{"report_id":"a9e1ff2e-6f63-4301-ac6c-dfb7692eeda9","version":0,"status":"done","tags":[],"date":"2026-10-15T16:15:33Z","url":{"schema":"http","addr":"xn--pay-bitefill-ljc.com/","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":0,"asn":214351,"as":"Femo It Solutions Limited","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"title":"Bitrefill Checkout","dom":{"size":11534,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (9860)","md5":"cc4d483d2d829ced153df38a663c3d08","sha1":"99686e904b3b073ce78939b829310e1cbf9611cd","sha256":"10a58a49f1f84fcd9bb6378c9a3258eb40fd0de288afd1caf822b891fb4c2fdf","sha512":"95e200cbec81ef079f3ce6d4c3bcfedcbc07605d335587ef95f016c47f3d05d0ed6b7d5fb53d7d016a50059f1690faf880f9c227a6072704ab228df0306b8b85","ssdeep":"192:yN5WnCu4EK4qWS2CXDQnnbVmp8qrZCBMr5u775yRiXbcigI7PZr:yznExqWS1gV08q0BJZykgigI7PZr","tlshash":"5632d8bd140141ab5627c9bf9b50fe5cb005a34acf559a09faf99216fac3eeb48c443c","dom_hash":"domhash3947585979b9772c57afcae25daca4b0","first_seen":"2026-10-15T16:00:44.074779Z","last_seen":"2026-10-15T16:15:49.987493Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"xn--pay-bitefill-ljc.com/","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":0,"asn":214351,"as":"Femo It Solutions Limited","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-19T16:15:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-10-11T22:46:23.68047Z","alert_count":0,"request_count":4,"received_data":197380,"sent_data":2332,"comment":"","tags":null,"fingerprints":null},{"fqdn":"eu-assets.i.posthog.com","ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-01-23","domain_rank":169009,"first_seen":"2024-02-28T08:06:29Z","last_seen":"2026-10-10T20:15:27.375054Z","alert_count":0,"request_count":6,"received_data":708285,"sent_data":3048,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"eu.i.posthog.com","ip":{"addr":"3.40.5.182","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2020-01-23","domain_rank":102660,"first_seen":"2024-02-20T15:34:02Z","last_seen":"2026-10-10T01:09:25.865016Z","alert_count":0,"request_count":2,"received_data":866,"sent_data":974,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-10-11T22:47:21.405407Z","alert_count":0,"request_count":1,"received_data":10792,"sent_data":540,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"xn--pay-bitefill-ljc.com","ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"domain_registered":"2026-09-20","domain_rank":0,"first_seen":"2026-10-15T16:00:38.302892Z","last_seen":"2026-10-15T16:00:38.302892Z","alert_count":9,"request_count":9,"received_data":630106,"sent_data":4309,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.11/dead-clicks-autocapture.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"577c388f3cdbf2dd61ed0381bbf43f14","sha1":"15442a21e3cc3f8da6d1fb44a69c9fec608e7f23","sha256":"1d0b2faf5145fc6c24e30287e186741dee00d1fedc75c1d063e3cd874b5b0b03","sha512":"fa0fcad8739b975e893234697c0239dc2e3515be06bf43af398ee4289fc7e7f18df5c84e596a7cb5e2fb3e586955bd14d73dfabf987dcb73a00212c6005b0e6a","ssdeep":"384:J6v6HNqqkoOVy0EEg2pykwEMQ5+sHzMm+rQ4eT50Fy05Qnna7lMS/zW6xTVubVnD:J6v6H8fEE5p0ENXMm2eT5z05ona7OSqT","tlshash":"afb2fb987650b37126db59da80bb0512e2293544b04b8468f26edcc73cf979271ebf3e","size":23896,"data":"","first_seen":"2026-10-09T20:51:28.756012Z","last_seen":"2026-10-15T19:00:35.04717Z","times_seen":928,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.11/web-vitals-with-attribution.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f307dda0085b0102293f29712c9b6ebc","sha1":"21c48a92f7f05f66fa12c3ce6ff076ff8af4cf09","sha256":"df8028288765a10318afacaff5a27f678394f74ce8354bab7ebbb318bc0463c8","sha512":"4c75f477c5caae400e3a73f597fb2b77f0039b7b516e5ddc4d3785c189fdfd5993c5bd3850e37067e06647211957f296b4ae8e7d81bf9bd85c4794fcd5a7faf3","ssdeep":"768:5pjbwohpXmrRVNk6Ze0RrQDVungn1z4Vugj2pkPQCiTZaDestI0TznVEN9SGtgmv:3jJc5boFzI7p8","tlshash":"52c2a7e2a592203822fb86e782734223773a765270c590dc65ff9f8259661c723e7f35","size":27027,"data":"","first_seen":"2026-09-10T08:27:10.542171Z","last_seen":"2026-10-15T18:04:51.946527Z","times_seen":2773,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.11/surveys.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"92d0d71b448a0c86b77328dc587078f6","sha1":"d861a0ffe6a18dce316acaaf8b34192ba5960472","sha256":"daf2e5f40411a852751012da24e375cb46d349584b7c210f659a8528136a020d","sha512":"6f36b2c081c5687af2c94ca4137bce70aaf9da8a5b726144b92bd910a31a5f9c0c9b515e91e2317382e346a6c20f50978b363ab17876d899a5020a68ebdae466","ssdeep":"1536:h9T42BGqfYXEEN6deHDClW2c08+YyXWP2JfmNJHHKEH2:hF7BGqXeDClWo+ZDH9H2","tlshash":"75a34a95ea41f06d42fb84a950bb4842f33d7b06fa4d8854b05b4cd43cd2989a3aff79","size":101658,"data":"","first_seen":"2026-10-09T20:51:28.561141Z","last_seen":"2026-10-15T19:00:35.416486Z","times_seen":1053,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.11/posthog-recorder.