{"report_id":"be49282c-0111-461f-a0bb-5a97d6d50d67","version":0,"status":"done","tags":[],"date":"2026-10-09T02:24:21Z","url":{"schema":"https","addr":"mixer.money/","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"172.67.136.201","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"mixer.money/en","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"title":"Bitcoin mixer 2.0 | Mixer Money - get clean coins from stock exchanges","dom":{"size":31283,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (914)","md5":"37974c93dca1266c15c834b4e4baa2a6","sha1":"535053d90c1abe4a3909abba986ed923d641e1f2","sha256":"aa4c6b94a8eb162cd0ad079630b64a9f54dd586021bde525f640a23ff92103eb","sha512":"4a575b68263b82fae8367b8f35f44a2c1c557ebbfbfa5ddb27763e133059c2e33f0fce35b5e3f66c3ae2d9843e71d0c63da2056cf9b630782f4439505c2872f9","ssdeep":"768:m4+GqtrY1R111137777e7777DeMYrfAk0ebSuXgiK:MNN9YFr3K","tlshash":"91e23f7080f5213a429391d56a756e1abfc1e143ca8a1a6173fc87d89fd7dc2cea315c","dom_hash":"domhasha7dbeaf3c79617f5bd4d2342f6168f6e","first_seen":"2026-10-09T01:59:18.628386Z","last_seen":"2026-10-09T02:24:23.832516Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"mixer.money/","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"172.67.136.201","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-13T02:24:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"blog.mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"mixer.money","ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2021-12-20","domain_rank":0,"first_seen":"2026-10-09T01:59:12.713919Z","last_seen":"2026-10-09T01:59:12.713919Z","alert_count":20,"request_count":20,"received_data":183068,"sent_data":9309,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"widget.replain.cc","ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"domain_registered":"2017-12-05","domain_rank":2974298,"first_seen":"2018-03-04T22:19:42Z","last_seen":"2026-10-03T03:40:57.89819Z","alert_count":0,"request_count":5,"received_data":413890,"sent_data":2457,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Re:plain","description":"Re:plain is a live chat integration for WhatsApp, Facebook Messenger, and Telegram, allowing you to connect live chat to your website.","website":"https://replain.cc","common_platform_enumeration":"","icon":"Replain.svg","categories":["Live chat"]},{"name":"Typeform","description":"Typeform is a Spanish online software as a service (SaaS) company that specialises in online form building and online surveys.","website":"https://www.typeform.com","common_platform_enumeration":"","icon":"Typeform.png","categories":["Surveys"]}]},{"fqdn":"ws.replain.cc","ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"domain_registered":"2017-12-05","domain_rank":3003637,"first_seen":"2020-02-10T04:17:58Z","last_seen":"2026-10-03T09:28:42.395466Z","alert_count":0,"request_count":1,"received_data":245,"sent_data":980,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"blog.mixer.money","ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2021-12-20","domain_rank":0,"first_seen":"2026-10-09T01:59:12.716389Z","last_seen":"2026-10-09T01:59:12.716389Z","alert_count":3,"request_count":3,"received_data":419752,"sent_data":1541,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"assets.replain.cc","ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"domain_registered":"2017-12-05","domain_rank":6294803,"first_seen":"2021-02-22T09:00:54Z","last_seen":"2026-10-09T01:59:13.655216Z","alert_count":0,"request_count":1,"received_data":2214,"sent_data":552,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"app.replain.cc","ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"domain_registered":"2017-12-05","domain_rank":2944265,"first_seen":"2018-06-15T14:19:11Z","last_seen":"2026-10-04T08:12:30.168885Z","alert_count":0,"request_count":1,"received_data":631,"sent_data":540,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"mixer.money/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","size":12332,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-10-14T09:39:11.847925Z","times_seen":131847,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/scripts/news.min.js","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8654fbd4d23ecdfbf661b7bded32f5a4","sha1":"0b725656610f60c798022a196377035d81e26f20","sha256":"26f6a7dd738590e57930ebf83604b65cbefc5b5c54cb4ab10542b50b53f4fe99","sha512":"46fafc505acfd19402a074fa4ba0efd19650ea68a641c73e43c4b8708d0bfaf9f638a4668af8600848f2a8956876c14f1dd2fbcd34f055627d1434a5a0e29212","ssdeep":"","tlshash":"ffd02bb31b0629b143fce56f725cdbc0742592e1180bd104a80c8c66b4f4e54c4f5e5c","size":285,"data":"","first_seen":"2026-10-09T01:59:18.637248Z","last_seen":"2026-10-09T02:24:23.856524Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/scripts/support.min.js","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"35cb482f1f4ef01140a52d081bbc1925","sha1":"d0d9290702ba2b26e79caee7b79c9afab6fdc9ff","sha256":"6764026e71d5bf0b1639237dc99b97aa1cae862750e331fa0d3919d599afc022","sha512":"e4f372094de291faedeeeedd0083fcb7cbb254136cfaf80a12d02e2b88a151c84b91c5df4ca1133dc18840187f5c1b22c4baa88c048cba5c78bed77908f7fe81","ssdeep":"","tlshash":"8ad02b8b3e415c38938915fce1ebc26cb07114adc514ac61a4d6d8982c64dc20864b4c","size":287,"data":"","first_seen":"2026-10-09T01:59:18.64801Z","last_seen":"2026-10-09T02:24:23.837072Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"widget.replain.cc/dist/client.js","fqdn":"widget.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"6992743367265d7be6fad97c3463c05a","sha1":"c6a26d957c30d7b06da77aba6edb02591bea68b3","sha256":"2b463e04c28920ec3e56687aa49a0e0d0021dbed2d37ab78b2cf59dfab864414","sha512":"21cf66dbda2e27a6b995d39ecca572d84e42eaf03f2ba57de09958b4c33915e425fd44b268450aa81d223227ab5aae365fd674c47fd40b09eb49ec0024ea91b6","ssdeep":"","tlshash":"7d71a6f5a012943253a818e5abf1b758f57c29fdba068c54482dac3b248cec79c32ac4","size":3560,"data":"","first_seen":"2026-07-15T17:38:15.99514Z","last_seen":"2026-10-09T02:24:23.850077Z","times_seen":25,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"widget.replain.cc/dist/js/widget.5485a696.js","fqdn":"widget.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"6ca17558cd7ebdc0372a04caf33212a1","sha1":"3d329885c2bb8969121f832e4928945a1c10454c","sha256":"2c04d367229cfbedac16fb429c530773588d2e673212a14f4607dc2852c1056d","sha512":"bb6be3f8295a753f686cccb9d5294c47c57ef6f33b084b3ac4fa893c7591b486efb1149d648d4dcfb233adaec1aad62634c16b33b81e153655365eea9b0b04f5","ssdeep":"3072:+vppUHu35V5lJl9XCztivPYOl9pmDuLvMdD5wQnWwoAiHbnIU5kkJYfrldQQJ3iF:oppEEV5XOztivDI7WyiLIUo5dd3iX4y","tlshash":"94642c897291b039479601f4643f2107f3392958780ad4b8f678ecda7e68c89627bf7c","size":332034,"data":"","first_seen":"2026-07-15T17:38:15.929991Z","last_seen":"2026-10-09T02:24:23.862616Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"widget.replain.cc/dist/js/lang-en-json.05f46a30.js","fqdn":"widget.