{"report_id":"d82a88f0-9e8e-44c5-82ff-6e0df7959546","version":0,"status":"done","tags":[],"date":"2026-07-12T20:35:18Z","url":{"schema":"http","addr":"pay-bitrefili.com","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"ip":{"addr":"158.94.210.56","port":0,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"pay-bitrefili.com/","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"title":"Bitrefill Checkout","dom":{"size":6557,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4678)","md5":"21aa51d730bbd82d222e4b2a55a7af81","sha1":"b93eab8719c6c1fce79ebd27b5a40c82cdd71dfb","sha256":"3572be0bb134d1f05b6d210b756dd28438433f2994d57f968fdac1f25a23b674","sha512":"a448c1861ed06228d528ec9f45fe0845b74d3ae4b66b69b903a213446c127336124a30634c00b4530277ffedb3e771dbaad83b42383490bb6b82e30cafa96b92","ssdeep":"96:wfjZ5GBGctASvP2EPS4vAL027xbcyJgIw0DcXWThZi9FL:yN5KhvP2EK4q0AbcigI7PZM","tlshash":"e3d1866a3801c1bb1b1345f8d260fa3da14aa74edf13d645f2b582633bc6ffa484946c","dom_hash":"domhash83aa2f6af085e3ffd439d2dfe3d5b8ce","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"pay-bitrefili.com","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"ip":{"addr":"158.94.210.56","port":0,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-16T20:35:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-bitrefili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-bitrefili.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"us-assets.i.posthog.com","ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-01-23","domain_rank":57965,"first_seen":"2024-02-22T12:48:35Z","last_seen":"2026-07-09T08:46:29.545581Z","alert_count":0,"request_count":8,"received_data":530170,"sent_data":3928,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"us.i.posthog.com","ip":{"addr":"18.213.57.175","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2020-01-23","domain_rank":42193,"first_seen":"2024-02-22T12:48:36Z","last_seen":"2026-07-09T09:05:01.752136Z","alert_count":0,"request_count":2,"received_data":852,"sent_data":978,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"pay-bitrefili.com","ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-05-13","domain_rank":0,"first_seen":"2026-07-12T12:02:51.162759Z","last_seen":"2026-07-12T12:02:51.162759Z","alert_count":12,"request_count":6,"received_data":717224,"sent_data":2803,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-05T22:19:28.847206Z","alert_count":0,"request_count":4,"received_data":197380,"sent_data":2304,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-05T22:22:24.069932Z","alert_count":0,"request_count":1,"received_data":10792,"sent_data":533,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/surveys.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ef58c953ca96eba6a10dd08181c6c159","sha1":"18023adee65fcfc14506ea15f9f1621f055e3a76","sha256":"206ab18791f0f30359fb7a35570edc7da6439ef83a02b3f1b38bfa2e0e122ef5","sha512":"e04cab5861caba84854d6f708423106a02c1adc36a7266a3318a6d1b4fb75f0e97abf7f54369d75404d336184da2c31754edb406bf3ca647fe9af90c50a70170","ssdeep":"1536:f9foHWuM2F5zfQvo73NNh09+k1IdxUSpIdoh+5dcv:fRo2u15co73+5eIdZyv","tlshash":"2f934cd5ba01f06e51eb81b420be5843f33d6b1afa0d4c14b1179c943dd6988a39ffa6","size":97151,"data":"","first_seen":"2026-07-07T17:49:28.305236Z","last_seen":"2026-07-17T02:30:56.575892Z","times_seen":826,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/web-vitals.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"27dfddaff41bd95880aa8898ef7193e1","sha1":"db9c8df6f248264c2b57bccf7aeed328b23e7cf1","sha256":"5962d5e5c5d5c47d7332856ebe1dbcdc12538422e5131204b8d98697a2eec762","sha512":"35ef5764486938115833225af0b8fe1ccfbe556f4526d76078549c20eaec8235a5c901b50a6c5bda87b5c01ca3c603d8f29b7a35e78fa7ada789e26dea2fad62","ssdeep":"96:EaAn/CG4vzq4AQCClXTlUWUlDmSuseUuM+hyljTK8m6DUNinuUPp51/7CPij:uCG7RCNTJU0TfMjlj+9Y5Pp3mij","tlshash":"56d1d7e9af81d43412bed6aa90795153373a67a66108419ce23effd014ac4c6235ff36","size":6664,"data":"","first_seen":"2026-06-30T16:58:51.64992Z","last_seen":"2026-07-17T17:20:12.056933Z","times_seen":1330,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/exception-autocapture.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ace47db0206b6f18e5cdf5a4ce2a35e","sha1":"a7962bc00e70eecfbc7335c7d98404e21087df91","sha256":"4ce543f25ef3706c08a669ed2977425f05da81f16c17e73b6cfba05ceaa3e2a3","sha512":"ee91975f20145f94f318ef6b2cd581ae9bd9c4ecc17cdc98d69d72f922092b82c8f381139952d8d8cc5755f12527f5078ae018eb1461f972ced5840936f8a103","ssdeep":"192:7/OCa99IV2b834vcvYYIQxFPMHZaaKVtDAVTc3Gw+UOU5HVxdHuaXNAHyB7RTcdH:bVc8oizE5avjDAFc3Gw+UOU51zOuASB6","tlshash":"a732c7c57ad1b0aa8be31810207f1103f2be1f56748ce1a1f157e668b5e6d49d233fa6","size":11840,"data":"","first_seen":"2026-05-05T22:03:43.994635Z","last_seen":"2026-07-14T15:16:29.310285Z","times_seen":3095,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/posthog-recorder.