{"report_id":"f16d45a0-0e10-4125-882b-75cf44169402","version":0,"status":"done","tags":[],"date":"2026-08-12T13:40:30Z","url":{"schema":"http","addr":"64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","fqdn":"64618654-checkout.renewplan.click","domain":"renewplan.click","tld":"click"},"ip":{"addr":"172.67.142.163","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","fqdn":"64618654-checkout.renewplan.click","domain":"renewplan.click","tld":"click"},"title":"Bon d'achat — Participation","dom":{"size":909,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c0e53934ebf8732c3ca776e492b23923","sha1":"29288f98d9ce02fde27ed700d7469389ffdfbc4b","sha256":"030599f68c4fac3a48d73a5f385f757dd6588089f7029cc302ae2e9b4f047d07","sha512":"780617c171f97fbab01acba767fa7ebc62dc3155f87b0f3524f0c3c0c4681c435f0720de66095789319065e2f417cfe7bd7bb8791ac766756784aca14471b05d","ssdeep":"","tlshash":"1c11c0535ce08d2a12328796b981fc0869e1914b87599d7178eac5ac4fd5fe2c8cf43c","dom_hash":"domhash4cc00f1eab68c9e6bec876d2aa36fb8f","first_seen":"2026-08-11T01:34:46.565908Z","last_seen":"2026-08-12T21:30:52.927988Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","fqdn":"64618654-checkout.renewplan.click","domain":"renewplan.click","tld":"click"},"ip":{"addr":"172.67.142.163","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-16T13:40:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"64618654-checkout.renewplan.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-09T22:23:43.881052Z","alert_count":0,"request_count":2,"received_data":18461,"sent_data":1222,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-09T22:20:44.514027Z","alert_count":0,"request_count":1,"received_data":63271,"sent_data":579,"comment":"","tags":null,"fingerprints":null},{"fqdn":"brain.login-cas.workers.dev","ip":{"addr":"104.21.66.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-11T01:34:41.82767Z","last_seen":"2026-08-11T01:34:41.82767Z","alert_count":0,"request_count":1,"received_data":767,"sent_data":620,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"64618654-checkout.renewplan.click","ip":{"addr":"172.67.142.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-12T13:35:34.044862Z","last_seen":"2026-08-12T13:35:34.044862Z","alert_count":5,"request_count":5,"received_data":903642,"sent_data":2933,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google AdSense","description":"Google AdSense is a program run by Google through which website publishers serve advertisements that are targeted to the site content and audience.","website":"https://www.google.com/adsense/start/","common_platform_enumeration":"","icon":"Google AdSense.svg","categories":["Advertising"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"64618654-checkout.renewplan.click/assets/index-DLn34vOO.js","fqdn":"64618654-checkout.renewplan.click","domain":"renewplan.click","tld":"click"},"ip":{"addr":"172.67.142.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ca8205c73f8fccea378be18fe740a4d3","sha1":"5013af0ac053cbd3e6ec2c15c599950e99434e66","sha256":"a04972a5f39121d4417dbd6d12495b7bd3740e8d58318abf33b6fcccac19f8b0","sha512":"2ff2e3d52bb463af78b420a0640c49f9a5bc94650f44ca2d0ebed4ad979b6b5afaf8f9ca0bb442deedbbb48f68b6a9e40d546016419ed8c0a144cef5340601e7","ssdeep":"6144:4FldyWwcwhKIh2GrwOf9PADEswKCT2PIbSZgDNPlPvhdkOFCunbyOX3KYNo:mdlwTtFf945ClPztX6X","tlshash":"3e052aafd99f4fff1774378438ff014824a84ff5245c4891a691882ad9a885738f6b2d","size":856165,"data":"","first_seen":"2026-08-11T01:34:46.575837Z","last_seen":"2026-08-12T21:30:52.938782Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"Brain gate denied by /allow","filename":"https://64618654-checkout.renewplan.click/assets/index-DLn34vOO.js","line_number":86,"column_number":12227}]},"http":[{"url":{"schema":"https","addr":"64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","fqdn":"64618654-checkout.renewplan.click","domain":"renewplan.click","tld":"click"},"ip":{"addr":"172.67.142.