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"d7a821ec7334351e310e16c8b08df428","sha1":"cd17238529395534427fb6a521cec0a04f7dad42","sha256":"cdd7f9a220b5d81c3ebb77e922365a39cc8c605b5c0c71b1e90ef05405e77854","sha512":"94619581211ddde3206a4ab5c50bef936be59fa6df459c9c4ab25867b492d3b79217364ad4f5099e3aa06c835b0914d62b63c5cdb67a97d7ab29071ef0686044","ssdeep":"96:LIzp0rKPpi5QDP0OdRwbAQwzhra1zMu9zzlwjODFjgaEiW/wnLBb+PpD:LqpbDDP0Od+SBcwu8OtgaEDwnLsPpD","tlshash":"0b91951fd34265f81b410e5d7a1f3ae1a49050a946182bf265e939dd30ef61cf3cf1a8","size":4570,"data":"","first_seen":"2026-03-04T14:06:01.231253Z","last_seen":"2026-10-09T02:24:23.860047Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mixer.money/css/main.min.css?ver=1","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.970Z","timestamp":1791512631970,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /css/main.min.css?ver=1 HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: text/css\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 16 Sep 2026 18:37:50 GMT\r\npriority: u=2,i=?0\r\netag: \"6aaae1fe-b7fa\"\r\nexpires: Fri, 16 Oct 2026 02:23:52 GMT\r\ncache-control: max-age=604800, public, no-transform\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Elc10VUh4aE72TNIwvP7PW4nVal73lAg%2BCaYz4d0wTukIS7a9YzyvlkgBMSwo8IkhpAC%2Fr6xnNRS1jMdkjyqJSSAVwUXANXv8WAdCGnEmMEhlCNrLvuqQR4R9cwovQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfdcbc156c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 47098\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47098,"size_decoded":47829,"mime_type":"text/css","magic":"ASCII text, with very long lines (47098), with no line terminators","md5":"cf34e86803059a11f49878ea63cf1abe","sha1":"2a4f6f2a667944810eda2864ab98ffc852753981","sha256":"3ace8af6f7dd1d3bd19533ffaa841a18bf1a31e9bc79a746688baebad636e669","sha512":"ee03b5861d663b81480d178b14fe4a0e1f09e9cd0afa9a71ea81e2facfb3de86a9989f05ecb5438c35a2769625223b2ce690b0388e684b73b379692e3556f4eb","ssdeep":"384:77lMopWr62oyHqzj9QXHp1XB7Kc4TSluivujNF7VBop5U81RkoTuydaomI1h7bOr:7lWO2oyHqlmHLRWTeuivIcyjhac+6","tlshash":"8423a6d3b5a0299d6123c41a759076bd752e9142f3a3cdeaf4267b704bca1c70af1a0f","first_seen":"2026-10-09T01:59:18.658335Z","last_seen":"2026-10-09T02:24:23.834034Z","times_seen":2,"resource_available":true,"data":null}},"time_used":285,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":248,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/icon-trash.jpg","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.992Z","timestamp":1791512631992,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/icon-trash.jpg HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:50 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f7a-533\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4l6GhWqStfJkIeXjj%2FeM9C7lUpnbQIXiNTXvBFxJr6J%2BoB5h5fR8cAOQ4igToHq5MqDqLL3ISD7udczxviwm3KeYBjwL0Ydwe3%2FFQGJZAnK8XfApsuIyivMOvP2XRw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfdebcb56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1331\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1331,"size_decoded":2090,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3","md5":"1838ba56818fb61fca519dbeb49fb051","sha1":"38a9916af3e08edc0c2e658684933f2dae2c534e","sha256":"53c3dd9a2d09f6d5a624dd67cd7538ae1816c570e956045465ced7ea0ed32d2c","sha512":"0e2f2f0be6adedd7cbea03f6e9d16e12946791e0a6ab7d3beb4717bd19ed9aa4cf2a0250ab1e722496d58c955a2a7d345cd8e00496f000de8b51e29f158cfcbf","ssdeep":"","tlshash":"742181296b0c5b13e817363262fcab0e37296e021d42575b3af93b18696b0c098d4284","first_seen":"2025-08-29T02:40:17.715139Z","last_seen":"2026-10-09T02:24:23.835046Z","times_seen":9,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/cropped-logo515x512-192x192.png","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.304Z","timestamp":1791512632304,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/cropped-logo515x512-192x192.png HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:47:01 GMT\r\npriority: u=6,i=?0\r\netag: \"5e2b1f85-3db9\"\r\nexpires: Fri, 16 Oct 2026 01:58:40 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CKMTlAp757EvelpTKR3AKb4U24wUdYW99uLSjdIB43NgVuInIEuiCjJvZ2ceqsjtyYO6ArTkEYHNHAAhzjldUkP63%2Bgv34l1V00XmwnAgFpttfDRisrgAESqPd%2FYUA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecffebdc56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15801\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15801,"size_decoded":16562,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"252e8b61ecbf2f67d218c119bc5b1dd8","sha1":"5ebf76938535d54dc932faabdfb9ed521eeee40a","sha256":"a7b41224294b84c84e5d13eda09c5fc8f345bf2879dc6de625c76afa29bf05ee","sha512":"0afc284eefac4d94267376ab21664483207468206010b5fc20f3142e3dcf303e5e30fca87b2ccb73323727efdce1876fd2c0f7c236d836d14f954ae0cd400128","ssdeep":"384:mRG2Ut56A0nJuaMnqRnglh0r4rp62KSOfZVupZnX:9hPknJ/MnaErp6XSOhVUx","tlshash":"7162d08f2028d87d38f92cd4262dd6b4356afa0dcd255ad53c4f4b4c375a13bae15b22","first_seen":"2025-08-29T02:40:17.709416Z","last_seen":"2026-10-09T02:24:23.835686Z","times_seen":9,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/icon-mixer.jpg","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.984Z","timestamp":1791512631984,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/icon-mixer.jpg HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:51 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:50 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f7a-727\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cGjtSYi3NERGjHIjWrTNxCR0BZIAOYO4CU2BOGdMLIy8dcOUP5XPHkxFbzC4GAxdWva1Np8pfdh5BksxWlpYr%2BcmHbhvgAnobxECCAlK1glZryy0PaVTIh2oiMR4Mw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfdebc656c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1831\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1831,"size_decoded":2586,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3","md5":"3f4e774b2a8ae31fc5604aa2411d4eb7","sha1":"c648a2f68e54fcea926e4984613b0babbd774edc","sha256":"00b4aa17bba14dc3ff66240620a9fb3f24a121a9cb248472190a776f20aae0c9","sha512":"735a31b998fafef0d3ab3cd05278226c0958c17fb5e4bdc2b4eb0fa3477890ebbf8c84597a2371e943401ffe30470fb99d5dd5da304904232833d783e591753e","ssdeep":"","tlshash":"8731b8527721ef6bec7502b838799270a1485d873e0a6b5726fb2738182b3d41fda534","first_seen":"2025-08-29T02:40:17.710437Z","last_seen":"2026-10-09T02:24:23.836363Z","times_seen":9,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/scripts/support.min.js","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.277Z","timestamp":1791512632277,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /scripts/support.min.js HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: application/javascript\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 17 Sep 2026 06:24:00 GMT\r\npriority: u=1,i=?0\r\netag: \"6aab8780-11f\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6qJbhM6nam%2BUPL2C8i%2FwPqp0j6dQ2qglJNuC%2FisJ6oLsSP4hi2%2BdK0qUXMehz%2BM%2BW%2BySr02DfKxlzOGpGnPHOGl%2FrF1Mg6cuJSqBSzcT3bZMN6j8FfhggN%2Bpe4cRsw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecffbbd956c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 287\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":287,"size_decoded":1072,"mime_type":"application/javascript","magic":"ASCII text, with no line terminators","md5":"35cb482f1f4ef01140a52d081bbc1925","sha1":"d0d9290702ba2b26e79caee7b79c9afab6fdc9ff","sha256":"6764026e71d5bf0b1639237dc99b97aa1cae862750e331fa0d3919d599afc022","sha512":"e4f372094de291faedeeeedd0083fcb7cbb254136cfaf80a12d02e2b88a151c84b91c5df4ca1133dc18840187f5c1b22c4baa88c048cba5c78bed77908f7fe81","ssdeep":"","tlshash":"8ad02b8b3e415c38938915fce1ebc26cb07114adc514ac61a4d6d8982c64dc20864b4c","first_seen":"2026-10-09T01:59:18.64801Z","last_seen":"2026-10-09T02:24:23.837072Z","times_seen":2,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/blogposts/en/news.html","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.520Z","timestamp":1791512632520,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /blogposts/en/news.html HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: text/html\r\nlast-modified: Fri, 09 Oct 2026 02:05:02 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Fx29YWiWuVF5vvPJGNWPa%2FwZhgUTP3fUwGnjOOVguJFGlFdHCHftTZf%2BhaYrhcKrvs8sEjdpinwKnJbMjpGpmYJO%2F9i38BK1psw%2B1XKyqxJgwh%2BZbo3KrSwLsf71Dg%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a479ed013bf256c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2154,"size_decoded":1454,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (447), with CRLF line terminators","md5":"a98cea38b10136797b6f75477bfb294a","sha1":"06f33663b2f937f0f51ec12d7d5a81642fc2d547","sha256":"451e4b78236ed100bd8d7ee15a033a2dcedce2d73ecbe1c3d5ce7c8ca68a27d0","sha512":"fc3739735dfcd3bc0e1279e4f56014afbb15df4058bff4505f6b83aac801e1200878dc27a2ab181e53b04cb68b60ac5b94c897e24a34fd1fb46eb0d5c82fcb2d","ssdeep":"","tlshash":"c341727040a773d1673361e51621298ffe623243ca394566b35d63cbef90ce08ca308d","first_seen":"2026-10-09T01:59:18.629708Z","last_seen":"2026-10-09T02:24:23.838Z","times_seen":2,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"widget.replain.cc/dist/media/notification.c5bc0cbc.mp3","fqdn":"widget.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:53.373Z","timestamp":1791512633373,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"widget.replain.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 10:31:05 GMT","end":"Mon, 07 Dec 2026 10:31:04 GMT"},"fingerprint":{"sha1":"A4:F6:F6:3B:C6:D9:BB:56:9A:1C:43:04:BD:89:3B:B5:D0:AA:41:01","sha256":"A5:CE:94:0B:58:02:5A:05:C2:19:D9:B5:CE:04:E1:89:A7:48:29:9C:EE:49:38:7B:8A:C3:55:40:89:47:CF:C8"}}},"request":{"raw":"GET /dist/media/notification.c5bc0cbc.mp3 HTTP/1.1\r\nHost: widget.replain.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mixer.money/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 \r\nserver: nginx\r\ndate: Fri, 09 Oct 2026 02:23:53 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 24659\r\nlast-modified: Tue, 14 Jul 2026 10:56:02 GMT\r\netag: \"6a5615c2-6053\"\r\nexpires: Sat, 09 Oct 2027 02:23:53 GMT\r\npragma: public\r\ncache-control: max-age=31536000, public, must-revalidate, proxy-revalidate\r\naccess-control-allow-origin: *\r\ncontent-range: bytes 0-24658/24659\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24659,"size_decoded":25064,"mime_type":"audio/mpeg","magic":"MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural","md5":"ac905963f5794835331c32a4908c6c2f","sha1":"f6e9ca416fa57b164cd95e0047392407c5466f49","sha256":"d29d3345cf4f562771b5b807bc898e977d32a63e49bb4b084dc86acae4597c1e","sha512":"fa16d70178fed775bb242b2921231b90b0510743b2eb4a1dff0863bbbdf03c5984c0a03abb91758c6f8ead30d6e00d58c72f15aa1810c81e810c996298f94b91","ssdeep":"768:ZqGjCWKuZbkD3ZHVcbwX24fnRMreOWzc/nmQ+:ZcWKuyDJGw3fRMrAzin6","tlshash":"c8b2d0bc720cde6afacf1214e66308aad2220428d7115fc9899295bc3c7767d7f5c02b","first_seen":"2023-04-07T02:27:17Z","last_seen":"2026-10-09T02:24:23.838974Z","times_seen":417,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/cropped-logo515x512-32x32.png","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.305Z","timestamp":1791512632305,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/cropped-logo515x512-32x32.png HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:47:01 GMT\r\npriority: u=6,i=?0\r\netag: \"5e2b1f85-392\"\r\nexpires: Fri, 16 Oct 2026 01:58:40 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SQ3L%2BuepaCD5e%2FBYrbhR6pjFLA5ygaqsGBS28WUQeTgE6jtWT04ArTjbuH7TwV2T4XA%2BWUdS2%2FuP3k9oJicaI5zjFVKfr4XFczE%2BjztvV%2FdzXjKUQpZ9MW4CJ1bUbg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecffebdd56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 914\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":914,"size_decoded":1680,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"994f85d2bfd41959119e0e5c0bce7efa","sha1":"4dafce7853880684feda5374cbda8505d85c45e8","sha256":"aae03fa43c48c1fbc5a52ccd0e34f53a204a48718b928357a8e71c5f395cb18a","sha512":"74084719c6552b4fd572cb975771c4cebadcbb790f4e4769dc61cfa9c34ccfa545044a60367f4eeeac63d76228f83f255fdf9010052a9ec7d72b7ac75ea90126","ssdeep":"","tlshash":"e3114843965979f863a51c3796d77941fbdc0d3828768560374740a776334544086b5f","first_seen":"2025-08-29T02:40:17.696687Z","last_seen":"2026-10-09T02:24:23.839687Z","times_seen":9,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"widget.replain.cc/dist/css/widget.ba13be89.css","fqdn":"widget.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.957Z","timestamp":1791512632957,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"widget.replain.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 10:31:05 GMT","end":"Mon, 07 Dec 2026 10:31:04 GMT"},"fingerprint":{"sha1":"A4:F6:F6:3B:C6:D9:BB:56:9A:1C:43:04:BD:89:3B:B5:D0:AA:41:01","sha256":"A5:CE:94:0B:58:02:5A:05:C2:19:D9:B5:CE:04:E1:89:A7:48:29:9C:EE:49:38:7B:8A:C3:55:40:89:47:CF:C8"}}},"request":{"raw":"GET /dist/css/widget.ba13be89.css HTTP/1.1\r\nHost: widget.replain.