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a515094186779894ea6cfd829e92bd09","sha1":"70d1d44c67b1531eff1b6201d601d478ad2694dd","sha256":"428162ee911176ab17679d606439449924c5b6c970b5f75c04d224ede8ea993f","sha512":"91392c41e610f3205d18958bdc192cb22d0f890925fc71b5228c5695a1c041d445c9feba685a7eb2454c5ea115c6d26826394afac216999f026f98bf0dbc94da","ssdeep":"3072:rE8dE25XN0RmNpAOyPL0q0zcB0tA8fj2P6R:rE8dE+XCmNpAOyPgq0zcB0tA2Ws","tlshash":"62f34cca7775a03357e6512580af0203f2353b19704a80a8f2aed9e9357c9c771b7b7a","size":162473,"data":"","first_seen":"2026-07-10T23:00:55.785494Z","last_seen":"2026-07-13T16:18:41.404129Z","times_seen":165,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/array.js","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b085ae6d569b0298e68adc6b7381a77b","sha1":"13fdc4390cbdce00f43205c870ff742cbc16a8ef","sha256":"7b30f076ae01406a88f52129b1e17f0cae77500ca90c3ce467a5430495eb6104","sha512":"bcf215ad7139c08f070f8c1ccb18352bbda798ee8ae46c64ba899bb35058e95c06851b26e1164755a33bbb1db9586f63c482d9670cc2bdb860c464ccfd46aed8","ssdeep":"3072:C1uA9wN+P0AKfkrxyjWbKqEy2Nbl2yihk+CNIVBudaDWbi04KJXFD:C1uA9H0M1yjWOqEyB/BudaRKJVD","tlshash":"52240c87b77ad03246e690a590360103e33a7b4a6149c06cf36addcd359d98ab277f36","size":225730,"data":"","first_seen":"2026-07-10T23:15:07.001726Z","last_seen":"2026-07-17T02:30:56.59758Z","times_seen":125,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/logs.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ffd316dfeb9638c5afce77eff6a5cc27","sha1":"e361580f8ab77a4b8a77aaf74e45b951776dd68e","sha256":"93db254d7d7756a1eb08cacac79abfa993c30c25f2c7033e54084d6928535aec","sha512":"e55f86a67fbb7e1191e0cbcb5c110aec9f29aa49019c5ca291c01d700f68ff515e16e7e9f02dad9c7f5692f7db65fadc947dd11ecbebbecab136783118602cca","ssdeep":"96:MCzHgNGT/6qWmN9mYqjyfwnVrOwDrcf07pem9E/4F2i:MCUNa6Xe9mSGzDrcf07peEE/4F2i","tlshash":"fc91a5863b93e0a54eba59cc983e4142d2366f749c0cd8c2c126cda828fd60adc7dd9d","size":4346,"data":"","first_seen":"2026-07-06T23:28:01.836061Z","last_seen":"2026-07-14T02:53:35.194812Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a1dcf1410999dcc119381158507e6ee4","sha1":"d58d8b138ca85c12f1df858ba8e8bb3dfe37795b","sha256":"df2d1ccc78018763e20686001e480740fd819aa93262f877de3efd95c8fa9643","sha512":"c5df5a46c30b9051916539494a1d7d0adbbebfe55fda0f15bd9839a7c45eb001ede18f3396913abff8e29c58c531b9d6e0c39e56f866f667ddd612a90928e134","ssdeep":"384:alS6foKt9ElKHkWECmuGQA6kHugnhXiUzih1ouZ0bFEUHOFb+:0ElhPH/nhSUzihCU0bFEUHOFb+","tlshash":"af62f9c87a50f2721ada485a807f0702f13a6a58654bc824b112fdcd746db9252fbe7f","size":14719,"data":"","first_seen":"2026-07-10T23:00:55.774726Z","last_seen":"2026-07-17T02:30:56.615864Z","times_seen":302,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitrefili.com/assets/index-BEPmboYs.js","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"69f3be019fea1983620456d24a91efbe","sha1":"c7814d72e1525f0c354f94451c8e9d9d3ce9d01f","sha256":"ffb67d3b5ddcec3f2b75ae40065efef2fd1a972865c4ac1d15f0d076c66cbf39","sha512":"855bf9eeb7686ad48ad3847bbce0c6a871b9cdc23135ae174e41df26564bd284183af68d8c3b3bc65dd78d0e470ef5ea502b32fa0fcd0fc288f5f9757ce8c433","ssdeep":"12288:3itmGBMU+mAyBm/CGpcvac9pt8DlRP0q1qzZyHu:3itmGBMU+mAyBMpcvPalR8q1WZyHu","tlshash":"08e48dd97380227913f301e461c92541f33d9668b226c5e4baad48652b87ef8737b7bc","size":678729,"data":"","first_seen":"2026-07-12T12:02:55.258185Z","last_seen":"2026-07-12T20:35:21.089602Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/array/phc_sfQdqnsQ6Yria3KgeCVG4r5rUtPDNJv9jVMcHW3PE3Lk/config.js","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"585b2ef03733269e7a5b5d6c64afc0ca","sha1":"794b941c86a3a6f198ed7c4352ecf996caec3b81","sha256":"3c12e5a0aabcef3c57b101587db263d2685e849b55f0f08d36b405d4812f344a","sha512":"113a81eab908123c71b6716b935cdc6f16b4ba13e8fd81a70d87323222a33ab1a524144f3f85896a5118f1ed42db2298ccb4355f0d37541cd6b1758667f5ec75","ssdeep":"","tlshash":"d121443d696404b9848e4724968b7d02efbe022731085c78f8dc8f8061fe1efa143b03","size":1227,"data":"","first_seen":"2026-07-12T12:02:55.246985Z","last_seen":"2026-07-12T20:35:21.091503Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/exception-autocapture.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:51.635Z","timestamp":1783888491635,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 05:00:09 GMT","end":"Thu, 01 Oct 2026 05:00:08 GMT"},"fingerprint":{"sha1":"68:9B:F0:B7:41:5D:1A:0A:61:51:4B:F0:79:B8:2A:6B:90:4A:0A:35","sha256":"E6:03:4C:B9:FB:6E:49:7F:B5:58:7E:95:71:48:C5:EA:B5:5D:1C:F8:E1:E1:F5:80:8E:26:AE:AE:39:D5:21:46"}}},"request":{"raw":"GET /static/exception-autocapture.js?v=1.399.2 HTTP/1.1\r\nHost: us-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:34:52 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a1a2d4c0b8ec0b55-OSL\r\ncf-cache-status: REVALIDATED\r\nx-amz-version-id: xWqF2Jm99QA0nRkC4__HgPn3KxprPzJ2\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Fri, 10 Jul 2026 22:15:12 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: EeNDsIusnA945NBlue1T6aAfcH2m2rkI5ZFg1+g7nQLjl4j4JiuhCOPXXfBO2LY1n0km17/e6cL0QoPK/LOt2oCISOGWUmE5\r\nx-amz-request-id: 0QF1QB66SH0X3Z68\r\netag: W/\"4ace47db0206b6f18e5cdf5a4ce2a35e\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":11840,"size_decoded":5181,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11789)","md5":"4ace47db0206b6f18e5cdf5a4ce2a35e","sha1":"a7962bc00e70eecfbc7335c7d98404e21087df91","sha256":"4ce543f25ef3706c08a669ed2977425f05da81f16c17e73b6cfba05ceaa3e2a3","sha512":"ee91975f20145f94f318ef6b2cd581ae9bd9c4ecc17cdc98d69d72f922092b82c8f381139952d8d8cc5755f12527f5078ae018eb1461f972ced5840936f8a103","ssdeep":"192:7/OCa99IV2b834vcvYYIQxFPMHZaaKVtDAVTc3Gw+UOU5HVxdHuaXNAHyB7RTcdH:bVc8oizE5avjDAFc3Gw+UOU51zOuASB6","tlshash":"a732c7c57ad1b0aa8be31810207f1103f2be1f56748ce1a1f157e668b5e6d49d233fa6","first_seen":"2026-05-05T22:03:43.994635Z","last_seen":"2026-07-14T15:16:29.310285Z","times_seen":3095,"resource_available":true,"data":null}},"time_used":518,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":518,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us.i.posthog.com/i/v0/e/?