{"report_id":"af790118-ffcd-4d6b-abbb-48bc92c984bf","version":6,"status":"done","tags":[],"date":"2026-02-22T15:51:05Z","url":{"schema":"https","addr":"cardx-refund.xyz/","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"cardx-refund.xyz/","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"title":"CardX - Card Collection Platform丨Gacha, Collect, Trade \u0026 Earn","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"cardx-refund.xyz/","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-29T15:51:05Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"cardx-refund.xyz","ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-13","domain_rank":0,"first_seen":"2026-02-22T15:51:06.116569Z","last_seen":"2026-02-22T15:51:06.116569Z","alert_count":28,"request_count":14,"received_data":1273839,"sent_data":6340,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cardx-refund.xyz/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Freact-window.min.js%3Ft%3D29529590%26u%3Dq6e4kaGKNEU3xLliGDY5MjU2NDQzMjhjZmYzYzM0MDI3YjhjMdC5vaVH7lU6Tr4L3A","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"96c2ff1601099c21c598c24e6f43c7c4","sha1":"d78fa2e81b7b5ccf287c793c5a9985caaa0f6162","sha256":"7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91","sha512":"d7df68372670f0173ac5dc3c54ee38f13b29703dde9f71ec74827b535735e99b2b253e07960d66d8c3230f13cf29f20aa0f083db014cee0710379ffab68932be","ssdeep":"6144:0ujB8gltIeTM5/S8g6zRh5gDVLU2GIt/KJAsJRrydM147u/lhDlEqH96lm:vhltVM/g61sNUWsSdG7R","tlshash":"1ed438c2821814f684eb0ab6d133a21fdb4cce9dc69f2d20bfe55c9553c87a292f655c","size":656642,"data":"","first_seen":"2026-01-02T13:08:19.247086Z","last_seen":"2026-07-27T12:16:15.967898Z","times_seen":2646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/sendgrid.fluid.min.js","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"54d4ae5bfa932dc5cc160851d92baa78","sha1":"691c5e0395da45c314ebc81ea611da8959e1f03c","sha256":"6b6db4a5c27f4ef13c28f5dffbad8378d9712e3c4996cd0d157a066869e43660","sha512":"d6b7c8b6b439fa983c9d72e97b44394ba01d7562a608efb9f6a83b3e9465d8233d7c43c2f9aa28c371308d56918624164b7e80b972879b0b63892b451e951ab2","ssdeep":"3072:pgd/REGW/xwceBJnKhMkWdGkmChcG1+gWT+qjz2pxhCI7uoPpE4q7BBYWwhY7BJH:pgxREGW5XeDnrkUGq2HoCI7u0pEo0XnH","tlshash":"cda45f20025e6577eadef4b29c221ef8a878764676378c55f52ceec2e015835aff3190","size":453245,"data":"","first_seen":"2026-02-22T15:51:08.810874Z","last_seen":"2026-02-22T19:56:36.354642Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"786457fe2be806becdbde46f997c3221","sha1":"118a182250a98040a4871164bbc62b296fd76733","sha256":"9a66c201bc809b0dca8a7329c5cbbbdb97e54bb6df4cae66c20772d5a9b2b471","sha512":"b6f2172b362f448b37c28d87aa4b205fb211d1052159e260b6b4b7e26cd81282a97a0002084f34c118af344ee293d6c124a6ff87c70eb4c169413efd3989e2a1","ssdeep":"3072:YQYV/DGVUOehNRFMxom4V+k+Cbw+V+0EN+ehr2VB3xS67y8P1Gye73TYwwhuDH9Y:HYpDHjZmi+sOVWPS67y41GOkdjc","tlshash":"c8942f20025e6977eadef4b69c221ef9a8787a4672378c55f42ceec2d415435aff3090","size":445482,"data":"","first_seen":"2026-02-22T15:51:08.833622Z","last_seen":"2026-02-22T19:56:36.361718Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"254ec6f0c4d187a068ab2537652ea564","sha1":"1ae3948ba0632c6bae0905a636b6ad56a8283643","sha256":"34685c8c7a37551619c00e8faf75e9ddfb2a003162270c5f78755390f46c6c17","sha512":"c7a9a3132d43786621023e639ed62e349f6aa6fcdc32df6f36847f44d01ad8a93b87116968f64477d61d36dd473c1ce45f960db38cf90279e4ad61a9d2617719","ssdeep":"192:+tkdES6CIf83e2SXC8uWS6Ct2bjroSI3brZUqKfzymDHvCH:+ff83qP3rwB","tlshash":"61d17d7e9ed20637586bf5bd8f9b7080292284275908ed203d4ce1029f8cd3597f6f94","size":6547,"data":"","first_seen":"2025-09-11T12:55:21.590438Z","last_seen":"2026-04-09T02:30:55.24237Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cardx-refund.xyz/favicon.ico","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:44.294Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:44 