{"report_id":"c941c27e-b418-41b1-a4d3-a0d842407858","version":0,"status":"done","tags":[],"date":"2026-07-12T23:42:04Z","url":{"schema":"http","addr":"pay-hoiafly.icu","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":0,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"pay-hoiafly.icu/","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"title":"Holafly Checkout","dom":{"size":28445,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (25283)","md5":"7d1ac9f78bebd9844bd503b958041431","sha1":"8d3d9a7e71b15d789e81c85b6b214309fae8f986","sha256":"b96cec86267d16e8a924495402f37f9da7c7a8e818991c4107223b95adfd42eb","sha512":"3e3559cbec0a13976d47da7661418637be9827aa6659d2747e3a846db5d1b8a1ba48866849ad1c88c58ba63fd1bb4c398a9e9eb672227f0190f3a834f8d2a23a","ssdeep":"384:XfsLc8GroEU8Qu5QKYHLiPwYDu/ibMqb8x2hMEiPwl:Xf4aoT8b5QaIYXH0Il","tlshash":"91d2f978631012bf5a03cbf8b7b4fb59610e9299da175144fbec032197c3ee6dca6498","dom_hash":"domhash489dabf20d0cc96e49d0a5b7cc12bc25","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"pay-hoiafly.icu","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":0,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-16T23:42:04Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-hoiafly.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"pay-hoiafly.icu","ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-06-11","domain_rank":0,"first_seen":"2026-07-12T20:35:32.319835Z","last_seen":"2026-07-12T20:35:32.319835Z","alert_count":18,"request_count":6,"received_data":788450,"sent_data":2781,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-12T22:22:25.184057Z","alert_count":0,"request_count":1,"received_data":10792,"sent_data":531,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-12T22:19:35.511658Z","alert_count":0,"request_count":3,"received_data":148035,"sent_data":1722,"comment":"","tags":null,"fingerprints":null},{"fqdn":"flagcdn.com","ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-04-05","domain_rank":30920,"first_seen":"2020-04-05T08:17:33Z","last_seen":"2026-07-10T06:13:48.09313Z","alert_count":0,"request_count":1,"received_data":994,"sent_data":535,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"pay-hoiafly.icu/config.js","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"c4d656c9def6694cc3e5374f36b59352","sha1":"fc3e785db17ae84ccb521110322cff39d8163f9f","sha256":"251417d43675973cd8025403c711835d16ff2e632b9a4853e26d2617e73d36be","sha512":"56e9b624c4d808747576ab36facc2d94cc19a9776a29a2e5ee9fe39d5f918e15c0986b25aa2e562b51062e8f17a7eaa776378faeabaab91ad2185b495fbdd519","ssdeep":"","tlshash":"17b09bdb57d64d57164445d80d3f1d59775f23cd4dc4455df3604124165de1290135cd","size":126,"data":"","first_seen":"2026-07-11T07:22:32.698784Z","last_seen":"2026-07-12T23:42:06.15699Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-hoiafly.icu/","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"7d94f0eb44c1c13bcdb76df08c3f333c","sha1":"6ff88498f01e890711ce0794bdcfc2cdb8beba95","sha256":"a4ea5acf7d8ba629eb2dfa5750db9eed8bb9706a1d7ea5882747723a39d280df","sha512":"979d73fde651f85ca1d638e6dcb0f7680932e44680370e5cf30b2e5ea7092023fcb391f33fa646e1c99d36aaf6f9801768f7366f803dc7cf7a87fd6f32bdc0df","ssdeep":"","tlshash":"8f41635df80774724ad276d0b1f6998bcf2a13944338cc44f92980c96780e8a876afb8","size":2312,"data":"","first_seen":"2026-07-11T07:22:32.707117Z","last_seen":"2026-07-12T23:42:06.162769Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-hoiafly.icu/assets/index-BI_SQCMl.js","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"15c5cdb12a00b5f930d3065c79328b66","sha1":"620b48650a8efa35c67ddf9cde23fbec584f8c77","sha256":"9f1077df8e724d91646b6ab49198f5c9a7720f53b1639bf9326c4eb6ca787af5","sha512":"4af62c0adf95233918665f29bd942b7fa990581850ebae4c654e7c980f8a7d17bdf51831f8d669ebe00773693ac1b32b24f73587b98d0e239eaff767dc0dabbd","ssdeep":"12288:i9Tg1d97DbxUAAj6kh5Zy0iDH9reC9npw+YqVUOGJEKGnq30/27B/qzZyHY:i9Tg1d97DbaAAj6kh5Zy0irpTtVUOGJU","tlshash":"63f48ed9b380227923f342e420992541f33d9968b626c5e4bedd48a52793df4633bb7c","size":742892,"data":"","first_seen":"2026-07-11T07:22:32.694912Z","last_seen":"2026-07-12T23:42:06.159383Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"PostHog