{"report_id":"fc72da65-bd89-466b-bd08-5d858eaac152","version":0,"status":"done","tags":[],"date":"2026-09-17T14:31:38Z","url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":0,"asn":32561,"as":"Aquiryn LLC","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"title":"Scams Recovery Service - Funds Recovery","dom":{"size":406,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (406), with no line terminators","md5":"30829f67571b6f6011537bf22242b698","sha1":"2146b45ea5b0df391061f42dfdf67b131f4c4dc5","sha256":"0598f5dc618963686c717e5bcde958989eb19e116f3a55513c60ae249fc14c91","sha512":"27c2ebb936e96c311f8dd8a43f50523d42238c230de7e629f966ca2cbee8164bf4cb1e41897b0f550399ecf3b95aaf86c5df433c028ac4303684f69889755a38","ssdeep":"","tlshash":"59e061f92de3c8662db0164e61b6e25c656ca0d43652e14502dccd79e930fbfcd42d88","dom_hash":"domhashfa92bf49a0529f3ae8099507699ba65b","first_seen":"2026-09-17T14:13:52.932056Z","last_seen":"2026-09-17T14:31:57.681607Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":0,"asn":32561,"as":"Aquiryn LLC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-22T14:31:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"recovery.mstoolsnetshop.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"funds-recovery.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2018-08-29","domain_rank":0,"first_seen":"2019-05-14T19:30:50Z","last_seen":"2026-09-17T14:13:47.374316Z","alert_count":0,"request_count":15,"received_data":3531,"sent_data":8646,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fraud.universalsavefinance.com","ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2026-04-18","domain_rank":0,"first_seen":"2026-09-17T14:13:46.586045Z","last_seen":"2026-09-17T14:13:46.586045Z","alert_count":0,"request_count":52,"received_data":1164325,"sent_data":27249,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Slick","description":"","website":"https://kenwheeler.github.io/slick","common_platform_enumeration":"","icon":"Slick.svg","categories":["JavaScript libraries"]},{"name":"Pikaday","description":"A refreshing JavaScript Datepicker.","website":"https://github.com/dbushell/Pikaday","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"Tidio","description":"Tidio is a customer communication product. It provides multi-channel support so users can communicate with customers on the go. Live chat, messenger, or email are all supported.","website":"https://www.tidio.com","common_platform_enumeration":"","icon":"Tidio.svg","categories":["Live chat"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"recovery.mstoolsnetshop.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2024-08-22","domain_rank":0,"first_seen":"2025-08-07T20:51:52.924478Z","last_seen":"2026-09-17T14:13:47.390901Z","alert_count":1,"request_count":1,"received_data":0,"sent_data":604,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/Our.Umbraco.Forms.IntlTelInput/js/validate.phonenumber.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5ea3e1612ede11b9e6be9ff83499fa5c","sha1":"82f7e372dde2bd806f60dd3c9c3c04e744aa7c94","sha256":"71d8b7acfee198676dc3abc902da4291e76e7fcdc2a3c5400acd52a61f66451b","sha512":"a84741adb39007a9b079be31040de9e2456db64f3adb472c5526ba4bdef5e7bb9a586acf48b7606a6448fa7b709241bdb1c25bedeca9fe2c0d9e92a933cf684b","ssdeep":"","tlshash":"ede06119f800d0156d3632fcd9f9c05dfdc802278142c4543c8c50411f72dd167f199d","size":428,"data":"","first_seen":"2024-08-20T19:59:03.803012Z","last_seen":"2026-09-17T14:31:57.709131Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/faq-two.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0a6a0ba403a2cef43abdcb1c5c9159f3","sha1":"dccbe10b7154bfd07db8157a7853177e881ec635","sha256":"8fc084f8868302a46472795fb67d24e401841fe4efe79231a846adae88958221","sha512":"43691c9776dee11d7ade4e32ff5a7c421aedf75af7b01cc3123379e0cdc0d417a2b3db939ca897a4cbfff6df936246b9d6042844fd1a7f8be2c426f0a6d01a9c","ssdeep":"","tlshash":"57116b0df4a9ca7208ff38410396b0503d94901ba34ce902359e6be55fc54b026b62d3","size":856,"data":"","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.689449Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"be2fa4b945397ae525389b0d79009a7a","sha1":"ae91b0b3f38a1626b172bef8383468b01e261f49","sha256":"90651088409bec74c1dfe71db7d495f4e1ad8a3bb7eef4c749c0794e5537b73a","sha512":"b46fb01fe1025a34237716845e8739591f81effa83534c437002d9e21de6f698bce7dc4287bc81b41a162c7ad80ae730f08867d2b19019b6447e83cd4cd30e42","ssdeep":"","tlshash":"e49000cc33030c0000f0ab002f0fbb88b0023020e0f0ac320e00300cb320c0bbac00c0","size":42,"data":"","first_seen":"2023-03-07T01:19:11Z","last_seen":"2026-09-17T18:46:09.601183Z","times_seen":28201,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"5add9f669ff1a9ec777544db4e59045a","sha1":"57ebddb5d59eebc5fe88a23ddad7b9893f27b7c3","sha256":"0427e88200bbcca8bb987d07f28a8dc1dc4002ce0a45729b9870342fc93e670a","sha512":"a4fcbbc9560e3c1df470ea90c4cdf707147d269c443de2cacc9a09a3586a82bd9cf46db6bc94c3afee1e0b73e8b0c54b66484b58a7697500341a564d8fd50165","ssdeep":"","tlshash":"6341759a566b337148ab73ab7f9b62183560c1037109cd063e2ec7c11f38e3964e75d9","size":2206,"data":"","first_seen":"2026-09-17T14:13:52.99715Z","last_seen":"2026-09-17T14:31:57.71381Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"819f3addee69d349a7efd39703800cad","sha1":"e7af908dbe5f4f04ef092b2ff6c5ee6801f5983e","sha256":"b17d267876efe3fdae4ef2d35437be0a80bd323626d6243ef6296b526729eac5","sha512":"8be3636f4870f0e5224fdbcecd0dabc022318fc073d0e62f7092e7eb2ccf3b8a02c3882c4b2df58ce4d3f8dfd60fc08eb9e1cee592ab19c24d7f7b522ac72da0","ssdeep":"","tlshash":"a2b0122444fa9032497f37aac6e913cdeb741217a0471a327e0c12ce1f406b249c1e23","size":118,"data":"","first_seen":"2026-09-17T14:13:52.998196Z","last_seen":"2026-09-17T14:31:57.714495Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"4e4939cb014036470c700cff9434a038","sha1":"e6a031b75b80ca64e489cb5fc6c4a6eb1a200335","sha256":"602f07d26de391fe1660e329ce8922431bcc5db7326831bb3db817080ad9d177","sha512":"3ee418678fa3f3afc3729ad3a82dd8ee771e8e9390cc43d3229ca3d1566d60aff71246896a4bb67d5c1650e64101d693e78d825192d5db2fa23d3767a476d74d","ssdeep":"","tlshash":"3ec0220d4278547a007b0144ea4bb281be600013a001c8027e4894c59f44a297c90e80","size":188,"data":"","first_seen":"2026-09-17T14:13:52.999484Z","last_seen":"2026-09-17T14:31:57.715172Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"6e0a2cd08c66e17c9e7185fbd8a95da4","sha1":"62858733a15e152d417552ab2668762f4a4b81c1","sha256":"bae7af7be1403100d9dd13fba86060a2a4b8cdaaf407466507fe7272e9cb4d4f","sha512":"579cfc81a87a7ab71497fefc3b6fe5005549a3ac125f54c970302613de84dfbdaa1689db06014240fad4fbda7b6b6d1f411510399df650719135b9dfac5c3079","ssdeep":"","tlshash":"581127ab59f651f20a3b357b43ef130539b891572405cd517d4c824a1fd486a07aebe8","size":1107,"data":"","first_seen":"2026-09-17T14:13:53.000864Z","last_seen":"2026-09-17T14:31:57.715781Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"1189cad2ff04c7529368a3f01750d5cc","sha1":"afcf7155c5ca8ed9339343f8fffdac0ef338607a","sha256":"246d3ab0cc76572fb5dbee3d075d3a93cc6ea198749dc7e391dc076deb215352","sha512":"b0445ca2ba5225b8c54f7158f35f40bd7be9f79a2bdfcc0966de68718bc8d10bde81c2abada6580e2d8c958d264231ef8651fb6433566559c232715efac09e09","ssdeep":"","tlshash":"0381335f50d21325ad77a27abbdfa018222866135841c4043d8c83506f889e597f6bfd","size":4011,"data":"","first_seen":"2026-09-17T14:13:53.00192Z","last_seen":"2026-09-17T14:31:57.716424Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"040782f8e4c6a5c5914ad2a148f0012b","sha1":"c417d403eb86f03508eac90204c1239e51873b9b","sha256":"9f95b18d12bad910255bcd9e00277c34b155e5929a83e320ce9f6bd2df781c94","sha512":"715a2dba54693301fa4d97f1d15b1dccbb1746a46c75fd7e0ebcb15ed2b4b53c0ce320176b3b6a5f1054dab491d3e1b2a09a52c60a4cb17554423bca311c77c0","ssdeep":"","tlshash":"49d01259559331c001733065395f85405e517023250ae9103a0da5d86f9cd2d3b16f89","size":196,"data":"","first_seen":"2026-09-17T14:13:53.002739Z","last_seen":"2026-09-17T14:31:57.716999Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"cf52be4e06d32f9daf3430a69ae2bc57","sha1":"e9d9548ab1b7b26837205776c20c863f5de4127d","sha256":"c139ca7c18a3d00e4f957279b9ac321ac2f01fd23da94f4013ea36e443c7e243","sha512":"04e827cd06a80000454ca5fdb6a6ae3dbbbed2e926d1d17244a63315b7bfd8861619dd4bda225bfbc4a6ad364f43b11e4290fb54d6c31babcd033f744d0be0c7","ssdeep":"","tlshash":"1821eb7930e4613ac785619e217ed3ac3ebc61523a07508091accd6dac20d2bc86fdbe","size":1117,"data":"","first_seen":"2025-08-07T20:52:02.526159Z","last_seen":"2026-09-17T14:31:57.71777Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/cookieconsent.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4212f7a1371b8cfeffb72e3f62742550","sha1":"6411f84218eddf5b49ff9f43e1942c9e808d25ff","sha256":"b850bea52fbb93d157037884f3b5c223bd44fe1a4d4c8139d5cc2ad28030a84e","sha512":"f2046288a354fba0c14990f39d4b6297c9a199b5db1d9c74bdd7e04a55134705f31f19dea3b6d365ae6b733f9bf59f7069ae1779cab01c47ee8e2fdcf8ef1f61","ssdeep":"384:47fmk/+Pxhywlu9Qegnqj/cXYFOarvJpHKUOZPnvo+gFBPUF5xvSpntDNf:zhywc9wnqj0Xa3nO1nvo+ggF5qHf","tlshash":"5f8229b937f4713b899f10a650afd659b03e66300c87e898c1a4f4742d99e4e4c8fe1b","size":18420,"data":"","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.694137Z","times_seen":21,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/cookieconsent-init.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a10201298f5de908650bae4b90bb72f3","sha1":"5749692a34f5934f73ed28312ef0a5ac89be88bb","sha256":"eb920344b72aa611786c4b26828c7832ab3526809d99bd02a647cb9f2013d9b2","sha512":"a9c71e05e711d23578eb5a35c1bcc980c76614aad8778393e1bd3f1ec900f82865b607a01b0f424c37afd573acad3e0bc56d58c28cc494c86c285997fd7c19a2","ssdeep":"96:sXPXitz7xw7Ctj2IHOzV7pJkg4ZgKZdvuaZDyD:QPXivtj29zJhMLhDyD","tlshash":"9ba1feba71bc603d09125164a78fb6426124534b886afc3cb98f73341f4c62ec9ba7d7","size":5015,"data":"","first_seen":"2024-08-20T19:59:03.812311Z","last_seen":"2026-09-17T14:31:57.711714Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/datepicker.init.