GMT\r\ncontent-type: image/x-icon\r\npriority: u=6,i=?0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"699046c8-3c2e\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1tqsMskErxi%2BW%2BMjqALMUG5Zi6pSgaRBaeBGs0Olt3AlmLqpHNmD4Pm42QDWcOpjwMcVTArIKr3%2BItM4GepUKGRjNybwrHLTczctjcVgQsk%3D\"}]}\r\ncf-ray: 9d1fa40eded037c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15406,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"bce78e52375f64096f65c406600c919c","sha1":"c9cc3c756d050a66159a5bf2e6eee5cef478344c","sha256":"3db1be1d18062b4c9b5459a51bdb2c7588a07eaa2fcea8ece467238739169156","sha512":"2eb898398059062a21a9b5d548c7ee5e16e36418b631e0333079513bd1358cf0f3096f2bfc4e377cfc47522f581b716bb2455d1459ecce717aa10027ddd73659","ssdeep":"96:LzK07S/1DBcXs9rYSMr7qxyzvr2V2ggu6SBdHvP8ADISXr8jZp:17yVBcXCrYlixyzvpDGpQp","tlshash":"e762e80f713529fcebb6f372731598d4ed7aad70cab6920a53d0ba399b23546bc01200","first_seen":"2026-02-22T15:51:08.802224Z","last_seen":"2026-02-22T19:56:36.358676Z","times_seen":2,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/eb6652f044d08311.css","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:43.397Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /eb6652f044d08311.css HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:43 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"699046c8-e06\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PXvfK7F7hR68KOrG%2Fuh6JbWx7uOM5PQBmjpNm3i%2FQlPfxvJexSv5BapExDVHCGmPHAUV%2BbplEBZPwAsjGHftw4VcGUldrZpeVvP10w9%2FBGE%3D\"}]}\r\ncf-ray: 9d1fa4093e0837c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3590,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3590), with no line terminators","md5":"d631edf024f27a88146a344c15820f3a","sha1":"948465712bc02841d13d2d3c8ad0a88d546ea50d","sha256":"458cea25a73041decbbef34e3dc00844310e72b5c8f1ddab2609504d7ead11ae","sha512":"d51c9cc55c1420403c33af16e26757c5790076a5f964a1c67deeb7bc5da6c2b5238407ab982133208d26868e8d82d98a775f08570337d9a8354f9f44d016dff2","ssdeep":"","tlshash":"16716a24402e844ed572fc9336ca7f63386e101896d44626de29096dcedbc7b73e1ba8","first_seen":"2026-02-22T15:51:08.807967Z","last_seen":"2026-02-22T19:56:36.352712Z","times_seen":2,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/sendgrid.fluid.min.js","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:43.403Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /sendgrid.fluid.min.js HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:43 GMT\r\ncontent-type: application/javascript\r\npriority: u=2,i=?0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"699046c8-6ea7d\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B%2FNoTXGXulUdvU3mHaJmlmKHQnC0HgX8tiNFp7mZm%2BYzytCsog6V4qIjFJYY%2FOUqvnOCf78C66KtMV4mTXIkD08bpu0ZkarsXnihmRxz9uY%3D\"}]}\r\ncf-ray: 