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-12T13:40:01.952Z","timestamp":1786542001952,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renewplan.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 22:39:07 GMT","end":"Sun, 08 Nov 2026 23:37:37 GMT"},"fingerprint":{"sha1":"34:CE:72:83:FD:42:3B:62:08:C2:C7:C4:44:4D:C4:A8:5A:C5:7E:A4","sha256":"45:D4:22:A4:14:54:B2:0D:C9:7B:51:C9:78:74:90:80:BD:06:A6:0A:62:43:53:DB:D8:77:43:84:BE:24:A0:49"}}},"request":{"raw":"GET /checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743 HTTP/1.1\r\nHost: 64618654-checkout.renewplan.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mhFQ7nAZPyDxKxiwmcjsWFWTi488ya6rkSGQd2y4uU6shd0W%2Bys4jd6nxPKKWdE%2BnjaYla%2BMef7AP6YKpCSYphkS2Tk3GjB55I4QHPa3hSDOnB8u5f3ekRz6oq3W3cSFMhVPstjVk%2BBiYQ3WDIUP8HgaNBk%3D\"}]}\r\nlast-modified: Mon, 10 Aug 2026 23:29:22 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\npriority: u=0,i\r\ndate: Wed, 12 Aug 2026 13:40:02 GMT\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a29fe3b8eadda41f-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google AdSense","description":"Google AdSense is a program run by Google through which website publishers serve advertisements that are targeted to the site content and audience.","website":"https://www.google.com/adsense/start/","common_platform_enumeration":"","icon":"Google AdSense.svg","categories":["Advertising"]}],"data":{"size":764,"size_decoded":1156,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"520c37a504ccd510d01221b53cfd9590","sha1":"5b15ddf28a15744bf90e8a859c6107c7017d1175","sha256":"2f6716620cd728ef29f9f28d8933b9ffdf9e34879953a383c0b0cf5fa8da16d6","sha512":"5ad39beea1daf1b17828fc93e9eb78b20b30d32b63943c43bd625dbb65d79e6579f8f2659bfa21bb92828867e32cb96ea6bfce5989a90c938d3bce7f157530c4","ssdeep":"","tlshash":"a70168936ce08e11527083655d91f4099962e29b4b89ac9834dee0bd0fc4bc6cacb5b8","first_seen":"2026-08-11T01:34:46.573739Z","last_seen":"2026-08-12T21:30:52.936173Z","times_seen":6,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":84,"connect":22,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"64618654-checkout.renewplan.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;1,9..40,400\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","date":"2026-08-12T13:40:02.564Z","timestamp":1786542002564,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:43 GMT","end":"Mon, 12 Oct 2026 18:07:42 GMT"},"fingerprint":{"sha1":"3C:2E:4A:58:D0:DB:8D:00:50:7D:0E:E6:87:DE:CA:95:B3:BA:1B:89","sha256":"C2:4F:05:DF:4B:24:E4:A9:E4:2A:30:66:F4:78:E7:75:AC:AE:71:43:E7:DA:3E:24:4B:A3:AA:9A:39:4E:E2:E1"}}},"request":{"raw":"GET /css2?family=DM+Sans:ital,opsz,wght@0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;1,9..40,400\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://64618654-checkout.renewplan.click/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 12 Aug 2026 13:40:02 GMT\r\ndate: Wed, 12 Aug 2026 13:40:02 