{"report_id":"a0caeea9-95d8-4c71-960a-54c0e91ddc2a","version":6,"status":"done","tags":[],"date":"2026-01-25T04:49:57Z","url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":0,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/home.php","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"title":"Plant Earn - Earn Real USDT Daily","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":0,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-01T04:49:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":15}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"pl28018948.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"pl28018948.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"pl28018948.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"unpkg.com","ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-01-06","domain_rank":1093,"first_seen":"2016-01-07T23:26:01Z","last_seen":"2026-01-18T23:20:15.877736Z","alert_count":0,"request_count":4,"received_data":1256313,"sent_data":1770,"comment":"","tags":null,"fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"flushpersist.com","ip":{"addr":"172.240.127.234","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2025-07-01","domain_rank":23810,"first_seen":"2025-07-08T10:43:12.76905Z","last_seen":"2026-01-21T22:18:51.784474Z","alert_count":3,"request_count":1,"received_data":530,"sent_data":779,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"protrafficinspector.com","ip":{"addr":"63.178.76.99","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2025-06-18","domain_rank":614186,"first_seen":"2025-07-25T22:45:21.95813Z","last_seen":"2026-01-21T11:51:50.493017Z","alert_count":0,"request_count":1,"received_data":437,"sent_data":472,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.rewardhub.safevpnapp.com","ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"domain_registered":"2025-07-26","domain_rank":0,"first_seen":"2026-01-24T19:33:43.343543Z","last_seen":"2026-01-24T19:33:43.343543Z","alert_count":0,"request_count":5,"received_data":329110,"sent_data":2765,"comment":"","tags":null,"fingerprints":[{"name":"Alpine.js","description":"","website":"https://github.com/alpinejs/alpine","common_platform_enumeration":"","icon":"Alpine.js.png","categories":["JavaScript frameworks"]},{"name":"Unpkg","description":"Unpkg is a content delivery network for everything on npm.","website":"https://unpkg.com","common_platform_enumeration":"","icon":"Unpkg.png","categories":["CDN"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"preferencenail.com","ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-07-01","domain_rank":20606,"first_seen":"2025-07-08T12:55:47.271261Z","last_seen":"2026-01-21T22:18:52.236505Z","alert_count":3,"request_count":1,"received_data":85956,"sent_data":426,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-18T22:14:28.232245Z","alert_count":0,"request_count":5,"received_data":283202,"sent_data":2843,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-18T22:17:29.309663Z","alert_count":0,"request_count":1,"received_data":13321,"sent_data":491,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"pl28018948.effectivegatecpm.com","ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2025-10-07","domain_rank":0,"first_seen":"2026-01-24T19:33:43.340248Z","last_seen":"2026-01-24T19:33:43.340248Z","alert_count":3,"request_count":1,"received_data":107686,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"realizationnewestfangs.com","ip":{"addr":"172.240.127.234","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-09-03","domain_rank":0,"first_seen":"2025-10-02T06:26:57.543488Z","last_seen":"2026-01-21T12:11:41.783713Z","alert_count":3,"request_count":1,"received_data":525,"sent_data":520,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"weirdopt.com","ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-07-01","domain_rank":37519,"first_seen":"2025-07-08T12:55:47.272157Z","last_seen":"2026-01-22T09:25:54.576288Z","alert_count":3,"request_count":1,"received_data":377,"sent_data":431,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"4a2b0b4b8def347812f148c9eb4c0e0c","sha1":"da70324c25d4f9504e2d9fe4223d09f23799b1f3","sha256":"2f15477aa77dc2a4ea1df308ccf9a795d7cb57a45a27ca53e28879c296ed7713","sha512":"f180daf213dc367f1a2b1855a48b2fef378ba730821b4d9d8ece8f70981c28c94d9f1ac4bcde07b12c44a7330403a50dd2335bf555efada6b5084b7ab5ca7ce3","ssdeep":"","tlshash":"f7c09bd458c65900c2173dd1d136583f623c5a65d17d4466263de3949573116d15ccee","size":138,"data":"","first_seen":"2023-05-17T12:49:57Z","last_seen":"2026-06-08T23:28:12.533985Z","times_seen":3323,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"cb01af57a8f8cefb70c855508db3ef60","sha1":"2c13a8b2bac0c676b89b25651c172bf4204df3d3","sha256":"37fca698659ffe2c84e9c6baf7124b87c5296ae844a63ddeb8d37923ac885ac9","sha512":"f12ebc86a10f1531bf114840c7e5604438da2bb4c210a423e74d95d3916fef63876b64eca6dca3eaaf2f49a411d2aa91d9423727d11606b9965d00686f7a839d","ssdeep":"","tlshash":"37c02bc84cc30900c2073582c039403732349262d17d44a4173cf7a09533226f01cc9d","size":141,"data":"","first_seen":"2025-08-15T03:59:43.707205Z","last_seen":"2026-06-04T18:09:45.337121Z","times_seen":83,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"40c692430d425284502daccb5c1ae5b4","sha1":"7cc4692d5cd6820db5cf6cc2b70c2ba6f28457d6","sha256":"6bc900532ff4fae83167d7b934553c995e905407b828dca7cbaf2675868518c7","sha512":"39eaa6396b874d2ecb44e74a6c4ffadf5a78b7814a47d6f9788619d3db7290578e70ae7cbfe8e9a71fc70a12019e5b99fcdb5806c4bb9ddd50b7696b2777b238","ssdeep":"","tlshash":"dac09bc45cc75900c2173593c175543771345661917d8465273db7949533126f15cc9d","size":137,"data":"","first_seen":"2025-08-15T03:59:43.728295Z","last_seen":"2026-06-02T20:04:50.078467Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"97d4aa9100709ad26f99dd3562e30144","sha1":"0fb8e32a75e1ad5e650201b4678faaccf4f08eb2","sha256":"8a3e8a2b571031ec934ac26e83c9de25dce125b063b52ab1bf466a8e9c215782","sha512":"27800dd4e1318f81cd3b0f3f8b8731972260f7cde740874e531efcf0f20ea78af0c4f9e5418b248c30cb91ab399b3aaa0f2e3b556674e3471c7eef361e82754e","ssdeep":"","tlshash":"12c08cc84cc21920c2237483c07a683631342a60917e846527bda390a073136e14cc9d","size":155,"data":"","first_seen":"2026-01-24T19:33:48.694863Z","last_seen":"2026-06-02T20:04:50.080114Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pl28018948.effectivegatecpm.com/25/6a/3c/256a3c09692e09aa10d35b8367a426e8.js","fqdn":"pl28018948.effectivegatecpm.com","domain":"effectivegatecpm.