{"report_id":"f010984a-767d-4699-adc0-bfb0ffecf930","version":6,"status":"done","tags":[],"date":"2026-05-23T05:50:39Z","url":{"schema":"http","addr":"verified-refunds.com/?fake_crap_for_dvmb_nalve_ldlots","fqdn":"verified-refunds.com","domain":"verified-refunds.com","tld":"com"},"ip":{"addr":"15.197.148.33","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","fqdn":"verified-refunds.com","domain":"verified-refunds.com","tld":"com"},"title":"verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","dom":{"size":922,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (776)","md5":"40abcdcc1bbe8ed23d5fc58423449f42","sha1":"f6049fb4e0d889a6cffb2a90b1f13ecd51d4f5e9","sha256":"abc4bd28e8b56ae84991e4d34f5a91ee603fc386036d4c57bde8b4c19762d043","sha512":"db160abc6ed904bb9fbe4c9232eb4feb6ff55ec718a524089eea1d0d8a9f9de6d17da059ddd850565a35accc3c78b57ae8bbaca70adb98f61bce46d93d940608","ssdeep":"","tlshash":"881123c38c51c21d59b085dc7933fb3ea266e01e9da1dc80f5f0006569cefd34c9a894","dom_hash":"domhash3eda90ef943b5e2e25bb94c9e2b5bdc3","first_seen":"2026-05-22T17:52:44.97826Z","last_seen":"2026-05-26T22:47:51.186724Z","times_seen":847,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"verified-refunds.com/?fake_crap_for_dvmb_nalve_ldlots","fqdn":"verified-refunds.com","domain":"verified-refunds.com","tld":"com"},"ip":{"addr":"15.197.148.33","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-27T05:50:39Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"www.google.com","ip":{"addr":"142.251.150.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-05-17T22:41:47.231515Z","alert_count":0,"request_count":1,"received_data":354,"sent_data":447,"comment":"","tags":null,"fingerprints":null},{"fqdn":"csp.secureserver.net","ip":{"addr":"23.44.47.70","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"1998-03-30","domain_rank":62352,"first_seen":"2022-12-18T21:17:09Z","last_seen":"2026-05-18T08:05:09.36078Z","alert_count":0,"request_count":2,"received_data":1016,"sent_data":1130,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img1.wsimg.com","ip":{"addr":"2.22.225.66","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"domain_registered":"2008-03-17","domain_rank":58983,"first_seen":"2012-06-20T14:42:31Z","last_seen":"2026-05-17T23:31:16.980761Z","alert_count":0,"request_count":5,"received_data":831229,"sent_data":2329,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"verified-refunds.com","ip":{"addr":"3.33.130.190","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-23T05:50:40.532222Z","last_seen":"2026-05-23T05:50:40.532222Z","alert_count":0,"request_count":2,"received_data":1680,"sent_data":1122,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","fqdn":"verified-refunds.com","domain":"verified-refunds.com","tld":"com"},"ip":{"addr":"3.33.130.190","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"0101edc617f0c823dd41e318c9d39fc9","sha1":"d6464936a6d2fa4c765c4d92a2771f812ee1898f","sha256":"ac6eaa139076a0142af7792131f998e6fd1805556c5f7174c3bcb149b2fe3aae","sha512":"7571051c857497560db8f9a8e56be6f7f0be0d615326808157a554ce64d07ff1dd67ab9cbb1cd354c42420d95173d076027e7f887e41b31defac0d2b3eb11df5","ssdeep":"","tlshash":"f67000280080000088308aeb320b2a8c322cf0e0a0008b20b230228220c00038c02080","size":25,"data":"","first_seen":"2025-03-02T07:03:41.