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"841d47151b8eeb966944878ba60c6ec6","sha1":"699cb37ca10bd266d0be3239a54932eed2e15a0d","sha256":"e29ed0639f7f4f47a6c21e2ae6bcf5406418ca4b90a5654852ebb50a8efe4774","sha512":"b02d8e54b965e7fe2fd742c64906db28c2b99043cdce5d06d814a2480912113efb8bcffa8148e9200dbdd4c24d38be79c207b02dd276eb177c7822201bf1bd03","ssdeep":"","tlshash":"a22101f3e1c30e7345be1414214e9f443821797ba8a35a44320ad8242decd6640fffb6","size":1330,"data":"","first_seen":"2025-08-07T20:52:02.455812Z","last_seen":"2026-09-17T14:31:57.688898Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"eventHandler","is_inline":false,"md5":"7c3c3ddeb80438dcbb3d081d2d00e152","sha1":"5a4016732ee72ec77b4f6ab17047bcea6d2ea34d","sha256":"321b4f657afbf8ba49518e6ab4cbad07ea967d0b4c68f71c7deed05ed09c1187","sha512":"b252f7dc795284fe8ce404711809130d8e16670a8e49b271f9a24b04a542a0fccb7a8c7238c12b37db35fe73a2fbf1cdb374468574db4e6d39975a17dca547a3","ssdeep":"","tlshash":"de6000f0003000000003c30000330cf300000c0f00ccc30cfc0000c000c00000000c03","size":16,"data":"","first_seen":"2023-04-10T15:57:29Z","last_seen":"2026-09-17T18:41:43.480376Z","times_seen":366745,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/moment/min/moment-with-locales.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d458b68730a7330653700489333a7837","sha1":"4059aeca1d0b99aec8006b37a927f09d9c0e794d","sha256":"430725b95468277dcbccc27e08e3d873276c0082737310b0b1ad330392511847","sha512":"e363c4d2b77ec19da13577ed94cefc0527a1206cdeccd790bb38a18810af504077095c47bec4a117ceb0056c1039137134836504fbaaeeb1b859684d89354716","ssdeep":"6144:cHOUXP7AhVuhTDGfNXqh/IT3TSZWkcSO2dpmcsmhce5NuNWPllei+BJkWomDBT5D:afAhVuhTDGRk/W3TSZWkcSO2dpmFmhcp","tlshash":"c774c8cf63e66b8e4a142116cc3dad0d284d0f81d079db35bfba5187f51ca2846bab71","size":369019,"data":"","first_seen":"2023-03-08T01:19:33Z","last_seen":"2026-09-17T16:22:54.995544Z","times_seen":2821,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"9b5e9f749e15aff6ff45d1c29ce41783","sha1":"2248b486538c63d047ae415b3139f46244419513","sha256":"c84b293eb1d7ab76c40ed9ba0194676314a0f055dd0b4830263ae85137fb6b8a","sha512":"8f2e7b8543ce4c93563e4bbe5475745b84cbd158a8b363cfb4eb3616d9fb91c68c43b1ccbdc8caf5912f5421f458709f740017eca0391b59f5c22bc1968d41cf","ssdeep":"","tlshash":"51d02bb915a284221694010e617b9259756460d42753614141ddcd7db930d7b8551958","size":263,"data":"","first_seen":"2025-08-06T06:01:10.021621Z","last_seen":"2026-09-17T14:31:57.718938Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"73d7c14e25c9258a7d3c4a3708771344","sha1":"b173bb641c96d94aaa5d875bff38a79fb3b9dad1","sha256":"34602f29c2f784873bf45a55a9e8ebc6ca8609732a9a2c7d110a65cd5b4fdd53","sha512":"acc59069dac821fc9630d3a301c7f28734f90f850c5b6ab3071b46567153add5041dc56adb5ff360348a5321c7b3de3e9753d600d6240f81f6cbe92f7807805c","ssdeep":"192:5EtBRTUdS4eDvzQ4Q6wRmKAJ/hfOk4jEdD0jca:5EtXTUdS4eDvzQ4zwRC44dmca","tlshash":"a9f1d7d77b81b45103727abb016f6da76408dfa275a58f97c860e4e4bf31780f82ae41","size":7847,"data":"","first_seen":"2025-08-07T20:52:02.509907Z","last_seen":"2026-09-17T14:31:57.701487Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/jquery.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"641dd14370106e992d352166f5a07e99","sha1":"eda46747c71d38a880bee44f9a439c3858bb8f99","sha256":"a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af","sha512":"a6e981b23351186aa43f32879dd64c6801be6e2af7ef8b0e472cccdeeba52d5d7894de4bcb292a364f1e11e525524077534338140a72687ada4fae62849843a5","ssdeep":"1536:IjjxXUHunxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBqUsuy8WnKdXwhLQvg:IeeIygP3fulzhsz8jlvaDioQ47GKH","tlshash":"d193f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","size":89795,"data":"","first_seen":"2023-03-26T04:59:07Z","last_seen":"2026-09-17T18:08:56.230423Z","times_seen":28096,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/jquery.validate.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6ef877ffbcf161cf8bd2c7054d290c23","sha1":"61fed7867fa63c18dc0907050e9da6d5c87c7839","sha256":"37f1043b3ca6e371925cdf4fe51f4e0531b02fcfc37c0595d5df4bb8f0cb9433","sha512":"9706adbb2537e6dbd80d598549657603847bdca1c6166ff7d7a92c7fdfa910019c4469a85aa8770014b8caf29c9fcc8b7fbdb0d26f47fe48a3bb81313ecaa794","ssdeep":"768:iWZ6/8lHJdkMioFpg5SUB2yQEny+zgxV4Ky47Z0z:W0d3ioFpg5SUB2yQEny+OaKyCiz","tlshash":"37b2a78976d271065e9720f4509b660b61b669a1e008e83cb5b8d4d2bef8fcc50f7f78","size":24600,"data":"","first_seen":"2023-04-05T15:31:11Z","last_seen":"2026-09-17T18:04:14.767592Z","times_seen":8990,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/navigation.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"08f25a1881e2dabad1bf3fe1abb32c58","sha1":"b3dec6ce96d0583a640dbe8d1ce9b83aed9fc5f1","sha256":"1fa735340c8136c61ab97d3b5f1351c4a07c02fdc5c9249d182cb9a139669f3e","sha512":"a348e3f212213aebb46e1a95d7ff86b0d123ad7c82e716c4de07682c264178e87f56efd21d5abe06931802ef4d635332eb3b3cff090e333e172664a0fd60cb4c","ssdeep":"","tlshash":"7f21104960f3b5ab003f71508b0f7a0873969003836aca22364d49e95f5a5b044b93eb","size":1315,"data":"","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.689987Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/jquery.validate.unobtrusive.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"99a6c2e4254d6d7f264d7edc5c8bf117","sha1":"40d3da09a615ef7b1c904a5e6e9b83e94851cf7a","sha256":"7103837ec95d1514b9007f4461c6cd0f9579e2b59fd67829b4ce2f1982b735cd","sha512":"73859e5780d3a8e2decf6c3c364c7226ac1aae6b9c1e2df2bc6ff7716a6c524be52087f166ac1fb9040d2f4d9b22b4f393edea49a3e93d2179bac5b184ff2fd8","ssdeep":"192:mDx+im4u0TccE/tybTKyBiwRG9cQf8zQ5CtKWOJeN8e787lXg7WHFVHUFNHrRg3:mD0idFBE16gcwcQkz4Ctb2eud5XcWHFZ","tlshash":"8cd19688364662b3aef730f7509f8007b176186a70854412f58581e1aebffe65663f1f","size":6272,"data":"","first_seen":"2023-03-12T17:39:01Z","last_seen":"2026-09-17T14:31:57.703128Z","times_seen":81,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/slick.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5a61c749e44e47159af8a6579dda121","sha1":"3b41b3bc956685015a347a2238e71db29dfa0dbb","sha256":"0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740","sha512":"5ed98cb4311c373da3ede92bb47bce551e22c30683ea8fc55097baf99abe1e0702b24de48f8b9241047cc1e4364158f5a343e4e8fc182e8866db4e99ccd7ee6e","ssdeep":"768:4rkkX123A5YHi6pWzYdlNWYcx16nnYdXRRMd2KYCQCsPShb1ez7RFmYH:EPrYdlNixEePiYH","tlshash":"e513a549d205276285d721e62105c40eb3f7fb3cba22c0e475c9d3ea646ec4896d7bfa","size":42863,"data":"","first_seen":"2023-03-07T01:06:34Z","last_seen":"2026-09-17T18:31:36.139583Z","times_seen":114776,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-17T18:40:08.560213Z","times_seen":435527,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/recaptcha.v3.init.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"892ee7b41ef04a47c61cbb2e86bbad13","sha1":"75c765dfa9260091058919037b4ab4368f2d8dbf","sha256":"56f1e8aab2b619223030ea14016ab3d09cabfdeaa32aef3e2c5c30836d5d21a5","sha512":"b9dc47f9c5f5ec4daa574153794926138b4ffe3caadc0253f5fabc71e09b48f2c5fa60457f5876c94b62b6011bc6365a4e979d6cbb71711c664f9ebe41ffabe5","ssdeep":"","tlshash":"0bf02b79713034b11dbb2070c01f768a6733b569e40591445504e97d1e7ddda4a42ead","size":537,"data":"","first_seen":"2023-11-04T02:02:34Z","last_seen":"2026-09-17T14:31:57.707975Z","times_seen":53,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/pikaday/pikaday.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a2f65e5942d6f13ab4e7bc8fb5dc72c0","sha1":"ff9b69429c3deb13fe38bdfb1e75d483a87e308e","sha256":"240e2bf4df8d07089d7efa5f1a40f7004d75247f5c64fd54f840412efc7d0e9d","sha512":"9170347c4f81466abf3cacb83e33983e9b610b193f457e06b505ebcf24945627bbf5cc29374ffdd18859c003d1b1205a369dcc4416830f4daad85fecdb904494","ssdeep":"384:BMD2nbJ3dlQds+R9csORfxxoXRPCnH8sCLSB0crFoUdG9NCFMzgK/qEsogV0sop:QEXlQds+RZsfPoFCnH8NLSB0crFoUdGr","tlshash":"3d62d8c730506a3352ab517859ab1607733294f4dc87882cb92c9add68ddc89227fff9","size":15555,"data":"","first_seen":"2025-08-07T20:52:02.507513Z","last_seen":"2026-09-17T14:31:57.705313Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/Our.Umbraco.Forms.IntlTelInput/js/intlTelInput.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1a65d712ff4ab7a09f61bbfe448238a4","sha1":"b467d76dd47b0fdcebca3b0fe7582f4cf90f8b76","sha256":"4d207cb73093f1034ad338e8103d58516f6f5f53492c24cbaa238c9e16105a6d","sha512":"73a86403273e78a0a7479ee71f5dc322b14de54d2b0b873a6d955add77a541fec21d9c62c11d1033c9b36ac20714c6f329d4ce41e389fee53e51dc845f45a6b4","ssdeep":"768:esqD7GzOoS+D45YdR3QWG6UdC8OxgtmKg3vTpzaDvCY9R:EfUQWodCjgtmKgNzazCw","tlshash":"ead20a9973551237a89aa0a1687f16472ebf34015a84cc8cb87ecdcc1feced9a1b5734","size":29481,"data":"","first_seen":"2023-04-07T09:15:38Z","last_seen":"2026-09-17T14:31:57.697448Z","times_seen":2154,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/Our.Umbraco.Forms.IntlTelInput/js/our.umbraco.forms.intl-tel-input.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a3ac0b3e02e041a9bc3517d86ad720a0","sha1":"842bcf68a9879085e412ac5ae9fdf38b98361ca2","sha256":"c91ced0cce04dbca19d33be1ce35f93e565d74b97b4d5ab68001d58568b60e92","sha512":"d5d5c72bb704ded0ed57ef3d47456bd2071007052a25db1c0312a122a545e977f81855709a701f296a2a886882c8fcd26b9ab799c342234680146bd78f7b56f4","ssdeep":"","tlshash":"093178af44441359b8b7a331f9da805dd7be0563589181023e8cc1105fb48d69bfafbd","size":1769,"data":"","first_seen":"2024-08-20T19:59:03.800783Z","last_seen":"2026-09-17T14:31:57.702039Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Error occurred during loading country2.json.","filename":"https://fraud.universalsavefinance.com/","line_number":2081,"column_number":21}]},"http":[{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/fontawesome/fa-solid-900.woff2","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.424Z","timestamp":1789655458424,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fonts/fontawesome/fa-solid-900.woff2 HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T18:41:51.81857Z","times_seen":18520184,"resource_available":true,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":268,"connect":164,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/mastercard-logo-white.