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"db5d82eae1d45ad9ffff6052ee3816c5","sha1":"10206fbc0ffb724a84a096905b7dee119324cf7f","sha256":"2a7a8b5ad177a74d626bfe164aa7227e882637cca65d10e7e418770441677f85","sha512":"57faa5c637fe6ce55f121a3f1bf3e860eec56ce4edd72ccd9885b5829c9cb09e4ae3c6e34d1b2469138bb0620fae519f899d6e41699f1f582bffe390d0612a34","ssdeep":"6144:jXVgnHzA72trUEzBCpDRfYtGdTqdgBctA9hU:jXazA7mrUEzopKtwqdcctA9hU","tlshash":"06242cda77a6703257ea5596c0770102f2353a09308b80a4f2ad9cda387d5c7a1b7f7e","size":215335,"data":"","first_seen":"2026-10-15T14:57:10.184853Z","last_seen":"2026-10-15T18:22:38.245169Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/config.js","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"d23758396daa9dcb3184c58a3b0f378f","sha1":"39b226057e104a5afc9e416022c6d11f956f8819","sha256":"9a43183466116a4c6880bda205fb9f5feb746957cfe274c24c954a6d8228296b","sha512":"e81915de43f8eb4a6d7bd50523d14dcea59b1e0ec3d6d6060d4df59567cde0171a3670b3b181212b7777d252d7be356f00260a09b9e608f97dc33a82d5058ca3","ssdeep":"","tlshash":"76f05cb72666743a5accb055d5ed0d9cbb7231070cdcb8617c6c00185b1c70fa475dd1","size":460,"data":"","first_seen":"2026-10-11T12:03:33.35313Z","last_seen":"2026-10-15T16:15:50.005448Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/assets/index-LJ_OEKN1.js","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"32a32d86b0907857c47917e621d63be4","sha1":"ba8b4b3b4394efa408546664b15bbde4edcf251d","sha256":"4aadb67f48ea371965c2f6e70abbc7d232f0ae5d1f80114c4c76dab5c63b134c","sha512":"61e2df2635d85c7120fb6801462f9d725da0971f9d561c9a9c16c5fcfbcbe6a751aa7e428f7adc5441dc8e8d27de4c6a0d838f17b54879b1bde6b4de325cafb3","ssdeep":"12288:ynePHFqh+UJFnIilzLSSYVWcwL8pHdvabDKtLxqzZyHr:ynePHFqhTJFnIilzLSSYVXpHdvJNWZyL","tlshash":"66c48dda7384237927e301e871d95641f32d966cb226c5f0aaad44152bc3df8633b7ac","size":586712,"data":"","first_seen":"2026-10-11T11:28:56.738631Z","last_seen":"2026-10-15T16:15:50.007013Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/array.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"959e76e51f40cb67eae09dcbb13a8cd1","sha1":"96e2940c073150725ad162ad300ebdd283e8be04","sha256":"6f03fd562abc2edbcf0fa273631a858df1ce13b2e6c7635f3bb3acdc9f76990b","sha512":"9191c476304250f2d27f4623e117e0de977280a960351bd0a90b9fb11c17f064641dede276c54e6e0c55429a8f20f412cb3fd70858798883191f504a897ec024","ssdeep":"6144:Jm9c8d6FdWiioWcgsjUHzAz5FItohTnE69Peit0NLn9:6cs6i1fHzQ5FIR","tlshash":"dc64d8daf7a6d03607f698e5d0374123e72d3a093149c06cf16f5cca394d68aa276e39","size":334399,"data":"","first_seen":"2026-10-15T14:57:15.790508Z","last_seen":"2026-10-15T18:06:21.327511Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/array/phc_uxjE5cAhUj7fPUJhKhSGJY7cFpPXvfuqgrZcSbGBSP7e/config.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8f707927813585c5ebb8fd11435ac58e","sha1":"3a495f7e89ae1715d3fa436b6449af78775c312e","sha256":"2ad7ca9f0d2b9636f93db2cae65ee43ee68f24e915540bc19644ff061c55c259","sha512":"30a4fa78271f94aedf24c827a0b918493ae3869f398d8de445cd26bb7cddc70212ed6b3df696c75ae6d40aa908f420949ec8abb374899fdc132c16156ede4b4c","ssdeep":"","tlshash":"4421c22d296915b584cd4325ba867d05affe012721186c6cf8dc4b44b6ff5de5642b03","size":1273,"data":"","first_seen":"2026-10-11T11:28:56.744431Z","last_seen":"2026-10-15T16:15:50.000142Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/api/wallet-connect-url?site=tron","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.421Z","timestamp":1792080366421,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitefill-ljc.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 16:58:35 GMT","end":"Sat, 19 Dec 2026 16:58:34 GMT"},"fingerprint":{"sha1":"04:42:86:B1:B7:0A:2D:E7:2A:A9:A0:EB:B3:A4:25:3B:17:25:C6:21","sha256":"DB:60:22:DA:E1:FA:A7:3E:14:C7:E7:87:92:72:3B:7C:52:2C:26:BC:58:33:7E:A6:D3:BF:E1:6B:25:27:C6:B5"}}},"request":{"raw":"GET /api/wallet-connect-url?site=tron HTTP/1.1\r\nHost: xn--pay-bitefill-ljc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Thu, 15 Oct 2026 16:06:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Idempotency-Key, Last-Event-ID\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63,"size_decoded":383,"mime_type":"application/json","magic":"JSON text data","md5":"a323b68b0305a4bd6d5b48e8e8b3290a","sha1":"8e54e4fa445d9bd426548ba03e17038522d9f4ea","sha256":"3aee170a0568c40b1a85c176ef7e74846aa197c9f9f35512b8f75019554f86ae","sha512":"208aba956c906774d972f7b8eaed2d012b493ae58672c3830b04e9415bf9fc8742ba03f9213ba48ca96be3a578f30b6e5190a72f15afcd042913ff29cc61aa19","ssdeep":"","tlshash":"08a02232030c2c228a00838002033c8c800b00e38880800a3c88ac0c282008a0003c83","first_seen":"2026-10-11T09:55:05.033864Z","last_seen":"2026-10-15T16:15:49.988788Z","times_seen":11,"resource_available":true,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.440Z","timestamp":1792080366440,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 12 Oct 2026 15:56:18 GMT\r\nexpires: Tue, 12 Oct 2027 15:56:18 GMT\r\ncache-control: public, max-age=31536000\r\nage: 259788\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-15T18:25:06.553208Z","times_seen":317281,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":0,"dns":0,"connect":31,"send":0,"wait":19,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.454Z","timestamp":1792080366454,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 12 Oct 2026 15:56:18 GMT\r\nexpires: Tue, 12 Oct 2027 15:56:18 GMT\r\ncache-control: public, max-age=31536000\r\nage: 259788\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-15T18:25:06.553208Z","times_seen":317281,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":19,"dns":0,"connect":0,"send":0,"wait":37,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.11/surveys.