9d1fa4093e0b37c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":453245,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65159)","md5":"54d4ae5bfa932dc5cc160851d92baa78","sha1":"691c5e0395da45c314ebc81ea611da8959e1f03c","sha256":"6b6db4a5c27f4ef13c28f5dffbad8378d9712e3c4996cd0d157a066869e43660","sha512":"d6b7c8b6b439fa983c9d72e97b44394ba01d7562a608efb9f6a83b3e9465d8233d7c43c2f9aa28c371308d56918624164b7e80b972879b0b63892b451e951ab2","ssdeep":"3072:pgd/REGW/xwceBJnKhMkWdGkmChcG1+gWT+qjz2pxhCI7uoPpE4q7BBYWwhY7BJH:pgxREGW5XeDnrkUGq2HoCI7u0pEo0XnH","tlshash":"cda45f20025e6577eadef4b29c221ef8a878764676378c55f52ceec2e015835aff3190","first_seen":"2026-02-22T15:51:08.810874Z","last_seen":"2026-02-22T19:56:36.354642Z","times_seen":2,"resource_available":true,"data":null}},"time_used":307,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":145,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/my.svg","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:44.088Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /my.svg HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:44 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"699046c8-207\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qhw9A12S1Fd5FAFgsi%2Bu75u4QTn4gsOwz%2Fo14NrJhfSh2RsonZtQ2tIfRD7QEenJk3OQ%2B5w7J9grE6ehymywI5O%2FHyc%2BQ5%2BIClHY8Fa2INU%3D\"}]}\r\ncf-ray: 9d1fa40d9eb437c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":519,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4502b1c34022f27df038fa42072b47f4","sha1":"f070b153c23f8ab862dde4c563ea8a4bd6f7a9df","sha256":"ef551fb52f7d4942c5ebe36db7c476b282fc43d40161f29b54a1c788a1db0570","sha512":"67ac9c53543bf0ce60e69b5ac55d33b2958cbdb4f65bf1d7e8c45b88a8049e64f53598dc405252d069dc5084ca9e53fc3b715021ee355176b1158c65936f7e46","ssdeep":"","tlshash":"4cf059f32e56c8d61956cd40ed226f99d05ebcb1458c8008d38068d122480afbe081ad","first_seen":"2026-02-22T15:51:08.813541Z","last_seen":"2026-02-22T19:56:36.361076Z","times_seen":2,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/bg-1.jpeg","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:44.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /bg-1.jpeg HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:44 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\netag: \"699046c8-0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AK6AchGA0%2BSO1ClIvp0%2FQio5UysFROUl%2Bq7Q0DeJ7caPm7XToo%2FQPf9nkExSwaF%2FEfUnpsYYNrZApWH0SIc7TqSJMFcFKDtE4TKhUoUuD%2B8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9d1fa40dbeb837c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T11:56:19.668403Z","times_seen":17578971,"resource_available":true,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Freact-window.min.js%3Ft%3D29529590%26u%3Dq6e4kaGKNEU3xLliGDY5MjU2NDQzMjhjZmYzYzM0MDI3YjhjMdC5vaVH7lU6Tr4L3A","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:44.302Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Freact-window.min.js%3Ft%3D29529590%26u%3Dq6e4kaGKNEU3xLliGDY5MjU2NDQzMjhjZmYzYzM0MDI3YjhjMdC5vaVH7lU6Tr4L3A HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:45 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\nvary: Accept-Encoding\r\ncache-control: max-age=2592000, must-revalidate\r\netag: W/\"a0502-14+i6Bt7XM8ofHk8WpmFyqoPYWI\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=react-window.min.js\r\ncdn-proxyver: 1.46\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 02/22/2026 15:50:44\r\ncdn-edgestorageid: 879\r\ncdn-requestid: 658fea32943da8c02c67970ad927bca1\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vFuiveDqxSH7x%2BmBE79IdlcB8Kiw9tQULLRG1enyj6ub%2B3kv8xSeiHgETcoz64EbGu95B3ej%2FHZkltlFF534a6OetE8NL61ov3iX0uTcm%2BA%3D\"}]}\r\ncf-cache-status: MISS\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: 