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mixer.money/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 14 Jul 2026 10:56:02 GMT\r\netag: W/\"6a5615c2-b87b\"\r\nexpires: Sat, 09 Oct 2027 02:23:52 GMT\r\npragma: public\r\ncache-control: max-age=31536000, public, must-revalidate, proxy-revalidate\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47227,"size_decoded":11119,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (47223), with no line terminators","md5":"67192f5e5cc7e4f8bfc686e86dad5725","sha1":"9f8dd41483efead0c2c798aa7f5cf37f14816505","sha256":"df176281e1de303c2e1fa9469ba7bf88881706aaca96aecd98983649614768ae","sha512":"0070c71ea2ee9316e7f31630b5d24a7e663d2afd96b632fd95abbd81ebf489dd39cf87ee7be448a0037d4f64ff481b55b61b6fac6f9f999cc107b0787c7cda17","ssdeep":"768:18bmcTiUQVcXzVQvANfejX9IkQFJi3UVu+yl/yUAuZ1Ed3d2Dkuk1GFxt/1o2Tbv:189iUQSXzVQvANfejX9IkQFJi3UVu+yR","tlshash":"2623626175ce201d6237c22efc81f998333da3139367b3e5eaa077258e4b5973526788","first_seen":"2026-03-03T03:28:36.308091Z","last_seen":"2026-10-09T02:24:23.842079Z","times_seen":105,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"wss://ws.replain.cc/widget?reconnected=0\u0026chatId=08c4c9c8-40fc-4961-943f-987e7ddee6e9\u0026clientId=V8wF5jChTTHp4SZAAIPSOZXI5\u0026token=40940a07a396c9304ad4893d2f50b364710dfcf82190b93eaa65d1c198388eae6bbd54f68e86331904821d29627f01dce748852c38480e0b448c957a8ccb990552cbedf05ce351361ca68513af3da3a526810833af55b3f551c3978b955bfc12299315cc4fbeb504f18a3a14008866fcf93af5758167f7abe49bc7abee79e9f1\u0026page=https%3A%2F%2Fmixer.money%2Fen\u0026lang=en","fqdn":"ws.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:53.598Z","timestamp":1791512633598,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"widget.replain.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 10:31:05 GMT","end":"Mon, 07 Dec 2026 10:31:04 GMT"},"fingerprint":{"sha1":"A4:F6:F6:3B:C6:D9:BB:56:9A:1C:43:04:BD:89:3B:B5:D0:AA:41:01","sha256":"A5:CE:94:0B:58:02:5A:05:C2:19:D9:B5:CE:04:E1:89:A7:48:29:9C:EE:49:38:7B:8A:C3:55:40:89:47:CF:C8"}}},"request":{"raw":"GET /widget?reconnected=0\u0026chatId=08c4c9c8-40fc-4961-943f-987e7ddee6e9\u0026clientId=V8wF5jChTTHp4SZAAIPSOZXI5\u0026token=40940a07a396c9304ad4893d2f50b364710dfcf82190b93eaa65d1c198388eae6bbd54f68e86331904821d29627f01dce748852c38480e0b448c957a8ccb990552cbedf05ce351361ca68513af3da3a526810833af55b3f551c3978b955bfc12299315cc4fbeb504f18a3a14008866fcf93af5758167f7abe49bc7abee79e9f1\u0026page=https%3A%2F%2Fmixer.money%2Fen\u0026lang=en HTTP/1.1\r\nHost: ws.replain.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://mixer.money\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: cEvxmnVW8doC8dFP9UkMZg==\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 02:23:53 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: nyeCwBfbJby+U+veHB/AuV2pUBo=\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":245,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-14T09:42:46.355375Z","times_seen":19095059,"resource_available":true,"data":null}},"time_used":386,"timings":{"blocked":0,"dns":121,"connect":169,"send":0,"wait":31,"receive":0,"ssl":65},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-09T02:23:51.471Z","timestamp":1791512631471,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rjcpV1dXZsTxcgUhnsI0WmTwGk21Sm%2FkGLUn2v0%2BVWH4hJWj7Hr3b%2F%2B9S3pRuUmvznQ4xP6hqHQ%2BzXzgscbX3zLM13DcvGZSIjUdzgWvD2CcqXgGBesHqRCKIzQaQA%3D%3D\"}]}\r\npriority: u=0,i\r\ncontent-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data: https://*.replain.cc https://blog.mixer.money;object-src 'none';script-src 'self' https://widget.replain.cc 'unsafe-inline';script-src-attr 'none';style-src 'self' 'unsafe-inline' https://widget.replain.cc;upgrade-insecure-requests;connect-src 'self' https://*.replain.cc wss://*.replain.cc;media-src 'self' data: https://*.replain.cc;frame-src 'self' https://widget.replain.cc\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nlocation: /en\r\nvary: Accept\r\nx-cache-status: EXPIRED\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfadba556c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-14T09:42:46.355375Z","times_seen":19095059,"resource_available":true,"data":null}},"time_used":232,"timings":{"blocked":-1,"dns":5,"connect":15,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.976Z","timestamp":1791512631976,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Sun, 11 Oct 2026 02:23:51 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3pMnWdEYMwVZ0g%2BpdGZziC4Jl%2BW%2FEa08ZxB1qksgGmUcfJDqyEzZpaUtacsByHlLCd8e8kLKv1LiyM%2BOXDYzDzx5hIssjUZOktGyoO4bLt%2FMJ7TRIfZk6wGvt5IdDQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ndate: Fri, 09 Oct 2026 02:23:51 GMT\r\nserver: cloudflare\r\ncf-ray: a479ecfddbc256c1-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12332,"size_decoded":4751,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12331)","md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-10-14T09:39:11.847925Z","times_seen":131847,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/logo-black.png","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.983Z","timestamp":1791512631983,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/logo-black.png HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:51 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f7b-f6f\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A8eI9ZTVCAuj95A1Ri2iEO0SwbAOFZW95IsVAVvWEBbOGtBQwH%2BXyIoE8TqzzpMUYMJVDSU%2FyGwzscNVkb4iG2S1gyN%2FYOBJRZ9qPL%2BPOpQFZGEs7jyaoQ0UAM0MbA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfddbc556c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3951\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3951,"size_decoded":4711,"mime_type":"image/png","magic":"PNG image data, 30 x 57, 8-bit/color RGBA, non-interlaced","md5":"add158184ce9a952a5d7e8091b38ceb2","sha1":"d1d887c2e0bdfd7c912ffdf01dae9140571152df","sha256":"c4876a509748f4f9105e282b4740e191e839c3ecb1a317aec7e0eec4f30da36d","sha512":"2ac124069567fcc251f989eb1357004bbc4b4cb9390e450a63ae62c9a1ebfc2a28b6162f7c6ed9f871078f05e179faab06f4d81a2216c02572cb3268635686c9","ssdeep":"","tlshash":"42816d7ecc764ef8afba14b50d446c82c0a92c5413414fb50f415c6826259bfd94824b","first_seen":"2025-08-29T02:40:17.690683Z","last_seen":"2026-10-09T02:24:23.844898Z","times_seen":9,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/icon-tap.jpg","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.986Z","timestamp":1791512631986,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/icon-tap.jpg HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:51 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:50 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f7a-63f\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mVn%2F6TovPXezqVBmuD9oPhllXQ0Rmu3VRWv7uBv2qLF1AIIuu%2BOSzeSPbv3qAd%2BJqPftbuqKQ9%2BfthFHcwOlhUNuaHBW%2BL9p%2FvTg6t%2BcTaxP7huFt9gSp5T9oi9xfw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfdebc756c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1599\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1599,"size_decoded":2366,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 51x50, components 3","md5":"400eb8998e781193227ca58cf822a505","sha1":"d41b727dd75c01a0cfe074ee3b8a091b76dd606d","sha256":"3cf91f9d795b9cecae3929140858350d797c554d97b57e525a90e0e6b6583556","sha512":"ccc63fceaacd441b15decbe79cd7ffa55330293f723197a236e112059493c1d00edaa7a1a7e0b4057bfd94f40e377ae04b161cac281337c5e332f37bf6b99838","ssdeep":"","tlshash":"6131879d07e1c713effa603a2039f372b3246d043515ab5b77706d59296baec09d2324","first_seen":"2025-08-29T02:40:17.693206Z","last_seen":"2026-10-09T02:24:23.845541Z","times_seen":9,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blog.mixer.money/wp-content/uploads/2026/10/716-main-Image-360x200.png","fqdn":"blog.mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.577Z","timestamp":1791512632577,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/10/716-main-Image-360x200.png