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"371ac3c00377086ab58b04d493e3a810","sha1":"5cc4d2bb1cf6388e706fab3b51c4aea8fce5d33d","sha256":"615a4b3b6c8a20700a91acf4e690ac2beba6c1cf904791942872d207677ded23","sha512":"64aedb45e10e0691758a13b70779fc3995f9466d40c07ccfe8bfa24538aa8b38ed7690ea1da98de7e42992825a24a26dad4f5b7a60ceea7658811c484ca257c3","ssdeep":"3072:EgB17aMWZ44SXdVY4lDKVVbZ4i3/9j9y1UglGewsU:EgBw194LwsU","tlshash":"7ca3c788bfd0f06d129a6473223f950ff11a4e42505ce558e907f8e66abc32af47db64","size":106829,"data":"","first_seen":"2026-01-25T04:49:59.561861Z","last_seen":"2026-01-25T04:49:59.561861Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/home.php","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"b815b8e17c168fae1fa06f202e7a6481","sha1":"47706e8f46d788f0a7122ac991277959510bce69","sha256":"2d4ad3e4fb6044ce40493cd2d87b08d271516f98491610ba1d8684298c83e0a2","sha512":"532fdc339d6e2400bcc9a0181d8a658f022294e1b108c3a85c0c25f006b1a4127f3d5c969a14fb1cb0da3d31ab0f5116b62369f30f4994123c3a850da69928ec","ssdeep":"","tlshash":"abd02b1d8903f510c0224977446dc10065749a27ac005cd53afe14144fccd1c08a7b24","size":282,"data":"","first_seen":"2026-01-24T19:33:48.67449Z","last_seen":"2026-01-25T04:49:59.602032Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/home.php","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"d947e4c34a6097ea31637dc68b36a26b","sha1":"44f9b8e64b75a9ba97539b43af638b01fe13578f","sha256":"c3b3f862b81c307c7a2f6871802b16ca7ae920dd40fd30e3ff7d6a411ac75445","sha512":"032719f88d0495495bd5429c6d5e7b25a397f6880d59a51b91dff6d4a55254c243ee56541afa867e4e5cafcd603bc352cfe4011b8ac081e56e0ee83dbbac4cca","ssdeep":"","tlshash":"14d02b5d8807f510c16349775479c10066349a1bb9009ce53afe18584fccd1c04a3b34","size":282,"data":"","first_seen":"2026-01-24T19:33:48.678609Z","last_seen":"2026-01-25T04:49:59.604423Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"594ad5036ddb5750d1ac103cc1b9e47b","sha1":"728078f2704cee07ef436e673f91b375ebe22eef","sha256":"504ae4347e8cd705305568ae6c44d215ff176403a320a0713bb7668ba255c663","sha512":"78972495a02d8868a2345822387e1d5d36a6ed13859ba9e144270a7820abe0e26889b240a897281c4439189f9f0123dc0782833127b8b2951bb291c12affe080","ssdeep":"","tlshash":"90c09bc45cc75900c2173593c175543771341661917d8465173da794d537166e15cc9d","size":137,"data":"","first_seen":"2025-08-15T03:59:43.738655Z","last_seen":"2026-06-02T20:04:50.130911Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"4d1d98552f5eeaa1f8f8ca9d22bb5f55","sha1":"4f41c009cac95cd0f25d5191af6c8bfa7d1be2bb","sha256":"205123fe931b3fe49c77cb587516fb9d48f181536c3ba10cadc6c1c319ccc933","sha512":"8c7c361a19fb627dded65ef0a5341fd442ccbb2df0cc0b35ef9c1656e5918fe2c7a5acddd50fa9adaa9801492e92e946a5148110fb38e8c1f102ca849687fa30","ssdeep":"","tlshash":"ddc02bc448c20900c3073594c275903731391a60c07d446b1e3ce3509433116d00ccde","size":146,"data":"","first_seen":"2023-10-20T01:15:51Z","last_seen":"2026-06-04T09:03:46.327229Z","times_seen":59,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"4490f9f7d7102611554188404682f919","sha1":"67def2b5a1640ecc58d73fef5c2338fc69a67652","sha256":"4377d4cfa55fe9da60b0fa0ce88b0a5140687e0a0e4cb85d7b3b0abb79b93c85","sha512":"5e89f726e16e32bbbed2b620f0c4432ee22e8031c46e5b06851abdb4bb3eb4c45e6d08704f3dd3ea3e54277986e83dab61333a7ff9b5855d863abde9ec813f5b","ssdeep":"","tlshash":"cbc02bc84cc31d20c21374c3c0baa83731343760907e846427bde390a073176e14cc9d","size":155,"data":"","first_seen":"2026-01-24T19:33:48.673702Z","last_seen":"2026-06-02T20:04:50.125169Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"9b71b3f499e0b733a9349f4d21a4c063","sha1":"69012870591e1f1f6cbc4963887371ce206c1605","sha256":"3efa6053c43a2533c8c8a84363a8d5e81c38ac32637e109beb38910781b639f1","sha512":"055d22ca1a378498ac0e880b601477a619039910df3f31e3c15fdff73b9672a4298417eadd62eb64bc1e67422afff2c4701935503468df8a36c51f511033c2b5","ssdeep":"","tlshash":"15c09bd45cc75900c2173593c175543771341661a17d8465173de7d49537127e15cc9d","size":137,"data":"","first_seen":"2025-08-15T03:59:43.701958Z","last_seen":"2026-06-02T20:04:50.096586Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/home.php","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"1e5981ae69adba9fc785d24b11148efa","sha1":"6f65257eef74ca0cb59711358b15e6da82026884","sha256":"95d0f115a5374d9de73f9e7531b835bdb1594e1e67b627e134fbd4c77e6dd795","sha512":"042584b4d39222f105bc546c9e3d9d20e21890c5cda82251e3a644129e91f5c6aefeb9b4a1f1a66f33ab1e07c9a8ac247b7444dc3b178372debc0944f24473cb","ssdeep":"","tlshash":"32d02b5d8403f600d0624977447dc20065349a176c009cd53afe14184fccd5d04a3b24","size":283,"data":"","first_seen":"2026-01-24T19:33:48.679433Z","last_seen":"2026-01-25T04:49:59.612292Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"c1967f33ab357b5637b4b8cf2c5ee680","sha1":"0af655be334f76d41e5cc8200887c04974faf7cd","sha256":"a2ada99c97fda085230b2eeeeb227ab6e7c8fec172ecb066416ec55cd33b571d","sha512":"67147390d9e225636486f0203ed404fa940c0a8755392611e54189a65ac840c179efb922d2fda13f5a1261fe280c4449b9d45beb5e42a65702119262ef8f6be8","ssdeep":"","tlshash":"02c08cc48cc31900c2633683c075643731381a22a27d846a173debd0e03323ae28ccad","size":158,"data":"","first_seen":"2025-09-18T11:49:24.675474Z","last_seen":"2026-06-02T20:04:50.154882Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"bd368389d3b5fd22a149d41fc9a98af7","sha1":"ef8917694e55ca291f5d8725e9ecc5990fe51b82","sha256":"cfe345acf6f145df611bd060c05fe6020ba3121f0bf75e6bd5a1f157fbb9cb83","sha512":"043b8ce71a96692da5541b00ded037adbac763e7b7ef3186a47bcc3edc0f7b8260071905a5b098eee2ab82855faf09023fc21ff6301424d9e5b2ddd7553b6273","ssdeep":"768:teMFz5xKXbmDy80gw95EhpZMj8RMnLnco3vgYPR9pebRSXobTb0Cmz+RQJnPWJbD:Aksbp30hpc8abvDiPN2m","tlshash":"3423e9e973dab13283ef11b650ff4646f3392894580e5428f619d8da382948d51f3fba","size":45778,"data":"","first_seen":"2026-01-14T09:24:02.735435Z","last_seen":"2026-05-04T07:02:33.715418Z","times_seen":137,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"886b9d61b8f99e3b786cd40a40a0e5b9","sha1":"d6c7fe7314be11ca895240e27c3d237b88925605","sha256":"3971c6d545b497bb7b329874589ebe0f01580ef83f5f29b96842a891e119c515","sha512":