447619Z","last_seen":"2026-08-07T10:20:01.450198Z","times_seen":57477,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","fqdn":"verified-refunds.com","domain":"verified-refunds.com","tld":"com"},"ip":{"addr":"3.33.130.190","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"4566be3a5ae95b1cc330f895a1bf2265","sha1":"712e5d763efe3bc39da3e99fdd0e13c3a5cbc943","sha256":"b23d5005af4518da7309bbb1f5dc1acf5adf215a3e28e21c59501eedcc7f08e4","sha512":"6b733bf4affdac5ace6d720afe9b8626a6f2a1c9c5c3e93b1a3b51611825398acae79c46a907bcf0cf4aef0e36947655673a5202362eff3741cc5d1fdfda8297","ssdeep":"","tlshash":"e6a00261508050e444fc911533733f17f7a3140524806450d7d0051472dfc27d0043d2","size":63,"data":"","first_seen":"2026-04-16T20:30:26.794154Z","last_seen":"2026-08-07T10:20:01.450792Z","times_seen":17745,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/static/js/main.be9a3b28.js","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.66","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"36107b56a8d59d0f5ba8343f488951ff","sha1":"298a0157a405194cb3534e05f103930221db8a88","sha256":"ac4bdeaa7098872b4c7c8a377994fbb27d918c0794d443027585321870d69c0f","sha512":"cca1067af957ec5c52999becdfa67ac0799ebe939d2a6505855a60c67629ba77eeab3d230fe0c8126c01c6764e492e9706c6bf33d084472ca554924b27ae1079","ssdeep":"12288:9o4dwcy856R7QYnT7QYnT1DUk4f0WTI4WugqciqXD5UT1FeUc2u:9oyw3Ou7QYnT7QYnTwT1hc2u","tlshash":"f3e42bce76e1b0b407e292eac43f6c4fb3686e15d008c561efbad9da94694498137f1c","size":703612,"data":"","first_seen":"2026-05-12T23:37:17.028535Z","last_seen":"2026-05-26T22:47:51.191282Z","times_seen":4716,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.66","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"7881774c8f50597625cd1a8d48caa5f1","sha1":"c4acc42169c8e153ed2d05321a1bbfda229b31c6","sha256":"245af47a8f4d6bf76e9dd9cf8313e0f08785ee34fe3f029c9c3e9b4e7018f4a9","sha512":"bbdf6ff6e7f6f3bdad72fd52f71d2942c98086c9f096e3aafc2f78c17b3a113a6f388900730f0de5e9dbf324cfea13086128b98ca2c03588b60c31f48ce0537b","ssdeep":"1536:6zSGh6DfEMRNJHY/vbV4vl1H9DOa3mTM+xLxCLuf:jN9Y/qE1f","tlshash":"5ca3a698f6a1f07142e76165412f010bf379a966b0aed0d4e725e8f4adf84ce8173f29","size":104828,"data":"","first_seen":"2026-05-08T19:37:18.071338Z","last_seen":"2026-07-27T07:54:46.897508Z","times_seen":11487,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"verified-refunds.com/?fake_crap_for_dvmb_nalve_ldlots","fqdn":"verified-refunds.com","domain":"verified-refunds.com","tld":"com"},"ip":{"addr":"3.33.130.190","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"52dad4b39e4e5a3a825c904115a54824","sha1":"bfdd39eeff0f635f2eb34a36db6d22eb5f866f49","sha256":"e52ae700e43daa575ed12056b03c9eb0ff6e823a62e5b14c436cb9b090957a6f","sha512":"3b77302a49d63d45602ac56fbe3eda5f14c6e59d3334f2a87f459e05c65049b89d316e0cfe0c4b0a9f720393d7958d51ffba53fe1b7aec325ba660c69a602bfc","ssdeep":"","tlshash":"e0b0125d3411c48451a562224b136f04286311d788001f4408000480212530f426a7c6","size":89,"data":"","first_seen":"2026-05-23T05:50:43.950101Z","last_seen":"2026-05-23T05:50:43.950101Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","fqdn":"verified-refunds.com","domain":"verified-refunds.com","tld":"com"},"ip":{"addr":"3.33.130.190","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d5d32b0ee8d41b1e47a523df01b25b68","sha1":"ac3178