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.445Z","timestamp":1789655458445,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/mastercard-logo-white.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 489\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":489,"size_decoded":753,"mime_type":"image/png","magic":"PNG image data, 45 x 36, 8-bit colormap, non-interlaced","md5":"aab0bc9606701860c7717b89db30fb43","sha1":"c21c770aad4d7fe465edc63990f0cd3f63b98e4b","sha256":"9a0ab4948cc844449e7e98e9f76a8061511651df20247e1e695503e1581fd05e","sha512":"6b4968d13acb58a833be5270fadc8888376423a40888431d5a1e161651999f345bb35632cc2cd9189c5830679d14560e98d74046fbb6e97867504b14f694f094","ssdeep":"","tlshash":"f0f0dcf85a2a48a0c21b47db187e6a1b08242d317931a05d8812753767b335032b9101","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.683526Z","times_seen":6,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/css/cookieconsent.css","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:59.964Z","timestamp":1789655459964,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /css/cookieconsent.css HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 5618\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":30080,"size_decoded":5929,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"f062f282f879ea0ca2bf6cbd70a21872","sha1":"2c11659a85cd45405c49b7769bfd19c1754e2f82","sha256":"af99ce66a536694f5de8c5bf3a67390b232e1a91782ecf608264cbf9ba724153","sha512":"aab8c3ca22d26d8d6ce1e75dd7b09bb0c4b2ac76696fa19de064d08928b317239fd209a1cb254f569221d3a09fde628701eb96b14684b55881a2e0d7e33f7e64","ssdeep":"192:jVTDkHuMXrexYjJNYYNsGsKk5fcBnetBEH4BEnfTDHKvpvJ+3HKihrQsJ886wBEL:5DkHuMi/c0sIpvJQthdJLKHAQ","tlshash":"20d2959c9b0191841237cf619be59b3cfbbc40229e8109eef7ed64464781bac00a6f7d","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.68451Z","times_seen":6,"resource_available":true,"data":null}},"time_used":75,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":74,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/Our.Umbraco.Forms.IntlTelInput/css/our.umbraco.forms.intl-tel-input.css","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.893Z","timestamp":1789655457893,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/Our.Umbraco.Forms.IntlTelInput/css/our.umbraco.forms.intl-tel-input.css HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 182\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":259,"size_decoded":492,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"40db4c210e9dc36e1f0cc6fc2a7d5db4","sha1":"b1ebe1e1aba44a6816aec0ea7a049d36b77ecf95","sha256":"ca868f761aa20ba1ebae19ead667e8e76d6d2714606c99f971613c342ecc1826","sha512":"3eb73ce1635df8a5a06010fd0fe121750f47a008461e16e5f6fe18594dc68d66985ba43feefef99a2efdaed4fdc968b0aa5e7451feaef08b8fefe99b4e144896","ssdeep":"","tlshash":"c1d05b05c20576072627c637b1362200b35b08669721d3a73b2d34a0cfa1d815073d10","first_seen":"2025-08-06T06:01:09.983381Z","last_seen":"2026-09-17T14:31:57.685347Z","times_seen":4,"resource_available":true,"data":null}},"time_used":2053,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2053,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/css/fontawesome.css","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.860Z","timestamp":1789655457860,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /css/fontawesome.css HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 12227\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":72616,"size_decoded":12539,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"eac353827237b5ea091f830c5acf2a3c","sha1":"301b9c09ebf3bf520be697b00bcb7010e0425770","sha256":"8ffa769473dd683d1ae4efdf730dda499e3f4ad6f107dfc95ebb799a5c0ac016","sha512":"1df9787ff1e5c7b05a72985f4bc37ff9e80ef698c54866c3419298bb939dde2841913691d158e76356679d2793da20f1515832cb2963105d7ac35ed356eb8bdd","ssdeep":"768:MXSvlhsCiaoabqBBJ2TsS40VEkTxY1STlpTRfBodFk0UUYJ6gyEIc:MXSvlhstaWfeEmEkFY1STlVR0q0+fdH","tlshash":"726305fcd01e00844b7bcaa5a7427a617a3db3b9ff4a4d41f2262d9c91c3654a186fcd","first_seen":"2025-08-07T20:52:02.502248Z","last_seen":"2026-09-17T14:31:57.686061Z","times_seen":3,"resource_available":true,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/jquery.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.869Z","timestamp":1789655457869,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /scripts/jquery.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 30829\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":89795,"size_decoded":31069,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"641dd14370106e992d352166f5a07e99","sha1":"eda46747c71d38a880bee44f9a439c3858bb8f99","sha256":"a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af","sha512":"a6e981b23351186aa43f32879dd64c6801be6e2af7ef8b0e472cccdeeba52d5d7894de4bcb292a364f1e11e525524077534338140a72687ada4fae62849843a5","ssdeep":"1536:IjjxXUHunxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBqUsuy8WnKdXwhLQvg:IeeIygP3fulzhsz8jlvaDioQ47GKH","tlshash":"d193f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-26T04:59:07Z","last_seen":"2026-09-17T18:08:56.230423Z","times_seen":28096,"resource_available":true,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":68,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/www.google.com/recaptcha/api9f37.js?render=6LcbENAmAAAAAAp8AV9Sno_D7XTbBya2-9zLEYId","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.125Z","timestamp":1789655458125,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /www.google.com/recaptcha/api9f37.js?render=6LcbENAmAAAAAAp8AV9Sno_D7XTbBya2-9zLEYId HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-09-17T18:37:05.424146Z","times_seen":155493,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/fontawesome/fa-brands-400.ttf","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:01.398Z","timestamp":1789655461398,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/fontawesome/fa-brands-400.ttf HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:02 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":689,"timings":{"blocked":0,"dns":0,"connect":171,"send":0,"wait":176,"receive":0,"ssl":342},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/slick.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.874Z","timestamp":1789655457874,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /scripts/slick.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 10291\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":42863,"size_decoded":10531,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (42862)","md5":"d5a61c749e44e47159af8a6579dda121","sha1":"3b41b3bc956685015a347a2238e71db29dfa0dbb","sha256":"0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740","sha512":"5ed98cb4311c373da3ede92bb47bce551e22c30683ea8fc55097baf99abe1e0702b24de48f8b9241047cc1e4364158f5a343e4e8fc182e8866db4e99ccd7ee6e","ssdeep":"768:4rkkX123A5YHi6pWzYdlNWYcx16nnYdXRRMd2KYCQCsPShb1ez7RFmYH:EPrYdlNixEePiYH","tlshash":"e513a549d205276285d721e62105c40eb3f7fb3cba22c0e475c9d3ea646ec4896d7bfa","first_seen":"2023-03-07T01:06:34Z","last_seen":"2026-09-17T18:31:36.139583Z","times_seen":114776,"resource_available":true,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/datepicker.init.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.885Z","timestamp":1789655457885,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/UmbracoForms/Assets/datepicker.init.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 648\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1330,"size_decoded":886,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1330), with no line terminators","md5":"841d47151b8eeb966944878ba60c6ec6","sha1":"699cb37ca10bd266d0be3239a54932eed2e15a0d","sha256":"e29ed0639f7f4f47a6c21e2ae6bcf5406418ca4b90a5654852ebb50a8efe4774","sha512":"b02d8e54b965e7fe2fd742c64906db28c2b99043cdce5d06d814a2480912113efb8bcffa8148e9200dbdd4c24d38be79c207b02dd276eb177c7822201bf1bd03","ssdeep":"","tlshash":"a22101f3e1c30e7345be1414214e9f443821797ba8a35a44320ad8242decd6640fffb6","first_seen":"2025-08-07T20:52:02.455812Z","last_seen":"2026-09-17T14:31:57.688898Z","times_seen":3,"resource_available":true,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/faq-two.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.894Z","timestamp":1789655457894,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /scripts/faq-two.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 346\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":856,"size_decoded":584,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"0a6a0ba403a2cef43abdcb1c5c9159f3","sha1":"dccbe10b7154bfd07db8157a7853177e881ec635","sha256":"8fc084f8868302a46472795fb67d24e401841fe4efe79231a846adae88958221","sha512":"43691c9776dee11d7ade4e32ff5a7c421aedf75af7b01cc3123379e0cdc0d417a2b3db939ca897a4cbfff6df936246b9d6042844fd1a7f8be2c426f0a6d01a9c","ssdeep":"","tlshash":"57116b0df4a9ca7208ff38410396b0503d94901ba34ce902359e6be55fc54b026b62d3","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.689449Z","times_seen":5,"resource_available":true,"data":null}},"time_used":2052,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2052,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/navigation.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.896Z","timestamp":1789655457896,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /scripts/navigation.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 566\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1315,"size_decoded":804,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"08f25a1881e2dabad1bf3fe1abb32c58","sha1":"b3dec6ce96d0583a640dbe8d1ce9b83aed9fc5f1","sha256":"1fa735340c8136c61ab97d3b5f1351c4a07c02fdc5c9249d182cb9a139669f3e","sha512":"a348e3f212213aebb46e1a95d7ff86b0d123ad7c82e716c4de07682c264178e87f56efd21d5abe06931802ef4d635332eb3b3cff090e333e172664a0fd60cb4c","ssdeep":"","tlshash":"7f21104960f3b5ab003f71508b0f7a0873969003836aca22364d49e95f5a5b044b93eb","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.689987Z","times_seen":5,"resource_available":true,"data":null}},"time_used":2050,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2050,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/code.tidio.co_443/wsaputyafjpz9oucrbika1gfpujcgsqb.