HTTP/1.1\r\nHost: blog.mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 02 Oct 2026 07:06:03 GMT\r\npriority: u=5,i\r\netag: \"6abf57db-265f0\"\r\naccept-ranges: bytes\r\nage: 1511\r\ncache-control: max-age=1200\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g9TtMY1HgCD3T6V8dzHO1FTftKpbD7S%2BrSFk%2BYerVMm5PA%2BHY4hHS9ESYue%2FGvEayU7K1ZChNZEmkDYFAUpyFPpzf%2FxqjpN4GXTKu8c%2BWmbs8u5BvdK7gabwZL1aDIdTSuA2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ed019bf956c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 157168\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":157168,"size_decoded":157872,"mime_type":"image/png","magic":"PNG image data, 360 x 200, 8-bit/color RGBA, non-interlaced","md5":"56f61c087b8a6a5150f61d660586cb17","sha1":"64cd4729a1bbeee310c308f2ea1a3c6e18ad49b3","sha256":"dd9b060c801b4b63255a6bb83aaf87def745145ab1ffbc851c2c5e468de114dc","sha512":"3edd1e93ca40da5de62b3ce70ef4860fb7b5ba6d7bfcde77e5ff940e6df9185c3b27a8c6354348744ed94d4e9793f5bf14af00a6a759dc5c588e9567cbb47897","ssdeep":"3072:e4eY4scuOlt7DBm/DqRkgRTG4rxWKEtG414cpwJ4QUxRyAjK52jSK7gHdZu:fRepfBGD9+TIfpwJ2xxUG","tlshash":"ffe3126bd7a8dcb877405e7b54999dd8ec636f1fb6fbba00ac0de090d20a45124cc64b","first_seen":"2026-10-09T01:59:18.649664Z","last_seen":"2026-10-09T02:24:23.846135Z","times_seen":2,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":14,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"blog.mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"assets.replain.cc/uploads/files/logo/20190319/08c4c9c8-40fc-4961-943f-987e7ddee6e9.jpg","fqdn":"assets.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:53.964Z","timestamp":1791512633964,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"widget.replain.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 10:31:05 GMT","end":"Mon, 07 Dec 2026 10:31:04 GMT"},"fingerprint":{"sha1":"A4:F6:F6:3B:C6:D9:BB:56:9A:1C:43:04:BD:89:3B:B5:D0:AA:41:01","sha256":"A5:CE:94:0B:58:02:5A:05:C2:19:D9:B5:CE:04:E1:89:A7:48:29:9C:EE:49:38:7B:8A:C3:55:40:89:47:CF:C8"}}},"request":{"raw":"GET /uploads/files/logo/20190319/08c4c9c8-40fc-4961-943f-987e7ddee6e9.jpg HTTP/1.1\r\nHost: assets.replain.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mixer.money/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 09 Oct 2026 02:23:54 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 1801\r\netag: \"e2b7d3ad7e3a2fdecf7112794ec64b5f\"\r\nlast-modified: Thu, 20 Aug 2020 09:06:27 GMT\r\nx-amz-request-id: c65edcdd1a08dd58\r\nexpires: Sat, 09 Oct 2027 02:23:54 GMT\r\npragma: public\r\ncache-control: max-age=31536000, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1801,"size_decoded":2214,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 80x80, components 3","md5":"e2b7d3ad7e3a2fdecf7112794ec64b5f","sha1":"a1a269b038014073d5fc0b57ba8900d43b353a1e","sha256":"db8922b1edb8793f3d875a9e1d49fb35c1bf7519101ef9229adbe187e5bd672a","sha512":"11335c348bb930cb32241905ba6ce14d16d6960534c0f42b1ca4496bba4b8f36661b3df2fc8b0b9ea3fc454cca5d29f64dbdc4a80fbc600fde66ef5289aa0ed9","ssdeep":"","tlshash":"d631dbc6b5e6100ee430c83794e938543d7dce31f635224e0255af7e65259d26d97a08","first_seen":"2025-08-29T02:40:17.705664Z","last_seen":"2026-10-09T02:24:23.846951Z","times_seen":4,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":0,"dns":32,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/logo.png","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.981Z","timestamp":1791512631981,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/logo.png HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:51 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f7b-8db\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dVIaEcwKpkJ5N4aGNDtqq3Im7JnlWtH%2Faad7P4GZ1cHElFy%2BvoKjuINr5HGw9EnO0Myhw85B2P5zM4DeZJPORs37bVhiRiMkx%2BvKGU1JGPXUbYEfXLsTmGC4m9ik0A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfddbc456c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2267\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2267,"size_decoded":3025,"mime_type":"image/png","magic":"PNG image data, 30 x 57, 8-bit/color RGBA, non-interlaced","md5":"b92a0278dcf0ea0103ec0dfbb9a95c0f","sha1":"4ec07eb3bd97e965bcd3ac99d3d2447aa5c8b7ba","sha256":"947792269ab99efc6565b7d2079420abecc4c04f5e39db4c854d5b2fe01c3a38","sha512":"5bb3528852593624856c3a282f7f82c93bd93700e5bfc3dc627d4eb621fa7bcdbd8e53140111da5abcee2d6d638a1c92c76580a4aae2566646a7f1fcf5d037ae","ssdeep":"","tlshash":"46415cd2b5085430894c3b5fcaa776d3f4f138007222980505ee735378d65cf09d93b4","first_seen":"2025-08-29T02:40:17.706558Z","last_seen":"2026-10-09T02:24:23.847541Z","times_seen":9,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/icon-mail.jpg","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.995Z","timestamp":1791512631995,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/icon-mail.jpg HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:50 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f7a-4d1\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tOh5WYyLgYuFqVYfxR%2BH9c7UQ6sjhTaoZY9Z2vuTZTE%2BgpOQxZGu8NkidwUx5A3GdukHSIt1gjd0XPEEXUJ%2Fo1ArEOAG9nok7iwmlc8HeE4UZSeRV05dp3MCUbqPww%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfdfbcd56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1233\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1233,"size_decoded":1992,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3","md5":"fd9655c63045f327939f2c04095f8324","sha1":"37c4db68facb444194c9f4ad5700f03850564a54","sha256":"72469d9226f5838f79c06053806cbc53bd94b17388f6cc4a1f577b94e2dcd4a8","sha512":"f9248fa965d6c7f90de93a5888e0b05db8c893d469cf99824844def64a38a95f640a1d2804f0611a8b16f49d199b11d0654bb3414cae7d8d2db9b2f83f84c4fb","ssdeep":"","tlshash":"ab2163117b22b712fcf0573676f88e38e535ee4ca21f1f8e3a706885160e0980cc66d0","first_seen":"2025-08-29T02:40:17.71928Z","last_seen":"2026-10-09T02:24:23.848262Z","times_seen":9,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"widget.replain.cc/dist/client.js","fqdn":"widget.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.513Z","timestamp":1791512632513,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"widget.replain.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 10:31:05 GMT","end":"Mon, 07 Dec 2026 10:31:04 GMT"},"fingerprint":{"sha1":"A4:F6:F6:3B:C6:D9:BB:56:9A:1C:43:04:BD:89:3B:B5:D0:AA:41:01","sha256":"A5:CE:94:0B:58:02:5A:05:C2:19:D9:B5:CE:04:E1:89:A7:48:29:9C:EE:49:38:7B:8A:C3:55:40:89:47:CF:C8"}}},"request":{"raw":"GET /dist/client.js HTTP/1.1\r\nHost: widget.replain.