init failedwindow.posthog.register is not a function","filename":"https://pay-hoiafly.icu/assets/index-BI_SQCMl.js","line_number":61,"column_number":179009}]},"http":[{"url":{"schema":"https","addr":"pay-hoiafly.icu/favicon.ico","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:38.170Z","timestamp":1783899698170,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-hoiafly.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 09:57:21 GMT","end":"Wed, 09 Sep 2026 09:57:20 GMT"},"fingerprint":{"sha1":"66:F3:BD:72:61:56:80:B2:76:3A:12:DA:3E:A1:0A:34:16:26:92:19","sha256":"CF:6D:7D:90:89:13:81:7D:57:51:70:CF:BC:94:6C:C3:00:4F:C7:41:91:23:F6:33:A5:77:98:A8:52:2D:01:41"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: pay-hoiafly.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-hoiafly.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 500 Internal Server Error\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 23:41:38 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 177\r\nConnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":177,"size_decoded":354,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"2491be81a371b392554cc7c86256998c","sha1":"c3f0cedd6c551ad74785082fc8cc66c19ef7c003","sha256":"f714729a10c9063767df157d00d20579edc1802a7360b6aa393ee7dcf7b221cc","sha512":"cc9884417a9ac5ef803e8674bc56a562905549dd5c339258e203363303b52cc016aecbdd7a971ce9f62ba2ec4e9e75e0482e3929b68e78834f3db1b948790f1d","ssdeep":"","tlshash":"5fc0807b27173c59c8b7257900c351c4d7c4411315f691008144861372c71c6dfc33d5","first_seen":"2026-07-04T06:00:05.01913Z","last_seen":"2026-07-12T23:42:06.148158Z","times_seen":7,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-hoiafly.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pay-hoiafly.icu/","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T23:41:36.809Z","timestamp":1783899696809,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-hoiafly.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 09:57:21 GMT","end":"Wed, 09 Sep 2026 09:57:20 GMT"},"fingerprint":{"sha1":"66:F3:BD:72:61:56:80:B2:76:3A:12:DA:3E:A1:0A:34:16:26:92:19","sha256":"CF:6D:7D:90:89:13:81:7D:57:51:70:CF:BC:94:6C:C3:00:4F:C7:41:91:23:F6:33:A5:77:98:A8:52:2D:01:41"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: pay-hoiafly.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 23:41:37 GMT\r\nContent-Type: text/html; charset=utf-8\r\nLast-Modified: Tue, 23 Jun 2026 19:06:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a3ad93e-c8c\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3212,"size_decoded":1824,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (2114)","md5":"967c2bdd73fa476e9a8980fa9bc510d5","sha1":"008cb48e6a714cf2bd4d50fd54d6ac438020d1c1","sha256":"b4d3e974301f776b8dc79a17694dee852056e6bd209d625d14127068d682bc67","sha512":"d9f94be577e8ca65ffe3e5d5318f7c1c34990f55c76651e5da9b1983c9958bfa567c1a8cf959bf9aea71a53e87cef50a858f2922490bc110e81fd900bf52dc65","ssdeep":"","tlshash":"cc61855eb842e422435166d5a4f1f84bdf5a13864338cc48f9aa80c95b81fca4a5beb8","first_seen":"2026-07-11T07:22:32.689015Z","last_seen":"2026-07-12T23:42:06.150054Z","times_seen":3,"resource_available":true,"data":null}},"time_used":279,"timings":{"blocked":-1,"dns":35,"connect":59,"send":0,"wait":60,"receive":0,"ssl":125},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-hoiafly.