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.897Z","timestamp":1789655457897,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /code.tidio.co_443/wsaputyafjpz9oucrbika1gfpujcgsqb.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-09-17T18:37:05.424146Z","times_seen":155493,"resource_available":true,"data":null}},"time_used":233,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":233,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/get-back-hover-98x98.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.450Z","timestamp":1789655458450,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/get-back-hover-98x98.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1264\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1264,"size_decoded":1529,"mime_type":"image/png","magic":"PNG image data, 98 x 98, 8-bit colormap, non-interlaced","md5":"c91cfea4002996a3f000c747740ccdad","sha1":"bb2820441561389e3f2e86d9658b079abe0a6c0e","sha256":"475b24b57e0a4eb0f48d824c409c0edab9bc8dedf870a344bb50d5f6ea87f417","sha512":"4d025a05ba8765cc9279440121f35ec4cf081bd3952a62e356f256d32e9129e4c6a04093a9363ddcb16b2bd851b6d5567090aedd4bc56c6a95287ec1937bd347","ssdeep":"","tlshash":"cc21ea6a34d1fb90ebe45807b335d718caf111ba61c7ad8480878c1b70e092cc94370f","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.69047Z","times_seen":6,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/code.tidio.co_443/wsaputyafjpz9oucrbika1gfpujcgsqb.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:59.986Z","timestamp":1789655459986,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /code.tidio.co_443/wsaputyafjpz9oucrbika1gfpujcgsqb.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Thu, 17 Sep 2026 14:31:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-09-17T18:37:05.424146Z","times_seen":155493,"resource_available":true,"data":null}},"time_used":75,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/apple-touch-icon.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:01.299Z","timestamp":1789655461299,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:31:01 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 14358\r\ndate: Thu, 17 Sep 2026 14:31:01 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":14358,"size_decoded":14624,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"234eb32a6858ead94ce292c3a5a7a02a","sha1":"04e6723e1d456c80cae4713d87c74a3205841cef","sha256":"17cbd52a249cb911a820b817dd2f45085f6788385d994caf4ff13d69f66f6394","sha512":"177640a47c2d5aff8b0c6ac34b8bf6f6467fff810a048c63c9922564d683b9694a9e879b398b34e392443ec0f6816a06d65e3dc4fe88e62e83245148d5a14132","ssdeep":"384:TyP31XL2cW5Do93AKQqEN1/DGVEyyhpGfQve35J:mPRL2DDgAjbNkyhpGms","tlshash":"3252d1eb0b61e1b5fc9bbcf06f5bb09784044012ab4061cd44ae9c3fe41c6c1ea1bab5","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.69121Z","times_seen":6,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/favicon-16x16.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:01.300Z","timestamp":1789655461300,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:31:01 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 620\r\ndate: Thu, 17 Sep 2026 14:31:01 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":620,"size_decoded":884,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"2f811b280bb9ca0a101e5437d2cab3dc","sha1":"ac9b50e67982f673d31550e2e04ceffa6511b57a","sha256":"ae54320d800f634532742add0793dac0dd6574070a3b73a5cf30df5a5f5f3568","sha512":"12757ff522ca33cf5bd726cb7b3a64dcfacebce897c1b1345ddec9f00c5bde4d9442b2fe101ea47eb98c4c3045c30c1294700cb3a301a7d685ff74b9a3e89837","ssdeep":"","tlshash":"44f0b7ffa5d74f9c458cc2a26c24b45b8c18884d1fdf30386219d8e634c2870280fbd6","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.691734Z","times_seen":5,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-17T14:30:57.012Z","timestamp":1789655457012,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\nlast-modified: Mon, 13 Jul 2026 20:23:54 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 16731\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Slick","description":"","website":"https://kenwheeler.github.io/slick","common_platform_enumeration":"","icon":"Slick.svg","categories":["JavaScript libraries"]},{"name":"Pikaday","description":"A refreshing JavaScript Datepicker.","website":"https://github.com/dbushell/Pikaday","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"Tidio","description":"Tidio is a customer communication product. It provides multi-channel support so users can communicate with customers on the go. Live chat, messenger, or email are all supported.","website":"https://www.tidio.com","common_platform_enumeration":"","icon":"Tidio.svg","categories":["Live chat"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":97978,"size_decoded":17043,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1525)","md5":"4152528cefed075037f35fb7cf892e82","sha1":"f671b451184ef7a05120ad053f3830a60e31465a","sha256":"204991b79197adb6cb85246b4e571fc3daa32dce40c1aee37b9ef1450ef8d05d","sha512":"49c1263f0c336c3c5b9f6b7c08f69eed5848380abc5c9f63366c32fe7ba94cdc9a1e9ba49add9f91f56a7e6e0b6f149f59811115ca1545aec44ac2d793cedf4e","ssdeep":"1536:WIzUJPmP5oaj4n91T9bCZ0Y70Lj25t/z1IRiMCSCOcF:WIzKONj491UZ/JIRiM/S","tlshash":"eca34120a8f0c8b540eb44d925b69e69aef4d703e6044188fb5c8bf65fb7c68cb73654","first_seen":"2026-09-17T14:13:52.946505Z","last_seen":"2026-09-17T14:31:57.69225Z","times_seen":2,"resource_available":true,"data":null}},"time_used":614,"timings":{"blocked":-1,"dns":333,"connect":69,"send":0,"wait":136,"receive":0,"ssl":75},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/www.google.com/recaptcha/api9f37.js?render=6LcbENAmAAAAAAp8AV9Sno_D7XTbBya2-9zLEYId","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.876Z","timestamp":1789655457876,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /www.google.com/recaptcha/api9f37.js?render=6LcbENAmAAAAAAp8AV9Sno_D7XTbBya2-9zLEYId HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-09-17T18:37:05.424146Z","times_seen":155493,"resource_available":true,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/pikaday/pikaday.min.css","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.891Z","timestamp":1789655457891,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/UmbracoForms/Assets/pikaday/pikaday.min.css HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 1399\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3260,"size_decoded":1710,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (3166)","md5":"c3005ef8f583defb1173325ca46e67e1","sha1":"2d3c6ab347a011daa0446307fe94e8bfe018731a","sha256":"801465fc2cd474a63329c646c6e374a921e50bbc7b15dd4c6e1e57f2eced6a81","sha512":"e1ffcae523064864b2f72a0cc1cd4eb2934d6ef12cd90e43722112f9cb0d6ec1cc4868734e70d3ee8802e9f252c53a8e5ba27102812b1e495dc6d89c63803a20","ssdeep":"","tlshash":"85617434e280652ff9b7c2b033915acf2855c4d7a97e573aa815b0adc9cb2d2146b70d","first_seen":"2025-08-06T06:01:09.984799Z","last_seen":"2026-09-17T14:31:57.692989Z","times_seen":6,"resource_available":true,"data":null}},"time_used":2052,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2052,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/fontawesome/fa-solid-900.woff","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:29.815Z","timestamp":1789655489815,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/fontawesome/fa-solid-900.woff HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:30 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":694,"timings":{"blocked":-1,"dns":0,"connect":176,"send":0,"wait":172,"receive":0,"ssl":346},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.895Z","timestamp":1789655457895,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 661\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1239,"size_decoded":899,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-17T18:40:08.560213Z","times_seen":435527,"resource_available":true,"data":null}},"time_used":2051,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2051,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/cookieconsent.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.899Z","timestamp":1789655457899,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /scripts/cookieconsent.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 6826\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":18420,"size_decoded":7065,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (18283)","md5":"4212f7a1371b8cfeffb72e3f62742550","sha1":"6411f84218eddf5b49ff9f43e1942c9e808d25ff","sha256":"b850bea52fbb93d157037884f3b5c223bd44fe1a4d4c8139d5cc2ad28030a84e","sha512":"f2046288a354fba0c14990f39d4b6297c9a199b5db1d9c74bdd7e04a55134705f31f19dea3b6d365ae6b733f9bf59f7069ae1779cab01c47ee8e2fdcf8ef1f61","ssdeep":"384:47fmk/+Pxhywlu9Qegnqj/cXYFOarvJpHKUOZPnvo+gFBPUF5xvSpntDNf:zhywc9wnqj0Xa3nO1nvo+ggF5qHf","tlshash":"5f8229b937f4713b899f10a650afd659b03e66300c87e898c1a4f4742d99e4e4c8fe1b","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.694137Z","times_seen":21,"resource_available":true,"data":null}},"time_used":2047,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2044,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/css/main.css","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.865Z","timestamp":1789655457865,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /css/main.css HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 12253\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":91751,"size_decoded":12565,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"66b1b0103128a1dc38c3aefa98d84901","sha1":"692b597f633948178b9d4f95380bfc8142206c14","sha256":"ab61b9e176d7126c20691ade99f601b5028059ca3bcc75b7829334053a1a7dd6","sha512":"bc8f86db86740e3787d33aea3386ac65b2f3b93ba56c95a2543214c2a15585474a3f2e90ae3864e6cd21de090d5ffd5eb1a7ef167493e66b5767f2bc4fa60371","ssdeep":"768:FRD2A7Fp+xajdMFkx/cqbrvc+IlFApXFJFef5ubF3LF3rFqrOOFxxVKuUxTd+oUf:Fp7dMWywe2pXDn1N0bExACM5","tlshash":"7d9385a637611140342f886536db9f68333c9407990bddedb6e21068afca6f85173bde","first_seen":"2025-08-06T06:01:10.00525Z","last_seen":"2026-09-17T14:31:57.694691Z","times_seen":4,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/jquery.validate.