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 14 Jul 2026 10:56:42 GMT\r\netag: W/\"6a5615ea-de8\"\r\nexpires: Fri, 09 Oct 2026 03:23:52 GMT\r\ncache-control: max-age=3600, public\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Re:plain","description":"Re:plain is a live chat integration for WhatsApp, Facebook Messenger, and Telegram, allowing you to connect live chat to your website.","website":"https://replain.cc","common_platform_enumeration":"","icon":"Replain.svg","categories":["Live chat"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3560,"size_decoded":1840,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3560), with no line terminators","md5":"6992743367265d7be6fad97c3463c05a","sha1":"c6a26d957c30d7b06da77aba6edb02591bea68b3","sha256":"2b463e04c28920ec3e56687aa49a0e0d0021dbed2d37ab78b2cf59dfab864414","sha512":"21cf66dbda2e27a6b995d39ecca572d84e42eaf03f2ba57de09958b4c33915e425fd44b268450aa81d223227ab5aae365fd674c47fd40b09eb49ec0024ea91b6","ssdeep":"","tlshash":"7d71a6f5a012943253a818e5abf1b758f57c29fdba068c54482dac3b248cec79c32ac4","first_seen":"2026-07-15T17:38:15.99514Z","last_seen":"2026-10-09T02:24:23.850077Z","times_seen":25,"resource_available":true,"data":null}},"time_used":414,"timings":{"blocked":-1,"dns":3,"connect":29,"send":0,"wait":29,"receive":0,"ssl":353},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"blog.mixer.money/wp-content/uploads/2026/09/715-RU-Image-360x200.png","fqdn":"blog.mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.578Z","timestamp":1791512632578,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/09/715-RU-Image-360x200.png HTTP/1.1\r\nHost: blog.mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 29 Sep 2026 06:26:11 GMT\r\npriority: u=5,i\r\netag: \"6abb5a03-1e4aa\"\r\naccept-ranges: bytes\r\nage: 1511\r\ncache-control: max-age=1200\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xLn0fOK1Z0gmtPcHoFXUON96Z%2F67HEYKDRexpQYhbk49W%2BtIpfvLbEWLPYY4RPfQJt9lRjWNtqZ8vEPebVp8geeSdtOS34VBNZn3LuOzvfbTOtemugQlF48Mej5SuE68zBI%2B\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ed019bfa56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 124074\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":124074,"size_decoded":124772,"mime_type":"image/png","magic":"PNG image data, 360 x 200, 8-bit/color RGBA, non-interlaced","md5":"6e70c1058c01646eb3f9f5df1cd53675","sha1":"c4e0227f41329f9bb4f15a85d83291a3a7b2f5c0","sha256":"585c4e605f61cb6e5841465d7219cdba60650e28edd852baf006cc33db70b93d","sha512":"bc6ab005baf22e2b4b06a0350a5a6149a917608587f3f7406b56f7b23eda0db57f8009035eb3182627ae6e6e78a6c6d13046fc4b703a07455f35095e5fa55872","ssdeep":"3072:rlG7QMrpjP/vvP3LJdoaKitNQ5iqgnVvFo2/b+:I7QMrpTf8cciB/Y","tlshash":"1bc312ee95df2dcda50d92070585f752f3ee63280d422b3c025e43b21e9a478e6706af","first_seen":"2026-10-09T01:59:18.631047Z","last_seen":"2026-10-09T02:24:23.851168Z","times_seen":2,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":3,"connect":2,"send":0,"wait":14,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"blog.mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/icon-protected-bitcoin.jpg","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.987Z","timestamp":1791512631987,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/icon-protected-bitcoin.jpg HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:50 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f7a-5d3\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ImPsFEGF9nLu%2BUHnqYPr7tyzxNjTi7JlMD7Iv7DPIwik3Ze89Ep14KHQXsNqhWT0eMaa4ZaE%2B07FAsnV29vvYbqUBDiLU1DPw7XrrlmchxWtR4Gy74j8Xq8Xl6sEUQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfdebc856c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1491\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1491,"size_decoded":2248,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3","md5":"9edf6c8f15c03f0030550cb8bc9b20ab","sha1":"beaec114e4c0398a85cdf641537935259b11fdf1","sha256":"4c6dfb14c0c94bc75f4572a85a5b2b71c17ae4ddd0763203522776f424a55389","sha512":"f4e45596fc90e26e294682f88650d7ecdd51820b523a2091fc568ce17550bceed0d53a035de4e431c139bd65b607c47eeb0b58864c63c897e8846ea306a7750a","ssdeep":"","tlshash":"183186147f159b09c9b2443f02789a5123a8ed49ba9a570f317c3c6da9278d06cc0a2d","first_seen":"2025-08-29T02:40:17.711521Z","last_seen":"2026-10-09T02:24:23.852802Z","times_seen":9,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/en","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-09T02:23:51.716Z","timestamp":1791512631716,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /en HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=0,i\r\ncontent-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data: https://*.replain.cc https://blog.mixer.money;object-src 'none';script-src 'self' https://widget.replain.cc 'unsafe-inline';script-src-attr 'none';style-src 'self' 'unsafe-inline' https://widget.replain.cc;upgrade-insecure-requests;connect-src 'self' https://*.replain.cc wss://*.replain.cc;media-src 'self' data: https://*.replain.cc;frame-src 'self' https://widget.replain.cc\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kNeaI9QdlVY0OPEVDRF3p2LHDvz5k6xnnXo5wfhe1G%2Fo07a%2B%2BHxo4TugS0xDT9HtcJ9cCrflfh6ir2u2lVXxtF0%2F5pKKQZKuX3Bs1r40QEj5bThSN2fMte9ITRyXWg%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a479ecfc3bb256c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28993,"size_decoded":8281,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (889), with CRLF line terminators","md5":"99bbc9e962787e6e48c139f4b5a7fdd1","sha1":"fbda61553a87669bdeb4c9044d79bb3b0b57a5ac","sha256":"cdb38f1affcba5c8adba5386bc908986256d3ed50c959323a60a8b9e7b43974e","sha512":"be79f25cb0e4753ab414fce500d2d452507d0af7303c7280f6229ae6f623d6f7188e924a93aaeb2bbf5a0c15864d1caf02f72364c0ac364e12b568f8524af918","ssdeep":"768:nupTfMzzzzOVVVVyVVVVWLpnJdbY8ggi8:u9vpE38","tlshash":"92d20c6044c2253b42b39191aa356b99fec1d183cb8b1a6172fda7c79ff7d80cda3158","first_seen":"2026-10-09T02:24:23.85395Z","last_seen":"2026-10-09T02:24:23.85395Z","times_seen":1,"resource_available":true,"data":null}},"time_used":69,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/background-image.jpg","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.267Z","timestamp":1791512632267,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/background-image.jpg HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:42 GMT\r\npriority: u=4,i\r\netag: \"5e2b1f72-73f0\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zrgWmnhh1RfwAJtGpyP2y24SyaP1rbWsi6pjGOVcTR7L8O8pVWJA2HJ3doFzOnpEhEHJGeY1tUL8GjhI3Lo80CMLKbSYna3bHGlFtsMX3Ph7G%2FFxrfChxSh%2FcrplCQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecffabd856c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 29680\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29680,"size_decoded":30439,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1301x524, components 