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4300,"size_decoded":1157,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"332a7282ed4afa37a55d8db4c15a7438","sha1":"803092fb318a69a07b6de0783981cd8d991b64b0","sha256":"791df45f12b6597ef516a98e3dc5372527fd8b703e8dc2d096c0a0891a2f2500","sha512":"69f35d039bc3b5b39adb01d785bb5425a305db508a4483dca335834a5e62bf6829d012553007047e949f8f7f54e7983c3a6f2b4dd5f8d7f6ff96b33a9aaefaec","ssdeep":"96:jYgEaJJc+ufYgEa/NkOEaepJc+ufOEawNkOXaepJc+ufOXawNkOxMaepJc+ufOx9:MOpVOpcDPc8yclhcG7","tlshash":"e991be81047bb114db572cc522ce7e32ef1f619064549874bbfe2888fc9ad6e5361b4d","first_seen":"2025-12-31T13:52:18.692367Z","last_seen":"2026-08-12T21:30:52.929915Z","times_seen":96,"resource_available":false,"data":null}},"time_used":311,"timings":{"blocked":-1,"dns":2,"connect":17,"send":0,"wait":32,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Outfit:wght@500;600;700\u0026family=Plus+Jakarta+Sans:ital,wght@0,400;0,500;0,600;0,700;0,800;1,400\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","date":"2026-08-12T13:40:02.565Z","timestamp":1786542002565,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:43 GMT","end":"Mon, 12 Oct 2026 18:07:42 GMT"},"fingerprint":{"sha1":"3C:2E:4A:58:D0:DB:8D:00:50:7D:0E:E6:87:DE:CA:95:B3:BA:1B:89","sha256":"C2:4F:05:DF:4B:24:E4:A9:E4:2A:30:66:F4:78:E7:75:AC:AE:71:43:E7:DA:3E:24:4B:A3:AA:9A:39:4E:E2:E1"}}},"request":{"raw":"GET /css2?family=Outfit:wght@500;600;700\u0026family=Plus+Jakarta+Sans:ital,wght@0,400;0,500;0,600;0,700;0,800;1,400\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://64618654-checkout.renewplan.click/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 12 Aug 2026 13:40:02 GMT\r\ndate: Wed, 12 Aug 2026 13:40:02 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12813,"size_decoded":1508,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"40c83465d16c96c4f03f0c13d4bb36e9","sha1":"569682ec09f8d8f2402eb7817a8dd210dcec6d41","sha256":"88fdc78a2b122cee777f80b7d3ab80fa30f2eb56d74b1b45113202ea78757057","sha512":"074d3c96a13d38b954b58cf533d32fab6cfcb883cb623f8024bade385c51d2189ba24f08530c09ac249caa22b103ec0b4b0216a30d5fa86f38efbd2255748fa7","ssdeep":"192:shprhwEhXOO/nO4O6KO5CFJRSdCmaRBUCj3Ro7CcQRvSC5VRed:pwnj6PdrF/0","tlshash":"c342b2a0092fa540eb871cc663cf3d36de5e6192705584b99ffd0898ec6ec2a6375b1c","first_seen":"2026-08-11T01:34:46.581735Z","last_seen":"2026-08-12T21:30:52.931564Z","times_seen":6,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":1,"connect":15,"send":0,"wait":33,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"64618654-checkout.renewplan.click/auth/token","fqdn":"64618654-checkout.renewplan.click","domain":"renewplan.click","tld":"click"},"ip":{"addr":"172.67.142.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","date":"2026-08-12T13:40:02.952Z","timestamp":1786542002952,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renewplan.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 22:39:07 GMT","end":"Sun, 08 Nov 2026 23:37:37 GMT"},"fingerprint":{"sha1":"34:CE:72:83:FD:42:3B:62:08:C2:C7:C4:44:4D:C4:A8:5A:C5:7E:A4","sha256":"45:D4:22:A4:14:54:B2:0D:C9:7B:51:C9:78:74:90:80:BD:06:A6:0A:62:43:53:DB:D8:77:43:84:BE:24:A0:49"}}},"request":{"raw":"GET /auth/token HTTP/1.1\r\nHost: 64618654-checkout.renewplan.