"103f44b19d9c13f3e450e8225be38e96dd46250f628bb0cc09fc4a4828c197124daf420efdf61957fc7732c2a6e930e54dc53e06c30508ad8d94987376c80e38","ssdeep":"","tlshash":"3ec08cc85cc60920c2137483c07a683631342660907e846427bda390a073136e14cc9d","size":155,"data":"","first_seen":"2026-01-24T19:33:48.67702Z","last_seen":"2026-06-02T20:04:50.095448Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"0928c4011cfce9ee4c5622aef46aef4f","sha1":"f356a9970fa100ce0651ea606da510be47190c56","sha256":"43c850d94db16600a25728819037f9340532317587e2d2bace585194fc00f3e7","sha512":"eccba35828d4f30547be5e722c9de757d4a9ab84d5d820cfe855580b257f3970bdc7ff665a99ad28f30d650ad8d65bc832d9a47c5f71aff38055fc1b61301d10","ssdeep":"","tlshash":"77c08cc85cc20920c2137483c17a683631342660907e846427bde394a073136e14cc9d","size":155,"data":"","first_seen":"2026-01-24T19:33:48.672849Z","last_seen":"2026-06-02T20:04:50.129818Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"4a31fd1f03149922fef46a7f29b681af","sha1":"1a34c88de51098d4c64fa55056dace87bfd42d07","sha256":"660b03da1e51254731a4557877b1e563a156364e399827ad884ac36960941b73","sha512":"b6bea80627f2762c96bf1d4b62eab812beb66b41eb00ac88dd48b35bf3786db055c964cdfe289f40dd64c201852894ce0ff5947c62171605c5dfddfe7827fb02","ssdeep":"","tlshash":"6cc09bc45cc75900c2173593c175543771341661917d9465173da7949533126e19cd9d","size":137,"data":"","first_seen":"2025-08-15T03:59:43.755262Z","last_seen":"2026-06-02T20:04:50.08872Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/home.php","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"b815b8e17c168fae1fa06f202e7a6481","sha1":"47706e8f46d788f0a7122ac991277959510bce69","sha256":"2d4ad3e4fb6044ce40493cd2d87b08d271516f98491610ba1d8684298c83e0a2","sha512":"532fdc339d6e2400bcc9a0181d8a658f022294e1b108c3a85c0c25f006b1a4127f3d5c969a14fb1cb0da3d31ab0f5116b62369f30f4994123c3a850da69928ec","ssdeep":"","tlshash":"abd02b1d8903f510c0224977446dc10065749a27ac005cd53afe14144fccd1c08a7b24","size":282,"data":"","first_seen":"2026-01-24T19:33:48.67449Z","last_seen":"2026-01-25T04:49:59.602032Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"6568f6d60d701ddb9fdfefa8b7485dbf","sha1":"34cfed25d061231c8f8dce81bd588fee720ad270","sha256":"2e29ed2de7d05dbe8e7fc1a10b7f024ce2a312b9a2dd303160f3f724137f67db","sha512":"34249fc7b344a667daa154f880b19c7dba649e1811b0178f30297dc453f8cdf5e88d77783a916da59e90c89fdc925540af6d82211da154f8b896168f915f48b3","ssdeep":"","tlshash":"39c02bc458c20904c30b39d0c136983f32381a60c07d486b263ce394b433016d04cced","size":149,"data":"","first_seen":"2023-07-09T01:36:23Z","last_seen":"2026-06-08T23:28:12.539845Z","times_seen":1163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"e5bb2c529d7e0892c2f67d51326c5f85","sha1":"262513d35ace05d09a1c58152d4c7477e3c4105e","sha256":"91b8cbd5e4aacdc134fcbe0c575903c3fe803f629e64cf59f706ca60d2c407b7","sha512":"271cad3bed13cc9dadecff5d4dd49a8146e7b691c141d12e8dbfdf0a4081c468e9eeeb767007a69b87a86952e772c8e89d09198dfd253e376f8852f23dbb86f4","ssdeep":"","tlshash":"57c08cc49cc31900d2273683c075653731382621a17d8469173cebd1e033236e25ccad","size":158,"data":"","first_seen":"2025-09-18T11:49:24.713095Z","last_seen":"2026-06-02T20:04:50.108632Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/home.php","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"19d65149ce4c748d9a55d2b1add6d4ee","sha1":"f243b4fa7fe7a09773cff7352072f0dd77ebe49a","sha256":"50fb8bdb1eba173868ac297cd01d1b10ae91dad4a0e38eb12c318330b9713eb7","sha512":"9e10eb90e59b716323ce988a3cd0486b5fd9eafed710f561ec961badf1117a59b8f922f7d1912ba3b19f281cd1923bf4478e01ac74b08a46ebd982b4728b196e","ssdeep":"","tlshash":"9ff02b2f51b544b60173265bd75a5355a221008b7882ed0a7e1e8f446f04ea818f4e9a","size":564,"data":"","first_seen":"2026-01-24T19:33:48.689606Z","last_seen":"2026-01-25T04:49:59.623269Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","size":85379,"data":"","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-06-09T01:08:08.197524Z","times_seen":18449,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"c6a6b3902c8e8970ff6a97ec96d79251","sha1":"4e93e02e5dcb3f55e80075e3850b8129dedac970","sha256":"af0aef6911bb609fbd698d02bedcf2c4fb0ffd5a0df64b149cfc3971a856d1b7","sha512":"3ee9eb7e3129889f2b780dfba0367d97031bbfd6892f982dabecde7fc84a8d4d2b0e1cfd592d09344a1b1589eed1dce70319186bdd07063c49d07847a7799575","ssdeep":"","tlshash":"5ec08c9088c20900c2073ec0d1364c3f232cae24c17d44672638e398847300ae18ccee","size":156,"data":"","first_seen":"2023-09-08T12:39:05Z","last_seen":"2026-06-08T23:28:12.515583Z","times_seen":2442,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"548f38b53ec922331f38d65dc5ce8586","sha1":"19a3b384b54722ef7b16464e70137417918ba19d","sha256":"e5b696740f80c8a49aacf696e2fae6c1212595210acf7ab337ad2967c1d9c723","sha512":"6664af3ad1f54a1e1aa2ef658c7b4ef3a45a69603559ae697e3802ec0dc3844e331777ed8f9fe5bdf81aae196e92ad79a91c2fca9b94dc1cbeb1e6b9fabde0eb","ssdeep":"","tlshash":"e5c08cc48ccb1900c2233693c076643731389621a17d84692b3cebd4e033236f24ccad","size":158,"data":"","first_seen":"2025-09-18T11:49:24.697087Z","last_seen":"2026-06-04T18:09:45.324061Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"9cda21d5474d8f8189f700472f4e747b","sha1":"a1f890e1e08fc2734749a64140498a20aa6deb44","sha256":"5c6d66d429b7c8399022c908f35716ab2007186b5cfe0b5e749171e620cbd7e9","sha512":"4b276f7d3883fb4090e6c01b63364e89d9cb193ee54b8e2f03cff174d1bbb4ca10c047074896132ab6f8ef0783b338ab2c659a52e655dc0648280d5f4b717841","ssdeep":"","tlshash":"41c08cc48cc36900c2233683c0b5647731381622a17d8469173cebd0e037236e24ccad","size":158,"data":"","first_seen":"2025-09-18T11:49:24.706941Z","last_seen":"2026-06-02T20:04:50.079391Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"281af4772e718ef27f3ca6c22635fc61","sha1":"8749642e2d45915a50dec2a39b849e6807038385","sha256":"a19f8b73ad545dfd1e6ac85561bf07b0e91c956474771450199cbdcc2aa2dcfd","sha512":"2888e3cd0757ca068b93713c6c5796c6c25ba35fafe552a22f26a96a6d6efdcfdcf697c0f1ec0e625a4a26beff0ab3d4405a872337b7ea40143703bd16d1c419","ssdeep":"","tlshash":"ebc08cc84cc22920c2137483c07a68363134276090be846427bda390a073136e18cc9d","size":155,"data":"","first_seen":"2026-01-24T19:33:48.677899Z","last_seen":"2026-06-02T20:04:50.133081Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"d480a2ef4b36d42fdfc4df1009300923","sha1":"d3be9c3ea727c45b87291c1595149e981530