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:37.499Z","timestamp":1783899697499,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:24 GMT","end":"Mon, 14 Sep 2026 08:37:23 GMT"},"fingerprint":{"sha1":"85:D0:EC:C2:01:33:25:23:96:FB:2B:54:90:54:84:07:0A:49:1F:03","sha256":"9D:7C:1C:9C:6A:25:1E:17:E0:DC:FD:42:95:CA:47:3D:C1:9C:20:FB:22:47:02:E3:27:EC:7C:62:03:30:83:BA"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-hoiafly.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 12 Jul 2026 23:41:37 GMT\r\ndate: Sun, 12 Jul 2026 23:41:37 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":1447,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e85517dadd43448782d60d7f207fddce","sha1":"6cd31f870727ba8090fac9602b42524b4139a619","sha256":"88fbd0b95222be288587a149c324189ecbd8de0d6f0c94f528ec53857e52b66c","sha512":"5edc78df5bb062a9a2e1ea6724c14dd7eb80d77ea0fa9572de4bb0d52bbd0d163815b08a1ae77084f99fbefbb07715da1c61f0bb36fb498710c91387792955f8","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:vXuM0p2+4","tlshash":"04227792002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:13:11.065101Z","last_seen":"2026-07-16T19:39:39.031148Z","times_seen":34187,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":35,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-hoiafly.icu/assets/index-CqnhaLdu.css","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:37.504Z","timestamp":1783899697504,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-hoiafly.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 09:57:21 GMT","end":"Wed, 09 Sep 2026 09:57:20 GMT"},"fingerprint":{"sha1":"66:F3:BD:72:61:56:80:B2:76:3A:12:DA:3E:A1:0A:34:16:26:92:19","sha256":"CF:6D:7D:90:89:13:81:7D:57:51:70:CF:BC:94:6C:C3:00:4F:C7:41:91:23:F6:33:A5:77:98:A8:52:2D:01:41"}}},"request":{"raw":"GET /assets/index-CqnhaLdu.css HTTP/1.1\r\nHost: pay-hoiafly.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-hoiafly.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 23:41:37 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 23 Jun 2026 19:06:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a3ad93e-9e07\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40455,"size_decoded":10318,"mime_type":"text/css","magic":"ASCII text, with very long lines (40454)","md5":"5fbb818316c0319fb54eb124f5d71582","sha1":"417d2f7cbe6ced78ab3d13653ec266fef98b192e","sha256":"e8d3232e0108bca0c477dd1cc05cf32c5e02f3f9ce6ac8bf89a84f3cf0c45cae","sha512":"23a771be149297b4599cf18b654cb99050f558e783ef8d68a744cd4215ca2a02c64a21f430ede788425f76aa02b1cceafd8379bb581aec58983ed1534b3c920d","ssdeep":"768:MwAxycOvBv62B1vWpnOah0TrCaI0Xjyv1X:Mw+ycOvE2B1aCTrCaFmvF","tlshash":"8c03d7a4f329dd7fac33947e63acf81c5105a5829d2167d9ff02a1128ac77f31da2618","first_seen":"2026-07-11T07:22:32.703667Z","last_seen":"2026-07-12T23:42:06.154487Z","times_seen":3,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":58,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-hoiafly.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:38.072Z","timestamp":1783899698072,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-hoiafly.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 337976\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-16T19:40:10.366031Z","times_seen":236722,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":12,"dns":0,"connect":0,"send":0,"wait":28,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-hoiafly.icu/config.js","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:37.496Z","timestamp":1783899697496,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-hoiafly.