_=1783888500216","fqdn":"us.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"18.213.57.175","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:35:00.222Z","timestamp":1783888500222,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Sun, 16 Nov 2025 00:00:00 GMT","end":"Tue, 15 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6A:93:A0:4B:D8:27:D0:2A:1E:35:71:6C:A2:1C:2A:2C:2E:E1:A7:D7","sha256":"2A:1F:69:7F:28:B0:DA:BD:59:C5:0F:27:B3:35:6D:E9:5B:8B:A2:4A:F8:89:F1:F0:10:CD:CD:8F:62:8E:07:E6"}}},"request":{"raw":"POST /i/v0/e/?_=1783888500216 HTTP/1.1\r\nHost: us.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: text/plain\r\nReferer: https://pay-bitrefili.com/\r\nContent-Length: 1269\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1867,"data":"\u001f‹\b\u0000\u0000\u0000\u0000\u0000\u0000\u0003½VmoÛ6\u0010þ+†\u000f\u001b\u00109zµ$÷c»vØÖ¢ÅÒ\u0016[\u0011\u0010\u0014u’XK¤JQ¶“ ÿ}GÉräXíÒ}X`Äð½ðȻ瞻O÷V×ñÌZ[Ž›äaìP; ~fGà†6õ\u001cßöbŸ\u0001Kh\u001c¤žuiÁ\u0016„Fó‹\u001d¤dË5­Z”6J6 4‡ÖZß[\u0017\u0012¿¬\\drg´ø›lAµ\\\n”»Ž\u0011¥\nu ð÷K® —{#Ì`Ë\u0019\u0010}Û\u0000*^@»Ñ²1\nÍk¸“ÂHß_?ŸJˆÌó\u0016ðF\u000e\nY§\u0014^tªBËRë¦]_]5ôÖN¹Æ(¼âK\u0026ë+s@)[óŽ3¥Ñ5T—‚Ö\u0026\\o«èŽtx[B‹áõ¯å\u001d¯*z\u0015.ÅO‡‡.Þ\\/\\gé\u003c[ `\u0015\u003c[ìÍ?µ]»~°t~^¼\u0002¶‘Wžã:øq\u0017‡g_õÚIF\u001e2…š‰¸¢¢è0\u003eF\u0007a¿ÿӚёƼcߛ\u0018}Ë\u0014€ %ð¢Äk»Ž\u0017\u003cHw\u003cÓ%\n½Ø¤nËa×H¥\u001f\u001b\u001få§æ\u0015O1\nbÀ\u001a~Lë»ô“di°rÁ\u0005ÞN“\u001e_éÝç$ _í`¿a«cYñÈ(öã8\u000e’hé¹ý\u0005³\rÉx«\t+©\u0010`jÉ21\u001cÈ5§\u0015¿£\u001aƒ‘Áßò\u001coe;‘ízמ³öƒuè.ƒ(øÛx0)r^t\n2ÒBێ^²Ó¤F”º±cþ.-\u0013\u000bv¸ì±\u0019|?\u000bìÈM˜F,¶iè†\u0019‹VCÙ\u0004°?âÃJƒƒn\b$ºªšŠÄVŽç=RI•a¡g\u0014\bàÚ`~F5´\u0003»=SÐZv\u0006ǃø‚vZ2Úh̒É;M«\u003e[\nkJZžaŠsls¸œ6=\u00011c§U÷ȌV•Ü¡Y\rZqÖ\u001ecžAÓ\u0017qŒü½\u00033 \u0019a\u0015g›o\u0004\u001e/˜AÚ\u0015$ç\nѓc$Ò\nÚ´¥Ô}Õ[Mëf\u00028ÏsV#ÞzGØk\u0010\u0006$-1P3·.¥)n{+X©¤]Ohßö0a\u0006d\u0019ހ\u001c°\u0004†å.2ìw¦­£”‹‚d²¦\\œj\u001fŽVÐTô\u0016¿j©‘\u0014\u0015/\n|oM5+ó€ìcBÏüz¦\u003eºáÓughy\u0014Œ…ž‰\u0004ú\u001f=+.6Xœ¼¢Å\u0013O8t%¾\u001f1n\u001e†æH\u001a\nhÛóɃâØýƒç\u0004e/Ÿ¿%‡Éto\u001d˜\u001behµ¥U\u0007=mù—–BÚ\u0010˜2«Ò\u001c‘A¥é¨DoÕ\u000f°O÷_o.­¾§·¡ý\u0000\u00167H°·C'N’dåz^Œ'\bºåEOF×ÃÐ:\bÀú±q4‹N7t'\tzL2¹cGé*°cÈ#;ˆÝ0\biL3\u001aö¹égÒ¿ú¬\u0002×\u0003ºŠcëëyBOR§å\u0006L5š’‘6—}\u0011í»Õ_ŠSÿ÷\u0002žx\u0015¨P½×o_¼ùm›|þðšýúÑû‹ÿÇ恃\u0011'9í*Ý\u001e\u0019Ûµ}Çúß^8\tdJm\u001ak®;çl¾Ù«'¶OÙ:N=¾·ƒœZžm$Ón\u0019š‹2Í·0۔\\hP‚V$íòÜì\u000b \n3Ìã§\u0018·ØoÖÚ\u000b¢881\u001fÑ=^4ëTß\bÖ:òO-G‹¾±'\u0000wƒØ›»A^umi\u0018¾ì̚L¹Ýôì§'\u0002ç„ûonÌÙㄨé\u001eƒ4º$f8A†,sœ+第L· 6¤šµêÕTkŠC7;αÇ\u0006\u0003Õ¡\u0019ԍž·\u0003Sþ/\u001dt0ÉGƒËžÙÌÎ7\u000fjG\u0011Mì4\u0003;\fÃ8O¼ÔÁ§÷Û\u0013Ψ\fKÆs\u003e}\u001b.ï\f+DpƒGÆÅ\u001dR\"\u000e'3Õ¬wXZ@n¯¹!fÓ\b\u0006z='`ò“\u0004ÙcÜÃ}Çñ¿Þü\u0003a\u0004\u000bNX\f\u0000\u0000"}},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:35:00 GMT\r\ncontent-type: application/json\r\ncontent-length: 15\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: https://pay-bitrefili.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 22\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":15,"size_decoded":426,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-07-17T17:40:53.531854Z","times_seen":40282,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitrefili.com/ultramodule-1.0.6.js","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.299Z","timestamp":1783888490299,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitrefili.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 10:00:19 GMT","end":"Tue, 11 Aug 2026 10:00:18 GMT"},"fingerprint":{"sha1":"99:5C:41:A8:50:0E:EB:A1:D0:91:87:00:0A:8E:FA:F3:BA:7F:0B:0F","sha256":"1D:E3:19:B4:C7:87:FF:5D:22:C8:20:C7:83:6A:9E:B4:1E:5E:EB:A8:F0:8D:94:E0:CE:A7:97:52:81:E1:AF:E7"}}},"request":{"raw":"GET /ultramodule-1.0.6.js HTTP/1.1\r\nHost: pay-bitrefili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 500 Internal Server Error\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 20:34:50 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 177\r\nConnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":177,"size_decoded":354,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"2491be81a371b392554cc7c86256998c","sha1":"c3f0cedd6c551ad74785082fc8cc66c19ef7c003","sha256":"f714729a10c9063767df157d00d20579edc1802a7360b6aa393ee7dcf7b221cc","sha512":"cc9884417a9ac5ef803e8674bc56a562905549dd5c339258e203363303b52cc016aecbdd7a971ce9f62ba2ec4e9e75e0482e3929b68e78834f3db1b948790f1d","ssdeep":"","tlshash":"5fc0807b27173c59c8b7257900c351c4d7c4411315f691008144861372c71c6dfc33d5","first_seen":"2026-07-04T06:00:05.01913Z","last_seen":"2026-07-12T23:42:06.148158Z","times_seen":7,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":58,"send":0,"wait":59,"receive":0,"ssl":63},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-bitrefili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-bitrefili.