{"report_id":"eaa8d027-8c4b-4789-990f-0db19bf42ac8","version":0,"status":"done","tags":[],"date":"2026-08-30T04:36:08Z","url":{"schema":"https","addr":"refundsnoot.com/","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"ip":{"addr":"198.251.88.188","port":0,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"final":{"url":{"schema":"https","addr":"refundsnoot.com/","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"title":"RefundsNoot | FICA Tip Credit Recovery","dom":{"size":4779,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4754)","md5":"7ca9d5fea005f810a96ed3b267b8e75f","sha1":"7a6e3e3162e371cf98fc88392a4bf934c09fb55b","sha256":"725dbffb793ec2ba757671fab953c2850032d385914796a178f82d7928465792","sha512":"1190627aa79a256769a868b83d78f93be15552dee11317fbc3146217b06c92950ccb2e4039a6765314412b252ee33b5f2ff3bdb33f78d547a1893f8826e2aa48","ssdeep":"96:sLk5AfJpxMeFSEJr2YwL1YwokFz9tpnhUs1pu4sE14AcoTUO/JJFAR5O:spaWxrupvnhUs1pNsEGm4O/X","tlshash":"baa19572a09275366d2715e6bcb763ca61fbc229e2460c00f1fc879d8fd9c40f9665a2","dom_hash":"domhash232ce231e338893871a167036e12879a","first_seen":"2026-08-30T04:36:09.521063Z","last_seen":"2026-08-30T04:36:56.681479Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"refundsnoot.com/","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"ip":{"addr":"198.251.88.188","port":0,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-04T04:36:08Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"refundsnoot.com","ip":{"addr":"198.251.88.188","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-30T04:32:14.237118Z","last_seen":"2026-08-30T04:32:14.237118Z","alert_count":0,"request_count":6,"received_data":196998,"sent_data":3182,"comment":"","tags":null,"fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"refundsnoot.com/assets/js/app.js","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"ip":{"addr":"198.251.88.188","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"9b3583ab41e3bae0351cc7f6eb12db53","sha1":"aa1fe92675a598e56f8944eb864115e7d7d53081","sha256":"f616ea6925a4312e02cccc3b56ef10fac91ea4e732bcaeedabf8aa65d6a3977a","sha512":"d83a3de77b01aeb850b7537562ff5ff92fc09697753a2ca37f40f40120d095f58f86708bd0b706c1e1e97dd58c969b9a83065d839ce28d546e41150a4f27ce6d","ssdeep":"","tlshash":"f5319be3369354f24dfa1eba3077978c7c659202f80264d08b9da47889d5f47f83ea44","size":1517,"data":"","first_seen":"2026-08-30T04:36:09.531968Z","last_seen":"2026-08-30T04:36:56.683923Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"refundsnoot.com/","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"ip":{"addr":"198.251.88.188","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-30T04:35:41.595Z","timestamp":1788064541595,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refundsnoot.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 19:18:10 GMT","end":"Fri, 27 Nov 2026 19:18:09 GMT"},"fingerprint":{"sha1":"82:69:CD:4B:12:0B:D5:D4:E4:4B:A0:8C:16:E9:14:9D:1E:BA:95:FA","sha256":"0E:95:A5:D1:A9:F4:52:DF:F0:A1:52:C7:A4:AA:59:16:C7:5D:5E:9D:1E:95:65:7C:AE:C4:17:A7:B6:EE:46:3F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: refundsnoot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nset-cookie: PHPSESSID=07539628f3c25d964fe734a78b7a502d; path=/; secure; HttpOnly; SameSite=Lax\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 1997\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ndate: Sun, 30 Aug 2026 04:35:41 