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.744Z","timestamp":1792080366744,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/1.438.11/surveys.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 15 Oct 2026 16:06:06 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a4b011b429abb517-OSL\r\ncf-cache-status: HIT\r\netag: W/\"92d0d71b448a0c86b77328dc587078f6\"\r\naccess-control-allow-origin: *\r\nage: 570\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-version-id: qSJsboX.3N3ogjeZxkrFMFbC4uwMIC9G\r\nlast-modified: Thu, 15 Oct 2026 14:23:13 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: /QiYbnygWXePbM+dsHV2F6ykkvLBz9w7ldPRVjLzaXe+oLOanj8/dUQ5u4yIYCx/zYabO3SblST+3e7Qr46nqXvk6G7rkHdY\r\nx-amz-request-id: D4MCSQHNC0CK8J7Z\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":101658,"size_decoded":34207,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"92d0d71b448a0c86b77328dc587078f6","sha1":"d861a0ffe6a18dce316acaaf8b34192ba5960472","sha256":"daf2e5f40411a852751012da24e375cb46d349584b7c210f659a8528136a020d","sha512":"6f36b2c081c5687af2c94ca4137bce70aaf9da8a5b726144b92bd910a31a5f9c0c9b515e91e2317382e346a6c20f50978b363ab17876d899a5020a68ebdae466","ssdeep":"1536:h9T42BGqfYXEEN6deHDClW2c08+YyXWP2JfmNJHHKEH2:hF7BGqXeDClWo+ZDH9H2","tlshash":"75a34a95ea41f06d42fb84a950bb4842f33d7b06fa4d8854b05b4cd43cd2989a3aff79","first_seen":"2026-10-09T20:51:28.561141Z","last_seen":"2026-10-15T19:00:35.416486Z","times_seen":1053,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.11/dead-clicks-autocapture.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.751Z","timestamp":1792080366751,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/1.438.11/dead-clicks-autocapture.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 15 Oct 2026 16:06:06 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a4b011b429b8b517-OSL\r\ncf-cache-status: HIT\r\netag: W/\"577c388f3cdbf2dd61ed0381bbf43f14\"\r\naccess-control-allow-origin: *\r\nage: 570\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-version-id: Sc.laNXErdkQTWUuhkWoIbSfIMkQ07IX\r\nlast-modified: Thu, 15 Oct 2026 14:23:10 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: gpOd1Zb8QRIcX3z249yQ2FsEV0FTP+cNEmMBHQEjaHtwZMZuHKrHHNYErgkhsaVdD7MZPetTP73yimNwsfBJ7qEy1iILLCrS\r\nx-amz-request-id: D4M12CCWEZ4SXNG3\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":23896,"size_decoded":9611,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23844)","md5":"577c388f3cdbf2dd61ed0381bbf43f14","sha1":"15442a21e3cc3f8da6d1fb44a69c9fec608e7f23","sha256":"1d0b2faf5145fc6c24e30287e186741dee00d1fedc75c1d063e3cd874b5b0b03","sha512":"fa0fcad8739b975e893234697c0239dc2e3515be06bf43af398ee4289fc7e7f18df5c84e596a7cb5e2fb3e586955bd14d73dfabf987dcb73a00212c6005b0e6a","ssdeep":"384:J6v6HNqqkoOVy0EEg2pykwEMQ5+sHzMm+rQ4eT50Fy05Qnna7lMS/zW6xTVubVnD:J6v6H8fEE5p0ENXMm2eT5z05ona7OSqT","tlshash":"afb2fb987650b37126db59da80bb0512e2293544b04b8468f26edcc73cf979271ebf3e","first_seen":"2026-10-09T20:51:28.756012Z","last_seen":"2026-10-15T19:00:35.04717Z","times_seen":928,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/array.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.419Z","timestamp":1792080366419,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/array.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 15 Oct 2026 16:06:06 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a4b011b23fc5b517-OSL\r\ncf-cache-status: REVALIDATED\r\netag: W/\"959e76e51f40cb67eae09dcbb13a8cd1\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-version-id: P.jo5SbzPB1KDEQfx6TSNy_vHUwcONSQ\r\nlast-modified: Thu, 15 Oct 2026 14:24:18 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: E/c88vPu5MsxFFh+yZiq3rf6LORzgevE1kYTH2sYaac4a95Ic+EDodmuAdtcJP4REW87Z68ECS3Z+76wqEHV5ZW1DjVgbE56\r\nx-amz-request-id: XANWR7P5NHDCAD01\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":334399,"size_decoded":106805,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65530), with no line terminators","md5":"959e76e51f40cb67eae09dcbb13a8cd1","sha1":"96e2940c073150725ad162ad300ebdd283e8be04","sha256":"6f03fd562abc2edbcf0fa273631a858df1ce13b2e6c7635f3bb3acdc9f76990b","sha512":"9191c476304250f2d27f4623e117e0de977280a960351bd0a90b9fb11c17f064641dede276c54e6e0c55429a8f20f412cb3fd70858798883191f504a897ec024","ssdeep":"6144:Jm9c8d6FdWiioWcgsjUHzAz5FItohTnE69Peit0NLn9:6cs6i1fHzQ5FIR","tlshash":"dc64d8daf7a6d03607f698e5d0374123e72d3a093149c06cf16f5cca394d68aa276e39","first_seen":"2026-10-15T14:57:15.790508Z","last_seen":"2026-10-15T18:06:21.327511Z","times_seen":41,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":71,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/array/phc_uxjE5cAhUj7fPUJhKhSGJY7cFpPXvfuqgrZcSbGBSP7e/config.