cadc","sha256":"5e74d3be763811a9d7ac6b886c0d2390d99e5f453b0e392fa8393b9d2bbdcf5e","sha512":"1edcbbbde51641dc7bccec4abc5355fbba71128ea922b0677872d6ee500f19df8dd53ca371d4ea75dd9bf399003223cd2e039ce028df64a9d29fd26e8e604867","ssdeep":"","tlshash":"30c09bc45cc76900c2173593c17554377134276191bd8465273da794a533126e19cc9d","size":137,"data":"","first_seen":"2025-09-18T11:49:24.705693Z","last_seen":"2026-06-02T20:04:50.109604Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"AsyncFunction","is_inline":false,"md5":"1ea529093f3b09247e326b1fa1fb7933","sha1":"38ee0ad8357062413403b1210765c73bdede5cbe","sha256":"f3f1d479809e595106641f1dfb28de7c5e1c673c5a71a44a8cca1a9c040ae64f","sha512":"f50e383f8ae69fc4995e762a03d6294397e650d3d0f153bed068d343956ca38fd53c64531a530beb328b0d95429814b62ca0975c19ac1571225b4965f821fb34","ssdeep":"","tlshash":"c9c08cc48cc32900c2233683c0756437713c2a21a1bd8469273cebd0e033236e28ccad","size":158,"data":"","first_seen":"2025-09-18T11:49:24.673924Z","last_seen":"2026-06-02T20:04:50.131497Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/lucide@latest/dist/umd/lucide.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c338c6af0827b163067c61202bf95e47","sha1":"5a4dc0bf01e30e44feeb98c513a8bf7059d9c179","sha256":"21748e5d685380e0ec3abdd314614d1f602869d4cb8eac02b526379073782524","sha512":"7604cdcf081fea858ca4fb7d53fae3e0fb09ee0e090276666df5d253ad2b52513414bcdf3b566aa29d5b017e1a38af51437b08236e86aef09d70923b42718e34","ssdeep":"3072:SEO9csk9tp02jr+KdJothTafDHEB7swQYYqa9mIgb/77GLP4IL+gB2bOI+GjimJE:vGEJfGQOVn3Lb//b6ZLqS3yyxfqL1di","tlshash":"e7c42325cade2d5e1a127658062eb4470f7840b7394b7c307dbc4b2acf6e01ade275ad","size":580994,"data":"","first_seen":"2026-01-24T15:21:27.519496Z","last_seen":"2026-02-09T19:56:51.054314Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"425ee18238006a833ea6857e45b8461f","sha1":"7a37bc09b9b88cc1693fbf5fa4f2a38d83e51f70","sha256":"dcd8fd0a496b609809886c37a13a44b1d26056c23cc0e55b3f6c0fb0fab03e55","sha512":"89625b7ec2a233212de457f2b1b0f9f1af01b7ee3995420c56086abb89a4ec93ac63f141882c3582871a2fcc72b7030d0c9925452c74b0a99aface8163ca3ff4","ssdeep":"","tlshash":"3bb01209ce06c402c1000ad580abc50869107310c530ccc982f94465928699c1c4b304","size":97,"data":"","first_seen":"2026-01-24T19:33:48.696533Z","last_seen":"2026-01-25T04:49:59.632282Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"98f7744d0a211339328b9fb275dcbfc0","sha1":"20a24534c6eeebbd802f922f450ebc34e099ebcc","sha256":"6020c56d7d39466bfc15c49b4aad4c708ddc07a954b81febfd684235c77ef3e3","sha512":"b9a778d0bf274124cd1b8c7cc87c63cc1116079572f6f58d41ebeaba0e03e32b550769963600ae63cf81c37c1e6ab1b378ab39ac4aff3c73a90ca4647e3082e8","ssdeep":"","tlshash":"3db01209cd0ac405c10006d580abc50459046310d220cdc982f954a9a29a9981c47304","size":97,"data":"","first_seen":"2026-01-24T19:33:48.698463Z","last_seen":"2026-01-25T04:49:59.634163Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"4394e15afb2bf8127e283df521972bff","sha1":"0bc6b9d62613ac4d1b2daa8eb90f6b5e4fe575fc","sha256":"e3317c0bae721d368070fa34ec99d2f7d7b329fb54a4942023b5b23389b72f74","sha512":"377e4583c1514e151acbd75dea488b0f179b3c0d6252296434fc4135305cf175cba5799b4f5316b1c97b6414d48f3c483243b7967be6d440ce2ebab53527b9b2","ssdeep":"","tlshash":"79b01209cd06c401c10006d580afc50459047310c120ccc982f95469a2d69d81c47304","size":97,"data":"","first_seen":"2026-01-24T19:33:48.700164Z","last_seen":"2026-01-25T04:49:59.635936Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/home.php","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-25T04:49:36.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safevpnapp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 12:37:42 GMT","end":"Sat, 04 Apr 2026 12:37:41 GMT"},"fingerprint":{"sha1":"4B:BA:3C:0B:0D:1C:89:95:1B:4D:E1:78:2A:65:74:2D:E5:B3:6D:E2","sha256":"68:84:1F:80:D3:14:4B:B3:C8:C8:2D:01:8B:84:65:02:08:0A:4B:B8:6F:74:26:FA:8D:87:60:C6:B2:A4:BC:D9"}}},"request":{"raw":"GET /home.php HTTP/1.1\r\nHost: www.rewardhub.safevpnapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=bdc76365a051738d86efe3149d877eaa\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 25 Jan 2026 04:49:36 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alpine.js","description":"","website":"https://github.com/alpinejs/alpine","common_platform_enumeration":"","icon":"Alpine.js.png","categories":["JavaScript frameworks"]},{"name":"Unpkg","description":"Unpkg is a content delivery network for everything on npm.","website":"https://unpkg.com","common_platform_enumeration":"","icon":"Unpkg.png","categories":["CDN"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":53597,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"d35d718363daa51f7a36f657565266c9","sha1":"c8ff126a503a5965020778a7b5988af6e93af1c6","sha256":"bb139db0e5c2d3aa20725aadb83f0f71fd949a07885f127cc9de3df713e96bb3","sha512":"fa49801ef66f9ec75f3da22d48cad9d6f1c176da552e0ace06eafed2d7f7f5cb3838fe1dbb6a88bc7b33a25f3dc173f380798258cae35d53e55e566af0dde49b","ssdeep":"768:/5CLRBrkPfrXRnkPfr9dO6Q00i+e/rfl2TMQoMJqLmDEBYPx:/a46Q0rfl2TMQoc","tlshash":"7233007c32f115b741d3c5f2b9b12f2aaea9d94bca2f8946b2ac46c11fc7c059d43294","first_seen":"2026-01-24T19:33:48.667829Z","last_seen":"2026-01-25T04:49:59.547843Z","times_seen":2,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:37.328Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"preferencenail.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 23:36:36 GMT","end":"Sat, 28 Mar 2026 23:36:35 GMT"},"fingerprint":{"sha1":"0E:EE:1D:ED:80:5A:CA:0C:1E:93:89:94:78:B7:34:91:38:D4:89:51","sha256":"CF:77:1B:FB:04:67:32:02:DF:D9:38:24:27:3D:A5:98:54:0C:4D:BA:C5:1B:62:FD:C1:E1:17:57:6F:63:B3:BF"}}},"request":{"raw":"GET /sfp.js HTTP/1.1\r\nHost: preferencenail.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Sun, 25 Jan 2026 04:49:37 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 32181\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nP3P: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\nAccess-Control-Allow-Origin: *\r\nVary: Accept-Encoding\r\nHost: preferencenail.