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"07539628f3c25d964fe734a78b7a502d","quoted":false,"path":"/","secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"PHPSESSID=07539628f3c25d964fe734a78b7a502d; path=/; secure; HttpOnly; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4779,"size_decoded":2461,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4768)","md5":"9b39bf4040a3f2caaf7d43445a692cef","sha1":"6ec37d757f21f1bcf72c581ae2b08b27870e9f6d","sha256":"9772cc7853cdc62cf34eb02a6ff22ba06341d099ecc4fa5ae6e7e63f44234590","sha512":"de17f5b00e52b8710f5584cebf52271f3062f118abdfe958b354a85616d4db35bc3c4f296d3e961f05cacb12987603bf78414f6e24a680849edf340daddc23a9","ssdeep":"96:ALk5AfJpxMeFLEJr2YwL1Ywo5F29tpnhUs1p9B4sE14AcoTUO/JJFAR54:ApaWyr/mvnhUs1pAsEGm4O/t","tlshash":"8da19472a09275366d2715e6bcb763cb61fb8219e2060c00f1fc87ad8fd9c40f9665a2","first_seen":"2026-08-30T04:36:09.52598Z","last_seen":"2026-08-30T04:36:56.682412Z","times_seen":2,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":-1,"dns":3,"connect":66,"send":0,"wait":69,"receive":0,"ssl":139},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refundsnoot.com/assets/css/app.css","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"ip":{"addr":"198.251.88.188","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://refundsnoot.com/","date":"2026-08-30T04:35:42.036Z","timestamp":1788064542036,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refundsnoot.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 19:18:10 GMT","end":"Fri, 27 Nov 2026 19:18:09 GMT"},"fingerprint":{"sha1":"82:69:CD:4B:12:0B:D5:D4:E4:4B:A0:8C:16:E9:14:9D:1E:BA:95:FA","sha256":"0E:95:A5:D1:A9:F4:52:DF:F0:A1:52:C7:A4:AA:59:16:C7:5D:5E:9D:1E:95:65:7C:AE:C4:17:A7:B6:EE:46:3F"}}},"request":{"raw":"GET /assets/css/app.css HTTP/1.1\r\nHost: refundsnoot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refundsnoot.com/\r\nCookie: PHPSESSID=07539628f3c25d964fe734a78b7a502d\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 04:35:42 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 29 Aug 2026 20:45:26 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 2763\r\ndate: Sun, 30 Aug 2026 04:35:42 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9765,"size_decoded":3094,"mime_type":"text/css","magic":"ASCII text, with very long lines (9764)","md5":"963c64e5b1d74dd7dc0989196843ef6e","sha1":"822fe543204b3d1f9b363b96c9aa641e89f8670a","sha256":"0ef6e33efdeb270d367a9082fa36dc0045c243171756fadb14b2637fbde4d46e","sha512":"a4ef135c6fc4ca245356f39338d6ca56e0d298a2afcaa08c442137b0e199a5040ef3e20663e354ecc3bb94bdb6778c84977e9fe25d4c9170610b2f1b74fe7032","ssdeep":"96:NmlquOPDG5nhcd1L+xKCJ4Llsd7Kx7CCJxgMClz4hSKJWbvud3931Bv:NysG5h6+xKCUmd7KxHMEh0juVZv","tlshash":"68126422a5687638b56ff4a4e5c427df70109126c13707edfc91b235c8cbab31a76a4e","first_seen":"2026-08-30T04:36:09.528731Z","last_seen":"2026-08-30T04:36:56.683167Z","times_seen":2,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refundsnoot.com/assets/js/app.js","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"ip":{"addr":"198.251.88.188","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://refundsnoot.com/","date":"2026-08-30T04:35:42.041Z","timestamp":1788064542041,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refundsnoot.