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.870Z","timestamp":1789655457870,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /scripts/jquery.validate.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 8049\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":24601,"size_decoded":8288,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (24462)","md5":"6ef877ffbcf161cf8bd2c7054d290c23","sha1":"61fed7867fa63c18dc0907050e9da6d5c87c7839","sha256":"37f1043b3ca6e371925cdf4fe51f4e0531b02fcfc37c0595d5df4bb8f0cb9433","sha512":"9706adbb2537e6dbd80d598549657603847bdca1c6166ff7d7a92c7fdfa910019c4469a85aa8770014b8caf29c9fcc8b7fbdb0d26f47fe48a3bb81313ecaa794","ssdeep":"768:iWZ6/8lHJdkMioFpg5SUB2yQEny+zgxV4Ky47Z0z:W0d3ioFpg5SUB2yQEny+OaKyCiz","tlshash":"37b2a78976d271065e9720f4509b660b61b669a1e008e83cb5b8d4d2bef8fcc50f7f78","first_seen":"2023-04-05T15:31:11Z","last_seen":"2026-09-17T18:04:14.767592Z","times_seen":8990,"resource_available":true,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":147,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"recovery.mstoolsnetshop.com/assets/uploads/Funds-recovery-10-1.mp4","fqdn":"recovery.mstoolsnetshop.com","domain":"mstoolsnetshop.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.437Z","timestamp":1789655458437,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /assets/uploads/Funds-recovery-10-1.mp4 HTTP/1.1\r\nHost: recovery.mstoolsnetshop.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T18:41:51.81857Z","times_seen":18520184,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"recovery.mstoolsnetshop.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/visa-logo-white.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.443Z","timestamp":1789655458443,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/visa-logo-white.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 735\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":735,"size_decoded":999,"mime_type":"image/png","magic":"PNG image data, 84 x 28, 8-bit colormap, non-interlaced","md5":"72900d1045f7d272d9cbd04bdaf5fbae","sha1":"a636d6b6e8184ea348eb6084c6a82981b3e8cb47","sha256":"f77510a1088d2651f2e3857ec0d580bf1f33a3c9529935b290768977cfbc034b","sha512":"0903eeaa0ac049d48234757d5547ab94bf72461d4fc3feb0110ff728e7a2eb9ccd78c58a8ce1bcc2f7867c044cf512f4a2cba1fa1e977765a5aea38244df580e","ssdeep":"","tlshash":"cf0144c2cb521d2456e2363581864988b4ee1eba7438c3bea132f06863b24d69355575","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.695799Z","times_seen":6,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/dmca-logo-white.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.446Z","timestamp":1789655458446,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/dmca-logo-white.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1110\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1110,"size_decoded":1375,"mime_type":"image/png","magic":"PNG image data, 131 x 43, 8-bit colormap, non-interlaced","md5":"6181a7221f4a83ceb8664fde65d6f131","sha1":"709ccf7d3a3724c4991537f87a966fc51eb33148","sha256":"12d558fa18dde9c983eaf040cf491ec52caae59eeb5c17d8f0cf39d5fa4eeb08","sha512":"53a78556abe1162d8a1142ad0a2df1e2117a37cc38834c7c8d63e65d3cb6fb30fe607d46acdab76d3a56a1acb13e020d7a560219a6b18c52afc14ad4e75a8132","ssdeep":"","tlshash":"f311e90560a27368e82152165f8e889ac20b4f2d7e6937ea18527d104fbf4497c880d5","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.696334Z","times_seen":6,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/credit-card.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.453Z","timestamp":1789655458453,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/credit-card.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 574\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":574,"size_decoded":838,"mime_type":"image/png","magic":"PNG image data, 34 x 37, 8-bit colormap, non-interlaced","md5":"d8701700fa18203260b2f697397fdb08","sha1":"acfae2e3131c4d94bfecf04c2a92bd281aa51ffa","sha256":"dc8604f35df1aaf90fc2206f5b2a57f13e4aa0b78fd167c1a6f28cae9c9c7813","sha512":"e4a5ce7d73176204b65e5e5d8b1c5ed4653104cdb637d97136ad80af8cbc3ade5bd3260547bb74a7460fca036b55ea6e3c7af5598cdeb8b5e2f78c11e8e1f6a9","ssdeep":"","tlshash":"fef00ceb4abd591ac6945233f3e1880890e9bfa040a62824602b089c066485b9b2a92c","first_seen":"2025-08-06T06:01:09.977137Z","last_seen":"2026-09-17T14:31:57.696881Z","times_seen":3,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/Our.Umbraco.Forms.IntlTelInput/js/intlTelInput.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.887Z","timestamp":1789655457887,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/Our.Umbraco.Forms.IntlTelInput/js/intlTelInput.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 11068\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":29519,"size_decoded":11308,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (26956)","md5":"1a65d712ff4ab7a09f61bbfe448238a4","sha1":"b467d76dd47b0fdcebca3b0fe7582f4cf90f8b76","sha256":"4d207cb73093f1034ad338e8103d58516f6f5f53492c24cbaa238c9e16105a6d","sha512":"73a86403273e78a0a7479ee71f5dc322b14de54d2b0b873a6d955add77a541fec21d9c62c11d1033c9b36ac20714c6f329d4ce41e389fee53e51dc845f45a6b4","ssdeep":"768:esqD7GzOoS+D45YdR3QWG6UdC8OxgtmKg3vTpzaDvCY9R:EfUQWodCjgtmKgNzazCw","tlshash":"ead20a9973551237a89aa0a1687f16472ebf34015a84cc8cb87ecdcc1feced9a1b5734","first_seen":"2023-04-07T09:15:38Z","last_seen":"2026-09-17T14:31:57.697448Z","times_seen":2154,"resource_available":true,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":234,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/logo.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.441Z","timestamp":1789655458441,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/logo.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1652\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1652,"size_decoded":1917,"mime_type":"image/png","magic":"PNG image data, 156 x 52, 8-bit colormap, non-interlaced","md5":"19a8decd03d8e964d8e874ad2c223f38","sha1":"246cb191b631b4727fd754995572ec8b3380435e","sha256":"6a001936b810f4a5a8ec50dfe5bba28f83f24e2e0946d192cf69b575f225752d","sha512":"2bbfff59a282eebc45fd373a9d34f36f5c714709490797eab0f2e8acf9231d5cc8d5fdcc9abae5a3f93b22c7584efb9be1f8712ebd8fb78d52c3b83a8767bbb3","ssdeep":"","tlshash":"74310ce454e9147102b3837908808f04d8142e9c7eb1a89f5461351eeff2de80e69f54","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.698002Z","times_seen":4,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/file-complaint-hover-98x98.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.448Z","timestamp":1789655458448,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/file-complaint-hover-98x98.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 545\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":545,"size_decoded":809,"mime_type":"image/png","magic":"PNG image data, 98 x 98, 4-bit colormap, non-interlaced","md5":"cd4135893f041f043ec14a3eecd138ad","sha1":"05c48099676e8ee25429eea2c94cbf32414536f4","sha256":"67e697e4a1d1ad1ec38a05e0898db6679600d4a3ce6c100260a46d3f0866b9e5","sha512":"5a4c2c31877a905b6a31589fbf8e975774b2febacd41e658e276a667f0d751677a1187bff8cbd51c0b0ec1bb7cb64a27cba36ebcfdb09d4c82eb331c09913d2a","ssdeep":"","tlshash":"87f0e15fdb82eaa6822e78df92ca508096e615ee20d5504a04058421a8990989945e41","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.698564Z","times_seen":6,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/img/icons/envelope.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:59.969Z","timestamp":1789655459969,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/img/icons/envelope.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:31:00 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 214\r\ndate: Thu, 17 Sep 2026 14:31:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":214,"size_decoded":478,"mime_type":"image/png","magic":"PNG image data, 19 x 14, 8-bit/color RGBA, non-interlaced","md5":"241dbd70746697a9f4a38891eda752c2","sha1":"8fcd901b6b5a048671111bb23c627ad8f158aedf","sha256":"ae440cfe781ea2a477f108362cb99d46db0c9443cc464ba4c37d0deec863b376","sha512":"6538abcebd5787241141a3d6c0d9b616e228a6cf1c53ce4411b53c3e5189ed4abf150b8ee2fa95fbfd7b18c9fab9eada379d47c4db4e5b369f803a9845b2187b","ssdeep":"","tlshash":"8ed023f71c304d0cc31820370ed053007f64249e1640e34704102d7c0b0eb6c84d9c06","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.699097Z","times_seen":5,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/titillium-web/titillium-web-semibold.woff","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:29.819Z","timestamp":1789655489819,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/titillium-web/titillium-web-semibold.woff HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:30 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":686,"timings":{"blocked":-1,"dns":0,"connect":174,"send":0,"wait":169,"receive":0,"ssl":343},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/fontawesome/fa-solid-900.ttf","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:30.529Z","timestamp":1789655490529,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/fontawesome/fa-solid-900.ttf HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:31 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":664,"timings":{"blocked":-1,"dns":0,"connect":164,"send":0,"wait":165,"receive":0,"ssl":333},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/maxresdefault-540x304.jpg","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.907Z","timestamp":1789655457907,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/maxresdefault-540x304.jpg HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:59 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 22301\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":22301,"size_decoded":22568,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], progressive, precision 8, 540x304, components 3","md5":"e93d5be5bd64150e06893abecac8b1d2","sha1":"9747321295814c8c050a27591ea96e585b502e46","sha256":"1fe2ff8353b09b6b19de19f0685605d8cc7bac836e80a0ba67afb0eb2abef4ab","sha512":"b28cb7f0911dfe00efb0893973a7ba09e71be0d8dc3f1782f4c39d2b6f92ed675e2cadf38ceb7903a32120fcd5a84d97d4e220261e705f24466e7acd7957729d","ssdeep":"384:2s3n0g0CfLpOzaKBVnQhBdrfJuZ/Up6IWiG9fWcPShvZBzKlYvF1TN:zsAKPQhBRJutUVUuBHt/N","tlshash":"6da2e131a7194c81eb2f69b20332abe8ef65cb4c8915c9159e9738f6510fb41ea11377","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.699896Z","times_seen":6,"resource_available":false,"data":null}},"time_used":2044,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2041,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/trustpilot-logo-white.