156ab1fd26ac597c73367bed18880c5ce1","sha256":"167d38de22fc467ddbebd2a93ac19cd51bf189e0147c168a07f147ef8da0b609","sha512":"6a53edbf80bb8214232a9c68ce71076f23a0af76870a81219cc32cd31bc08558b2ebcfddeff4b0b86e983b1f1b63d65d82fdf792a0abd816587c4fd0e8688c9a","ssdeep":"","tlshash":"d09002840262480848ea662c0b06aa323730820880f3cce088c0e008320be43628b9c7","size":53,"data":"","first_seen":"2026-04-16T20:30:26.798415Z","last_seen":"2026-08-07T10:20:01.45132Z","times_seen":17745,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.66","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","date":"2026-05-23T05:50:16.662Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /signals/js/clients/scc-c2/scc-c2.min.js HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://verified-refunds.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: eGmJN+OHjZppQyUDSFsr+5pDNTE8OQy9QD9vFBsMZJyFYfbqCF4uL9oiJcxU9Sav07vhMZpbx58=\r\nx-amz-request-id: KE7TGK14PCJZ0KK2\r\nlast-modified: Fri, 08 May 2026 19:21:03 GMT\r\netag: \"7881774c8f50597625cd1a8d48caa5f1\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-version: 1.3.1\r\nx-amz-version-id: dme6aPSMphG3BD7fNOuiwhoRczvqFwYz\r\naccept-ranges: bytes\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=1800\r\nexpires: Sat, 23 May 2026 06:20:16 GMT\r\ndate: Sat, 23 May 2026 05:50:16 GMT\r\ncontent-length: 21233\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":104828,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7881774c8f50597625cd1a8d48caa5f1","sha1":"c4acc42169c8e153ed2d05321a1bbfda229b31c6","sha256":"245af47a8f4d6bf76e9dd9cf8313e0f08785ee34fe3f029c9c3e9b4e7018f4a9","sha512":"bbdf6ff6e7f6f3bdad72fd52f71d2942c98086c9f096e3aafc2f78c17b3a113a6f388900730f0de5e9dbf324cfea13086128b98ca2c03588b60c31f48ce0537b","ssdeep":"1536:6zSGh6DfEMRNJHY/vbV4vl1H9DOa3mTM+xLxCLuf:jN9Y/qE1f","tlshash":"5ca3a698f6a1f07142e76165412f010bf379a966b0aed0d4e725e8f4adf84ce8173f29","first_seen":"2026-05-08T19:37:18.071338Z","last_seen":"2026-07-27T07:54:46.897508Z","times_seen":11487,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":64,"dns":38,"connect":0,"send":0,"wait":9,"receive":1,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/static/js/main.be9a3b28.js","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.66","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","date":"2026-05-23T05:50:16.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /parking-lander/static/js/main.be9a3b28.js HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://verified-refunds.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: 4HenI3TOZJ1iUchj25vqQ5JuuNS2r1uRv7Nd/jMDbZy3vy/rzD80+ggVIBLKgtJZQ/H4EDNdVmCSlOp7DIwJEg==\r\nx-amz-request-id: 71D4FZC65KZ9DDBM\r\nlast-modified: Tue, 12 May 2026 22:49:17 GMT\r\netag: \"36107b56a8d59d0f5ba8343f488951ff\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: WwtZ7vOKuyIIruyRg.TIRXZeL_kMjakD\r\naccept-ranges: bytes\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 184972\r\ncache-control: max-age=31536000\r\nexpires: Sun, 23 May 2027 05:50:16 GMT\r\ndate: Sat, 23 May 2026 05:50:16 