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.680Z","timestamp":1792080366680,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /array/phc_uxjE5cAhUj7fPUJhKhSGJY7cFpPXvfuqgrZcSbGBSP7e/config.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 15 Oct 2026 16:06:06 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=300\r\nvary: Origin, Referer,origin, access-control-request-method, access-control-request-headers, Accept-Encoding\r\naccess-control-allow-origin: https://xn--pay-bitefill-ljc.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 1\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nlast-modified: Thu, 15 Oct 2026 16:06:06 GMT\r\ncf-cache-status: EXPIRED\r\ncf-ray: a4b011b3b944b517-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1273,"size_decoded":1284,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1073)","md5":"8f707927813585c5ebb8fd11435ac58e","sha1":"3a495f7e89ae1715d3fa436b6449af78775c312e","sha256":"2ad7ca9f0d2b9636f93db2cae65ee43ee68f24e915540bc19644ff061c55c259","sha512":"30a4fa78271f94aedf24c827a0b918493ae3869f398d8de445cd26bb7cddc70212ed6b3df696c75ae6d40aa908f420949ec8abb374899fdc132c16156ede4b4c","ssdeep":"","tlshash":"4421c22d296915b584cd4325ba867d05affe012721186c6cf8dc4b44b6ff5de5642b03","first_seen":"2026-10-11T11:28:56.744431Z","last_seen":"2026-10-15T16:15:50.000142Z","times_seen":7,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.11/posthog-recorder.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.749Z","timestamp":1792080366749,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/1.438.11/posthog-recorder.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 15 Oct 2026 16:06:06 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a4b011b429b6b517-OSL\r\ncf-cache-status: HIT\r\netag: W/\"db5d82eae1d45ad9ffff6052ee3816c5\"\r\naccess-control-allow-origin: *\r\nage: 570\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-version-id: e6h5lVxr8Ez9bzMakmS6qh7_2H8duQX1\r\nlast-modified: Thu, 15 Oct 2026 14:23:12 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: 0HUEiNprZAH/xwCcwis9D1J0wWbj75Armod5Prc3L+JxjDfwjc2EKV3+ZS9DNGKkHfOV854stcEn7VMalkf4lemq7xqhpm3j\r\nx-amz-request-id: D4MFNJJWDBF4VQ51\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":215335,"size_decoded":68521,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"db5d82eae1d45ad9ffff6052ee3816c5","sha1":"10206fbc0ffb724a84a096905b7dee119324cf7f","sha256":"2a7a8b5ad177a74d626bfe164aa7227e882637cca65d10e7e418770441677f85","sha512":"57faa5c637fe6ce55f121a3f1bf3e860eec56ce4edd72ccd9885b5829c9cb09e4ae3c6e34d1b2469138bb0620fae519f899d6e41699f1f582bffe390d0612a34","ssdeep":"6144:jXVgnHzA72trUEzBCpDRfYtGdTqdgBctA9hU:jXazA7mrUEzopKtwqdcctA9hU","tlshash":"06242cda77a6703257ea5596c0770102f2353a09308b80a4f2ad9cda387d5c7a1b7f7e","first_seen":"2026-10-15T14:57:10.184853Z","last_seen":"2026-10-15T18:22:38.245169Z","times_seen":29,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu-assets.i.posthog.com/static/1.438.11/web-vitals-with-attribution.js","fqdn":"eu-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"172.66.166.164","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.753Z","timestamp":1792080366753,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 22:45:53 GMT","end":"Sat, 12 Dec 2026 23:45:35 GMT"},"fingerprint":{"sha1":"E9:88:90:18:3A:27:F7:9C:4D:0D:10:2A:C0:DA:04:F8:4C:C8:48:D8","sha256":"21:FE:A0:8D:68:D8:0E:8E:EB:FB:65:BB:B5:99:97:4E:65:A5:9F:23:44:D6:66:2A:F9:3E:B5:8D:C1:A8:ED:C3"}}},"request":{"raw":"GET /static/1.438.11/web-vitals-with-attribution.js HTTP/1.1\r\nHost: eu-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 15 Oct 2026 16:06:06 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a4b011b429bcb517-OSL\r\ncf-cache-status: HIT\r\netag: W/\"f307dda0085b0102293f29712c9b6ebc\"\r\naccess-control-allow-origin: *\r\nage: 570\r\ncache-control: public, max-age=31536000, immutable\r\nx-amz-version-id: KG.ulKZqC_Mek3b3vCYQI47hNvAOOC3Q\r\nlast-modified: Thu, 15 Oct 2026 14:23:13 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: lK4lJiSVDYAGXMNWPAv8YLdyWZYI3xFgaWlTSvFP8w4wuAhQjj3pIv1xpGcoErztCHVCVMJll+G6w11SOKaww06yQtKTgBm7\r\nx-amz-request-id: D4MBBGSGA26ZKWNB\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":27027,"size_decoded":7912,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (26971)","md5":"f307dda0085b0102293f29712c9b6ebc","sha1":"21c48a92f7f05f66fa12c3ce6ff076ff8af4cf09","sha256":"df8028288765a10318afacaff5a27f678394f74ce8354bab7ebbb318bc0463c8","sha512":"4c75f477c5caae400e3a73f597fb2b77f0039b7b516e5ddc4d3785c189fdfd5993c5bd3850e37067e06647211957f296b4ae8e7d81bf9bd85c4794fcd5a7faf3","ssdeep":"768:5pjbwohpXmrRVNk6Ze0RrQDVungn1z4Vugj2pkPQCiTZaDestI0TznVEN9SGtgmv:3jJc5boFzI7p8","tlshash":"52c2a7e2a592203822fb86e782734223773a765270c590dc65ff9f8259661c723e7f35","first_seen":"2026-09-10T08:27:10.542171Z","last_seen":"2026-10-15T18:04:51.946527Z","times_seen":2773,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu.i.posthog.com/e/","fqdn":"eu.