419ed83928b8b089ca8b5fb40fc8f597c64dcb998","first_seen":"2026-10-11T11:28:56.746184Z","last_seen":"2026-10-11T11:52:24.089716Z","times_seen":3,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/assets/index-Cs1TeOMe.css","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.198Z","timestamp":1791718088198,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitrefll-fgb.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 17:55:37 GMT","end":"Thu, 10 Dec 2026 17:55:36 GMT"},"fingerprint":{"sha1":"16:FF:71:B4:3E:38:F8:6B:B6:A0:E9:4A:9A:34:0A:1D:71:5D:6A:FE","sha256":"33:01:E0:34:9A:32:2E:DA:EF:FC:C7:BD:6D:F1:61:1F:7B:C7:A9:05:89:6D:AA:36:84:45:57:F5:07:89:9B:43"}}},"request":{"raw":"GET /assets/index-Cs1TeOMe.css HTTP/1.1\r\nHost: xn--pay-bitrefll-fgb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 11 Oct 2026 11:28:08 GMT\r\nContent-Type: text/css\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6abd18f1-9246\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37446,"size_decoded":9434,"mime_type":"text/css","magic":"ASCII text, with very long lines (37445)","md5":"e1980621975a2f3e4bcdb54a3aa1a379","sha1":"5c327c4e9b8185ddc5b616f626f5a72a3a241c74","sha256":"137328a05ef92e18f1fba19b72861c090be47204d49079ec9ce842715fe533c5","sha512":"6d3466a684d2da1115c35f2439c8277ebea34e6a4d294da56efe31c28cc609312caa1708a159ee7b7869c03d190a1ec94ae4e462a263f39bbfc1d3dcb7bd6859","ssdeep":"768:MTlyKVyceiO+wR5fMBUWysfJwW6rM+wnw+0Xj04w:MTk8yceiKR5fMtaW6rM+wnwP4R","tlshash":"1af2a464f329dd7fac33947e63acf81c6205a5869d2167d9ff02650286c77f21d62228","first_seen":"2026-10-11T11:28:56.753313Z","last_seen":"2026-10-11T11:52:24.084323Z","times_seen":3,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/api/wallet-connect-url?site=evm","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.485Z","timestamp":1791718088485,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitrefll-fgb.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 17:55:37 GMT","end":"Thu, 10 Dec 2026 17:55:36 GMT"},"fingerprint":{"sha1":"16:FF:71:B4:3E:38:F8:6B:B6:A0:E9:4A:9A:34:0A:1D:71:5D:6A:FE","sha256":"33:01:E0:34:9A:32:2E:DA:EF:FC:C7:BD:6D:F1:61:1F:7B:C7:A9:05:89:6D:AA:36:84:45:57:F5:07:89:9B:43"}}},"request":{"raw":"GET /api/wallet-connect-url?site=evm HTTP/1.1\r\nHost: xn--pay-bitrefll-fgb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 11 Oct 2026 11:28:08 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Idempotency-Key, Last-Event-ID\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":62,"size_decoded":382,"mime_type":"application/json","magic":"JSON text data","md5":"9e6d8eb2b65bb02f9c6818498d86bb47","sha1":"7e6f872305ea7f70bd3368b639d2df20ae993468","sha256":"e11930a92c65f5f9e88d2bb6acc3389b595c4f859a8855e936258bef8bc42674","sha512":"7107c5c9d4c234013bade3c6d06202e7b2d05cf9e8220c523a5a7bff9cf62d76b3fff59c8f059922bc21a1e334df3731bd072c17e31ebe473ed74cee07b6257b","ssdeep":"","tlshash":"37a00272026dad91aa51abc01a1a7f4e652f1026b59ae2667984bd4cc23c2560106ca2","first_seen":"2026-10-11T09:55:04.995893Z","last_seen":"2026-10-11T12:34:50.509011Z","times_seen":6,"resource_available":true,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/favicon.ico","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.816Z","timestamp":1791718088816,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitrefll-fgb.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 17:55:37 GMT","end":"Thu, 10 Dec 2026 17:55:36 GMT"},"fingerprint":{"sha1":"16:FF:71:B4:3E:38:F8:6B:B6:A0:E9:4A:9A:34:0A:1D:71:5D:6A:FE","sha256":"33:01:E0:34:9A:32:2E:DA:EF:FC:C7:BD:6D:F1:61:1F:7B:C7:A9:05:89:6D:AA:36:84:45:57:F5:07:89:9B:43"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: xn--pay-bitrefll-fgb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 11 Oct 2026 11:28:08 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 443\r\nConnection: keep-alive\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nETag: \"364-65cb3e5e27fa3-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":868,"size_decoded":753,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"281c54ce4d7a844431d079ebec069570","sha1":"d12fcc7dd075007aeeb7830048ee6fa0de236afe","sha256":"5d675e9689a85da6c9404cf792c450507bfa103984ec0de239ddc00ff7f37dd5","sha512":"e67abd0ab231dcbc938771b305db38100e655594c468a60081d754f3e775766c2e42aee0a15ea1fccd05f229286b6b37092ba9776304d139b816288eb3208946","ssdeep":"","tlshash":"76111e975cd0c809131006966c91f419ed83928b8b089ca8b5fb40fc8f597c64dcb998","first_seen":"2026-10-11T11:28:56.746184Z","last_seen":"2026-10-11T11:52:24.089716Z","times_seen":3,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/api/wallet-connect-url?site=tron","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.488Z","timestamp":1791718088488,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitrefll-fgb.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 17:55:37 GMT","end":"Thu, 10 Dec 2026 17:55:36 GMT"},"fingerprint":{"sha1":"16:FF:71:B4:3E:38:F8:6B:B6:A0:E9:4A:9A:34:0A:1D:71:5D:6A:FE","sha256":"33:01:E0:34:9A:32:2E:DA:EF:FC:C7:BD:6D:F1:61:1F:7B:C7:A9:05:89:6D:AA:36:84:45:57:F5:07:89:9B:43"}}},"request":{"raw":"GET /api/wallet-connect-url?site=tron HTTP/1.1\r\nHost: xn--pay-bitrefll-fgb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 11 Oct 2026 11:28:08 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Idempotency-Key, Last-Event-ID\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63,"size_decoded":383,"mime_type":"application/json","magic":"JSON text data","md5":"a323b68b0305a4bd6d5b48e8e8b3290a","sha1":"8e54e4fa445d9bd426548ba03e17038522d9f4ea","sha256":"3aee170a0568c40b1a85c176ef7e74846aa197c9f9f35512b8f75019554f86ae","sha512":"208aba956c906774d972f7b8eaed2d012b493ae58672c3830b04e9415bf9fc8742ba03f9213ba48ca96be3a578f30b6e5190a72f15afcd042913ff29cc61aa19","ssdeep":"","tlshash":"08a02232030c2c228a00838002033c8c800b00e38880800a3c88ac0c282008a0003c83","first_seen":"2026-10-11T09:55:05.033864Z","last_seen":"2026-10-11T12:34:50.492003Z","times_seen":6,"resource_available":true,"data":null}},"time_used":323,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":323,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitrefll-fgb.com/api/wallet-connect-url?site=solana","fqdn":"xn--pay-bitrefll-fgb.com","domain":"xn--pay-bitrefll-fgb.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitrefll-fgb.com/","date":"2026-10-11T11:28:08.490Z","timestamp":1791718088490,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitrefll-fgb.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 11 Sep 2026 17:55:37 GMT","end":"Thu, 10 Dec 2026 17:55:36 GMT"},"fingerprint":{"sha1":"16:FF:71:B4:3E:38:F8:6B:B6:A0:E9:4A:9A:34:0A:1D:71:5D:6A:FE","sha256":"33:01:E0:34:9A:32:2E:DA:EF:FC:C7:BD:6D:F1:61:1F:7B:C7:A9:05:89:6D:AA:36:84:45:57:F5:07:89:9B:43"}}},"request":{"raw":"GET /api/wallet-connect-url?site=solana HTTP/1.1\r\nHost: xn--pay-bitrefll-fgb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://xn--pay-bitrefll-fgb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 11 Oct 2026 11:28:08 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Idempotency-Key, Last-Event-ID\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72,"size_decoded":392,"mime_type":"application/json","magic":"JSON text data","md5":"16648b97044056285203717b81f3ac77","sha1":"04ae3dccb0507f2a85a1dea8c8f4c97a034d3bcd","sha256":"48968e6b685914d24dbeeb65ede7fc87e0e5b9e2ee3befc9b3e08fdddbe3ff22","sha512":"65016711fdcb56c4fe989dd9c0887908896d644123e9da42ea3dd6ae762066c946c4a5515d1650ea187632ba79a6731ffbd221192c4562c374d3f0abdbda25a3","ssdeep":"","tlshash":"26a0112200ec2e028ec08282382a308aa20b00038a82aa0838c8b0080030323202b8aa","first_seen":"2026-10-11T09:55:05.018287Z","last_seen":"2026-10-11T12:34:50.512683Z","times_seen":6,"resource_available":true,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-11","alert":"Sinkholed","trigger":"xn--pay-bitrefll-fgb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}