GMT\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":703612,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"36107b56a8d59d0f5ba8343f488951ff","sha1":"298a0157a405194cb3534e05f103930221db8a88","sha256":"ac4bdeaa7098872b4c7c8a377994fbb27d918c0794d443027585321870d69c0f","sha512":"cca1067af957ec5c52999becdfa67ac0799ebe939d2a6505855a60c67629ba77eeab3d230fe0c8126c01c6764e492e9706c6bf33d084472ca554924b27ae1079","ssdeep":"12288:9o4dwcy856R7QYnT7QYnT1DUk4f0WTI4WugqciqXD5UT1FeUc2u:9oyw3Ou7QYnT7QYnTwT1hc2u","tlshash":"f3e42bce76e1b0b407e292eac43f6c4fb3686e15d008c561efbad9da94694498137f1c","first_seen":"2026-05-12T23:37:17.028535Z","last_seen":"2026-05-26T22:47:51.191282Z","times_seen":4716,"resource_available":true,"data":null}},"time_used":136,"timings":{"blocked":60,"dns":37,"connect":3,"send":0,"wait":8,"receive":6,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/static/css/main.1a427d5f.css","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.66","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","date":"2026-05-23T05:50:16.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /parking-lander/static/css/main.1a427d5f.css HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://verified-refunds.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: J1kciOzQdqOY6Wuz4x5E9Md4sje+9yPYjVgUjh7Ru9o04nS5FmmmhWm8hJqnxj9Y5IiqYMds2gU=\r\nx-amz-request-id: 6T02WDPR2R14HMVX\r\nlast-modified: Fri, 22 May 2026 17:49:04 GMT\r\netag: \"06089fd0b1e9d13c4a7e9d674c1d3b66\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: OH56GaVbjBJuO8F9whffyrY5M29mbFjX\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=31536000\r\nexpires: Sun, 23 May 2027 05:50:16 GMT\r\ndate: Sat, 23 May 2026 05:50:16 GMT\r\ncontent-length: 4272\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":19617,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (19572)","md5":"06089fd0b1e9d13c4a7e9d674c1d3b66","sha1":"983271d80b85d08970c17f76eb9a698a448829e8","sha256":"d550db2fcf635bdbdd4cb743b169e223280dd08d26867129714c92402bf5a433","sha512":"d639ed9becabccf77a9ff1a467e4abc5ccd6510d369470a8da59d4a6be8e357c8b756556d051b433aa191780cca3b6367754091cea8121e5843359c9c8d3478a","ssdeep":"384:v9HfffU8GKbmB9aLNLi6qjUYyQyl/gj1nXSxHqUoCtC/0rtYYlBVpx:v9HfffU8GKbmB9aLNLi6qjUYyQylYRn0","tlshash":"a492a6515dd6182ea02be424e9f9eb689068f051d5afa7b1f877133f85df0c2a33660c","first_seen":"2026-05-22T17:52:44.988265Z","last_seen":"2026-07-15T00:57:50.23697Z","times_seen":5176,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":55,"dns":46,"connect":1,"send":0,"wait":5,"receive":1,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/px.js?ch=2\u0026abp=2\u0026gdabp=true","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.66","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","date":"2026-05-23T05:50:16.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /parking-lander/px.js?ch=2\u0026abp=2\u0026gdabp=true HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://verified-refunds.com/\r\nOrigin: https://verified-refunds.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: tqQ1IbM0Gq2XMEbyo2EILE28ipUcMe3P4I14K7UlMKEbHzsPGAJY9AT8u94qeuZR63vsYJZh+EI=\r\nx-amz-request-id: BGEHR47PSEF18FAE\r\nlast-modified: Tue, 12 May 2026 22:49:22 GMT\r\netag: \"d41d8cd98f00b204e9800998ecf8427e\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: E85sdR5dWGfTBM2GLEMl8.btis4SwkDV\r\naccept-ranges: bytes\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=31536000\r\nexpires: Sun, 23 May 2027 05:50:16 GMT\r\ndate: Sat, 23 May 2026 05:50:16 GMT\r\ncontent-length: 20\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","fqdn":"verified-refunds.com","domain":"verified-refunds.com","tld":"com"},"ip":{"addr":"3.33.130.190","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-23T05:50:16.