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.40.5.182","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:09.682Z","timestamp":1792080369682,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 16 Nov 2025 00:00:00 GMT","end":"Tue, 15 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"99:B5:42:B0:EF:B1:77:97:C3:FF:B8:89:87:B5:A3:F4:32:08:FE:27","sha256":"BF:C3:D3:B1:0B:53:D4:58:C2:A8:1F:37:4C:D0:F6:A2:F8:E0:1E:BB:05:FA:53:84:BA:CC:BF:1D:78:D1:F7:A5"}}},"request":{"raw":"POST /e/ HTTP/1.1\r\nHost: eu.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: text/plain\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nContent-Length: 932\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 15 Oct 2026 16:06:09 GMT\r\ncontent-type: application/json\r\ncontent-length: 15\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: https://xn--pay-bitefill-ljc.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 23\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15,"size_decoded":433,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-10-15T18:22:38.251218Z","times_seen":60212,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":0,"dns":3,"connect":28,"send":0,"wait":50,"receive":0,"ssl":57},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.451Z","timestamp":1792080366451,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 12 Oct 2026 15:56:18 GMT\r\nexpires: Tue, 12 Oct 2027 15:56:18 GMT\r\ncache-control: public, max-age=31536000\r\nage: 259788\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-15T18:25:06.553208Z","times_seen":317281,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":19,"dns":0,"connect":0,"send":0,"wait":30,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/config.js","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.018Z","timestamp":1792080366018,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitefill-ljc.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 16:58:35 GMT","end":"Sat, 19 Dec 2026 16:58:34 GMT"},"fingerprint":{"sha1":"04:42:86:B1:B7:0A:2D:E7:2A:A9:A0:EB:B3:A4:25:3B:17:25:C6:21","sha256":"DB:60:22:DA:E1:FA:A7:3E:14:C7:E7:87:92:72:3B:7C:52:2C:26:BC:58:33:7E:A6:D3:BF:E1:6B:25:27:C6:B5"}}},"request":{"raw":"GET /config.js HTTP/1.1\r\nHost: xn--pay-bitefill-ljc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Thu, 15 Oct 2026 16:06:06 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 460\r\nLast-Modified: Wed, 16 Sep 2026 18:53:37 GMT\r\nConnection: keep-alive\r\nETag: \"6aaae5b1-1cc\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":460,"size_decoded":726,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"d23758396daa9dcb3184c58a3b0f378f","sha1":"39b226057e104a5afc9e416022c6d11f956f8819","sha256":"9a43183466116a4c6880bda205fb9f5feb746957cfe274c24c954a6d8228296b","sha512":"e81915de43f8eb4a6d7bd50523d14dcea59b1e0ec3d6d6060d4df59567cde0171a3670b3b181212b7777d252d7be356f00260a09b9e608f97dc33a82d5058ca3","ssdeep":"","tlshash":"76f05cb72666743a5accb055d5ed0d9cbb7231070cdcb8617c6c00185b1c70fa475dd1","first_seen":"2026-10-11T12:03:33.35313Z","last_seen":"2026-10-15T16:15:50.005448Z","times_seen":3,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/ultramodule-1.0.6.js","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.024Z","timestamp":1792080366024,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitefill-ljc.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 16:58:35 GMT","end":"Sat, 19 Dec 2026 16:58:34 GMT"},"fingerprint":{"sha1":"04:42:86:B1:B7:0A:2D:E7:2A:A9:A0:EB:B3:A4:25:3B:17:25:C6:21","sha256":"DB:60:22:DA:E1:FA:A7:3E:14:C7:E7:87:92:72:3B:7C:52:2C:26:BC:58:33:7E:A6:D3:BF:E1:6B:25:27:C6:B5"}}},"request":{"raw":"GET /ultramodule-1.0.6.js HTTP/1.1\r\nHost: xn--pay-bitefill-ljc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Thu, 15 Oct 2026 16:06:06 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 443\r\nConnection: keep-alive\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nETag: \"364-65cb3e5e27fa3-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":868,"size_decoded":753,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"281c54ce4d7a844431d079ebec069570","sha1":"d12fcc7dd075007aeeb7830048ee6fa0de236afe","sha256":"5d675e9689a85da6c9404cf792c450507bfa103984ec0de239ddc00ff7f37dd5","sha512":"e67abd0ab231dcbc938771b305db38100e655594c468a60081d754f3e775766c2e42aee0a15ea1fccd05f229286b6b37092ba9776304d139b816288eb3208946","ssdeep":"","tlshash":"76111e975cd0c809131006966c91f419ed83928b8b089ca8b5fb40fc8f597c64dcb998","first_seen":"2026-10-11T11:28:56.746184Z","last_seen":"2026-10-15T16:15:50.006428Z","times_seen":6,"resource_available":true,"data":null}},"time_used":103,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":40,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/assets/index-LJ_OEKN1.js","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.025Z","timestamp":1792080366025,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitefill-ljc.