9d1fa40eeed137c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":656642,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"96c2ff1601099c21c598c24e6f43c7c4","sha1":"d78fa2e81b7b5ccf287c793c5a9985caaa0f6162","sha256":"7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91","sha512":"d7df68372670f0173ac5dc3c54ee38f13b29703dde9f71ec74827b535735e99b2b253e07960d66d8c3230f13cf29f20aa0f083db014cee0710379ffab68932be","ssdeep":"6144:0ujB8gltIeTM5/S8g6zRh5gDVLU2GIt/KJAsJRrydM147u/lhDlEqH96lm:vhltVM/g61sNUWsSdG7R","tlshash":"1ed438c2821814f684eb0ab6d133a21fdb4cce9dc69f2d20bfe55c9553c87a292f655c","first_seen":"2026-01-02T13:08:19.247086Z","last_seen":"2026-07-27T12:16:15.967898Z","times_seen":2646,"resource_available":true,"data":null}},"time_used":1059,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":822,"receive":237,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz//secureproxy?s=%2Fjmpd%2F","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:45.773Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"POST //secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://cardx-refund.xyz/\r\ncontent-type: application/json\r\nContent-Length: 2202\r\nOrigin: https://cardx-refund.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2202,"data":"{\"route\":\"8XUwkBv9vhPYfVpD1fxb7EC65sUXJdqr\",\"payload\":\"2JrDGqmrsqB2nE54L3uYyZB4dZEERP9T1kVhDkLa3rr8MuGqiGNq93nHXGMsRvQ42YS1SraWreEc3w9C9kabdge3uBhXc89xGFhfsGo7yoVpZX8hxNXfGAk5AfCPFZxsd8o7AdLmHCAJct83xoMK14b3s8iQHjxEqv7AbwR1sKvSXXFSe6fWdx4CvqDGUBkWaRNEAeMakASV65C2LPuaXd1oEH8LdxkXcSWhFZJsTnbQyu9vLxGLt2s8acnKejbrjyt8BAKYQroWQbyaMTsbKqq5ALMAHzDpjxeWUffzLmdfWyw8jXtoy8b7mv2kbqw3HmgWJDs4mhFh5AWXg7Sv8oZQASw3WAQbZYX74ZQv9dALhvwfabuhiq63zZjqJpiWY4BRN525SvHhipyAgbE6QNi3A8vofZ7miU4NzGD2VHicetxJkq4a6sYQ4Bh1fb5bECfrBUNotWtMGrpPWHKLwzPciVMjhxHXyfXjCXmFYtKcL5QFYbUZ8Jq7aVicj5GUmtNrqQM8BaJoyj1hbAv6LqKtEeonMi9FoNYt4joPf7noVzF3X7i3gLWhEXc8Vg3yDfrWHGK2P5EM5rqEfXzv4nSAcHU7KBJUpVmfZcPpsoV4P5UNmXvn9vHN8x624cJ9yKw3ra7TiDBvujS6Pwgwu5Xa7AVrAvm8FYtEbAxL8K2LvAq28SN6dErh9fXVYHHq1pBYP4xXCnDSZasqwToixTAKjGEzRsUn7g8FaF1K4teULTgJyovDSShHX67voevB57yZG2dKhGm7fSzbFx2WXSN9Gr3rKSQjmfERptU4NJNRRLkZmMcAJmCXLvGPf9LGXnzBTah2VsemFgGQC3m3QBDP7YK2cZ5X63vtfty7ykXTPZDsvpjktW3Us3pM2HSxTBuGqmrfjdbWzkb5HNrcoUJcRZBCHbQRrnKYxkox1hxXdVYxYgtNmRcdbqKzUJ841bFU4dBdB9a4U2wmumATRnXkn9bw22QLmPhbYJTAyG1NQ5tyDH9pEJXp6NhEL69RxvKBF3Q9Xs56gkVTtFWQptHNoRisUT4Z8xnUe1BLeNpTHBs5cC3VKNSpdHr7i1QX6LEzULAzFGHrUG2gALEbtLdRq9M9B4KF73ZFH9HBULcQ6PMAaavZot1gCYdZbS1y4TsMuB51fkYrb4vd5dtDaJfSCWQzj23R7f4Dp1zCM4ZW1DUqPFcwgpMb3yrZw5zFWmvNBnuVgXNAk1KdjY7rSNennZfugMs6KH3UBWnYNfonksiAMC3DreYxkfzznWHSx2Mne2Ev1sTtDYw5jPsc8YJnwHUrjJMTSdoeK2w6sG4xkkfsZyvWT3GFsavccYgg7EexXENeKePaEgtNm2gEdShh5RnWGoeLCUGm5PhbecM593ZFmvGxDTmJrWULKKpCv35oF5tFCc1hg81qD7XpPmTwB47Y8DSFeAybxJeBkqWwYRAG8Xhz2JQf9UBV3dWMdPVfNCRcY1dnMnytRjbmWNQgw4QYHXvnqZ6YoczxiFdcRLgDaUFq3t8yJNyGvJD8z5u2gs8Dh3LrQpK3J8EqiBBBvr2uejv6koC2VZC1ix7nuJJBEMtEYwQVYn5yicyjgB7jpUmZdwRTGQXU8d72pdgTugpjJ8M8vNirvrYmw3a214eqFNF2bog1WLFKZCxZ5C5zLdRmGAsMWVN8GoMtrNidmwKXfNGSBXJBShDRtB375XCf2EwsrxCnT3p5V3RtbSwVChWHBx2htzPnhLr7oAVEejPDJteAkCVMk8j82uYXUDW3w72LyH3xfYnSUc7UTWG5PdmXToEZRFph2ozmXk2SsGj2VMnLHbNrgb24hjbFVzzxNaAt1HH1jXXEtZ8yAA3pXQ3LxQ96AM1AP84RDYZ7pv3DNboxgdztBYFPbxsQjWgN9UWga1GH1kjwkkUkoeC6kMTWPwx44xtCNGtVqXovo1araKYJask4243nXttkeAPtN9Lsi2DHuJhwwUeEvCVktNNAuFBZYHbnsJ22UFCkAh95zfNGkG2E8vrsmyAnC9guVsDZUyuTVCpnYMFiEnQQnnkfU3JzZHNY5bZGKdFp6ZYc2akFWFMjPTAPU8o9bjTb5uWNumgumUuXfzsD4LzKEHYnv8aj7jbTKhFYgXo15QB3hBwqN\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:46 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"d6-Hq/JsTmhc/d51cK4V5ik9p1gVdY\"\r\nx-ratelimit-limit: 