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"verified-refunds.com","organization":""},"issuer":{"commonName":"GoDaddy TLS Intermediate CA DV - R1v1","organization":"GoDaddy.com"},"validity":{"start":"Fri, 22 May 2026 21:47:22 GMT","end":"Sun, 06 Dec 2026 21:47:22 GMT"},"fingerprint":{"sha1":"A9:B6:7C:C5:1C:A6:AD:EB:10:2B:C5:CC:B6:8E:B3:91:79:94:79:93","sha256":"4E:31:64:27:80:3E:38:E5:ED:0E:4C:21:32:BD:06:A4:B5:BE:52:55:83:67:B2:02:6E:54:7A:76:D8:BA:83:B6"}}},"request":{"raw":"GET /lander?fake_crap_for_dvmb_nalve_ldlots= HTTP/1.1\r\nHost: verified-refunds.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://verified-refunds.com/?fake_crap_for_dvmb_nalve_ldlots\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: private, max-age=86400\r\nContent-Type: text/html\r\nDate: Sat, 23 May 2026 05:50:16 GMT\r\nServer: openresty\r\nSet-Cookie: traffic_target=gd; Path=/; Max-Age=86400\ncaf_ipaddr=91.90.42.154; Path=/; Max-Age=86400\ncountry=NO; Path=/; Max-Age=86400\ncity=\"Oslo\"; Path=/; Max-Age=86400\nlander_type=parkweb; Path=/; Max-Age=86400\r\nX-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_QM6LCjD+aHapNEmiTfEk1Xu1+9tuj5VGciplyclpgW91hmOFd/msny7BHnWURQk5bn9cDDR8RyGl/uLvhgamfw\r\nX-Content-Type-Options: nosniff\r\nContent-Length: 795\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":795,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (794)","md5":"54d08229d86bbdaa78710911be0f3b2f","sha1":"03085e05c99a86ffd5ad43d86ea82b98fed64b96","sha256":"7e26956ba6b4bc3903b3ea011bd83dc8a44876afcabeaa18fd14c7d481216267","sha512":"62570e88c9d047deae24936090306f37afdc0457689381e4c0f5c22db42334902a0e9dca7f9ec76109bdd10cad4f5f0b73b6ed7a30f0d87273f45894e59a5cdf","ssdeep":"","tlshash":"1701bdd28c51c61c0ab0959d7933fa2ea216e01adcd2e981e5d0003668dabe34c5ad90","first_seen":"2026-05-22T17:52:44.982545Z","last_seen":"2026-05-26T22:47:51.19017Z","times_seen":858,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/adsense/domains/caf.js?abp=1\u0026gdabp=true","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.150.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","date":"2026-05-23T05:50:16.660Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Thu, 07 May 2026 15:53:58 GMT","end":"Thu, 30 Jul 2026 15:53:57 GMT"},"fingerprint":{"sha1":"3D:2F:68:CA:7D:7E:91:9E:9A:F6:55:25:90:92:2C:70:DF:61:E1:AA","sha256":"17:D0:A6:F1:72:DB:CB:B5:FD:37:15:CC:95:48:17:63:D5:77:2E:57:FC:4D:6A:36:5B:D9:8A:76:6B:1B:54:5E"}}},"request":{"raw":"GET /adsense/domains/caf.js?abp=1\u0026gdabp=true HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://verified-refunds.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncross-origin-resource-policy: cross-origin\r\ncontent-type: text/html; charset=UTF-8\r\nx-content-type-options: nosniff\r\ncache-control: no-store, must-revalidate\r\ndate: Sat, 23 May 2026 05:50:16 GMT\r\nserver: sffe\r\ncontent-length: 1604\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":401,"timings":{"blocked":183,"dns":1,"connect":21,"send":0,"wait":30,"receive":0,"ssl":163},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img1.wsimg.com/parking-lander/px.js?ch=1\u0026abp=1\u0026gdabp=true","fqdn":"img1.wsimg.com","domain":"wsimg.com","tld":"com"},"ip":{"addr":"2.22.225.66","port":443,"asn":20940,"as":"Akamai International B.V.","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","date":"2026-05-23T05:50:16.