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 09:57:21 GMT","end":"Wed, 09 Sep 2026 09:57:20 GMT"},"fingerprint":{"sha1":"66:F3:BD:72:61:56:80:B2:76:3A:12:DA:3E:A1:0A:34:16:26:92:19","sha256":"CF:6D:7D:90:89:13:81:7D:57:51:70:CF:BC:94:6C:C3:00:4F:C7:41:91:23:F6:33:A5:77:98:A8:52:2D:01:41"}}},"request":{"raw":"GET /config.js HTTP/1.1\r\nHost: pay-hoiafly.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-hoiafly.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 23:41:37 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 126\r\nLast-Modified: Tue, 23 Jun 2026 19:06:38 GMT\r\nConnection: keep-alive\r\nETag: \"6a3ad93e-7e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":126,"size_decoded":391,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"c4d656c9def6694cc3e5374f36b59352","sha1":"fc3e785db17ae84ccb521110322cff39d8163f9f","sha256":"251417d43675973cd8025403c711835d16ff2e632b9a4853e26d2617e73d36be","sha512":"56e9b624c4d808747576ab36facc2d94cc19a9776a29a2e5ee9fe39d5f918e15c0986b25aa2e562b51062e8f17a7eaa776378faeabaab91ad2185b495fbdd519","ssdeep":"","tlshash":"17b09bdb57d64d57164445d80d3f1d59775f23cd4dc4455df3604124165de1290135cd","first_seen":"2026-07-11T07:22:32.698784Z","last_seen":"2026-07-12T23:42:06.15699Z","times_seen":3,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-hoiafly.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pay-hoiafly.icu/ultramodule-1.0.6.js","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:37.501Z","timestamp":1783899697501,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-hoiafly.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 09:57:21 GMT","end":"Wed, 09 Sep 2026 09:57:20 GMT"},"fingerprint":{"sha1":"66:F3:BD:72:61:56:80:B2:76:3A:12:DA:3E:A1:0A:34:16:26:92:19","sha256":"CF:6D:7D:90:89:13:81:7D:57:51:70:CF:BC:94:6C:C3:00:4F:C7:41:91:23:F6:33:A5:77:98:A8:52:2D:01:41"}}},"request":{"raw":"GET /ultramodule-1.0.6.js HTTP/1.1\r\nHost: pay-hoiafly.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-hoiafly.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 500 Internal Server Error\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 23:41:37 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 177\r\nConnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":177,"size_decoded":354,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"2491be81a371b392554cc7c86256998c","sha1":"c3f0cedd6c551ad74785082fc8cc66c19ef7c003","sha256":"f714729a10c9063767df157d00d20579edc1802a7360b6aa393ee7dcf7b221cc","sha512":"cc9884417a9ac5ef803e8674bc56a562905549dd5c339258e203363303b52cc016aecbdd7a971ce9f62ba2ec4e9e75e0482e3929b68e78834f3db1b948790f1d","ssdeep":"","tlshash":"5fc0807b27173c59c8b7257900c351c4d7c4411315f691008144861372c71c6dfc33d5","first_seen":"2026-07-04T06:00:05.01913Z","last_seen":"2026-07-12T23:42:06.148158Z","times_seen":7,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":59,"send":0,"wait":59,"receive":0,"ssl":62},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-hoiafly.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pay-hoiafly.icu/assets/index-BI_SQCMl.js","fqdn":"pay-hoiafly.icu","domain":"pay-hoiafly.icu","tld":"icu"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:37.502Z","timestamp":1783899697502,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-hoiafly.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Jun 2026 09:57:21 GMT","end":"Wed, 09 Sep 2026 09:57:20 GMT"},"fingerprint":{"sha1":"66:F3:BD:72:61:56:80:B2:76:3A:12:DA:3E:A1:0A:34:16:26:92:19","sha256":"CF:6D:7D:90:89:13:81:7D:57:51:70:CF:BC:94:6C:C3:00:4F:C7:41:91:23:F6:33:A5:77:98:A8:52:2D:01:41"}}},"request":{"raw":"GET /assets/index-BI_SQCMl.js HTTP/1.1\r\nHost: pay-hoiafly.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-hoiafly.