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitrefili.com/assets/index-BEPmboYs.js","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.300Z","timestamp":1783888490300,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitrefili.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 10:00:19 GMT","end":"Tue, 11 Aug 2026 10:00:18 GMT"},"fingerprint":{"sha1":"99:5C:41:A8:50:0E:EB:A1:D0:91:87:00:0A:8E:FA:F3:BA:7F:0B:0F","sha256":"1D:E3:19:B4:C7:87:FF:5D:22:C8:20:C7:83:6A:9E:B4:1E:5E:EB:A8:F0:8D:94:E0:CE:A7:97:52:81:E1:AF:E7"}}},"request":{"raw":"GET /assets/index-BEPmboYs.js HTTP/1.1\r\nHost: pay-bitrefili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 20:34:50 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 10 Jul 2026 15:25:41 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a510ef5-a5b49\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":678729,"size_decoded":242479,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (42551)","md5":"69f3be019fea1983620456d24a91efbe","sha1":"c7814d72e1525f0c354f94451c8e9d9d3ce9d01f","sha256":"ffb67d3b5ddcec3f2b75ae40065efef2fd1a972865c4ac1d15f0d076c66cbf39","sha512":"855bf9eeb7686ad48ad3847bbce0c6a871b9cdc23135ae174e41df26564bd284183af68d8c3b3bc65dd78d0e470ef5ea502b32fa0fcd0fc288f5f9757ce8c433","ssdeep":"12288:3itmGBMU+mAyBm/CGpcvac9pt8DlRP0q1qzZyHu:3itmGBMU+mAyBMpcvPalR8q1WZyHu","tlshash":"08e48dd97380227913f301e461c92541f33d9668b226c5e4baad48652b87ef8737b7bc","first_seen":"2026-07-12T12:02:55.258185Z","last_seen":"2026-07-12T20:35:21.089602Z","times_seen":2,"resource_available":true,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":60,"send":0,"wait":120,"receive":185,"ssl":63},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-bitrefili.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-bitrefili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.907Z","timestamp":1783888490907,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 326768\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-17T17:37:11.014411Z","times_seen":237793,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/array/phc_sfQdqnsQ6Yria3KgeCVG4r5rUtPDNJv9jVMcHW3PE3Lk/config.js","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:51.479Z","timestamp":1783888491479,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 05:00:09 GMT","end":"Thu, 01 Oct 2026 05:00:08 GMT"},"fingerprint":{"sha1":"68:9B:F0:B7:41:5D:1A:0A:61:51:4B:F0:79:B8:2A:6B:90:4A:0A:35","sha256":"E6:03:4C:B9:FB:6E:49:7F:B5:58:7E:95:71:48:C5:EA:B5:5D:1C:F8:E1:E1:F5:80:8E:26:AE:AE:39:D5:21:46"}}},"request":{"raw":"GET /array/phc_sfQdqnsQ6Yria3KgeCVG4r5rUtPDNJv9jVMcHW3PE3Lk/config.js HTTP/1.1\r\nHost: us-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:34:51 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=300\r\nvary: Origin, Referer,origin, access-control-request-method, access-control-request-headers, Accept-Encoding\r\naccess-control-allow-origin: https://pay-bitrefili.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 2\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nlast-modified: Sun, 12 Jul 2026 20:34:51 GMT\r\ncf-cache-status: EXPIRED\r\ncf-ray: a1a2d4bfc84a0b55-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":1227,"size_decoded":1245,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1027)","md5":"585b2ef03733269e7a5b5d6c64afc0ca","sha1":"794b941c86a3a6f198ed7c4352ecf996caec3b81","sha256":"3c12e5a0aabcef3c57b101587db263d2685e849b55f0f08d36b405d4812f344a","sha512":"113a81eab908123c71b6716b935cdc6f16b4ba13e8fd81a70d87323222a33ab1a524144f3f85896a5118f1ed42db2298ccb4355f0d37541cd6b1758667f5ec75","ssdeep":"","tlshash":"d121443d696404b9848e4724968b7d02efbe022731085c78f8dc8f8061fe1efa143b03","first_seen":"2026-07-12T12:02:55.246985Z","last_seen":"2026-07-12T20:35:21.091503Z","times_seen":2,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":0,"dns":0,"connect":1,"send":0,"wait":125,"receive":0,"ssl":9},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:51.631Z","timestamp":1783888491631,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 05:00:09 GMT","end":"Thu, 01 Oct 2026 05:00:08 GMT"},"fingerprint":{"sha1":"68:9B:F0:B7:41:5D:1A:0A:61:51:4B:F0:79:B8:2A:6B:90:4A:0A:35","sha256":"E6:03:4C:B9:FB:6E:49:7F:B5:58:7E:95:71:48:C5:EA:B5:5D:1C:F8:E1:E1:F5:80:8E:26:AE:AE:39:D5:21:46"}}},"request":{"raw":"GET /static/dead-clicks-autocapture.js?v=1.399.2 HTTP/1.1\r\nHost: us-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:34:52 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a1a2d4c0b8e80b55-OSL\r\ncf-cache-status: REVALIDATED\r\nx-amz-version-id: qekj69Y1WO8EHOYTD9ulrWP4BgPR_ZrW\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Fri, 10 Jul 2026 22:15:12 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: FiZfVx1aeO/laOpMc75A9ZC9UUqXy33XzNW4cMXEDxajiFyXGfawb7A9yvWvyI0lSnue8l2xLalA92qs49jwiMsRCVFPW0GI\r\nx-amz-request-id: 0QF0CFMS61AKFHYA\r\netag: W/\"a1dcf1410999dcc119381158507e6ee4\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14719,"size_decoded":6391,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (14666)","md5":"a1dcf1410999dcc119381158507e6ee4","sha1":"d58d8b138ca85c12f1df858ba8e8bb3dfe37795b","sha256":"df2d1ccc78018763e20686001e480740fd819aa93262f877de3efd95c8fa9643","sha512":"c5df5a46c30b9051916539494a1d7d0adbbebfe55fda0f15bd9839a7c45eb001ede18f3396913abff8e29c58c531b9d6e0c39e56f866f667ddd612a90928e134","ssdeep":"384:alS6foKt9ElKHkWECmuGQA6kHugnhXiUzih1ouZ0bFEUHOFb+:0ElhPH/nhSUzihCU0bFEUHOFb+","tlshash":"af62f9c87a50f2721ada485a807f0702f13a6a58654bc824b112fdcd746db9252fbe7f","first_seen":"2026-07-10T23:00:55.774726Z","last_seen":"2026-07-17T02:30:56.615864Z","times_seen":302,"resource_available":true,"data":null}},"time_used":502,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":502,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/web-vitals.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:51.633Z","timestamp":1783888491633,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 05:00:09 GMT","end":"Thu, 01 Oct 2026 05:00:08 GMT"},"fingerprint":{"sha1":"68:9B:F0:B7:41:5D:1A:0A:61:51:4B:F0:79:B8:2A:6B:90:4A:0A:35","sha256":"E6:03:4C:B9:FB:6E:49:7F:B5:58:7E:95:71:48:C5:EA:B5:5D:1C:F8:E1:E1:F5:80:8E:26:AE:AE:39:D5:21:46"}}},"request":{"raw":"GET /static/web-vitals.js?v=1.399.2 HTTP/1.1\r\nHost: us-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:34:52 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a1a2d4c0b8ea0b55-OSL\r\ncf-cache-status: REVALIDATED\r\nx-amz-version-id: f9elv7QwlrMBBS6ouQkSnfMIUoKr7kIa\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Fri, 10 Jul 2026 22:15:12 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: QFAl+T9llZJhzI/Adzg3iq7vRm+q6EVeJ0kg7mEjC6cDx2XxH+mSCZyYJuiTD5quh/caM3Di/g6GBClapkpT79yiOcAIzVo7\r\nx-amz-request-id: 0QF50RYX8T4VFG1H\r\netag: W/\"27dfddaff41bd95880aa8898ef7193e1\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6664,"size_decoded":3533,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (6624)","md5":"27dfddaff41bd95880aa8898ef7193e1","sha1":"db9c8df6f248264c2b57bccf7aeed328b23e7cf1","sha256":"5962d5e5c5d5c47d7332856ebe1dbcdc12538422e5131204b8d98697a2eec762","sha512":"35ef5764486938115833225af0b8fe1ccfbe556f4526d76078549c20eaec8235a5c901b50a6c5bda87b5c01ca3c603d8f29b7a35e78fa7ada789e26dea2fad62","ssdeep":"96:EaAn/CG4vzq4AQCClXTlUWUlDmSuseUuM+hyljTK8m6DUNinuUPp51/7CPij:uCG7RCNTJU0TfMjlj+9Y5Pp3mij","tlshash":"56d1d7e9af81d43412bed6aa90795153373a67a66108419ce23effd014ac4c6235ff36","first_seen":"2026-06-30T16:58:51.64992Z","last_seen":"2026-07-17T17:20:12.056933Z","times_seen":1330,"resource_available":true,"data":null}},"time_used":507,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":507,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitrefili.com/config.js","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.294Z","timestamp":1783888490294,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitrefili.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 10:00:19 GMT","end":"Tue, 11 Aug 2026 10:00:18 GMT"},"fingerprint":{"sha1":"99:5C:41:A8:50:0E:EB:A1:D0:91:87:00:0A:8E:FA:F3:BA:7F:0B:0F","sha256":"1D:E3:19:B4:C7:87:FF:5D:22:C8:20:C7:83:6A:9E:B4:1E:5E:EB:A8:F0:8D:94:E0:CE:A7:97:52:81:E1:AF:E7"}}},"request":{"raw":"GET /config.js HTTP/1.1\r\nHost: pay-bitrefili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 500 Internal Server Error\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 20:34:50 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 177\r\nConnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":177,"size_decoded":354,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"2491be81a371b392554cc7c86256998c","sha1":"c3f0cedd6c551ad74785082fc8cc66c19ef7c003","sha256":"f714729a10c9063767df157d00d20579edc1802a7360b6aa393ee7dcf7b221cc","sha512":"cc9884417a9ac5ef803e8674bc56a562905549dd5c339258e203363303b52cc016aecbdd7a971ce9f62ba2ec4e9e75e0482e3929b68e78834f3db1b948790f1d","ssdeep":"","tlshash":"5fc0807b27173c59c8b7257900c351c4d7c4411315f691008144861372c71c6dfc33d5","first_seen":"2026-07-04T06:00:05.01913Z","last_seen":"2026-07-12T23:42:06.148158Z","times_seen":7,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-bitrefili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-bitrefili.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.297Z","timestamp":1783888490297,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:24 GMT","end":"Mon, 14 Sep 2026 08:37:23 GMT"},"fingerprint":{"sha1":"85:D0:EC:C2:01:33:25:23:96:FB:2B:54:90:54:84:07:0A:49:1F:03","sha256":"9D:7C:1C:9C:6A:25:1E:17:E0:DC:FD:42:95:CA:47:3D:C1:9C:20:FB:22:47:02:E3:27:EC:7C:62:03:30:83:BA"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 12 Jul 2026 20:34:50 GMT\r\ndate: Sun, 12 Jul 2026 20:34:50 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":1447,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e85517dadd43448782d60d7f207fddce","sha1":"6cd31f870727ba8090fac9602b42524b4139a619","sha256":"88fbd0b95222be288587a149c324189ecbd8de0d6f0c94f528ec53857e52b66c","sha512":"5edc78df5bb062a9a2e1ea6724c14dd7eb80d77ea0fa9572de4bb0d52bbd0d163815b08a1ae77084f99fbefbb07715da1c61f0bb36fb498710c91387792955f8","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:vXuM0p2+4","tlshash":"04227792002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:13:11.065101Z","last_seen":"2026-07-17T17:49:26.282139Z","times_seen":34314,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":36,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/posthog-recorder.