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 262134820bbca770baf49267a1a244ef\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85379,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators","md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-06-09T01:08:08.197524Z","times_seen":18449,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":57,"dns":0,"connect":17,"send":0,"wait":21,"receive":18,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/assets/img/logo.png","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:39.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safevpnapp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 12:37:42 GMT","end":"Sat, 04 Apr 2026 12:37:41 GMT"},"fingerprint":{"sha1":"4B:BA:3C:0B:0D:1C:89:95:1B:4D:E1:78:2A:65:74:2D:E5:B3:6D:E2","sha256":"68:84:1F:80:D3:14:4B:B3:C8:C8:2D:01:8B:84:65:02:08:0A:4B:B8:6F:74:26:FA:8D:87:60:C6:B2:A4:BC:D9"}}},"request":{"raw":"GET /assets/img/logo.png HTTP/1.1\r\nHost: www.rewardhub.safevpnapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/home.php\r\nCookie: PHPSESSID=bdc76365a051738d86efe3149d877eaa; dom3ic8zudi28v8lr6fgphwffqoz0j6c=4a81517c-ea73-4391-a8e9-8d148faecac4%3A3%3A1; pp_main_256a3c09692e09aa10d35b8367a426e8=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Mon, 25 Jan 2027 04:49:39 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 05 Nov 2025 19:32:34 GMT\r\naccept-ranges: bytes\r\ncontent-length: 32868\r\ndate: Sun, 25 Jan 2026 04:49:39 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":32868,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit colormap, non-interlaced","md5":"2b1b4a56925db51a57bcf42286558c94","sha1":"48c430040d4c6b8c54218141b77fc8e0e8cc513b","sha256":"4901969c00849db5ac38476ad0b1a2d63994841baace9ee7501a31bb1d4a6a8a","sha512":"173d982b648926c6d533c57954b97dbb3f04063fa843153866562828b3134764ba7ccd50cdf9365512275b143b307407def40f9738b2a50f8d063bf8276d1825","ssdeep":"768:MPGTAEUi0NSJeeV8O12SQgLLA1SCN/B+JA+P8fX/:wWIigSJYOgSrlCRB+JAY8fX/","tlshash":"5de2e11086ba4768c5223030b4865df68b689b00d3cc9976b33d5299c3b78a5f53dfb6","first_seen":"2026-01-24T19:33:48.66413Z","last_seen":"2026-01-25T04:49:59.552435Z","times_seen":2,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":278,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa25L7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:38.565Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa25L7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.rewardhub.safevpnapp.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 84924\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 24 Jan 2026 10:49:12 GMT\r\nexpires: Sun, 24 Jan 2027 10:49:12 GMT\r\ncache-control: public, max-age=31536000\r\nage: 64826\r\nlast-modified: Tue, 09 Sep 2025 18:33:55 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":84924,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 84924, version 1.0","md5":"f5b588b5cfef2173838149769c8a0269","sha1":"5312086a01f8e8299094ddee5819b9727a19cae2","sha256":"b8811a6cd6f7e0707dfc9e9e6f1daf5f6f450b51e887e163945a9ade91c2720f","sha512":"05d5271c633bbe102775c0b6df9c5e110dae3a2517061714bb5c26ec66a00f8e1b62961135ec96962e7ccaf3942d8e32bd86f42558cbac8ee16ff6c333117886","ssdeep":"1536:PABWz4rSN/GzH27xN5UR1OnX+uyRsd1osLZBi/JGyQI01xDj+C:PAG4rCGa7L5UR1OnX+fGd/VB03QI+xP","tlshash":"378302b4ae71b3968f1c7fe46396273c2a7bdf41053950aeae44e16787f00dba148784","first_seen":"2025-05-29T19:39:57.235915Z","last_seen":"2026-06-09T01:26:39.628335Z","times_seen":15667,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":9,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:37.084Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"GET /css2?family=Inter:wght@300;400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 25 Jan 2026 04:49:37 GMT\r\ndate: Sun, 25 Jan 2026 04:49:37 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12635,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"f04de8ad1ef740d940ec0f534a8f6474","sha1":"3b31756e84c8887867417c7d6cc64501c9d9193c","sha256":"2f1ac0c31bc3ede8317cf72e9d28051ec727c9a0014aa69cff495abd6256bb4e","sha512":"69afede137c125294044274e463f30c02594f379ec879285e0b3ee41097f503dfb8272487759870f547e4dc4cf8828a2c1efaa806deb2f3124b7f6d67c638783","ssdeep":"192:wNA1cO3lnxirNNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:8KYXuM0p2+4","tlshash":"28427892002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:44:19.218006Z","last_seen":"2026-06-09T00:30:23.485893Z","times_seen":24132,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":89,"dns":0,"connect":20,"send":0,"wait":31,"receive":0,"ssl":66},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:37.347Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.rewardhub.safevpnapp.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 24 Jan 2026 18:23:05 GMT\r\nexpires: Sun, 24 Jan 2027 18:23:05 GMT\r\ncache-control: public, max-age=31536000\r\nage: 37592\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-06-09T01:17:26.69154Z","times_seen":206550,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":56,"dns":1,"connect":7,"send":0,"wait":9,"receive":11,"ssl":45},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:37.354Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.rewardhub.safevpnapp.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 24 Jan 2026 18:23:05 GMT\r\nexpires: Sun, 24 Jan 2027 18:23:05 GMT\r\ncache-control: public, max-age=31536000\r\nage: 37592\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-06-09T01:17:26.69154Z","times_seen":206550,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":63,"dns":0,"connect":24,"send":0,"wait":12,"receive":5,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"weirdopt.com/ad/advertisers.js","fqdn":"weirdopt.com","domain":"weirdopt.com","tld":"com"},"ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:39.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"weirdopt.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Dec 2025 00:51:40 GMT","end":"Sun, 29 Mar 2026 00:51:39 GMT"},"fingerprint":{"sha1":"F3:CE:FF:C9:F8:70:23:18:40:13:70:96:1A:D1:FD:34:D3:CD:66:FC","sha256":"07:8C:A3:3F:1D:F1:E0:75:3D:26:20:F5:D5:75:64:CE:F7:40:6E:B7:BB:B9:EC:79:33:27:5F:51:2E:B0:12:E7"}}},"request":{"raw":"GET /ad/advertisers.js HTTP/1.1\r\nHost: weirdopt.