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-origin: \r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-type: application/json\r\ndate: Wed, 12 Aug 2026 13:40:03 GMT\r\nvary: Origin\r\nvia: 1.1 Caddy\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncontent-encoding: zstd\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RoBcZnHc%2B64Fz4jQ2vaNw2%2BMtsdoqlGK%2Bp7XRQ0j70i7UQD0HxWovUWuEXlyQQ12jRH2Xjmb6QQtzjQK9G11tRtZHWneI%2F1%2BRacqu6XJvPoTpoaJfJsyD2PjPpHeA53ERXjqWhqKq%2BZz3L%2BzlJ6ytPp6Xe8%3D\"}]}\r\ncf-ray: a29fe3be7b11a41f-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":399,"size_decoded":1020,"mime_type":"application/json","magic":"JSON text data","md5":"cc81b638519c3d7fd7dba158c70dd056","sha1":"e654c0d8a41ad8cb77e92f561b919fa6add3f5c7","sha256":"72887142e21fadab300bc9f50a442a0df635a9704bbbc3db1c781ae2e95cb77e","sha512":"3ff9ccb3e46445a27648623d3e74b661b13479e76511e241bf70ae2b0b170f9e20fcd2c5bbfc21067e904401ce0cad87d1cb6862c648962fcd3e8e7f5aaa8eec","ssdeep":"","tlshash":"96e0f14e112c1f4d60d19f071b8ee82d2d187aa0156b1774442028acf9281dc83769b1","first_seen":"2026-08-12T13:40:32.484765Z","last_seen":"2026-08-12T13:40:32.484765Z","times_seen":1,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"64618654-checkout.renewplan.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"64618654-checkout.renewplan.click/assets/index-DLn34vOO.js","fqdn":"64618654-checkout.renewplan.click","domain":"renewplan.click","tld":"click"},"ip":{"addr":"172.67.142.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","date":"2026-08-12T13:40:02.520Z","timestamp":1786542002520,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renewplan.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 22:39:07 GMT","end":"Sun, 08 Nov 2026 23:37:37 GMT"},"fingerprint":{"sha1":"34:CE:72:83:FD:42:3B:62:08:C2:C7:C4:44:4D:C4:A8:5A:C5:7E:A4","sha256":"45:D4:22:A4:14:54:B2:0D:C9:7B:51:C9:78:74:90:80:BD:06:A6:0A:62:43:53:DB:D8:77:43:84:BE:24:A0:49"}}},"request":{"raw":"GET /assets/index-DLn34vOO.js HTTP/1.1\r\nHost: 64618654-checkout.renewplan.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=3,i=?0\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-type: text/javascript; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 10 Aug 2026 23:29:17 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y8BLTABNBSBc%2Bg3gc3SJMNbqxj9EdqKZ7cDgMU39mJDLunhlSvL0taosf%2BUSrqCiNhX29BGVCJ%2F5gmM%2ByY%2Boyt4jd7%2Fk4N6Muac2njbcZ41zhXVw%2Ftli%2B7Mb3V1fQP6C8RWo2jHssQCfld26EzZXRLK4mkk%3D\"}]}\r\ndate: Wed, 12 Aug 2026 13:40:02 GMT\r\nage: 299\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"dklnkc3ztb8jicmd\"\r\ncf-ray: a29fe3bbbb00a41f-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":856165,"size_decoded":273088,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (41335)","md5":"ca8205c73f8fccea378be18fe740a4d3","sha1":"5013af0ac053cbd3e6ec2c15c599950e99434e66","sha256":"a04972a5f39121d4417dbd6d12495b7bd3740e8d58318abf33b6fcccac19f8b0","sha512":"2ff2e3d52bb463af78b420a0640c49f9a5bc94650f44ca2d0ebed4ad979b6b5afaf8f9ca0bb442deedbbb48f68b6a9e40d546016419ed8c0a144cef5340601e7","ssdeep":"6144:4FldyWwcwhKIh2GrwOf9PADEswKCT2PIbSZgDNPlPvhdkOFCunbyOX3KYNo:mdlwTtFf945ClPztX6X","tlshash":"3e052aafd99f4fff1774378438ff014824a84ff5245c4891a691882ad9a885738f6b2d","first_seen":"2026-08-11T01:34:46.575837Z","last_seen":"2026-08-12T21:30:52.938782Z","times_seen":6,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"64618654-checkout.renewplan.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"64618654-checkout.renewplan.click/assets/index-DNnh02Sa.css","fqdn":"64618654-checkout.renewplan.click","domain":"renewplan.click","tld":"click"},"ip":{"addr":"172.67.142.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","date":"2026-08-12T13:40:02.522Z","timestamp":1786542002522,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renewplan.