10000\r\nx-ratelimit-remaining: 9999\r\nx-ratelimit-reset: 1771775505936\r\ncdn-proxyver: 1.46\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 02/22/2026 15:50:46\r\ncdn-edgestorageid: 879\r\ncdn-requestid: a5a2f138d899efa730d8c0507458f994\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QrzPnPOxx%2BgoGXRE72W26RO5eT%2FaU3jpZy3Ew9zWxISenHr7LjWqsKnTNRH4KdBlCclXYwU8gDdJQYkaaxFXDsHMaLwfx0zGf6cXT7rZ680%3D\"}]}\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9d1fa4181ffb37c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":214,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"af03025f03c014593886867020bb84ea","sha1":"1eafc9b139a173f779d5c2b85798a4f69d6055d6","sha256":"2532cdec181fbdf815d9c666abf5ae659f5b1a20d9665cb4ad079c47270746a4","sha512":"40ef85dc69fd324a58fa6e57011a9ab1ee1d3d935edaca85e048a667e38af26af01a0a82879a2e4ab54ab7c7cdfa499179c9e47149f0aa733c80faefe6e29245","ssdeep":"","tlshash":"7cd02344d1f6748515c73d6503574a18e1772d93f84732160852c543459323f670d315","first_seen":"2026-02-22T15:51:08.817695Z","last_seen":"2026-02-22T15:51:08.817695Z","times_seen":1,"resource_available":false,"data":null}},"time_used":470,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":469,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-22T15:50:43.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Feb 2026 15:50:43 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e7yGpBz63HSjhfYFN9lIUPExTOtxGI4oXzC259YTXIfY49hFJBiWL60ebPoaTJua4T47k8AXLEHCDXwLrcSnf9wK2olaTnx9Xg5WtSpFD20%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 66873\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9d1fa4077ada07e7-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35578,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1152)","md5":"19214f67cddcfa8714b318927188f22e","sha1":"2e8cc6a2820a4184d24c39e94e763e354826c507","sha256":"19dbf0c2ac7ce95373a5065b188a63412416fdc544b0c14cda4fdaf70a5eaaa5","sha512":"b81cebae0061cf0fcb43cc18015b09470a29be41ce6fba8cca7f8c2f718108d5ccf1c5ccac70ddb57668db41a42d27932000a794f88faeb90da746bfbdfc1916","ssdeep":"384:1wiM0lmhtlSCayHepMHLmueCsNtliCayHe5cEDsff83qP3rw+:Ci2ZeynVsluyqDsff86Pz","tlshash":"66f2f9f013f2097a6427a6f84be6a5117e32d0a3c80add9973cd45929f82cdc44f7a96","first_seen":"2026-02-22T15:51:08.819956Z","last_seen":"2026-02-22T19:56:36.351426Z","times_seen":2,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":97,"dns":64,"connect":8,"send":0,"wait":22,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/03b6b6a31236de88.css","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:43.399Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /03b6b6a31236de88.css HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:43 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"699046c8-16046\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Zlu6cj5kEZoDcAMda4Aiz5Glx5%2BHvJBMvpVrp3lKT7FACZhaBLO%2BJqTXS7anC0j%2F8hLWPMhFJMIsz2IvxR0N0jSWXrLHD%2BX%2B1w6vVIxiMzg%3D\"}]}\r\ncf-ray: 