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 19:18:10 GMT","end":"Fri, 27 Nov 2026 19:18:09 GMT"},"fingerprint":{"sha1":"82:69:CD:4B:12:0B:D5:D4:E4:4B:A0:8C:16:E9:14:9D:1E:BA:95:FA","sha256":"0E:95:A5:D1:A9:F4:52:DF:F0:A1:52:C7:A4:AA:59:16:C7:5D:5E:9D:1E:95:65:7C:AE:C4:17:A7:B6:EE:46:3F"}}},"request":{"raw":"GET /assets/js/app.js HTTP/1.1\r\nHost: refundsnoot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refundsnoot.com/\r\nCookie: PHPSESSID=07539628f3c25d964fe734a78b7a502d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 29 Aug 2026 20:45:26 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 640\r\ndate: Sun, 30 Aug 2026 04:35:42 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1517,"size_decoded":898,"mime_type":"text/javascript","magic":"Unicode text, UTF-8 text, with very long lines (800)","md5":"9b3583ab41e3bae0351cc7f6eb12db53","sha1":"aa1fe92675a598e56f8944eb864115e7d7d53081","sha256":"f616ea6925a4312e02cccc3b56ef10fac91ea4e732bcaeedabf8aa65d6a3977a","sha512":"d83a3de77b01aeb850b7537562ff5ff92fc09697753a2ca37f40f40120d095f58f86708bd0b706c1e1e97dd58c969b9a83065d839ce28d546e41150a4f27ce6d","ssdeep":"","tlshash":"f5319be3369354f24dfa1eba3077978c7c659202f80264d08b9da47889d5f47f83ea44","first_seen":"2026-08-30T04:36:09.531968Z","last_seen":"2026-08-30T04:36:56.683923Z","times_seen":2,"resource_available":true,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refundsnoot.com/assets/img/logo.png","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"ip":{"addr":"198.251.88.188","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refundsnoot.com/","date":"2026-08-30T04:35:42.045Z","timestamp":1788064542045,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refundsnoot.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 19:18:10 GMT","end":"Fri, 27 Nov 2026 19:18:09 GMT"},"fingerprint":{"sha1":"82:69:CD:4B:12:0B:D5:D4:E4:4B:A0:8C:16:E9:14:9D:1E:BA:95:FA","sha256":"0E:95:A5:D1:A9:F4:52:DF:F0:A1:52:C7:A4:AA:59:16:C7:5D:5E:9D:1E:95:65:7C:AE:C4:17:A7:B6:EE:46:3F"}}},"request":{"raw":"GET /assets/img/logo.png HTTP/1.1\r\nHost: refundsnoot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refundsnoot.com/\r\nCookie: PHPSESSID=07539628f3c25d964fe734a78b7a502d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 04:35:42 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 29 Aug 2026 20:45:26 GMT\r\naccept-ranges: bytes\r\ncontent-length: 95818\r\ndate: Sun, 30 Aug 2026 04:35:42 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":95818,"size_decoded":96104,"mime_type":"image/png","magic":"PNG image data, 4000 x 1143, 8-bit/color RGBA, non-interlaced","md5":"97460ef8b8969ba0e4682c09868bd218","sha1":"0ea7e8f93bacedffcf10f2fa38bbca2f30649ab3","sha256":"af740e1ad60861af55f4c11f5c1b74509ab2e51106d3330cf0c2bd07892ff3aa","sha512":"115daa37140517c7b8415dda70af433776632bcc51ca76213a1089732fdc43fddf237a8f66b910941ff1b86ad58dfbd63c6e6955db8dab19bebaba0e821df05e","ssdeep":"1536:k/Q4LVvhjqk0CY8sbcvR/Hc7+LJ5jqTyOkDR/bML+o1Lr20WyuH89N:k/VVvh2FCHsEZh7/wL+o1f2Ry40N","tlshash":"f393f1c34eabde9adf2f05b5ad4407645aa1015fe806b3bb4734e46cdf580c6acba1c1","first_seen":"2026-08-30T04:36:09.533993Z","last_seen":"2026-08-30T04:36:56.684635Z","times_seen":2,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":131,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refundsnoot.com/assets/img/logo-dark.png","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"ip":{"addr":"198.251.88.188","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refundsnoot.com/","date":"2026-08-30T04:35:42.046Z","timestamp":1788064542046,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refundsnoot.