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 22:39:07 GMT","end":"Sun, 08 Nov 2026 23:37:37 GMT"},"fingerprint":{"sha1":"34:CE:72:83:FD:42:3B:62:08:C2:C7:C4:44:4D:C4:A8:5A:C5:7E:A4","sha256":"45:D4:22:A4:14:54:B2:0D:C9:7B:51:C9:78:74:90:80:BD:06:A6:0A:62:43:53:DB:D8:77:43:84:BE:24:A0:49"}}},"request":{"raw":"GET /assets/index-DNnh02Sa.css HTTP/1.1\r\nHost: 64618654-checkout.renewplan.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=2,i=?0\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-type: text/css; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 10 Aug 2026 23:29:17 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ca6zxMFJGGxicY24tp5oy6Ba1giSAqvbSpOtwL6GiOWmHhez1c8dQCGHSgZW8beyeksaR1VKAiXKUIhUpgJu3Ff%2FoNYbPs6xnLAgnd2Ni7qm1iZA0J%2FayDJde4I0qac1ZIkGHUCkSYzipujKOOXdRjrhFM0%3D\"}]}\r\ndate: Wed, 12 Aug 2026 13:40:02 GMT\r\nage: 299\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"dklnkc9axghdwq6\"\r\ncf-ray: a29fe3bbbb01a41f-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42414,"size_decoded":10893,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (42407)","md5":"6935b44d301a0b866501b15cc6540a77","sha1":"9ba22208841ef3f4bfb06c171712f646c3a8f5c7","sha256":"5069d1028f5996f2f235e4e200ca67927aaea03ee5dc05a29219ab563ce32b82","sha512":"2b579b4741b3de5b0a1d9948ecd967df758a7c883631d360bb9a0d51fe87cd3a7fe6363df20143ab35a1d8c605e2e6085080a666929f3846da5af65415dfb553","ssdeep":"768:ShiAea8lef+aIp+C6qAwgoH9TR1r7cXNNB4bsSBVeZyO7SHKcAs9Py4ePRt2:ShzZodTmCFPO7SHKcAs9q4ePRt2","tlshash":"1613656ad150e238fc3be991679877df6044d412dd234bd8d992a12888cb7f33b7264e","first_seen":"2026-08-11T01:34:46.577409Z","last_seen":"2026-08-12T21:30:52.942027Z","times_seen":6,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"64618654-checkout.renewplan.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"64618654-checkout.renewplan.click/favicon.svg","fqdn":"64618654-checkout.renewplan.click","domain":"renewplan.click","tld":"click"},"ip":{"addr":"172.67.142.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","date":"2026-08-12T13:40:02.941Z","timestamp":1786542002941,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"renewplan.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 22:39:07 GMT","end":"Sun, 08 Nov 2026 23:37:37 GMT"},"fingerprint":{"sha1":"34:CE:72:83:FD:42:3B:62:08:C2:C7:C4:44:4D:C4:A8:5A:C5:7E:A4","sha256":"45:D4:22:A4:14:54:B2:0D:C9:7B:51:C9:78:74:90:80:BD:06:A6:0A:62:43:53:DB:D8:77:43:84:BE:24:A0:49"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: 64618654-checkout.renewplan.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=6,i=?0\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 10 Aug 2026 23:29:17 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tZ%2BfxVXUwfXbzY%2FPmXFtSWJGDOnvTlqQYM3Zrs7K1iu7Q8Kl0BQMv81HZjHKcTgMetAp8Dy6a2HYi1iuH9UenzVyGEUNzt6oAoYfKmgdq8K8ncIzyp3hrIgl3jDiIhkmj%2FQhr3r16uCwh7QJTaMForjVNCw%3D\"}]}\r\ndate: Wed, 12 Aug 2026 13:40:02 GMT\r\nage: 299\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"dklnkcflrm1b8f\"\r\ncf-ray: a29fe3be5b10a41f-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":303,"size_decoded":951,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d51aa036c81db483e2fda764c157e03c","sha1":"93d04b90f2cdf718c22cebd0e6f2a463caf2d6da","sha256":"1ad2074470fe10d93303282305d0a73f2a598b26b17290c50c71aff9609f119c","sha512":"d09d4bc614649f8f8196a16c9a78afd1fa0018ee27f510a064a39d05af6aa698be300d44b04b481460ef731511b2a786cdcc4d3c0be9e913930c382169aa1b8c","ssdeep":"","tlshash":"d1e0c265d218a82cf7264508eb29706530ab51d7474c2264ac902938e11619eb8f36ed","first_seen":"2026-08-11T01:34:46.583165Z","last_seen":"2026-08-12T21:30:52.943036Z","times_seen":6,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"64618654-checkout.renewplan.