9d1fa4093e0937c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":90182,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (63243)","md5":"d209f073d527bc5945f0b4aba7b87c6d","sha1":"d25fc3e8dc054a45de5f5518dd264f05d7445493","sha256":"75dafb3c0c486391f907b1571c8b857c9659d1c947c869ca3d103bb8f6b12be9","sha512":"7a2a53733f8081c3feb927e1f52c9dc04ab77dd3c3273941045cde55c7cfbde911cdca4de86a4a1da909c7ca934a940c6d4770233cd4827a7a4ae5bbd720be7f","ssdeep":"1536:GnsvB8LEhchsAFsQ+pCMoWtxjxQvwSmi6qJXn7pJO2Ad+KjfaFJw0:GnsvB8LEhchsAFsQ+pCMoWtxORmqn7pR","tlshash":"ab9355ada6a5143b7c17d0f9d1a8e8ada12bf1c4ef3a57eabd82121057e17f31c53900","first_seen":"2026-02-22T15:51:08.822185Z","last_seen":"2026-02-22T19:56:36.357364Z","times_seen":2,"resource_available":false,"data":null}},"time_used":396,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":286,"receive":110,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/dae2bc1ad061e4b6.css","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:43.401Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /dae2bc1ad061e4b6.css HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:43 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"699046c8-7ee\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V0RSBFYDl%2F8OFIKi7leO2MutXHpyH8e11R%2FNtNG0Ef9WCRkluMaaG1KPsdlCDdEV1irtR0zUMvQuxpjF6aXUsQxI8o%2BKD%2FqoFSL%2FKEmyuKw%3D\"}]}\r\ncf-ray: 9d1fa4093e0a37c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2030,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2030), with no line terminators","md5":"5c0e1e80a88c5a167be78d4de64927a3","sha1":"ad70ab4e9877e6a9f4c016e739fa7e319c398ed6","sha256":"0f0c890b3255a445115d1fb9dfd94c4d9ced5a5fa787b15188ad63e16f5fc78b","sha512":"ecf22130f8a932d4fcbe0001f72401f2d322979dc7d4e514a20dfc09cb9fa689ba26084434c5033723f98252514c0e74b6a8016942f7a650e343f12c8b1c7820","ssdeep":"","tlshash":"0341a840e641311e311bc36851d396aaf4b647d0d8215f3d73b732a59f660da6a3b622","first_seen":"2026-02-22T15:51:08.82444Z","last_seen":"2026-02-22T19:56:36.353681Z","times_seen":2,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/secureproxy?e=ping_proxy","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:44.057Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://cardx-refund.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:44 GMT\r\ncontent-type: text/html; charset=utf-8\r\npriority: u=4,i=?0\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nlast-modified: Sun, 22 Feb 2026 15:50:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ryB6wFnn5z6O6LZoXxID3CECM9EuzrHlLh0qkjtJw1X2VFf46GO2RUNj%2FEl5k5Ln3bJVJwyBSFdiA%2BSKM64QsL51ZHoPFhQApmnOguAsmi0%3D\"}]}\r\ncf-ray: 9d1fa40d6eab37c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"6fdb087aa3fbfbcb8287a593a0919e61","sha1":"0e514a0662bcb69dc863953d1ce26e3d40e81a87","sha256":"9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2","sha512":"be5457d14c930b51b47ab152850c1ceaafe6ef88c8671b48164abbc83410b0c07a1e178540f6cdeac5f2672cadb1d1cbbb3434b3e39bc2c50c4646a2bae57437","ssdeep":"","tlshash":"fe300000300000000000000c0000000000000000000000000000000000300000000000","first_seen":"2023-04-12T09:14:15Z","last_seen":"2026-07-27T01:14:27.709324Z","times_seen":8965,"resource_available":true,"data":null}},"time_used":177,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/home.svg","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:44.082Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /home.svg HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:44 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"699046c8-254\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SH8Bc%2Fbj50tXU2pRzGanyKGxURIef9iyXswUGs4wR0iD3kyuPy%2B2rXyBC24rjEateQ1SLhYHTqm%2F6jSD%2FSc33z3hneBmwzzT%2Fog1Y%2Fntvtw%3D\"}]}\r\ncf-ray: 