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 19:18:10 GMT","end":"Fri, 27 Nov 2026 19:18:09 GMT"},"fingerprint":{"sha1":"82:69:CD:4B:12:0B:D5:D4:E4:4B:A0:8C:16:E9:14:9D:1E:BA:95:FA","sha256":"0E:95:A5:D1:A9:F4:52:DF:F0:A1:52:C7:A4:AA:59:16:C7:5D:5E:9D:1E:95:65:7C:AE:C4:17:A7:B6:EE:46:3F"}}},"request":{"raw":"GET /assets/img/logo-dark.png HTTP/1.1\r\nHost: refundsnoot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refundsnoot.com/\r\nCookie: PHPSESSID=07539628f3c25d964fe734a78b7a502d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 04:35:42 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 29 Aug 2026 20:45:26 GMT\r\naccept-ranges: bytes\r\ncontent-length: 82455\r\ndate: Sun, 30 Aug 2026 04:35:42 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":82455,"size_decoded":82741,"mime_type":"image/png","magic":"PNG image data, 4000 x 1143, 8-bit/color RGBA, non-interlaced","md5":"28156855eced89243247d36ea1ac0b6e","sha1":"548f57528d232eec8f25f5c637277ace4d9791a4","sha256":"5603d95f9aed2175f9ce2d6d80ba3e4e4ba5e015bc25bd9c3acecd611fcf2eb3","sha512":"8dcc3c963061abccef9a79d5534ddfff914c2beb87cf7c9a3397f462f3893383a1460c559e1876657cd86ac05b42fa04bc531b5607e0dd75aa21889dc7bd2148","ssdeep":"1536:ktm01bHEBSMim0Jc4otXoGyeu5v6NRjeapMQsngVM1maJs:k40REIMimEcrTu5SGSqK","tlshash":"5383e1895c5b0ed0fdb000bbd8502b99eb60558bd369df828372f9329cd91c998c635b","first_seen":"2026-08-30T04:36:09.536033Z","last_seen":"2026-08-30T04:36:56.685332Z","times_seen":2,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":137,"receive":132,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"refundsnoot.com/favicon.ico","fqdn":"refundsnoot.com","domain":"refundsnoot.com","tld":"com"},"ip":{"addr":"198.251.88.188","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://refundsnoot.com/","date":"2026-08-30T04:35:42.322Z","timestamp":1788064542322,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.refundsnoot.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 19:18:10 GMT","end":"Fri, 27 Nov 2026 19:18:09 GMT"},"fingerprint":{"sha1":"82:69:CD:4B:12:0B:D5:D4:E4:4B:A0:8C:16:E9:14:9D:1E:BA:95:FA","sha256":"0E:95:A5:D1:A9:F4:52:DF:F0:A1:52:C7:A4:AA:59:16:C7:5D:5E:9D:1E:95:65:7C:AE:C4:17:A7:B6:EE:46:3F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: refundsnoot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://refundsnoot.com/\r\nCookie: PHPSESSID=07539628f3c25d964fe734a78b7a502d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 04:35:42 GMT\r\ncontent-type: image/x-icon\r\nlast-modified: Sat, 29 Aug 2026 20:45:26 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 714\r\ndate: Sun, 30 Aug 2026 04:35:42 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":705,"size_decoded":1048,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"f1399f05598b503128f5a3a99dfebd53","sha1":"a77140673e71e717f7f99d1b490b140577d8967d","sha256":"63a1e240f7a19906fea9c3bb3f3a0aecd3f399d67826b36a5ca6e20e9210736c","sha512":"2552bbcde67bcc76f16ca77dc80df2d2eb3810028fd699700e0a4277fa7e5d75af577e0b64a867aa3bb5dababd7524bd6743e474bed2043eb37aea650486f616","ssdeep":"","tlshash":"2a0144d17a41ac70f8de2436f80a352c59d5800015b877790b294ba05d5fc9db291933","first_seen":"2026-08-30T04:36:09.537464Z","last_seen":"2026-08-30T04:36:56.686014Z","times_seen":2,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}