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.wsimg.com","organization":""},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Fri, 05 Sep 2025 18:24:05 GMT","end":"Wed, 07 Oct 2026 18:24:05 GMT"},"fingerprint":{"sha1":"0E:95:B5:3C:BC:57:5B:29:44:36:31:82:4A:13:83:C0:BB:C6:51:2D","sha256":"2E:41:DD:15:BE:3D:3A:3A:29:F0:65:E6:52:EC:88:54:C4:60:01:9E:68:96:30:F3:2A:31:D9:A1:95:CA:69:24"}}},"request":{"raw":"GET /parking-lander/px.js?ch=1\u0026abp=1\u0026gdabp=true HTTP/1.1\r\nHost: img1.wsimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://verified-refunds.com/\r\nOrigin: https://verified-refunds.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-amz-id-2: R1d3Kuz9zso6NH0RvlH9LerEjrwTy+PUQoAUUrjEqRmfTNQOmaMJctJe2peUmq5lRaABAtiu1ac=\r\nx-amz-request-id: F1MZSX57DFV0TJ5P\r\nlast-modified: Tue, 12 May 2026 22:49:22 GMT\r\netag: \"d41d8cd98f00b204e9800998ecf8427e\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: E85sdR5dWGfTBM2GLEMl8.btis4SwkDV\r\naccept-ranges: bytes\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=31536000\r\nexpires: Sun, 23 May 2027 05:50:16 GMT\r\ndate: Sat, 23 May 2026 05:50:16 GMT\r\ncontent-length: 20\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"csp.secureserver.net/eventbus/web?clientid=b18ef4f046435b64a469b32c3c1c20a3","fqdn":"csp.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"23.44.47.70","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","date":"2026-05-23T05:50:17.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.secureserver.net","organization":"Special Domain Services, LLC"},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Thu, 23 Oct 2025 00:07:48 GMT","end":"Tue, 24 Nov 2026 00:07:48 GMT"},"fingerprint":{"sha1":"0C:85:75:97:2A:6F:2B:92:48:28:1A:FB:30:8A:C4:98:A7:9E:26:CE","sha256":"2F:4B:65:33:11:10:9D:A1:94:4B:5A:5D:40:E6:63:70:B6:7E:1A:7F:E7:90:E4:E8:F4:4A:37:2E:94:17:64:AB"}}},"request":{"raw":"POST /eventbus/web?clientid=b18ef4f046435b64a469b32c3c1c20a3 HTTP/1.1\r\nHost: csp.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 1094\r\nOrigin: https://verified-refunds.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://verified-refunds.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1094,"data":"{\"schemaId\":\"urn:shared:user:events:/v1\",\"data\":[{\"global\":{\"traceId\":\"4cac3947b41f4ba88fb7536642ee1b96\",\"client\":{\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"sdk\":{\"name\":\"scc-c2\",\"version\":\"1.3.1\"},\"device\":{\"viewportWidth\":1280,\"viewportHeight\":1024,\"screenResolutionWidth\":1280,\"screenResolutionHeight\":1024}},\"page\":{\"traceId\":\"4cac3947b41f4ba88fb7536642ee1b96\",\"host\":\"verified-refunds.com\",\"path\":\"/lander\",\"location\":\"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=\",\"referrer\":\"https://verified-refunds.com/?fake_crap_for_dvmb_nalve_ldlots\",\"sessionPageViewCount\":1},\"context\":{\"userType\":\"c2\",\"visitorId\":\"0c60625e-2267-4cdf-9fff-b1be914c5c0f\",\"sessionId\":\"0c60625e-2267-4cdf-9fff-b1be914c5c0f\"}},\"events\":[{\"schemaId\":\"urn:shared:user:event:/data-platform/signals/page-view/v1\",\"data\":{\"eventCreationTimestamp\":\"2026-05-23T05:50:16.953Z\",\"forensics\":{\"traceIdAdopted\":false},\"traffic\":{\"pageLevelProperties\":{\"ap\":\"parking\"},\"customProperties\":{}},\"producerEventId\":\"cc25dacb-7a3a-4f60-9030-0503c91f15a7\"}}]}]}"}},"response":{"raw":"HTTP/1.1 