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.442Z","timestamp":1789655458442,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/trustpilot-logo-white.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 811\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":811,"size_decoded":1075,"mime_type":"image/png","magic":"PNG image data, 131 x 33, 8-bit colormap, non-interlaced","md5":"25462cc6160bdc6772f82ca44eb815d9","sha1":"e40394975c08fe0421e3ea6f1aceab78be85d7a0","sha256":"4fff2e94e50eb6b0bbbfd7cbc30a2b627b6d5a746fdf27c43fb0a91d0ac48b14","sha512":"0576040901d3d24623293c03ff2cba9e0798cc3458b493ce049791e60184953bb43b36bcb4c69df1358202d673f2ec3a266187805aab6c8a64e0a057bcc48bbc","ssdeep":"","tlshash":"2e0175dc9221e958b6d883ccd4700669d4a10d8ecb3099254a67706807773d0ce2d3b1","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.700426Z","times_seen":6,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/img/icons/map.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:59.968Z","timestamp":1789655459968,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/img/icons/map.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:31:00 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 423\r\ndate: Thu, 17 Sep 2026 14:31:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":423,"size_decoded":687,"mime_type":"image/png","magic":"PNG image data, 18 x 24, 8-bit/color RGBA, non-interlaced","md5":"345adba9dc35b591dc141b0b4fd263be","sha1":"45b7f68138cd68553838f42f282d64dfad5dd70c","sha256":"b5eeb4d6bbc5ca284d4b9da532c5e75933ed1f0bd752c196067bd89a233d44a7","sha512":"3fba21637f87f1a299c8734df4355ea0d7eb42e9fbba4f82bcdfed3643558ef84a519ea3aed7f2838fbaca749b0db6afa6578159a352c725e54038c0106c5057","ssdeep":"","tlshash":"08e0a36495574c20d5f17053ef37002044b15974dc56960803c4d4b6777a8d65a4e893","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.700948Z","times_seen":5,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:00.036Z","timestamp":1789655460036,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 3702\r\ndate: Thu, 17 Sep 2026 14:31:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7847,"size_decoded":3941,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (7847), with no line terminators","md5":"73d7c14e25c9258a7d3c4a3708771344","sha1":"b173bb641c96d94aaa5d875bff38a79fb3b9dad1","sha256":"34602f29c2f784873bf45a55a9e8ebc6ca8609732a9a2c7d110a65cd5b4fdd53","sha512":"acc59069dac821fc9630d3a301c7f28734f90f850c5b6ab3071b46567153add5041dc56adb5ff360348a5321c7b3de3e9753d600d6240f81f6cbe92f7807805c","ssdeep":"192:5EtBRTUdS4eDvzQ4Q6wRmKAJ/hfOk4jEdD0jca:5EtXTUdS4eDvzQ4zwRC44dmca","tlshash":"a9f1d7d77b81b45103727abb016f6da76408dfa275a58f97c860e4e4bf31780f82ae41","first_seen":"2025-08-07T20:52:02.509907Z","last_seen":"2026-09-17T14:31:57.701487Z","times_seen":3,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":73,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/Our.Umbraco.Forms.IntlTelInput/js/our.umbraco.forms.intl-tel-input.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.888Z","timestamp":1789655457888,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/Our.Umbraco.Forms.IntlTelInput/js/our.umbraco.forms.intl-tel-input.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 672\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1772,"size_decoded":910,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"a3ac0b3e02e041a9bc3517d86ad720a0","sha1":"842bcf68a9879085e412ac5ae9fdf38b98361ca2","sha256":"c91ced0cce04dbca19d33be1ce35f93e565d74b97b4d5ab68001d58568b60e92","sha512":"d5d5c72bb704ded0ed57ef3d47456bd2071007052a25db1c0312a122a545e977f81855709a701f296a2a886882c8fcd26b9ab799c342234680146bd78f7b56f4","ssdeep":"","tlshash":"093178af44441359b8b7a331f9da805dd7be0563589181023e8cc1105fb48d69bfafbd","first_seen":"2024-08-20T19:59:03.800783Z","last_seen":"2026-09-17T14:31:57.702039Z","times_seen":4,"resource_available":true,"data":null}},"time_used":2055,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2055,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/cfd.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.454Z","timestamp":1789655458454,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/cfd.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 784\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":784,"size_decoded":1048,"mime_type":"image/png","magic":"PNG image data, 40 x 44, 8-bit colormap, non-interlaced","md5":"a9a385b246743dec545dcaa17eaf45eb","sha1":"41578ef14ff69cde30fd1420d1f76e92ba506e47","sha256":"66f9b61d4fb3b9ab5bece2b7d6689d6cc53f733910ff4e56ca17357399b9aaa8","sha512":"b3f51a73a70371207d4bf9278cf9b743d47b7353b904c8d208c2a6e56d272b30a38281d18108bd4df2321c7352c6582220ee02e6e6ddc60315ec6fa346215b95","ssdeep":"","tlshash":"9f01202ef6a207b5c989d7b98c60921441a155370bf2e8572016cb1bb72e48af9da706","first_seen":"2025-08-06T06:01:09.990059Z","last_seen":"2026-09-17T14:31:57.702559Z","times_seen":3,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/jquery.validate.unobtrusive.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.873Z","timestamp":1789655457873,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /scripts/jquery.validate.unobtrusive.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 2555\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6272,"size_decoded":2794,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (5341)","md5":"99a6c2e4254d6d7f264d7edc5c8bf117","sha1":"40d3da09a615ef7b1c904a5e6e9b83e94851cf7a","sha256":"7103837ec95d1514b9007f4461c6cd0f9579e2b59fd67829b4ce2f1982b735cd","sha512":"73859e5780d3a8e2decf6c3c364c7226ac1aae6b9c1e2df2bc6ff7716a6c524be52087f166ac1fb9040d2f4d9b22b4f393edea49a3e93d2179bac5b184ff2fd8","ssdeep":"192:mDx+im4u0TccE/tybTKyBiwRG9cQf8zQ5CtKWOJeN8e787lXg7WHFVHUFNHrRg3:mD0idFBE16gcwcQkz4Ctb2eud5XcWHFZ","tlshash":"8cd19688364662b3aef730f7509f8007b176186a70854412f58581e1aebffe65663f1f","first_seen":"2023-03-12T17:39:01Z","last_seen":"2026-09-17T14:31:57.703128Z","times_seen":81,"resource_available":true,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":226,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/moment/min/moment-with-locales.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.882Z","timestamp":1789655457882,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/UmbracoForms/Assets/moment/min/moment-with-locales.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 67974\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":369019,"size_decoded":68214,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d458b68730a7330653700489333a7837","sha1":"4059aeca1d0b99aec8006b37a927f09d9c0e794d","sha256":"430725b95468277dcbccc27e08e3d873276c0082737310b0b1ad330392511847","sha512":"e363c4d2b77ec19da13577ed94cefc0527a1206cdeccd790bb38a18810af504077095c47bec4a117ceb0056c1039137134836504fbaaeeb1b859684d89354716","ssdeep":"6144:cHOUXP7AhVuhTDGfNXqh/IT3TSZWkcSO2dpmcsmhce5NuNWPllei+BJkWomDBT5D:afAhVuhTDGRk/W3TSZWkcSO2dpmFmhcp","tlshash":"c774c8cf63e66b8e4a142116cc3dad0d284d0f81d079db35bfba5187f51ca2846bab71","first_seen":"2023-03-08T01:19:33Z","last_seen":"2026-09-17T16:22:54.995544Z","times_seen":2821,"resource_available":true,"data":null}},"time_used":235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":144,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/img/icons/play.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.153Z","timestamp":1789655458153,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/img/icons/play.