3","md5":"a656b4a83374be41d820c36b253e237a","sha1":"9b8dfba4a396907af9e706768c88e18ccbbaa365","sha256":"f6a865a12fd4d38cb38c06af432c3d99e3cf7ee0acbb480c59677460ac7b9f15","sha512":"d6a00cfbcbb80ff03f5f97c08bfaaeb190a841ee4a3abc6b8e4d0e4bab4ec9be80a9ec3a6f85d8b522d1d77d5fc10b8cb32db9118d10e099ef406ed0699f7af6","ssdeep":"768:m3jT4eURnayUdhhXjz07SgGvEy1rBUePZR:KOahhTgn6z/RR","tlshash":"4ed2ae23ff51d396c699633158f30b1a3bb740b59b200747aa67093468b73487f39ba6","first_seen":"2025-08-29T02:40:17.708455Z","last_seen":"2026-10-09T02:24:23.8558Z","times_seen":9,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/scripts/news.min.js","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.278Z","timestamp":1791512632278,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /scripts/news.min.js HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: application/javascript\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 17 Sep 2026 06:23:41 GMT\r\npriority: u=1,i=?0\r\netag: \"6aab876d-11d\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Hqs%2BD8h3LhiyTzonXaMQBD9%2BPxvMurQM7yWTGtoTiue1WNwmzoWVctaFTQXGGZmcd7qUIL5tKmmJkNpDZRYoljnWoXzmDRgRc7mTs2M4BjEHewd1pjhBTSmkHlCRqQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecffbbda56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 285\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":285,"size_decoded":1056,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with no line terminators","md5":"8654fbd4d23ecdfbf661b7bded32f5a4","sha1":"0b725656610f60c798022a196377035d81e26f20","sha256":"26f6a7dd738590e57930ebf83604b65cbefc5b5c54cb4ab10542b50b53f4fe99","sha512":"46fafc505acfd19402a074fa4ba0efd19650ea68a641c73e43c4b8708d0bfaf9f638a4668af8600848f2a8956876c14f1dd2fbcd34f055627d1434a5a0e29212","ssdeep":"","tlshash":"ffd02bb31b0629b143fce56f725cdbc0742592e1180bd104a80c8c66b4f4e54c4f5e5c","first_seen":"2026-10-09T01:59:18.637248Z","last_seen":"2026-10-09T02:24:23.856524Z","times_seen":2,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blog.mixer.money/wp-content/uploads/2026/09/714-Image-EN-360x200.png","fqdn":"blog.mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.579Z","timestamp":1791512632579,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/09/714-Image-EN-360x200.png HTTP/1.1\r\nHost: blog.mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 29 Sep 2026 08:08:56 GMT\r\npriority: u=5,i\r\netag: \"6abb7218-214d4\"\r\naccept-ranges: bytes\r\nage: 1511\r\ncache-control: max-age=1200\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FWBbJpWVhCtNqu1YfNdYfR%2Bw9semjVGaOr2v1jwmMxW17%2FfOsS%2BTxmgfoX4zJ06owWe8%2BT88e5rXSi4u11U65RtxzxEwGjC8QqRwtYv890mndUlD%2FstLdAoChX45B2trhSs7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ed019bfb56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 136404\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":136404,"size_decoded":137108,"mime_type":"image/png","magic":"PNG image data, 360 x 200, 8-bit/color RGBA, non-interlaced","md5":"0ebba8dc98d5b4c06f9b3bb634ed7698","sha1":"dc5c0992fc6c6c82f7bd0c42128ed43d0b231ba9","sha256":"d57672fbb7fbf2fa7b7a9fa5a7388f505bf74401cf06c3b6d6825453ff236251","sha512":"fdbf32b8ab2eb67691936df737e204170f0374d1864b0191176c08911804c906aa694b0bd2d7d90969d95c264906ae29d4441b9522b7c86bff5d407a76d7f370","ssdeep":"3072:rhpjLJjD2qnQ3fSJosY51XUViBSZB8Zyu21Ixb:3jLJjD2qYfSJosq1Xai7Zyw","tlshash":"e4d31297c08ba6463259d839fa27adff7444f1ecdae824388ed16977dc0b9804cd86c5","first_seen":"2026-10-09T01:59:18.633645Z","last_seen":"2026-10-09T02:24:23.857448Z","times_seen":2,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":3,"connect":2,"send":0,"wait":19,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"blog.mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"widget.replain.cc/dist/js/lang-en-json.05f46a30.js","fqdn":"widget.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:53.884Z","timestamp":1791512633884,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"widget.replain.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 10:31:05 GMT","end":"Mon, 07 Dec 2026 10:31:04 GMT"},"fingerprint":{"sha1":"A4:F6:F6:3B:C6:D9:BB:56:9A:1C:43:04:BD:89:3B:B5:D0:AA:41:01","sha256":"A5:CE:94:0B:58:02:5A:05:C2:19:D9:B5:CE:04:E1:89:A7:48:29:9C:EE:49:38:7B:8A:C3:55:40:89:47:CF:C8"}}},"request":{"raw":"GET /dist/js/lang-en-json.05f46a30.js HTTP/1.1\r\nHost: widget.replain.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mixer.money/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 09 Oct 2026 02:23:53 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 14 Jul 2026 10:56:02 GMT\r\netag: W/\"6a5615c2-11da\"\r\nexpires: Sat, 09 Oct 2027 02:23:53 GMT\r\npragma: public\r\ncache-control: max-age=31536000, public, must-revalidate, proxy-revalidate\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4570,"size_decoded":2632,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (4551), with no line terminators","md5":"d7a821ec7334351e310e16c8b08df428","sha1":"cd17238529395534427fb6a521cec0a04f7dad42","sha256":"cdd7f9a220b5d81c3ebb77e922365a39cc8c605b5c0c71b1e90ef05405e77854","sha512":"94619581211ddde3206a4ab5c50bef936be59fa6df459c9c4ab25867b492d3b79217364ad4f5099e3aa06c835b0914d62b63c5cdb67a97d7ab29071ef0686044","ssdeep":"96:LIzp0rKPpi5QDP0OdRwbAQwzhra1zMu9zzlwjODFjgaEiW/wnLBb+PpD:LqpbDDP0Od+SBcwu8OtgaEDwnLsPpD","tlshash":"0b91951fd34265f81b410e5d7a1f3ae1a49050a946182bf265e939dd30ef61cf3cf1a8","first_seen":"2026-03-04T14:06:01.231253Z","last_seen":"2026-10-09T02:24:23.860047Z","times_seen":40,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.replain.cc/auth","fqdn":"app.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:53.369Z","timestamp":1791512633369,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"widget.replain.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 10:31:05 GMT","end":"Mon, 07 Dec 2026 10:31:04 GMT"},"fingerprint":{"sha1":"A4:F6:F6:3B:C6:D9:BB:56:9A:1C:43:04:BD:89:3B:B5:D0:AA:41:01","sha256":"A5:CE:94:0B:58:02:5A:05:C2:19:D9:B5:CE:04:E1:89:A7:48:29:9C:EE:49:38:7B:8A:C3:55:40:89:47:CF:C8"}}},"request":{"raw":"OPTIONS /auth HTTP/1.1\r\nHost: app.replain.