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Sun, 25 Jan 2026 04:49:39 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 0\r\nConnection: keep-alive\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 2d7456d0dcb8e8c0bb5116626b7ef3e9\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-09T01:17:26.71202Z","times_seen":16255444,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":59,"dns":0,"connect":17,"send":0,"wait":17,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pl28018948.effectivegatecpm.com/25/6a/3c/256a3c09692e09aa10d35b8367a426e8.js","fqdn":"pl28018948.effectivegatecpm.com","domain":"effectivegatecpm.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:36.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"effectivegatecpm.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Dec 2025 21:45:50 GMT","end":"Fri, 06 Mar 2026 21:45:49 GMT"},"fingerprint":{"sha1":"4D:1C:0D:DB:A3:77:74:26:85:B0:AD:E4:B7:D6:63:03:F7:70:5B:C1","sha256":"9A:F3:3F:D6:D1:0C:71:F9:29:9F:CD:B5:C6:5A:D8:DC:57:BB:69:1F:2D:12:B6:B9:74:23:CD:5A:2A:D3:FB:BE"}}},"request":{"raw":"GET /25/6a/3c/256a3c09692e09aa10d35b8367a426e8.js HTTP/1.1\r\nHost: pl28018948.effectivegatecpm.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Sun, 25 Jan 2026 04:49:37 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 38053\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 8\r\nHost: pl28018948.effectivegatecpm.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 3f5ac7bf61aa8cfdc5ce04a1f4e494cb\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":106829,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"371ac3c00377086ab58b04d493e3a810","sha1":"5cc4d2bb1cf6388e706fab3b51c4aea8fce5d33d","sha256":"615a4b3b6c8a20700a91acf4e690ac2beba6c1cf904791942872d207677ded23","sha512":"64aedb45e10e0691758a13b70779fc3995f9466d40c07ccfe8bfa24538aa8b38ed7690ea1da98de7e42992825a24a26dad4f5b7a60ceea7658811c484ca257c3","ssdeep":"3072:EgB17aMWZ44SXdVY4lDKVVbZ4i3/9j9y1UglGewsU:EgBw194LwsU","tlshash":"7ca3c788bfd0f06d129a6473223f950ff11a4e42505ce558e907f8e66abc32af47db64","first_seen":"2026-01-25T04:49:59.561861Z","last_seen":"2026-01-25T04:49:59.561861Z","times_seen":1,"resource_available":true,"data":null}},"time_used":831,"timings":{"blocked":309,"dns":40,"connect":91,"send":0,"wait":113,"receive":92,"ssl":184},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"pl28018948.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"pl28018948.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"pl28018948.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/assets/img/logo.png","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:36.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safevpnapp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 12:37:42 GMT","end":"Sat, 04 Apr 2026 12:37:41 GMT"},"fingerprint":{"sha1":"4B:BA:3C:0B:0D:1C:89:95:1B:4D:E1:78:2A:65:74:2D:E5:B3:6D:E2","sha256":"68:84:1F:80:D3:14:4B:B3:C8:C8:2D:01:8B:84:65:02:08:0A:4B:B8:6F:74:26:FA:8D:87:60:C6:B2:A4:BC:D9"}}},"request":{"raw":"GET /assets/img/logo.png HTTP/1.1\r\nHost: www.rewardhub.safevpnapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/home.php\r\nCookie: PHPSESSID=bdc76365a051738d86efe3149d877eaa\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Mon, 25 Jan 2027 04:49:36 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 05 Nov 2025 19:32:34 GMT\r\naccept-ranges: bytes\r\ncontent-length: 32868\r\ndate: Sun, 25 Jan 2026 04:49:36 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":32868,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit colormap, non-interlaced","md5":"2b1b4a56925db51a57bcf42286558c94","sha1":"48c430040d4c6b8c54218141b77fc8e0e8cc513b","sha256":"4901969c00849db5ac38476ad0b1a2d63994841baace9ee7501a31bb1d4a6a8a","sha512":"173d982b648926c6d533c57954b97dbb3f04063fa843153866562828b3134764ba7ccd50cdf9365512275b143b307407def40f9738b2a50f8d063bf8276d1825","ssdeep":"768:MPGTAEUi0NSJeeV8O12SQgLLA1SCN/B+JA+P8fX/:wWIigSJYOgSrlCRB+JAY8fX/","tlshash":"5de2e11086ba4768c5223030b4865df68b689b00d3cc9976b33d5299c3b78a5f53dfb6","first_seen":"2026-01-24T19:33:48.66413Z","last_seen":"2026-01-25T04:49:59.552435Z","times_seen":2,"resource_available":false,"data":null}},"time_used":602,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":316,"receive":286,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/lucide@0.563.0/dist/umd/lucide.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:37.036Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Dec 2025 07:56:49 GMT","end":"Sat, 21 Mar 2026 08:56:47 GMT"},"fingerprint":{"sha1":"26:50:C2:17:0A:FF:C4:D7:84:D7:E7:28:A7:58:4B:CD:0A:7B:2A:79","sha256":"93:15:E6:80:68:21:48:A6:B0:14:8D:F2:4E:A3:50:33:6C:01:5B:84:8D:F6:75:2E:09:A4:79:DD:37:13:FA:B0"}}},"request":{"raw":"GET /lucide@0.563.0/dist/umd/lucide.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 25 Jan 2026 04:49:37 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-encoding: gzip\r\ncf-ray: 9c35251e7df55687-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\nage: 151362\r\ncache-control: public, max-age=31536000\r\nexpires: Mon, 25 Jan 2027 04:49:37 GMT\r\nlast-modified: Fri, 23 Jan 2026 10:45:23 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nvia: 1.1 fly.io, 1.1 fly.io\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-expose-headers: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncontent-digest: sha256=:IXSOXWhTgODsOr3TFGFNH2AoadTLjqwCtSY3kHN4JSQ=:\r\nfly-request-id: 01KFN7AVEZ980WKFKB4K42XR8W-fra\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":580994,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"c338c6af0827b163067c61202bf95e47","sha1":"5a4dc0bf01e30e44feeb98c513a8bf7059d9c179","sha256":"21748e5d685380e0ec3abdd314614d1f602869d4cb8eac02b526379073782524","sha512":"7604cdcf081fea858ca4fb7d53fae3e0fb09ee0e090276666df5d253ad2b52513414bcdf3b566aa29d5b017e1a38af51437b08236e86aef09d70923b42718e34","ssdeep":"3072:SEO9csk9tp02jr+KdJothTafDHEB7swQYYqa9mIgb/77GLP4IL+gB2bOI+GjimJE:vGEJfGQOVn3Lb//b6ZLqS3yyxfqL1di","tlshash":"e7c42325cade2d5e1a127658062eb4470f7840b7394b7c307dbc4b2acf6e01ade275ad","first_seen":"2026-01-24T15:21:27.519496Z","last_seen":"2026-02-09T19:56:51.054314Z","times_seen":23,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"realizationnewestfangs.com/pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=2674\u0026rd=2674\u0026fd=546\u0026bv=25.12.4806\u0026tmpl=70","fqdn":"realizationnewestfangs.com","domain":"realizationnewestfangs.com","tld":"com"},"ip":{"addr":"172.240.127.234","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:37.326Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"realizationnewestfangs.