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 16:58:35 GMT","end":"Sat, 19 Dec 2026 16:58:34 GMT"},"fingerprint":{"sha1":"04:42:86:B1:B7:0A:2D:E7:2A:A9:A0:EB:B3:A4:25:3B:17:25:C6:21","sha256":"DB:60:22:DA:E1:FA:A7:3E:14:C7:E7:87:92:72:3B:7C:52:2C:26:BC:58:33:7E:A6:D3:BF:E1:6B:25:27:C6:B5"}}},"request":{"raw":"GET /assets/index-LJ_OEKN1.js HTTP/1.1\r\nHost: xn--pay-bitefill-ljc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Thu, 15 Oct 2026 16:06:06 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6abd18f1-8f3d8\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}],"data":{"size":586712,"size_decoded":214302,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (42312)","md5":"32a32d86b0907857c47917e621d63be4","sha1":"ba8b4b3b4394efa408546664b15bbde4edcf251d","sha256":"4aadb67f48ea371965c2f6e70abbc7d232f0ae5d1f80114c4c76dab5c63b134c","sha512":"61e2df2635d85c7120fb6801462f9d725da0971f9d561c9a9c16c5fcfbcbe6a751aa7e428f7adc5441dc8e8d27de4c6a0d838f17b54879b1bde6b4de325cafb3","ssdeep":"12288:ynePHFqh+UJFnIilzLSSYVWcwL8pHdvabDKtLxqzZyHr:ynePHFqhTJFnIilzLSSYVXpHdvJNWZyL","tlshash":"66c48dda7384237927e301e871d95641f32d966cb226c5f0aaad44152bc3df8633b7ac","first_seen":"2026-10-11T11:28:56.738631Z","last_seen":"2026-10-15T16:15:50.007013Z","times_seen":6,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":60,"receive":86,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/favicon.ico","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.797Z","timestamp":1792080366797,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitefill-ljc.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 16:58:35 GMT","end":"Sat, 19 Dec 2026 16:58:34 GMT"},"fingerprint":{"sha1":"04:42:86:B1:B7:0A:2D:E7:2A:A9:A0:EB:B3:A4:25:3B:17:25:C6:21","sha256":"DB:60:22:DA:E1:FA:A7:3E:14:C7:E7:87:92:72:3B:7C:52:2C:26:BC:58:33:7E:A6:D3:BF:E1:6B:25:27:C6:B5"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: xn--pay-bitefill-ljc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Thu, 15 Oct 2026 16:06:06 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 443\r\nConnection: keep-alive\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nETag: \"364-65cb3e5e27fa3-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":868,"size_decoded":753,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"281c54ce4d7a844431d079ebec069570","sha1":"d12fcc7dd075007aeeb7830048ee6fa0de236afe","sha256":"5d675e9689a85da6c9404cf792c450507bfa103984ec0de239ddc00ff7f37dd5","sha512":"e67abd0ab231dcbc938771b305db38100e655594c468a60081d754f3e775766c2e42aee0a15ea1fccd05f229286b6b37092ba9776304d139b816288eb3208946","ssdeep":"","tlshash":"76111e975cd0c809131006966c91f419ed83928b8b089ca8b5fb40fc8f597c64dcb998","first_seen":"2026-10-11T11:28:56.746184Z","last_seen":"2026-10-15T16:15:50.006428Z","times_seen":6,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-15T16:06:04.959Z","timestamp":1792080364959,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitefill-ljc.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 16:58:35 GMT","end":"Sat, 19 Dec 2026 16:58:34 GMT"},"fingerprint":{"sha1":"04:42:86:B1:B7:0A:2D:E7:2A:A9:A0:EB:B3:A4:25:3B:17:25:C6:21","sha256":"DB:60:22:DA:E1:FA:A7:3E:14:C7:E7:87:92:72:3B:7C:52:2C:26:BC:58:33:7E:A6:D3:BF:E1:6B:25:27:C6:B5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xn--pay-bitefill-ljc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Thu, 15 Oct 2026 16:06:05 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 443\r\nConnection: keep-alive\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nETag: \"364-65cb3e5e27fa3-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":868,"size_decoded":753,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"281c54ce4d7a844431d079ebec069570","sha1":"d12fcc7dd075007aeeb7830048ee6fa0de236afe","sha256":"5d675e9689a85da6c9404cf792c450507bfa103984ec0de239ddc00ff7f37dd5","sha512":"e67abd0ab231dcbc938771b305db38100e655594c468a60081d754f3e775766c2e42aee0a15ea1fccd05f229286b6b37092ba9776304d139b816288eb3208946","ssdeep":"","tlshash":"76111e975cd0c809131006966c91f419ed83928b8b089ca8b5fb40fc8f597c64dcb998","first_seen":"2026-10-11T11:28:56.746184Z","last_seen":"2026-10-15T16:15:50.006428Z","times_seen":6,"resource_available":true,"data":null}},"time_used":399,"timings":{"blocked":0,"dns":300,"connect":29,"send":0,"wait":34,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/api/wallet-connect-url?site=evm","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.417Z","timestamp":1792080366417,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitefill-ljc.