9d1fa40d8eaf37c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":596,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9f90f2bd139554f7418c8de0594dcb56","sha1":"eaaccceee1b398e22c39c301f57af34256db11e2","sha256":"2096d94752ddf1f7c2add175a80661575f5d12f1e46dc4e5d7bb5a1c2b6a6645","sha512":"731aeefdfeaa80b720346810d4ce92023f6f6c2d45d057ce2590d41ade74edc443a991cfe489115eb457a2af716ea860438d2f89fa04666ed47ed0cf0e7d03fb","ssdeep":"","tlshash":"f4f0acf391de91d4c9628f59b83532b7a6371eb2c949a2d481205f90fa440c5c80de8c","first_seen":"2026-02-22T15:51:08.827585Z","last_seen":"2026-02-22T19:56:36.359285Z","times_seen":2,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/trade.svg","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:44.084Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /trade.svg HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:44 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"699046c8-4c2\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uY3MgcQBKsSld4J1B0gj0VtE48D%2BjcWdBsHALn4ln3rml70YzqK4d%2BNyp8zf6IMQBPY4XUuCBXrrS%2BeSTNOjT1RmOSz7D29%2Fxy16vQKSj1Y%3D\"}]}\r\ncf-ray: 9d1fa40d8eb137c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1218,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"23ffc1abc399d6bd0045af371960397d","sha1":"36a9feb8bced7e2daacb2533fd2f035ffbf0da99","sha256":"dc788cd84c8aeefe66684f96d707b84a7774734fdbe405fa49055b46779f6f39","sha512":"b16e581b2bd7aef1139f5b70f027842811fa5c3f38ae84c52b90a8e09873427fe6f9045cda6edc7b8f8a561af9057dcb667e3ae8e0a4fd89c32a7dd9652deb8e","ssdeep":"","tlshash":"5921e2f6f46870e0e51f4b6bbc3a993954aa3ce65ff203495d0165b3d15a0c2c05dd61","first_seen":"2026-02-22T15:51:08.829744Z","last_seen":"2026-02-22T19:56:36.359849Z","times_seen":2,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":135,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardx-refund.xyz/gallery.svg","fqdn":"cardx-refund.xyz","domain":"cardx-refund.xyz","tld":"xyz"},"ip":{"addr":"172.67.149.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cardx-refund.xyz/","date":"2026-02-22T15:50:44.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardx-refund.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Feb 2026 09:18:46 GMT","end":"Fri, 15 May 2026 10:18:28 GMT"},"fingerprint":{"sha1":"98:79:2D:C1:C9:D0:BC:4E:E7:EB:79:F8:FF:98:A1:94:30:09:59:6B","sha256":"2C:6E:5D:9A:2A:7E:6C:58:99:5A:DF:DF:D9:E4:9E:BA:17:E6:03:95:45:2C:74:61:07:03:20:FC:89:87:95:B5"}}},"request":{"raw":"GET /gallery.svg HTTP/1.1\r\nHost: cardx-refund.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cardx-refund.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 15:50:44 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Sat, 14 Feb 2026 09:56:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cdn-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"699046c8-3e0\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3VdkondXW6iOcpt%2BW%2FOd7u%2BNaDX%2FEFs9%2FGM76M23GsyXG%2FtA%2BwsPpAbRu5P5lypoAaUJEgqOvMkXb%2B8iAzSjF2wpNU7VPSvtpUdCiKCe%2BzU%3D\"}]}\r\ncf-ray: 9d1fa40d8eb237c2-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":992,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5925fa23c7d1d0f5431b84415554020f","sha1":"5e40e9f2e52f7482d29e62d1894c7bdf169678da","sha256":"c944c55e82725a15a4cdc583c9ae557da990c2813291c7242b244990af69f1b2","sha512":"496fa8085917d2be761803760507d8aab47b247b23202e103b23d985dd1e0be90f9524c8631bc8bb860c005dfd2392bed0704da6a47a1d4ed9cc815ce4faac05","ssdeep":"","tlshash":"72119bb3f394a9c89341477a5deb2c6eb32fb8fb4f421188c3a0dd1659a90d95f05894","first_seen":"2026-02-22T15:51:08.83171Z","last_seen":"2026-02-22T19:56:36.360504Z","times_seen":2,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"cardx-refund.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}