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 23:46:27 GMT","end":"Sat, 28 Mar 2026 23:46:26 GMT"},"fingerprint":{"sha1":"14:D8:A4:21:72:37:E4:C0:CE:53:5D:C0:99:88:BB:F5:AB:09:9F:77","sha256":"E0:A6:B2:57:A8:ED:75:A3:DB:37:93:9B:8F:60:2D:A9:97:B8:E8:E5:77:A2:C7:8E:B2:CF:E2:E9:F7:6A:43:C7"}}},"request":{"raw":"GET /pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=2674\u0026rd=2674\u0026fd=546\u0026bv=25.12.4806\u0026tmpl=70 HTTP/1.1\r\nHost: realizationnewestfangs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Sun, 25 Jan 2026 04:49:37 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nHost: realizationnewestfangs.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-09T01:17:26.71202Z","times_seen":16255444,"resource_available":true,"data":null}},"time_used":683,"timings":{"blocked":294,"dns":14,"connect":92,"send":0,"wait":94,"receive":0,"ssl":187},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flushpersist.com/pxf.gif?uuid=4a81517c-ea73-4391-a8e9-8d148faecac4\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=256a3c09692e09aa10d35b8367a426e8\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=4","fqdn":"flushpersist.com","domain":"flushpersist.com","tld":"com"},"ip":{"addr":"172.240.127.234","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:39.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"flushpersist.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 22:13:33 GMT","end":"Sat, 28 Mar 2026 22:13:32 GMT"},"fingerprint":{"sha1":"A3:08:82:4A:9A:ED:6E:4C:29:FC:10:0D:1D:8F:8B:68:0E:D0:49:72","sha256":"B4:01:36:5D:F9:70:75:BF:F6:56:67:76:BB:CC:A2:D3:BA:69:61:33:56:FC:C7:21:69:6E:04:BE:95:D7:B2:F5"}}},"request":{"raw":"GET /pxf.gif?uuid=4a81517c-ea73-4391-a8e9-8d148faecac4\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=256a3c09692e09aa10d35b8367a426e8\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=4 HTTP/1.1\r\nHost: flushpersist.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Sun, 25 Jan 2026 04:49:39 GMT\r\nContent-Type: image/gif\r\nContent-Length: 1\r\nConnection: keep-alive\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\nx-envoy-upstream-service-time: 1\r\nHost: flushpersist.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: a2bcce9f6f294fc6d78fb877f94dc360\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-09T01:17:26.71202Z","times_seen":16255444,"resource_available":true,"data":null}},"time_used":673,"timings":{"blocked":289,"dns":0,"connect":93,"send":0,"wait":95,"receive":0,"ssl":193},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-25","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.15.4/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:36.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Dec 2025 07:56:49 GMT","end":"Sat, 21 Mar 2026 08:56:47 GMT"},"fingerprint":{"sha1":"26:50:C2:17:0A:FF:C4:D7:84:D7:E7:28:A7:58:4B:CD:0A:7B:2A:79","sha256":"93:15:E6:80:68:21:48:A6:B0:14:8D:F2:4E:A3:50:33:6C:01:5B:84:8D:F6:75:2E:09:A4:79:DD:37:13:FA:B0"}}},"request":{"raw":"GET /alpinejs@3.15.4/dist/cdn.min.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 25 Jan 2026 04:49:36 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-encoding: gzip\r\ncf-ray: 9c35251d1f020b31-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\nage: 114894\r\ncache-control: public, max-age=31536000\r\nexpires: Mon, 25 Jan 2027 04:49:36 GMT\r\nlast-modified: Tue, 13 Jan 2026 21:43:58 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nvia: 1.1 fly.io, 1.1 fly.io\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-expose-headers: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncontent-digest: sha256=:z+NFrPbxRd9hG9BgwF/mAgujEh8L915r1aHxV/u5y4M=:\r\nfly-request-id: 01KEWN179TQWHEFQ49G4V93PZC-arn\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]}],"data":{"size":45778,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (40549)","md5":"bd368389d3b5fd22a149d41fc9a98af7","sha1":"ef8917694e55ca291f5d8725e9ecc5990fe51b82","sha256":"cfe345acf6f145df611bd060c05fe6020ba3121f0bf75e6bd5a1f157fbb9cb83","sha512":"043b8ce71a96692da5541b00ded037adbac763e7b7ef3186a47bcc3edc0f7b8260071905a5b098eee2ab82855faf09023fc21ff6301424d9e5b2ddd7553b6273","ssdeep":"768:teMFz5xKXbmDy80gw95EhpZMj8RMnLnco3vgYPR9pebRSXobTb0Cmz+RQJnPWJbD:Aksbp30hpc8abvDiPN2m","tlshash":"3423e9e973dab13283ef11b650ff4646f3392894580e5428f619d8da382948d51f3fba","first_seen":"2026-01-14T09:24:02.735435Z","last_seen":"2026-05-04T07:02:33.715418Z","times_seen":137,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"protrafficinspector.com/stats","fqdn":"protrafficinspector.com","domain":"protrafficinspector.com","tld":"com"},"ip":{"addr":"63.178.76.99","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:37.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"traffinspector.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 19 Nov 2025 00:00:00 GMT","end":"Fri, 18 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"11:9F:BE:35:27:7B:7B:85:C9:B3:FF:0E:CA:F6:0D:13:B0:A9:A0:BB","sha256":"81:A4:38:32:0D:BC:66:C8:7B:6D:08:BC:93:91:76:73:A2:BD:D0:53:3C:BF:2F:FD:B8:87:00:C6:EC:3B:6C:77"}}},"request":{"raw":"GET /stats HTTP/1.1\r\nHost: protrafficinspector.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.rewardhub.safevpnapp.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 25 Jan 2026 04:49:37 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 40\r\nserver: fasthttp\r\naccess-control-allow-origin: https://www.rewardhub.safevpnapp.com\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\nset-cookie: uid_id2=4a81517c-ea73-4391-a8e9-8d148faecac4:3:1; expires=Wed, 23 Jan 2036 04:49:37 GMT; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"d8f5c80b1c7be8936e7305104f47aa38","sha1":"1121f7bde5f7b7e432b269b87e1c893bba51a046","sha256":"50c89193aab00d017d3111e91df899bb9b302db2dbba20b50eb77aaf9848e969","sha512":"cadb50b06e90a15132f189fffed2c460c77f82a90e714d49c2517d14bf8fcb8b495e30e610697023729460c6c2f88f7e572d71f1b5623c8024e6148fb24107aa","ssdeep":"","tlshash":"ef900403d03d10553d41775d1d43134dc0f3515c4350d00543005740c44003c4334517","first_seen":"2026-01-25T04:49:59.588318Z","last_seen":"2026-01-25T04:49:59.588318Z","times_seen":1,"resource_available":false,"data":null}},"time_used":522,"timings":{"blocked":250,"dns":21,"connect":21,"send":0,"wait":21,"receive":0,"ssl":207},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:39.