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 16:58:35 GMT","end":"Sat, 19 Dec 2026 16:58:34 GMT"},"fingerprint":{"sha1":"04:42:86:B1:B7:0A:2D:E7:2A:A9:A0:EB:B3:A4:25:3B:17:25:C6:21","sha256":"DB:60:22:DA:E1:FA:A7:3E:14:C7:E7:87:92:72:3B:7C:52:2C:26:BC:58:33:7E:A6:D3:BF:E1:6B:25:27:C6:B5"}}},"request":{"raw":"GET /api/wallet-connect-url?site=evm HTTP/1.1\r\nHost: xn--pay-bitefill-ljc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Thu, 15 Oct 2026 16:06:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Idempotency-Key, Last-Event-ID\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65,"size_decoded":385,"mime_type":"application/json","magic":"JSON text data","md5":"2befd8d632dbcd5f4d7f20f34d75268d","sha1":"e202dc5333e9d27eff2d06a4c83f9a6d4b9262f6","sha256":"b90fe483705ad8839b45ad8afe00fe5e63873162c35caf26db0a8a6954286bb6","sha512":"a56cbec9c84ed80eee5ee885eec3ac64d17626f95f90686e68b38238a0714c0bae9dcf6bc8eb801c858bf73bb26ae9c1268410d0355e97cccdef386f3af41d84","ssdeep":"","tlshash":"27a02222020c8cc08e008ac0000e380c833f0002f28ae0803080b28ec03c002020fcb2","first_seen":"2026-10-15T16:00:44.095195Z","last_seen":"2026-10-15T16:15:50.007766Z","times_seen":3,"resource_available":true,"data":null}},"time_used":373,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":373,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/api/wallet-connect-url?site=solana","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.423Z","timestamp":1792080366423,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitefill-ljc.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 16:58:35 GMT","end":"Sat, 19 Dec 2026 16:58:34 GMT"},"fingerprint":{"sha1":"04:42:86:B1:B7:0A:2D:E7:2A:A9:A0:EB:B3:A4:25:3B:17:25:C6:21","sha256":"DB:60:22:DA:E1:FA:A7:3E:14:C7:E7:87:92:72:3B:7C:52:2C:26:BC:58:33:7E:A6:D3:BF:E1:6B:25:27:C6:B5"}}},"request":{"raw":"GET /api/wallet-connect-url?site=solana HTTP/1.1\r\nHost: xn--pay-bitefill-ljc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Thu, 15 Oct 2026 16:06:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Idempotency-Key, Last-Event-ID\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72,"size_decoded":392,"mime_type":"application/json","magic":"JSON text data","md5":"16648b97044056285203717b81f3ac77","sha1":"04ae3dccb0507f2a85a1dea8c8f4c97a034d3bcd","sha256":"48968e6b685914d24dbeeb65ede7fc87e0e5b9e2ee3befc9b3e08fdddbe3ff22","sha512":"65016711fdcb56c4fe989dd9c0887908896d644123e9da42ea3dd6ae762066c946c4a5515d1650ea187632ba79a6731ffbd221192c4562c374d3f0abdbda25a3","ssdeep":"","tlshash":"26a0112200ec2e028ec08282382a308aa20b00038a82aa0838c8b0080030323202b8aa","first_seen":"2026-10-11T09:55:05.018287Z","last_seen":"2026-10-15T16:15:50.008381Z","times_seen":11,"resource_available":true,"data":null}},"time_used":340,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":340,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.449Z","timestamp":1792080366449,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 12 Oct 2026 15:56:18 GMT\r\nexpires: Tue, 12 Oct 2027 15:56:18 GMT\r\ncache-control: public, max-age=31536000\r\nage: 259788\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-15T18:25:06.553208Z","times_seen":317281,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":23,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"eu.i.posthog.com/i/v0/e/","fqdn":"eu.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.40.5.182","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:14.881Z","timestamp":1792080374881,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 16 Nov 2025 00:00:00 GMT","end":"Tue, 15 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"99:B5:42:B0:EF:B1:77:97:C3:FF:B8:89:87:B5:A3:F4:32:08:FE:27","sha256":"BF:C3:D3:B1:0B:53:D4:58:C2:A8:1F:37:4C:D0:F6:A2:F8:E0:1E:BB:05:FA:53:84:BA:CC:BF:1D:78:D1:F7:A5"}}},"request":{"raw":"POST /i/v0/e/ HTTP/1.1\r\nHost: eu.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: text/plain\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nContent-Length: 1212\r\nOrigin: https://xn--pay-bitefill-ljc.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1826,"data":"\u001f‹\b\u0000\u0000\u0000\u0000\u0000\u0000\u0003½VYoã6\u0010þ+†‡\u0016ˆ\u001cÒ¶,)ûÔn»A·\u0007‚\u0026AÛ\u0014\u0005AQ#‰k™T(ÒG‚ü÷\u000e%Ÿ‰·{\u003cÔ0œhNj曏ó\u0014ðF²\u0019¬ƒË ©\u0004s«\u000f?Fâ»êîC\\\\ß½¯~®n®Þÿ\u0015‹wÍõŸ‹Â=”æ^ÜdWßß\\Ç\u0010œ\u0007\u0019·¢\n.ÿ~\nœ“9Æ ”Ó\t‰H8%Q\u0012ƄB˜Lã4L M‹$M\u0013B\nôƒ\u0005(‹ægKÈØBZ^·(mŒnÀX\tmpù\u0014œiü\u0013ü!U®—^‹Ïl\u0001¦•Z¡œ\u0012/Ê\fêÀàó;i Ð+/Ìa!\u00050»n\u0000\u0015?@;³ºñ\n+ç𨕗Þݾ=”0]\u0014-à‰\b\n…3\u0006Çœ©Ñ²²¶i//.V*\f\u001b¾\u000e3i¡u\u001dÖ\u001fÄPèù…SéÖ¿ÎÇl¼IÃm¥øÜ'ï\\\f_2‡gg¼ìkñ«~D\u0017~\u0011\rÉà›Ík\u000f~»\u001dP2$o\u0006(˜NÞ\fVþÇ,.