202 Accepted\r\nContent-Type: application/json\r\nContent-Length: 2\r\nAccess-Control-Allow-Origin: *\r\nx-bus-trace-id: 164170767046176656282718220566814128615\r\nx-envoy-upstream-service-time: 89\r\nx-error-info: 0\r\nx-request-id: f468411f-b316-4e28-8391-63a15d89c824\r\nExpires: Sat, 23 May 2026 05:50:17 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Sat, 23 May 2026 05:50:17 GMT\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=86400 ; includeSubDomains ; preload\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-07T13:07:49.852688Z","times_seen":756466,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":31,"dns":11,"connect":2,"send":0,"wait":177,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"csp.secureserver.net/eventbus/web?clientid=8da2217409854bee82e12dc4ca0b39fb","fqdn":"csp.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"23.44.47.70","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=","date":"2026-05-23T05:50:17.216Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.secureserver.net","organization":"Special Domain Services, LLC"},"issuer":{"commonName":"Starfield Secure Certificate Authority - G2","organization":"Starfield Technologies, Inc."},"validity":{"start":"Thu, 23 Oct 2025 00:07:48 GMT","end":"Tue, 24 Nov 2026 00:07:48 GMT"},"fingerprint":{"sha1":"0C:85:75:97:2A:6F:2B:92:48:28:1A:FB:30:8A:C4:98:A7:9E:26:CE","sha256":"2F:4B:65:33:11:10:9D:A1:94:4B:5A:5D:40:E6:63:70:B6:7E:1A:7F:E7:90:E4:E8:F4:4A:37:2E:94:17:64:AB"}}},"request":{"raw":"POST /eventbus/web?clientid=8da2217409854bee82e12dc4ca0b39fb HTTP/1.1\r\nHost: csp.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 1774\r\nOrigin: https://verified-refunds.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://verified-refunds.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1774,"data":"{\"schemaId\":\"urn:shared:user:events:/v1\",\"data\":[{\"global\":{\"traceId\":\"4cac3947b41f4ba88fb7536642ee1b96\",\"client\":{\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"sdk\":{\"name\":\"scc-c2\",\"version\":\"1.3.1\"},\"device\":{\"viewportWidth\":1280,\"viewportHeight\":1024,\"screenResolutionWidth\":1280,\"screenResolutionHeight\":1024}},\"page\":{\"traceId\":\"4cac3947b41f4ba88fb7536642ee1b96\",\"host\":\"verified-refunds.com\",\"path\":\"/lander\",\"location\":\"https://verified-refunds.com/lander?fake_crap_for_dvmb_nalve_ldlots=\",\"referrer\":\"https://verified-refunds.com/?fake_crap_for_dvmb_nalve_ldlots\",\"sessionPageViewCount\":1},\"context\":{\"userType\":\"c2\",\"visitorId\":\"0c60625e-2267-4cdf-9fff-b1be914c5c0f\",\"sessionId\":\"0c60625e-2267-4cdf-9fff-b1be914c5c0f\"}},\"events\":[{\"schemaId\":\"urn:shared:user:event:/rigor/page-navigation/v1\",\"data\":{\"eventCreationTimestamp\":\"2026-05-23T05:50:16.960Z\",\"navigationType\":\"navigate\",\"timing\":{\"navigation\":{\"connectEnd\":1779515416481,\"connectStart\":1779515416