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 399\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":399,"size_decoded":663,"mime_type":"image/png","magic":"PNG image data, 26 x 30, 8-bit/color RGBA, non-interlaced","md5":"7303bf3c18accaf5c354fec8ecbbfc0d","sha1":"0160498e15a3c34074bfc5ea1afec76bf5c1ce51","sha256":"63dde4568ae4207892c4df21e0102d7bd0ad98f994eefa16a612e1b1f0ebabb4","sha512":"b82b9e2100188217dca265cbd23a2980a528cf70c4ee578769b4690a575f458764e27b4f2b317b8ffc69306758ea4e8928f79691e05f28b7ea7e2f9f8dd7636a","ssdeep":"","tlshash":"56e0f1f15341847826d42ffee1301781d250c431511907c7f186f256190065e594c7cc","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.704223Z","times_seen":5,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/titillium-web/titillium-web-bold.woff2","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.423Z","timestamp":1789655458423,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fonts/titillium-web/titillium-web-bold.woff2 HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T18:41:51.81857Z","times_seen":18520184,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/titillium-web/titillium-web-regular.ttf","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:30.513Z","timestamp":1789655490513,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/titillium-web/titillium-web-regular.ttf HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:31 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":691,"timings":{"blocked":-1,"dns":0,"connect":169,"send":0,"wait":175,"receive":0,"ssl":347},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/css/contact-forms.css","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.867Z","timestamp":1789655457867,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /css/contact-forms.css HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 1878\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10709,"size_decoded":2189,"mime_type":"text/css","magic":"assembler source, ASCII text","md5":"fabac3d83a7d2767cf04009ab5688e3f","sha1":"9d3b98a57218e9457aae6c4c1d9a0b5dffbc2cc7","sha256":"95c55cd5553f43e3926559659df7851de62428492639b6c0b34030a4e1249289","sha512":"98d798e74ea5b8bb3fb4291e3c157a509186e779d9ee687410eb71e041816a74eef3a266679c284e4f6fe754413e750f7e095b69016b91328a509f13185d028d","ssdeep":"192:VHHAy0zVBRRhXYC2IQ0hwL7FEOCt2l/oXyYyEXy0Oz0n:VnAyEVBRRhXZ2IQ0mL7FEOCySy+OYn","tlshash":"b422cc5827d00510b81f885822deaf75333ea412da4eddfd3ad21521af8a3f456e1fe9","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.704787Z","times_seen":6,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/fontawesome/fa-brands-400.woff2","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:59.982Z","timestamp":1789655459982,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/fontawesome/fa-brands-400.woff2 HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:00 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":696,"timings":{"blocked":0,"dns":0,"connect":172,"send":0,"wait":172,"receive":0,"ssl":351},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/titillium-web/titillium-web-regular.woff","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:29.822Z","timestamp":1789655489822,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/titillium-web/titillium-web-regular.woff HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:30 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":679,"timings":{"blocked":-1,"dns":0,"connect":169,"send":0,"wait":169,"receive":0,"ssl":341},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/pikaday/pikaday.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.884Z","timestamp":1789655457884,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/UmbracoForms/Assets/pikaday/pikaday.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 5605\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":15555,"size_decoded":5844,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (15555), with no line terminators","md5":"a2f65e5942d6f13ab4e7bc8fb5dc72c0","sha1":"ff9b69429c3deb13fe38bdfb1e75d483a87e308e","sha256":"240e2bf4df8d07089d7efa5f1a40f7004d75247f5c64fd54f840412efc7d0e9d","sha512":"9170347c4f81466abf3cacb83e33983e9b610b193f457e06b505ebcf24945627bbf5cc29374ffdd18859c003d1b1205a369dcc4416830f4daad85fecdb904494","ssdeep":"384:BMD2nbJ3dlQds+R9csORfxxoXRPCnH8sCLSB0crFoUdG9NCFMzgK/qEsogV0sop:QEXlQds+RZsfPoFCnH8NLSB0crFoUdGr","tlshash":"3d62d8c730506a3352ab517859ab1607733294f4dc87882cb92c9add68ddc89227fff9","first_seen":"2025-08-07T20:52:02.507513Z","last_seen":"2026-09-17T14:31:57.705313Z","times_seen":5,"resource_available":true,"data":null}},"time_used":237,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":233,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/css/bootstrap-mod.css","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.857Z","timestamp":1789655457857,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /css/bootstrap-mod.css HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 5889\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":86296,"size_decoded":6258,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"e8616bb388746e45cbc9f2948297dab6","sha1":"ea6ec99988097db21447a421d2760025c997c0e6","sha256":"57247479d29593d7e5563a52185d0c710a2fb55d4c8d77fda02d0c1e4b8892d3","sha512":"eb229d9c3aa65eb658fc444552ff067418f73ddd75fb7fe5b9726f8976e7576226f56ad6fc26f24a129fc47d9e6caa56913d703802500b227d283ac92de51e89","ssdeep":"384:ymRNWMGf9xbDNL2akvWwCiE+ohLUsoNOeMUVYYI0TxIYTT1yV:tinbDNMUUsoNOeMUVYYI0TxIYTo","tlshash":"1c835b73e980050a55b2673da3d3367efebd5167d201acf274eeba118b616c24c85cca","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.705879Z","times_seen":6,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/Our.Umbraco.Forms.IntlTelInput/css/intlTelInput.min.css","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.892Z","timestamp":1789655457892,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/Our.Umbraco.Forms.IntlTelInput/css/intlTelInput.min.css HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 2582\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":19159,"size_decoded":2893,"mime_type":"text/css","magic":"ASCII text, with very long lines (19159), with no line terminators","md5":"2da2e54f66d2fbd3d645d021ae66bfe8","sha1":"d5c42a24cb55e2fc7de22091d6c72ce20bc74d09","sha256":"be857eed1b4e265bb9ba342239c160da2f75f5f719db73d0acdcda7431b8fe36","sha512":"13fccb7e910b95a112794e525a174137921bd67973703cf06ceb71f32381ab1db1eef6da4fa902caa275eda5b3aac611fc3b75da1f03e03eea36fb943c901d70","ssdeep":"192:6wR+nXh/TVc6jU+4v7fix43obCfCfIlSf:6wRWXhK6jU+4vTixaACaglSf","tlshash":"0f821f1709a32429f627d5a261708eb637278c0bf4264fba49153e7ca3825d51df3fe2","first_seen":"2023-06-13T00:17:54Z","last_seen":"2026-09-17T14:31:57.706433Z","times_seen":22,"resource_available":true,"data":null}},"time_used":2054,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2051,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/gdpr-logo-white.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.447Z","timestamp":1789655458447,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/gdpr-logo-white.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 968\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":968,"size_decoded":1232,"mime_type":"image/png","magic":"PNG image data, 99 x 48, 8-bit colormap, non-interlaced","md5":"30cf54c5f4ca471516f253e04c5e5d4b","sha1":"353236377ebfc5c3b0880d3de695de2b399e043a","sha256":"1f3017cc66b5b077cba59f615026e5365a88614c93086efc8603c10ebbb25841","sha512":"27ebb87666d33a3dcb7522c6b48fc2ac3ccd4817ee3d747e6ae9fba9b8ad50f85c1c9b14cb2b4c03456f6503f5120fdf264cf26df835c46d6661b7eec14fd67d","ssdeep":"","tlshash":"d311c4e6c4c808088a0307438307e6149d3a1cf8b9b2c38333a13c418bf28c92dfa503","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.706976Z","times_seen":6,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/banking.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.452Z","timestamp":1789655458452,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/banking.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 501\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":501,"size_decoded":765,"mime_type":"image/png","magic":"PNG image data, 37 x 37, 8-bit colormap, non-interlaced","md5":"7833160874e8cddbbc26e4345d1d2cc1","sha1":"4b78af55c30f683150c9abf7d3256f1bf57f1be9","sha256":"1194d9b3751267739a9f82fa1caabe3235928b37cdf023708d5725262ea5fc31","sha512":"c90be87504e6fa03679ebcc6b6f8fb4551a5a2e56a688b0652af4a7527f9ef66b5327cd77e6431a3680b4504bab83033149d38be6496e086f47cf0a51b41685f","ssdeep":"","tlshash":"aff005c74f8c813d475a1637da79c098bc5d04b84255f04b688bde5cb1135817001b71","first_seen":"2025-08-06T06:01:09.995592Z","last_seen":"2026-09-17T14:31:57.707563Z","times_seen":3,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/country2.json","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:00.134Z","timestamp":1789655460134,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /country2.json HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Thu, 17 Sep 2026 14:31:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-09-17T18:37:05.424146Z","times_seen":155493,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/recaptcha.v3.init.min.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.878Z","timestamp":1789655457878,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/UmbracoForms/Assets/recaptcha.v3.init.min.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 325\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":537,"size_decoded":563,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (537), with no line terminators","md5":"892ee7b41ef04a47c61cbb2e86bbad13","sha1":"75c765dfa9260091058919037b4ab4368f2d8dbf","sha256":"56f1e8aab2b619223030ea14016ab3d09cabfdeaa32aef3e2c5c30836d5d21a5","sha512":"b9dc47f9c5f5ec4daa574153794926138b4ffe3caadc0253f5fabc71e09b48f2c5fa60457f5876c94b62b6011bc6365a4e979d6cbb71711c664f9ebe41ffabe5","ssdeep":"","tlshash":"0bf02b79713034b11dbb2070c01f768a6733b569e40591445504e97d1e7ddda4a42ead","first_seen":"2023-11-04T02:02:34Z","last_seen":"2026-09-17T14:31:57.707975Z","times_seen":53,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/titillium-web/titillium-web-semibold.woff2","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.422Z","timestamp":1789655458422,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fonts/titillium-web/titillium-web-semibold.woff2 HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T18:41:51.81857Z","times_seen":18520184,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/titillium-web/titillium-web-bold.woff","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:29.817Z","timestamp":1789655489817,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/titillium-web/titillium-web-bold.woff HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:30 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":689,"timings":{"blocked":-1,"dns":0,"connect":169,"send":0,"wait":170,"receive":0,"ssl":350},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/UmbracoForms/Assets/themes/default/umbracoforms.min.html","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.880Z","timestamp":1789655457880,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/UmbracoForms/Assets/themes/default/umbracoforms.min.html HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/html\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 1773\r\ndate: Thu, 17 Sep 2026 14:30:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4520,"size_decoded":2006,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (394)","md5":"a76d69d730b251d32b36fc07cbdd067f","sha1":"96dd3d0dd7e66286bd913c1293ee82fa5c67706f","sha256":"5415b1a628357e72e37a7f001383cc93dca2349df8551c5b8e615338683e632d","sha512":"0247c423db4e24a76f35acf31ede5520d7d4f76ad7b8bc2c740ad97d28961263e0faf10b7ca2532d4cc6672bc6729ffb2bcb113749e8a9f280dcebb3d03d7b03","ssdeep":"96:1j9jwIjYj5jDK/D5DMF+C8LZqXKHvpIkdNBrRx9PaQxJbGD:1j9jhjYj9K/Vo+n4aHvFdNBrX9ieJGD","tlshash":"bf917326bafd217e10a3816265fd63487ea0c453c6a705a076acc1391f9ef59fe171c4","first_seen":"2025-08-07T20:52:02.483271Z","last_seen":"2026-09-17T14:31:57.708603Z","times_seen":3,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":145,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/App_Plugins/Our.Umbraco.Forms.IntlTelInput/js/validate.phonenumber.