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:51.623Z","timestamp":1783888491623,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 05:00:09 GMT","end":"Thu, 01 Oct 2026 05:00:08 GMT"},"fingerprint":{"sha1":"68:9B:F0:B7:41:5D:1A:0A:61:51:4B:F0:79:B8:2A:6B:90:4A:0A:35","sha256":"E6:03:4C:B9:FB:6E:49:7F:B5:58:7E:95:71:48:C5:EA:B5:5D:1C:F8:E1:E1:F5:80:8E:26:AE:AE:39:D5:21:46"}}},"request":{"raw":"GET /static/posthog-recorder.js?v=1.399.2 HTTP/1.1\r\nHost: us-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:34:52 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a1a2d4c0a8e00b55-OSL\r\ncf-cache-status: REVALIDATED\r\nx-amz-version-id: XhT6GJjy7L7oOfELv121O06tx1TidhsI\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Fri, 10 Jul 2026 22:15:12 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: A8oBKVLyRVWl5tnsvs0dCFQF+8E6leUtJvM1OW4+EXlILcc1eTXUHDjOJ06h/lxqWgGphz3xurAZkEcs+YQGL4XJ0fXoRuu1\r\nx-amz-request-id: 0QFEPB2ASX0D4N1E\r\netag: W/\"a515094186779894ea6cfd829e92bd09\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":162473,"size_decoded":53346,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a515094186779894ea6cfd829e92bd09","sha1":"70d1d44c67b1531eff1b6201d601d478ad2694dd","sha256":"428162ee911176ab17679d606439449924c5b6c970b5f75c04d224ede8ea993f","sha512":"91392c41e610f3205d18958bdc192cb22d0f890925fc71b5228c5695a1c041d445c9feba685a7eb2454c5ea115c6d26826394afac216999f026f98bf0dbc94da","ssdeep":"3072:rE8dE25XN0RmNpAOyPL0q0zcB0tA8fj2P6R:rE8dE+XCmNpAOyPgq0zcB0tA2Ws","tlshash":"62f34cca7775a03357e6512580af0203f2353b19704a80a8f2aed9e9357c9c771b7b7a","first_seen":"2026-07-10T23:00:55.785494Z","last_seen":"2026-07-13T16:18:41.404129Z","times_seen":165,"resource_available":true,"data":null}},"time_used":516,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":516,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/logs.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:51.628Z","timestamp":1783888491628,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 05:00:09 GMT","end":"Thu, 01 Oct 2026 05:00:08 GMT"},"fingerprint":{"sha1":"68:9B:F0:B7:41:5D:1A:0A:61:51:4B:F0:79:B8:2A:6B:90:4A:0A:35","sha256":"E6:03:4C:B9:FB:6E:49:7F:B5:58:7E:95:71:48:C5:EA:B5:5D:1C:F8:E1:E1:F5:80:8E:26:AE:AE:39:D5:21:46"}}},"request":{"raw":"GET /static/logs.js?v=1.399.2 HTTP/1.1\r\nHost: us-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:34:52 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a1a2d4c0a8e50b55-OSL\r\ncf-cache-status: REVALIDATED\r\nx-amz-version-id: 6olpl_7f0jhg8eUIzh6cvp1I.J5bzUGz\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Fri, 10 Jul 2026 22:15:12 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: heiLy7M2GvfIGQqm95Lv1d0tGM7dAmNFND5Sn9DgwMX2nF8ypRBu5iLzeJ0OmK1Jc4aGu/fTYEc=\r\nx-amz-request-id: 0QF04EJN80S1VGWM\r\netag: W/\"ffd316dfeb9638c5afce77eff6a5cc27\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":4346,"size_decoded":2605,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4312)","md5":"ffd316dfeb9638c5afce77eff6a5cc27","sha1":"e361580f8ab77a4b8a77aaf74e45b951776dd68e","sha256":"93db254d7d7756a1eb08cacac79abfa993c30c25f2c7033e54084d6928535aec","sha512":"e55f86a67fbb7e1191e0cbcb5c110aec9f29aa49019c5ca291c01d700f68ff515e16e7e9f02dad9c7f5692f7db65fadc947dd11ecbebbecab136783118602cca","ssdeep":"96:MCzHgNGT/6qWmN9mYqjyfwnVrOwDrcf07pem9E/4F2i:MCUNa6Xe9mSGzDrcf07peEE/4F2i","tlshash":"fc91a5863b93e0a54eba59cc983e4142d2366f749c0cd8c2c126cda828fd60adc7dd9d","first_seen":"2026-07-06T23:28:01.836061Z","last_seen":"2026-07-14T02:53:35.194812Z","times_seen":19,"resource_available":true,"data":null}},"time_used":491,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":491,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us.i.posthog.com/e/?_=1783888494477","fqdn":"us.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"18.213.57.175","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:54.483Z","timestamp":1783888494483,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Sun, 16 Nov 2025 00:00:00 GMT","end":"Tue, 15 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6A:93:A0:4B:D8:27:D0:2A:1E:35:71:6C:A2:1C:2A:2C:2E:E1:A7:D7","sha256":"2A:1F:69:7F:28:B0:DA:BD:59:C5:0F:27:B3:35:6D:E9:5B:8B:A2:4A:F8:89:F1:F0:10:CD:CD:8F:62:8E:07:E6"}}},"request":{"raw":"POST /e/?_=1783888494477 HTTP/1.1\r\nHost: us.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: text/plain\r\nReferer: https://pay-bitrefili.com/\r\nContent-Length: 890\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:34:54 GMT\r\ncontent-type: application/json\r\ncontent-length: 15\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: https://pay-bitrefili.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 22\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":15,"size_decoded":426,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-07-17T17:40:53.531854Z","times_seen":40282,"resource_available":false,"data":null}},"time_used":413,"timings":{"blocked":-1,"dns":9,"connect":93,"send":0,"wait":118,"receive":0,"ssl":192},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitrefili.com/","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T20:34:49.639Z","timestamp":1783888489639,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitrefili.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 10:00:19 GMT","end":"Tue, 11 Aug 2026 10:00:18 GMT"},"fingerprint":{"sha1":"99:5C:41:A8:50:0E:EB:A1:D0:91:87:00:0A:8E:FA:F3:BA:7F:0B:0F","sha256":"1D:E3:19:B4:C7:87:FF:5D:22:C8:20:C7:83:6A:9E:B4:1E:5E:EB:A8:F0:8D:94:E0:CE:A7:97:52:81:E1:AF:E7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: pay-bitrefili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 20:34:49 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 868\r\nLast-Modified: Fri, 10 Jul 2026 15:25:41 GMT\r\nConnection: keep-alive\r\nETag: \"6a510ef5-364\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":868,"size_decoded":1121,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"41e067c1db09d9c3be5539410dade066","sha1":"5b4bcd501bc18d346634731a8936a359cba66bd3","sha256":"83ec491827cf70cd13e16a6b565173b586993a6225caaee0908749520a2d1591","sha512":"f5f9ff2765da3901aeb4d750ef26173d8399b3e8568c5990764683e2c443e91408c10681fb0927826ff5860324d93d059953f0637821af5d49923e06f723da38","ssdeep":"","tlshash":"e1111e876ce0c819231047925c90f419ed87968b87089ca8b5fb80fccf597c64d8b998","first_seen":"2026-07-12T12:02:55.257071Z","last_seen":"2026-07-12T20:35:21.095365Z","times_seen":2,"resource_available":true,"data":null}},"time_used":246,"timings":{"blocked":-1,"dns":3,"connect":59,"send":0,"wait":60,"receive":0,"ssl":124},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-bitrefili.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-bitrefili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.855Z","timestamp":1783888490855,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 326768\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-17T17:37:11.014411Z","times_seen":237793,"resource_available":false,"data":null}},"time_used":115,"timings":{"blocked":3,"dns":1,"connect":41,"send":0,"wait":17,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitrefili.com/favicon.ico","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:51.129Z","timestamp":1783888491129,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitrefili.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 10:00:19 GMT","end":"Tue, 11 Aug 2026 10:00:18 GMT"},"fingerprint":{"sha1":"99:5C:41:A8:50:0E:EB:A1:D0:91:87:00:0A:8E:FA:F3:BA:7F:0B:0F","sha256":"1D:E3:19:B4:C7:87:FF:5D:22:C8:20:C7:83:6A:9E:B4:1E:5E:EB:A8:F0:8D:94:E0:CE:A7:97:52:81:E1:AF:E7"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: pay-bitrefili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 500 Internal Server Error\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 20:34:51 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 177\r\nConnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":177,"size_decoded":354,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"2491be81a371b392554cc7c86256998c","sha1":"c3f0cedd6c551ad74785082fc8cc66c19ef7c003","sha256":"f714729a10c9063767df157d00d20579edc1802a7360b6aa393ee7dcf7b221cc","sha512":"cc9884417a9ac5ef803e8674bc56a562905549dd5c339258e203363303b52cc016aecbdd7a971ce9f62ba2ec4e9e75e0482e3929b68e78834f3db1b948790f1d","ssdeep":"","tlshash":"5fc0807b27173c59c8b7257900c351c4d7c4411315f691008144861372c71c6dfc33d5","first_seen":"2026-07-04T06:00:05.01913Z","last_seen":"2026-07-12T23:42:06.148158Z","times_seen":7,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-bitrefili.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-bitrefili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pay-bitrefili.com/assets/index-Dzq-v-UJ.css","fqdn":"pay-bitrefili.com","domain":"pay-bitrefili.com","tld":"com"},"ip":{"addr":"158.94.210.56","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.302Z","timestamp":1783888490302,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pay-bitrefili.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 10:00:19 GMT","end":"Tue, 11 Aug 2026 10:00:18 GMT"},"fingerprint":{"sha1":"99:5C:41:A8:50:0E:EB:A1:D0:91:87:00:0A:8E:FA:F3:BA:7F:0B:0F","sha256":"1D:E3:19:B4:C7:87:FF:5D:22:C8:20:C7:83:6A:9E:B4:1E:5E:EB:A8:F0:8D:94:E0:CE:A7:97:52:81:E1:AF:E7"}}},"request":{"raw":"GET /assets/index-Dzq-v-UJ.css HTTP/1.1\r\nHost: pay-bitrefili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.3\r\nDate: Sun, 12 Jul 2026 20:34:50 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 10 Jul 2026 15:25:41 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a510ef5-8bc8\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35784,"size_decoded":9317,"mime_type":"text/css","magic":"ASCII text, with very long lines (35783)","md5":"1edfc7982fcac41caacea99702811eaf","sha1":"865aab86cd918a29cb7c0ad8347241b9e18b53f7","sha256":"47f0b30522793cb916e179c0c509a45ee3a69d0797f95d45beafc255939adeba","sha512":"70c7d85165ed3c81a82080e7638682e6176d9e021a8a44558f71ffb89f68017f4d79643206ef3140848c99e60bbaa7af14bebf5662fa543551adea008aa684a4","ssdeep":"384:U3KtdksAYTSwygle6vYBG35WysfATuTrC3yT0JPpzSstS1XjSu/pbb:U3Qryce6vYBG35WysfSuTrC3T0XjVBX","tlshash":"56f2d664f329dd7fac33947e63acf81c520576829e2167e9ff0261028ac77f61d61628","first_seen":"2026-07-12T12:02:55.252638Z","last_seen":"2026-07-12T20:35:21.096569Z","times_seen":2,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":59,"send":0,"wait":59,"receive":0,"ssl":62},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"pay-bitrefili.