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.rewardhub.safevpnapp.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 24 Jan 2026 18:23:05 GMT\r\nexpires: Sun, 24 Jan 2027 18:23:05 GMT\r\ncache-control: public, max-age=31536000\r\nage: 37594\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-06-09T01:17:26.69154Z","times_seen":206550,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/assets/css/output.css","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:36.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safevpnapp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 12:37:42 GMT","end":"Sat, 04 Apr 2026 12:37:41 GMT"},"fingerprint":{"sha1":"4B:BA:3C:0B:0D:1C:89:95:1B:4D:E1:78:2A:65:74:2D:E5:B3:6D:E2","sha256":"68:84:1F:80:D3:14:4B:B3:C8:C8:2D:01:8B:84:65:02:08:0A:4B:B8:6F:74:26:FA:8D:87:60:C6:B2:A4:BC:D9"}}},"request":{"raw":"GET /assets/css/output.css HTTP/1.1\r\nHost: www.rewardhub.safevpnapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/home.php\r\nCookie: PHPSESSID=bdc76365a051738d86efe3149d877eaa\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Tue, 24 Feb 2026 04:49:36 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 12 Nov 2025 15:43:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 19546\r\ndate: Sun, 25 Jan 2026 04:49:36 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":153839,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (418)","md5":"40bc0db3e8b7bc7af9636de2b60834e5","sha1":"9f0e07a13e5c71e2f0df1e05515036420614a130","sha256":"60e1ffb8387eb506028491d75a15473c4c0f649bdbe3ce3183291a34e71a07d6","sha512":"9f01cbbbc2b65836aca7227033ec7feec380295a9b547e4a6a5ff3b66cb0407290d9c3a914a1970a9d709420867b060828ef0a6d92d63d141dae9ac3705a8db4","ssdeep":"768:4Zfn135J3pyf70WSzT8Y4Yz8TJtBebUVqWIeGtKlPBsf:wfn135JbTgYzSjGtKlPBsf","tlshash":"98e333745af088327c6ea0f5a24ef15ceb3fa0c8ce2e8aa9add510146bd53f55c96d40","first_seen":"2026-01-24T19:33:48.661287Z","last_seen":"2026-01-25T04:49:59.590737Z","times_seen":2,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.rewardhub.safevpnapp.com/","fqdn":"www.rewardhub.safevpnapp.com","domain":"safevpnapp.com","tld":"com"},"ip":{"addr":"139.99.61.249","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-25T04:49:34.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.safevpnapp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 12:37:42 GMT","end":"Sat, 04 Apr 2026 12:37:41 GMT"},"fingerprint":{"sha1":"4B:BA:3C:0B:0D:1C:89:95:1B:4D:E1:78:2A:65:74:2D:E5:B3:6D:E2","sha256":"68:84:1F:80:D3:14:4B:B3:C8:C8:2D:01:8B:84:65:02:08:0A:4B:B8:6F:74:26:FA:8D:87:60:C6:B2:A4:BC:D9"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.rewardhub.safevpnapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nset-cookie: PHPSESSID=bdc76365a051738d86efe3149d877eaa; path=/; secure\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\nlocation: /home.php\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Sun, 25 Jan 2026 04:49:36 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":53597,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-09T01:17:26.71202Z","times_seen":16255444,"resource_available":true,"data":null}},"time_used":2902,"timings":{"blocked":1265,"dns":714,"connect":271,"send":0,"wait":367,"receive":0,"ssl":281},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/alpinejs@3.x.x/dist/cdn.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:36.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Dec 2025 07:56:49 GMT","end":"Sat, 21 Mar 2026 08:56:47 GMT"},"fingerprint":{"sha1":"26:50:C2:17:0A:FF:C4:D7:84:D7:E7:28:A7:58:4B:CD:0A:7B:2A:79","sha256":"93:15:E6:80:68:21:48:A6:B0:14:8D:F2:4E:A3:50:33:6C:01:5B:84:8D:F6:75:2E:09:A4:79:DD:37:13:FA:B0"}}},"request":{"raw":"GET /alpinejs@3.x.x/dist/cdn.min.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Sun, 25 Jan 2026 04:49:36 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 47\r\ncf-ray: 9c35251ceefe0b31-OSL\r\nlocation: /alpinejs@3.15.4/dist/cdn.min.js\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=60, s-maxage=300\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45778,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-09T01:17:26.71202Z","times_seen":16255444,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":13,"dns":1,"connect":1,"send":0,"wait":30,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/lucide@latest/dist/umd/lucide.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.1.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:36.770Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Dec 2025 07:56:49 GMT","end":"Sat, 21 Mar 2026 08:56:47 GMT"},"fingerprint":{"sha1":"26:50:C2:17:0A:FF:C4:D7:84:D7:E7:28:A7:58:4B:CD:0A:7B:2A:79","sha256":"93:15:E6:80:68:21:48:A6:B0:14:8D:F2:4E:A3:50:33:6C:01:5B:84:8D:F6:75:2E:09:A4:79:DD:37:13:FA:B0"}}},"request":{"raw":"GET /lucide@latest/dist/umd/lucide.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.rewardhub.safevpnapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Sun, 25 Jan 2026 04:49:37 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 49\r\ncf-ray: 9c35251ceefd0b31-OSL\r\nlocation: /lucide@0.563.0/dist/umd/lucide.js\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=60, s-maxage=300\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":580994,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-09T01:17:26.71202Z","times_seen":16255444,"resource_available":true,"data":null}},"time_used":280,"timings":{"blocked":11,"dns":1,"connect":1,"send":0,"wait":251,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.rewardhub.safevpnapp.com/home.php","date":"2026-01-25T04:49:37.352Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.rewardhub.safevpnapp.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 24 Jan 2026 18:23:05 GMT\r\nexpires: Sun, 24 Jan 2027 18:23:05 GMT\r\ncache-control: public, max-age=31536000\r\nage: 37592\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-06-09T01:17:26.69154Z","times_seen":206550,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":59,"dns":0,"connect":25,"send":0,"wait":11,"receive":6,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}