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.889Z","timestamp":1789655457889,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /App_Plugins/Our.Umbraco.Forms.IntlTelInput/js/validate.phonenumber.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 246\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":431,"size_decoded":484,"mime_type":"text/javascript","magic":"ASCII text, with CRLF line terminators","md5":"5ea3e1612ede11b9e6be9ff83499fa5c","sha1":"82f7e372dde2bd806f60dd3c9c3c04e744aa7c94","sha256":"71d8b7acfee198676dc3abc902da4291e76e7fcdc2a3c5400acd52a61f66451b","sha512":"a84741adb39007a9b079be31040de9e2456db64f3adb472c5526ba4bdef5e7bb9a586acf48b7606a6448fa7b709241bdb1c25bedeca9fe2c0d9e92a933cf684b","ssdeep":"","tlshash":"ede06119f800d0156d3632fcd9f9c05dfdc802278142c4543c8c50411f72dd167f199d","first_seen":"2024-08-20T19:59:03.803012Z","last_seen":"2026-09-17T14:31:57.709131Z","times_seen":4,"resource_available":true,"data":null}},"time_used":2054,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2054,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/titillium-web/titillium-web-regular.woff2","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.420Z","timestamp":1789655458420,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fonts/titillium-web/titillium-web-regular.woff2 HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T18:41:51.81857Z","times_seen":18520184,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/online-scams.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.451Z","timestamp":1789655458451,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/online-scams.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 473\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":473,"size_decoded":737,"mime_type":"image/png","magic":"PNG image data, 38 x 37, 8-bit colormap, non-interlaced","md5":"cab1faaf523c168e47f3ea23d92b6c88","sha1":"3c3cf8a4307de80459f7e283e41d6d25fcc88240","sha256":"0c1df93860803fed4308df453743beff1222b912574274275dc83715949c85fa","sha512":"cb76e076abede16ceb3a207ad61c90023457f9717bb2df844e511a6b85cc398ec4b63a467f9ef31408e5ac7441d387e612a96afc122c53519800d9428bd8747d","ssdeep":"","tlshash":"13f023b70d156e35e8e2363311158283e06203357439153f019e9e30e5203f4e4e03b5","first_seen":"2025-08-06T06:01:09.97282Z","last_seen":"2026-09-17T14:31:57.709666Z","times_seen":3,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/titillium-web/titillium-web-semibold.ttf","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:30.524Z","timestamp":1789655490524,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/titillium-web/titillium-web-semibold.ttf HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:31 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":680,"timings":{"blocked":-1,"dns":0,"connect":169,"send":0,"wait":169,"receive":0,"ssl":341},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/fight-hover-98x98.png","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.449Z","timestamp":1789655458449,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/fight-hover-98x98.png HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 709\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":709,"size_decoded":973,"mime_type":"image/png","magic":"PNG image data, 98 x 98, 4-bit colormap, non-interlaced","md5":"9028b17592a58bf414970f63f159b1fb","sha1":"9cf01b49934000225ecf716c5f273d9f5c8c4f62","sha256":"5cbe60d9ad2a2e3e36dfb6c4955fe272792af00eba927eb512787d8318dff80a","sha512":"1a7a75e722cc9e2e17d0149482db7bf62a048dd18a851a1db8823388a2110ce50af85d33bc8d29f71df0bdcfd09088889d71b9e44b8c1b53ad8c0ba5f3e5bffa","ssdeep":"","tlshash":"ba016503826065b0d8d4023743946d53de96817da3bdb606e0c6f8099acca699419232","first_seen":"2023-11-11T13:49:46Z","last_seen":"2026-09-17T14:31:57.710951Z","times_seen":6,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/fontawesome/fa-brands-400.woff","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:00.698Z","timestamp":1789655460698,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/fontawesome/fa-brands-400.woff HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:01 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":693,"timings":{"blocked":0,"dns":0,"connect":172,"send":0,"wait":178,"receive":0,"ssl":343},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"funds-recovery.com/assets/fonts/titillium-web/titillium-web-bold.ttf","fqdn":"funds-recovery.com","domain":"funds-recovery.com","tld":"com"},"ip":{"addr":"104.219.250.37","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:31:30.526Z","timestamp":1789655490526,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"funds-recovery.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 06:02:14 GMT","end":"Wed, 16 Dec 2026 06:02:13 GMT"},"fingerprint":{"sha1":"1C:2B:47:32:35:8D:D4:23:0F:6B:81:D6:3E:1F:E2:99:55:DE:6B:18","sha256":"B6:98:7C:F2:86:1C:67:57:7C:9A:C1:A7:84:C9:40:4C:00:5F:86:89:40:60:63:54:F2:E6:8D:24:46:DC:E9:43"}}},"request":{"raw":"GET /assets/fonts/titillium-web/titillium-web-bold.ttf HTTP/1.1\r\nHost: funds-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://fraud.universalsavefinance.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nserver: nginx/1.28.3 (Ubuntu)\r\ndate: Thu, 17 Sep 2026 14:31:31 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nconnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":162,"size_decoded":321,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-09-17T15:57:03.976559Z","times_seen":3643,"resource_available":true,"data":null}},"time_used":691,"timings":{"blocked":-1,"dns":0,"connect":169,"send":0,"wait":172,"receive":0,"ssl":349},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/scripts/cookieconsent-init.js","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:57.900Z","timestamp":1789655457900,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /scripts/cookieconsent-init.js HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ncontent-length: 1524\r\ndate: Thu, 17 Sep 2026 14:30:59 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5015,"size_decoded":1763,"mime_type":"text/javascript","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (340)","md5":"a10201298f5de908650bae4b90bb72f3","sha1":"5749692a34f5934f73ed28312ef0a5ac89be88bb","sha256":"eb920344b72aa611786c4b26828c7832ab3526809d99bd02a647cb9f2013d9b2","sha512":"a9c71e05e711d23578eb5a35c1bcc980c76614aad8778393e1bd3f1ec900f82865b607a01b0f424c37afd573acad3e0bc56d58c28cc494c86c285997fd7c19a2","ssdeep":"96:sXPXitz7xw7Ctj2IHOzV7pJkg4ZgKZdvuaZDyD:QPXivtj29zJhMLhDyD","tlshash":"9ba1feba71bc603d09125164a78fb6426124534b886afc3cb98f73341f4c62ec9ba7d7","first_seen":"2024-08-20T19:59:03.812311Z","last_seen":"2026-09-17T14:31:57.711714Z","times_seen":5,"resource_available":true,"data":null}},"time_used":2046,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2043,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fraud.universalsavefinance.com/assets/uploads/landing2_bck.jpg","fqdn":"fraud.universalsavefinance.com","domain":"universalsavefinance.com","tld":"com"},"ip":{"addr":"23.153.104.17","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fraud.universalsavefinance.com/","date":"2026-09-17T14:30:58.151Z","timestamp":1789655458151,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.fraud.universalsavefinance.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 22:52:02 GMT","end":"Fri, 11 Dec 2026 22:52:01 GMT"},"fingerprint":{"sha1":"AD:52:B0:1D:70:ED:91:D2:BD:B5:98:4C:0E:A5:FB:B2:6E:B2:0C:B2","sha256":"52:F6:11:AC:BD:D5:0A:2D:93:18:E5:70:6F:48:25:FC:0C:80:11:35:F8:78:DD:62:34:87:1D:55:23:8A:35:D9"}}},"request":{"raw":"GET /assets/uploads/landing2_bck.jpg HTTP/1.1\r\nHost: fraud.universalsavefinance.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fraud.universalsavefinance.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 24 Sep 2026 14:30:58 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Apr 2024 09:02:55 GMT\r\naccept-ranges: bytes\r\ncontent-length: 62643\r\ndate: Thu, 17 Sep 2026 14:30:58 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":62643,"size_decoded":62910,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1900x920, components 3","md5":"c2e592fd0bfa3e8583dc7b8add63e26b","sha1":"bfa81bedf816ec4680bb8f4e9bee72823509895e","sha256":"d5679b62c712b1888cd25586bb1450ff59c15221806191887e24a6223bdaabde","sha512":"ef89a9bb0957361f9f4ae190ec74b3da1fb92d9e965cb449ac319c537f1763acc94b181b553f75d709fabaa6489d4c667d5c5c0b70b8b8ae778f9edd3cd78637","ssdeep":"1536:orpA26XyKo6EfxIcyqMnV6VkAgjvFuBXtwg8n8kEPX:owzo60xknn1t6XknDEf","tlshash":"ae530256634c01dcf0182139a55f2bb9773287b41aae88636892663cb9edb507dc8bd8","first_seen":"2023-08-29T22:08:48Z","last_seen":"2026-09-17T14:31:57.712441Z","times_seen":5,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":75,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}