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"pay-bitrefili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/array.js","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.831Z","timestamp":1783888490831,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 05:00:09 GMT","end":"Thu, 01 Oct 2026 05:00:08 GMT"},"fingerprint":{"sha1":"68:9B:F0:B7:41:5D:1A:0A:61:51:4B:F0:79:B8:2A:6B:90:4A:0A:35","sha256":"E6:03:4C:B9:FB:6E:49:7F:B5:58:7E:95:71:48:C5:EA:B5:5D:1C:F8:E1:E1:F5:80:8E:26:AE:AE:39:D5:21:46"}}},"request":{"raw":"GET /static/array.js HTTP/1.1\r\nHost: us-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:34:51 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a1a2d4bc2c7ab4eb-OSL\r\ncf-cache-status: REVALIDATED\r\nx-amz-version-id: _D6TwHZxCEaJt0HBi0xoziga155gpd.S\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Fri, 10 Jul 2026 22:15:12 GMT\r\nserver: cloudflare\r\nx-amz-id-2: sitnzDv0ZJmmNiuVSUqm5zmeW12NgVRbKy/AAlYJc1nD9Hy5bhXiKfcI8EWBQ9ueloACfemLSFN6WzA17Nri6TeNIqWXn0B5\r\nx-amz-request-id: AEQ5TBXRD9A75RPT\r\netag: W/\"b085ae6d569b0298e68adc6b7381a77b\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":225730,"size_decoded":73494,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65530), with no line terminators","md5":"b085ae6d569b0298e68adc6b7381a77b","sha1":"13fdc4390cbdce00f43205c870ff742cbc16a8ef","sha256":"7b30f076ae01406a88f52129b1e17f0cae77500ca90c3ce467a5430495eb6104","sha512":"bcf215ad7139c08f070f8c1ccb18352bbda798ee8ae46c64ba899bb35058e95c06851b26e1164755a33bbb1db9586f63c482d9670cc2bdb860c464ccfd46aed8","ssdeep":"3072:C1uA9wN+P0AKfkrxyjWbKqEy2Nbl2yihk+CNIVBudaDWbi04KJXFD:C1uA9H0M1yjWOqEyB/BudaRKJVD","tlshash":"52240c87b77ad03246e690a590360103e33a7b4a6149c06cf36addcd359d98ab277f36","first_seen":"2026-07-10T23:15:07.001726Z","last_seen":"2026-07-17T02:30:56.59758Z","times_seen":125,"resource_available":true,"data":null}},"time_used":563,"timings":{"blocked":0,"dns":3,"connect":2,"send":0,"wait":485,"receive":0,"ssl":73},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.902Z","timestamp":1783888490902,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 326768\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-17T17:37:11.014411Z","times_seen":237793,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:50.912Z","timestamp":1783888490912,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 01:48:42 GMT\r\nexpires: Fri, 09 Jul 2027 01:48:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 326768\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-17T17:37:11.014411Z","times_seen":237793,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us-assets.i.posthog.com/static/surveys.js?v=1.399.2","fqdn":"us-assets.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"104.20.17.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pay-bitrefili.com/","date":"2026-07-12T20:34:51.627Z","timestamp":1783888491627,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 05:00:09 GMT","end":"Thu, 01 Oct 2026 05:00:08 GMT"},"fingerprint":{"sha1":"68:9B:F0:B7:41:5D:1A:0A:61:51:4B:F0:79:B8:2A:6B:90:4A:0A:35","sha256":"E6:03:4C:B9:FB:6E:49:7F:B5:58:7E:95:71:48:C5:EA:B5:5D:1C:F8:E1:E1:F5:80:8E:26:AE:AE:39:D5:21:46"}}},"request":{"raw":"GET /static/surveys.js?v=1.399.2 HTTP/1.1\r\nHost: us-assets.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://pay-bitrefili.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pay-bitrefili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 20:34:52 GMT\r\ncontent-type: application/javascript\r\ncf-ray: a1a2d4c0a8e20b55-OSL\r\ncf-cache-status: REVALIDATED\r\nx-amz-version-id: scG3U4gjTwljst3DW3eKTQC3hlqT_uV1\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400\r\nx-amz-server-side-encryption: AES256\r\nlast-modified: Fri, 10 Jul 2026 22:15:12 GMT\r\nserver: cloudflare\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\naccess-control-allow-methods: POST, GET, DELETE, PUT\r\naccess-control-expose-headers: ETag\r\naccess-control-max-age: 3000\r\nx-amz-id-2: TxPVzB8u7C68cdak5KzL8+xHiKlkLJ+UF8myt3KuPdeiUyD2lGvyVgmxyo1witgvAQTpGp1AbTiCqcm/Akplg1KQANrhV/Ln\r\nx-amz-request-id: 0QF7J2ZT1GNZDX38\r\netag: W/\"ef58c953ca96eba6a10dd08181c6c159\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97151,"size_decoded":33168,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"ef58c953ca96eba6a10dd08181c6c159","sha1":"18023adee65fcfc14506ea15f9f1621f055e3a76","sha256":"206ab18791f0f30359fb7a35570edc7da6439ef83a02b3f1b38bfa2e0e122ef5","sha512":"e04cab5861caba84854d6f708423106a02c1adc36a7266a3318a6d1b4fb75f0e97abf7f54369d75404d336184da2c31754edb406bf3ca647fe9af90c50a70170","ssdeep":"1536:f9foHWuM2F5zfQvo73NNh09+k1IdxUSpIdoh+5dcv:fRo2u15co73+5eIdZyv","tlshash":"2f934cd5ba01f06e51eb81b420be5843f33d6b1afa0d4c14b1179c943dd6988a39ffa6","first_seen":"2026-07-07T17:49:28.305236Z","last_seen":"2026-07-17T02:30:56.575892Z","times_seen":826,"resource_available":true,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}