éx2$ß\u000e®@ÌôňP‚_:Ø\u0014á¢Ó\u001eÔg_7Ô\u001cˆk®J‡ù1;¨ðî\u00268¡c\rƔ«ÎÄë[a\u0000\u0014«@–\u0015\u001e›’Ñd/]ÊÜ\"\u001eè(ñ…\\HX6ÚؗÆ;ù±y-3̂ˆ\bú‡Ãn\u000f'ãdH©×H…dz¬ƒ›t\u000f“1¹z\rëVÌ`ÛSŒ\u0019§#’qL‡\t¡þ„ùŒå²µLT\\)ð­\u0015¹ê\u0003J+y-\u001f¹Ål¬÷\u000fFd4\r)\titK§—ćÓx|ï=„V…,œµÐ¶[/í,›#h)¢\u001c?çÏ'•Ø\u001cv7\u001b\u0013\u0011M¸ \"L8Ã”\u0016c‘äY–\u0026Å\u0001~¿ÄGT\u001e\b®O¤\\]\u001fŠÔBoã½Pi“c§O(\u0010Äs?\u0002'Týtˆõ+\u0005ŸkçÜ‹Ï¸³ZðÆb•|ÝyVwÕ2ØTÖÊ\u001cK\\àÔÃù!\u00070P'ì¬q/Ìx]ë%šÍÁ\u001a)Ú]NX\thº\u0026n3Ÿ\f¸Mœ\u0003ϙ¨¥˜ýwæ\u001c2W²B\u001aDO™X«xÓVÚv]o-Ÿ7{ÀM§I2Úâ­s„•\u0005åAÒ2\u000f5êJûæ¶k%*£•v\u001d¿}Üçé‘å‰\u0003\nÀ\u0016xÒ;Ëqà…\rvR©J–ë9—êX»E)\u003ecϽ\u0015ž\u001a‡È\u0000o»\u0001Û+vÓ\u0000yp\\õwo¯Ù†¸Ÿ‚\r•¡\f­\u0016¼v~æ¢\u0011¾¹Á1R%êJ­}ˆ\u001cjË·Ê\u000eÔ\u000b\u001c¬]µðŸpL\u0012ä°É\bï\f\u001a£‹â\u000bYvÓxۓøF\u0000GºŸòŽ¯÷‚»ßùLÂÞûÜø:Üv#ÿuÜ\u0012\u0002qš\u001eTýå$ÇY\u0018ӈ†I\u000e8Óù(‚1@VÄ\u001dñ-;æÿ¤Ï”SˆÆ\u0011¢ôùu—Žúaõ\fÔ×]ï\u001b¢CT\u0016ÜÕ¶ÝÒ\"‰°eÁÿö†\u0007‰°7fÍNÀ)›O\rDoû\u00057ý±ãgÜûÇ\u000e/·€ýÌ\u001bhj¾î\u0007Œ!­•¥§!Ë­óeß\n¶LzÒ·–j†\u0014VÔ¼üÊ\bXˆÏó\u003c\"’ÞŒ\u000b+\u0017p2¬T\u0016Œâ5Ë\\QøÝ\u0002TÙ]üä”uQ»¶òTŒ\u001cÔOå+\u0013c\u003cⱿÚìéüÐÊ×úÁƒƒ(\rn3~õx}³Š\u000e£a6æ£0\u001a¥qD‹t’¦¢Û\u000eƒsì‰,$¾ú.\u0019îª\u0002;ËpaE\u0006Å%Icã\u000fî\u0016¿¿ \u0013\u00026e.=Ñz\fúzuãˆõJÓç#òx½pP¿ºûàùŸó õ¨àö¤Ùd˜ø½äù_a¯äçÌ\u000b\u0000\u0000"}},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 15 Oct 2026 16:06:14 GMT\r\ncontent-type: application/json\r\ncontent-length: 15\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: https://xn--pay-bitefill-ljc.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 22\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":15,"size_decoded":433,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-10-15T18:22:38.251218Z","times_seen":60212,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.021Z","timestamp":1792080366021,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:49 GMT","end":"Fri, 11 Dec 2026 20:01:48 GMT"},"fingerprint":{"sha1":"E3:3D:17:9C:78:F1:DE:68:C7:E6:BB:8F:08:DC:78:F3:9D:DF:F2:43","sha256":"EB:D6:1D:9A:76:0B:5A:3C:08:74:83:6D:AA:A7:F4:B3:0D:17:8F:4F:3E:6B:9C:91:6C:5B:9E:F7:08:1F:00:62"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Thu, 15 Oct 2026 16:06:06 GMT\r\ndate: Thu, 15 Oct 2026 16:06:06 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":1447,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"859ed7a809c823fc4c3b21178846441d","sha1":"d8f7f19047db4b58ff5147ae8b0ad70804263d9a","sha256":"d0db1bd8545c950185812adf96ec94bc7313a58750a86bf6f38168669e628919","sha512":"73643b482c472422817a112b606f73a53f73cc44c713377f1d0091aa08be3ed25fe003a500daa3f2953b340e79b8060b5416c11027a21dcd4d98688bb3562f14","ssdeep":"192:9NNIxO34OxvENOPCO3/NxoNNryfO3iExBONEhYO3RrxSx:vXyMopi+8","tlshash":"3b227792002ba400ab971dc263cf7f3aaece50896085d1b95ffd0dc59ceed66436876d","first_seen":"2026-10-05T17:52:09.328959Z","last_seen":"2026-10-15T18:28:07.582112Z","times_seen":1293,"resource_available":true,"data":null}},"time_used":344,"timings":{"blocked":-1,"dns":0,"connect":274,"send":0,"wait":35,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pay-bitefill-ljc.com/assets/index-Cs1TeOMe.css","fqdn":"xn--pay-bitefill-ljc.com","domain":"xn--pay-bitefill-ljc.com","tld":"com"},"ip":{"addr":"62.60.226.163","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xn--pay-bitefill-ljc.com/","date":"2026-10-15T16:06:06.028Z","timestamp":1792080366028,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pay-bitefill-ljc.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 20 Sep 2026 16:58:35 GMT","end":"Sat, 19 Dec 2026 16:58:34 GMT"},"fingerprint":{"sha1":"04:42:86:B1:B7:0A:2D:E7:2A:A9:A0:EB:B3:A4:25:3B:17:25:C6:21","sha256":"DB:60:22:DA:E1:FA:A7:3E:14:C7:E7:87:92:72:3B:7C:52:2C:26:BC:58:33:7E:A6:D3:BF:E1:6B:25:27:C6:B5"}}},"request":{"raw":"GET /assets/index-Cs1TeOMe.css HTTP/1.1\r\nHost: xn--pay-bitefill-ljc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pay-bitefill-ljc.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Thu, 15 Oct 2026 16:06:06 GMT\r\nContent-Type: text/css\r\nLast-Modified: Wed, 30 Sep 2026 14:13:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6abd18f1-9246\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37446,"size_decoded":9434,"mime_type":"text/css","magic":"ASCII text, with very long lines (37445)","md5":"e1980621975a2f3e4bcdb54a3aa1a379","sha1":"5c327c4e9b8185ddc5b616f626f5a72a3a241c74","sha256":"137328a05ef92e18f1fba19b72861c090be47204d49079ec9ce842715fe533c5","sha512":"6d3466a684d2da1115c35f2439c8277ebea34e6a4d294da56efe31c28cc609312caa1708a159ee7b7869c03d190a1ec94ae4e462a263f39bbfc1d3dcb7bd6859","ssdeep":"768:MTlyKVyceiO+wR5fMBUWysfJwW6rM+wnw+0Xj04w:MTk8yceiKR5fMtaW6rM+wnwP4R","tlshash":"1af2a464f329dd7fac33947e63acf81c6205a5869d2167d9ff02650286c77f21d62228","first_seen":"2026-10-11T11:28:56.753313Z","last_seen":"2026-10-15T16:15:50.009587Z","times_seen":6,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"xn--pay-bitefill-ljc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}