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 23:41:37 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Tue, 23 Jun 2026 19:06:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a3ad93e-b55ec\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":742892,"size_decoded":273260,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (43520)","md5":"15c5cdb12a00b5f930d3065c79328b66","sha1":"620b48650a8efa35c67ddf9cde23fbec584f8c77","sha256":"9f1077df8e724d91646b6ab49198f5c9a7720f53b1639bf9326c4eb6ca787af5","sha512":"4af62c0adf95233918665f29bd942b7fa990581850ebae4c654e7c980f8a7d17bdf51831f8d669ebe00773693ac1b32b24f73587b98d0e239eaff767dc0dabbd","ssdeep":"12288:i9Tg1d97DbxUAAj6kh5Zy0iDH9reC9npw+YqVUOGJEKGnq30/27B/qzZyHY:i9Tg1d97DbaAAj6kh5Zy0irpTtVUOGJU","tlshash":"63f48ed9b380227923f342e420992541f33d9968b626c5e4bedd48a52793df4633bb7c","first_seen":"2026-07-11T07:22:32.694912Z","last_seen":"2026-07-12T23:42:06.159383Z","times_seen":3,"resource_available":true,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":58,"send":0,"wait":119,"receive":176,"ssl":64},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-hoiafly.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-hoiafly.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flagcdn.com/w40/no.png","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:38.046Z","timestamp":1783899698046,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 31 May 2026 01:26:53 GMT","end":"Sat, 29 Aug 2026 02:26:16 GMT"},"fingerprint":{"sha1":"D2:6E:B0:B6:96:56:08:49:68:3B:CB:E0:E3:66:23:60:CD:73:2B:8D","sha256":"F5:81:41:B3:1E:2C:6F:26:A5:EF:89:3C:3C:84:66:48:2D:2F:E3:EA:E4:EF:C2:ED:58:8E:15:45:FB:B1:55:93"}}},"request":{"raw":"GET /w40/no.png HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-hoiafly.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 12 Jul 2026 23:41:38 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 01 Jul 2025 15:39:58 GMT\r\netag: \"6864014e-a4\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\naccept-ranges: bytes\r\npriority: u=5,i\r\nage: 493910\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BW3nuiXfKz%2BerQ35Rt6cYhtDV3Ty3VREZJooDgm8EA8SV8xM3RYHiBMH1VvgoZlESMo5DCfpH2AgJV%2FQRh4WjmGA1t7KE0pgFsn22j%2Bu5LmgPvNlI1lNJrnJbTzB9A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a1a3e658edecb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 164\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":164,"size_decoded":994,"mime_type":"image/png","magic":"PNG image data, 40 x 29, 4-bit colormap, non-interlaced","md5":"9d9545b9ce771270e7a1a09765cc48b3","sha1":"bdfa440b450c434248da8e98daf25faa49e0b32e","sha256":"2b03bf0a83b55ad0d9ebe2576dddc0d1eee11ee8cb6476363e2649ce9baaf003","sha512":"74224e9d0ec0d6e2efd01835480673ffec46660303e9b2886335c9262d4300f6ce7a868d321d66519fc71ce355584f8aa08550180a6e6dba458c3f9501c6e8bf","ssdeep":"","tlshash":"e5c080c17fd55cb5d5c7657a2421402158f9345877452d0144545a1158d711c71c918b","first_seen":"2025-02-12T08:32:15.780066Z","last_seen":"2026-07-15T10:09:36.878267Z","times_seen":203,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":3,"connect":13,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:38.068Z","timestamp":1783899698068,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-hoiafly.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 337976\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-16T19:40:10.366031Z","times_seen":236722,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":17,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-hoiafly.icu/","date":"2026-07-12T23:41:38.070Z","timestamp":1783899698070,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-hoiafly.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 337976\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-16T19:40:10.366031Z","times_seen":236722,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":12,"dns":0,"connect":0,"send":0,"wait":21,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}