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://mixer.money/\r\nOrigin: https://mixer.money\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 09 Oct 2026 02:23:53 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 0\r\nx-dns-prefetch-control: off\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nx-download-options: noopen\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: https://mixer.money\r\naccess-control-allow-headers: Authorization, Content-Type\r\naccess-control-allow-methods: OPTIONS,GET,POST,PUT,DELETE\r\naccess-control-allow-credentials: true\r\nallow: POST\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":631,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-14T09:42:46.355375Z","times_seen":19095059,"resource_available":true,"data":null}},"time_used":158,"timings":{"blocked":0,"dns":29,"connect":29,"send":0,"wait":35,"receive":0,"ssl":64},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/bitcoin-trouble-info.png","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.989Z","timestamp":1791512631989,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/bitcoin-trouble-info.png HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:44 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f74-3242\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q2r2A8ybetTrNM%2B50tn8L%2BlQ1oGntY1wqFngJtvS2j%2FqgP1nJtb%2BpoC9wK1pcXUBWIQ3ZRp1wNqfgiCTo%2F4tR0ZblS%2FCZ%2F6Lx5orSEVyYRLJWsor2OX7rQvfSuq8iQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfdebc956c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12866\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12866,"size_decoded":13634,"mime_type":"image/png","magic":"PNG image data, 360 x 118, 8-bit/color RGBA, non-interlaced","md5":"b57d4cf6b881b12fe58b0cbb87f82c2b","sha1":"0fea0d68987629c867ce19d7d48b89c2de7347c1","sha256":"bddb2df7bda37acef60f41676d63f2e5a0e53ccb123fc52600a9b89eb0e647f6","sha512":"3be1ba52533c6042d81e33fd32c8d23b6d8c1e73aa6bf312b78ff7ace10f172ebcdc89fd36147a321a4b8253bd6271c4eef086cd335a61837e206dabadf39e5d","ssdeep":"192:d7FcJUIDRfKqLFPn/rzCX9lJpNTVJ0RYc7+DBMr0sPFTxq1s+F0glqJOgNL2jqSU:dIUAhKqFHrWX9lhZCecKFMlheFHoSj6","tlshash":"d642c0e4feb2e4745de591a3e443960633a2db682cf4b05271c11218a51ddf1836ddce","first_seen":"2025-08-29T02:40:17.713685Z","last_seen":"2026-10-09T02:24:23.860677Z","times_seen":9,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/icon-lock.jpg","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.991Z","timestamp":1791512631991,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/icon-lock.jpg HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:50 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f7a-4ed\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EoV%2BuJDdKV9wHw4FWjlhtZeD7p%2FVt9nEhxblgaeBwrw3a%2FNSthWDZG2zngnp2SXTr2qpHNmTZqDZw8QMXFNQRsvkGaZCIKJw4CiKYpqJyWzioJj1c8blT8A90bWv6w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfdebca56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1261\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1261,"size_decoded":2020,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3","md5":"8f6d026e3f61fc1789b75ec8e7f9dcd4","sha1":"31c81f92af38cc191bc80fa09909188dc0163647","sha256":"455d14a9ed2f54dbc96b0348bd33d98ae3a7a5aacae00f4355bd23ba2bcd1f2f","sha512":"9bea56ade8cc0e20db023112677d08beb1c2296773645845a74240c62ef691607301143f4ec34421d0de6af761249e20e49a839f297407ae685313f74452aac8","ssdeep":"","tlshash":"842163261b268b02e1e74b3355b9831827987a4218037b4f62fc2d9039267f44ed1658","first_seen":"2025-08-29T02:40:17.695062Z","last_seen":"2026-10-09T02:24:23.861366Z","times_seen":9,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mixer.money/img/icon-guarantee.jpg","fqdn":"mixer.money","domain":"mixer.money","tld":"money"},"ip":{"addr":"104.21.48.188","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:51.994Z","timestamp":1791512631994,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mixer.money","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 02:17:57 GMT","end":"Tue, 22 Dec 2026 03:17:42 GMT"},"fingerprint":{"sha1":"53:6F:E1:61:2A:4B:47:66:F7:55:16:F4:E2:CE:37:27:33:F9:9A:DC","sha256":"E6:15:10:94:7B:6F:79:AE:5F:C6:AE:21:5D:47:FE:C5:93:25:E0:42:B1:E6:34:5A:E7:A0:17:88:BC:F4:15:E1"}}},"request":{"raw":"GET /img/icon-guarantee.jpg HTTP/1.1\r\nHost: mixer.money\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 24 Jan 2020 16:46:50 GMT\r\npriority: u=5,i\r\netag: \"5e2b1f7a-485\"\r\nexpires: Fri, 16 Oct 2026 01:58:39 GMT\r\ncache-control: public, max-age=604800, no-transform\r\nage: 1512\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sFlE7MWG7d%2FpqCFWRPh0P%2FNR0EbxqeU8XuoZnez2iFd6%2FWI%2FoJg4bOO2shtCotnH1aSEHBrlBkwX5u8JrFjzPpWogFP9BJ3GhUV3V0Od9gsnEpG2%2BiEny0nk0hGWCg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a479ecfdfbcc56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1157\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1157,"size_decoded":1920,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3","md5":"0930812dddf66edebe3cad852f07a726","sha1":"577ea06f1207ba89c4d68046ee6aca0e2637d1c0","sha256":"8c49c47f06de90e9faf0ef79657ff4b399a4a5b511efe979cad380ea14bfae81","sha512":"74f3ce357cf1314cdac9ae5df44a5480195d8e8a99f1a1f16e5d332ab8a87b8eb51301dd2dc4e61d71f7304d315a2b2ec97523ae610ee2488dd05f4482d00f3f","ssdeep":"","tlshash":"702175bf7b688b03f953003621784bb0274fbe4531026b1f60f92c18667b1da0dc51e8","first_seen":"2025-08-29T02:40:17.716301Z","last_seen":"2026-10-09T02:24:23.861996Z","times_seen":9,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"mixer.money","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"widget.replain.cc/dist/js/widget.5485a696.js","fqdn":"widget.replain.cc","domain":"replain.cc","tld":"cc"},"ip":{"addr":"178.21.8.220","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mixer.money/en","date":"2026-10-09T02:23:52.956Z","timestamp":1791512632956,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"widget.replain.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 10:31:05 GMT","end":"Mon, 07 Dec 2026 10:31:04 GMT"},"fingerprint":{"sha1":"A4:F6:F6:3B:C6:D9:BB:56:9A:1C:43:04:BD:89:3B:B5:D0:AA:41:01","sha256":"A5:CE:94:0B:58:02:5A:05:C2:19:D9:B5:CE:04:E1:89:A7:48:29:9C:EE:49:38:7B:8A:C3:55:40:89:47:CF:C8"}}},"request":{"raw":"GET /dist/js/widget.5485a696.js HTTP/1.1\r\nHost: widget.replain.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mixer.money/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 09 Oct 2026 02:23:52 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 14 Jul 2026 10:56:02 GMT\r\netag: W/\"6a5615c2-51102\"\r\nexpires: Sat, 09 Oct 2027 02:23:52 GMT\r\npragma: public\r\ncache-control: max-age=31536000, public, must-revalidate, proxy-revalidate\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Typeform","description":"Typeform is a Spanish online software as a service (SaaS) company that specialises in online form building and online surveys.","website":"https://www.typeform.com","common_platform_enumeration":"","icon":"Typeform.png","categories":["Surveys"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":332034,"size_decoded":118901,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (46361)","md5":"6ca17558cd7ebdc0372a04caf33212a1","sha1":"3d329885c2bb8969121f832e4928945a1c10454c","sha256":"2c04d367229cfbedac16fb429c530773588d2e673212a14f4607dc2852c1056d","sha512":"bb6be3f8295a753f686cccb9d5294c47c57ef6f33b084b3ac4fa893c7591b486efb1149d648d4dcfb233adaec1aad62634c16b33b81e153655365eea9b0b04f5","ssdeep":"3072:+vppUHu35V5lJl9XCztivPYOl9pmDuLvMdD5wQnWwoAiHbnIU5kkJYfrldQQJ3iF:oppEEV5XOztivDI7WyiLIUo5dd3iX4y","tlshash":"94642c897291b039479601f4643f2107f3392958780ad4b8f678ecda7e68c89627bf7c","first_seen":"2026-07-15T17:38:15.929991Z","last_seen":"2026-10-09T02:24:23.862616Z","times_seen":23,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}