481,\"domComplete\":1779515416956,\"domContentLoadedEventEnd\":1779515416956,\"domContentLoadedEventStart\":1779515416955,\"domInteractive\":1779515416894,\"domLoading\":1779515416609,\"domainLookupEnd\":1779515416481,\"domainLookupStart\":1779515416481,\"fetchStart\":1779515416481,\"navigationStart\":1779515416481,\"requestStart\":1779515416496,\"responseEnd\":1779515416601,\"responseStart\":1779515416601,\"loadEventStart\":1779515416956,\"loadEventEnd\":0,\"pageLoadTime\":475,\"domContentLoadedTime\":474,\"domInteractiveTime\":413,\"serverResponseTime\":105},\"paint\":{}},\"traffic\":{\"pageLevelProperties\":{\"ap\":\"parking\"}},\"producerEventId\":\"0fe99d25-6dca-4b72-bf42-e894a3d7b64b\",\"contentLoadType\":\"hard\",\"response\":{\"transferSize\":1483,\"encodedBodySize\":795,\"decodedBodySize\":795}}}]}]}"}},"response":{"raw":"HTTP/1.1 202 Accepted\r\nContent-Type: application/json\r\nContent-Length: 2\r\nAccess-Control-Allow-Origin: *\r\nx-bus-trace-id: 117236073098462495102631902456873573950\r\nx-envoy-upstream-service-time: 95\r\nx-error-info: 0\r\nx-request-id: bdfa9b10-b1eb-4945-9edb-8fe7b3c96de6\r\nExpires: Sat, 23 May 2026 05:50:17 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Sat, 23 May 2026 05:50:17 GMT\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=86400 ; includeSubDomains ; preload\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-07T13:07:49.852688Z","times_seen":756466,"resource_available":true,"data":null}},"time_used":243,"timings":{"blocked":28,"dns":10,"connect":3,"send":0,"wait":184,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"verified-refunds.com/?fake_crap_for_dvmb_nalve_ldlots","fqdn":"verified-refunds.com","domain":"verified-refunds.com","tld":"com"},"ip":{"addr":"3.33.130.190","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-23T05:50:15.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"verified-refunds.com","organization":""},"issuer":{"commonName":"GoDaddy TLS Intermediate CA DV - R1v1","organization":"GoDaddy.com"},"validity":{"start":"Fri, 22 May 2026 21:47:22 GMT","end":"Sun, 06 Dec 2026 21:47:22 GMT"},"fingerprint":{"sha1":"A9:B6:7C:C5:1C:A6:AD:EB:10:2B:C5:CC:B6:8E:B3:91:79:94:79:93","sha256":"4E:31:64:27:80:3E:38:E5:ED:0E:4C:21:32:BD:06:A4:B5:BE:52:55:83:67:B2:02:6E:54:7A:76:D8:BA:83:B6"}}},"request":{"raw":"GET /?fake_crap_for_dvmb_nalve_ldlots HTTP/1.1\r\nHost: verified-refunds.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nDate: Sat, 23 May 2026 05:50:16 GMT\r\nContent-Length: 147\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":147,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"57828450e75d799efed84fe8836ea18b","sha1":"59d2eb98f79dcaba3ae1f33aa2a66b860d6343c1","sha256":"d5475497fa18243716371183a3cea6f7a8b48aeca97ee338d154c4054697d4c5","sha512":"2999d47f3ded3b36e319a0cd73665ff91550593f4ace66f085396a68c8a5304b8bd44c7d41730355c7be4a21461567a6a83436688895d095cc07c4bcb6c209e3","ssdeep":"","tlshash":"a3c02bed7c21c44018e032110ee3bf0c1c2713e7b8008f401dc00870692034f4e1b7c1","first_seen":"2026-05-23T05:50:43.932261Z","last_seen":"2026-05-23T05:50:43.932261Z","times_seen":1,"resource_available":false,"data":null}},"time_used":600,"timings":{"blocked":249,"dns":34,"connect":3,"send":0,"wait":101,"receive":0,"ssl":209},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}