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","date":"2026-08-12T13:40:02.950Z","timestamp":1786542002950,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:39 GMT","end":"Mon, 12 Oct 2026 18:07:38 GMT"},"fingerprint":{"sha1":"12:E8:CE:14:FC:4E:1E:0D:A3:9B:2E:5D:D0:88:79:79:71:C9:F8:6A","sha256":"58:07:B9:A1:6C:54:97:F9:9D:6A:66:E2:49:57:FB:86:86:8D:12:97:8F:4A:C9:74:A1:9D:69:4E:1F:A6:CC:9D"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://64618654-checkout.renewplan.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 62460\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 12 Aug 2026 13:20:59 GMT\r\nexpires: Thu, 12 Aug 2027 13:20:59 GMT\r\ncache-control: public, max-age=31536000\r\nage: 1143\r\nlast-modified: Wed, 10 Sep 2025 16:30:17 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":62460,"size_decoded":63271,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 62460, version 1.0","md5":"4c04ee82dc1deb4f32b244195d258e9b","sha1":"9bd2bc9c6f54075acd20589f87c17a73e3ab07b3","sha256":"ab72fd10c9ac5633c1f9ae4267864b674596062e023458e02973080bd1098904","sha512":"43bd417c75382fbcad7a44c73db7ec8e883bb505b63215ec67488eb205b61acd94031d5740bdf70cf413fcb126ac6a567b4c71831eeb063e5643fa0adc704895","ssdeep":"1536:Hjv9lkTtdw0aS3yPvWdfDSFdW6KK8zPJ86DQMBXQX:Hz9ceS3y2FDSFdRKNzPJj5gX","tlshash":"8753028264d3489c8c8b69d354847f1c707ef88fc1b88995a8e33ca14d4b1e6e85ad7f","first_seen":"2025-09-11T19:26:36.805532Z","last_seen":"2026-08-16T16:36:32.634413Z","times_seen":24620,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":0,"dns":2,"connect":31,"send":0,"wait":17,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"brain.login-cas.workers.dev/allow","fqdn":"brain.login-cas.workers.dev","domain":"login-cas.workers.dev","tld":"workers.dev"},"ip":{"addr":"104.21.66.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743\u0026token=69eeb548114e2b4da7209316b8f86743","date":"2026-08-12T13:40:03.281Z","timestamp":1786542003281,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login-cas.workers.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 21:20:55 GMT","end":"Sun, 18 Oct 2026 22:15:33 GMT"},"fingerprint":{"sha1":"95:14:8F:F8:BD:34:3B:D3:3B:A8:4B:F2:2D:39:F7:43:E2:A8:7C:F0","sha256":"AC:E4:48:F3:70:A8:BE:45:CF:D0:5F:90:E7:0E:48:8F:C6:73:18:6B:64:D4:8B:E2:68:09:8D:4F:E1:2D:00:68"}}},"request":{"raw":"OPTIONS /allow HTTP/1.1\r\nHost: brain.login-cas.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: authorization,x-browser-fingerprint\r\nReferer: https://64618654-checkout.renewplan.click/\r\nOrigin: https://64618654-checkout.renewplan.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\ndate: Wed, 12 Aug 2026 13:40:03 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: https://64618654-checkout.renewplan.click\r\nvary: Origin\r\naccess-control-allow-headers: Authorization, Content-Type, X-Browser-Fingerprint\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-max-age: 86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gtLOPM3rKoqeVxC9TxUIXm5EqeFv0AeiOerCEtBPH2BqdRHa7ZkeTtzewv2c5HEpjr5MyMs4bLfpW%2FTbra6HzYGYWAdi9ta7SW%2Bs%2FB4QIgebH6U6wQA4p4QK93xl9O0VcoT0O%2FoAIsFzVGOOLeY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: a29fe3c0adbb56ca-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":767,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T16:31:29.758893Z","times_seen":17920984,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":0,"dns":10,"connect":15,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}