{"report_id":"09ac841c-371e-4df9-a64b-b2d7a043a0bf","version":6,"status":"done","tags":[],"date":"2026-01-20T09:23:51Z","url":{"schema":"http","addr":"steamrefund.top","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"steamrefund.top/","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"title":"Name | Cryptocurrency trading and invest platform","dom":{"size":129791,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3947)","md5":"e6884332bd454cc5ff480db16356466c","sha1":"183130e8333f9622d78e27558db45bdfb5758dfa","sha256":"bd6782283571db9358b0ad9f2a807980263c58b44b64b407b30548473d25ea84","sha512":"04bc0076fac95b1f061df91f6afe92f1644ae2a494369aa573c728be5b7b7c84ff190650dce746ca7e6241452870d886410d416be0455520eb6d89e0b44151fa","ssdeep":"1536:5dnwVOWGCPZlv0nsvv9vv5vv6kvvmvvRnvvt9vvHvvB0LhMPrnvfp:LdNjr5","tlshash":"d7c3d8e8a3f4a1a4e046d3e5d62255267f66a4b76b03c668f3bc0f80df42c9dcc57846","dom_hash":"domhashf5c5e331da36a052ef8ff7b40fd7a6b3","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"steamrefund.top","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-24T09:23:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-18T22:14:28.232245Z","alert_count":0,"request_count":4,"received_data":163852,"sent_data":2200,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-18T22:17:29.309663Z","alert_count":0,"request_count":1,"received_data":23026,"sent_data":475,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"steamrefund.top","ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-06-02","domain_rank":0,"first_seen":"2025-06-23T06:51:07.862281Z","last_seen":"2026-01-20T09:19:54.504806Z","alert_count":82,"request_count":41,"received_data":2009105,"sent_data":18707,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery:3.4.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"steamrefund.top/assets/js/app.min.js","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d07fddad2dbb2e1b33663063df276af3","sha1":"ff05ef5d12cab598273743b8ecba860d5fe3eb19","sha256":"84c100eb29667fada78eac7c2ef3831d2dfa9d01827c00f9a8c07a8da28231ee","sha512":"497e5b7368287addb7d29b29b80a3f89ee35f8b1fb5156b0b02bf27fbc6b238fbe78d4554ec7f879b982da6ff9b1e4750f1daf058c5f921c5032eec06afd48c6","ssdeep":"","tlshash":"c57122791314b93c02a30ad7e6e6aad07a343886d5411070a8b9ccaf1fd98d39371ff6","size":3615,"data":"","first_seen":"2023-07-07T00:40:59Z","last_seen":"2026-06-07T23:46:49.554582Z","times_seen":435,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/js/header.js","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6346713cce7e17259e64d496ba485768","sha1":"245f3809552985258772d5749a57198898707caa","sha256":"078e59fd4c57b2ecddabd2a0fb0a1157a3bfd7475957f0f67d3adb0dfd163020","sha512":"1ffc08826328cb2ae820caa60f29b684558cf851ee5f70d9c0f0e501cd714498ad7b5c352284d3e913ae0d0ca253fd3001bea86dc3f20965258a0b61233e224d","ssdeep":"","tlshash":"1901d22667047d7d40bb0bafe7e20e94fb2590d79461403730ad898f0fe25d1a6a6af0","size":764,"data":"","first_seen":"2023-07-19T01:27:01Z","last_seen":"2026-05-17T06:36:06.091007Z","times_seen":138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/js/jquery-3.4.1.min.js","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a6b6350ee94a3ea74595c065cbf58af0","sha1":"b15f7cfa79519756dff1ad22553fd0ed09024343","sha256":"412b8ff9c5ab32b9019fcd84bcd4a54c0e265a14528474f4ee45b27a20abeaeb","sha512":"f5a9c6aee347c155e4dd796c51716b7447bc22ae44741fceb6bcfee02f955ad4063d38613f241108a3e1f3e1f540fcaed8d9848b9a0fb823c00955cf9a19efad","ssdeep":"1536:jTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPmt:jgZm0H5HO5+gCKWZyPmHQ47GKR","tlshash":"a08319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","size":88147,"data":"","first_seen":"2023-03-07T01:10:32Z","last_seen":"2026-06-08T21:19:14.652524Z","times_seen":5125,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/js/toastr.js","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a02ccbbcf3073559037a62af82bfdd24","sha1":"4d5f7b3f3f280698aa26b10e1d7c6dd5708d64aa","sha256":"27f959b17ddfe77ca20a31b9950ebc3fbe8030c3ac376eec7355b2d7925e364c","sha512":"35acaadcc160935be74fb1492b1b0ca205aed6b61d8bd8edf4e26254c7772da02941ec53de59e3d66ce1695cc12de4ed9cf32b750e04659c7c0e2521b4697f22","ssdeep":"192:JJZWM9gzM3t3QrpJvxl6Xs8cZ9tID6CqQwPjOoOg6yS21tl3jWq5T14:JY45Kk7cZDItqLNO6S21tNA","tlshash":"deb20a08695263654cb7737c8aab800cfb769323458a96067dbc92d82f70714d6f6fec","size":24854,"data":"","first_seen":"2023-07-07T00:40:59Z","last_seen":"2026-06-07T23:46:49.515699Z","times_seen":915,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"29ac057b2d746415874f6328be7628d7","sha1":"e87680e405cad1e249b2ee856e6e95e307e6076f","sha256":"f6698b8bb6a22b7d8312437e840a2982d7474b4834fffd0307a973efd3271b99","sha512":"c2f3c80c594f34a33cd7bd67abbfb9a0ab05829a81e318b1a48577650d65a96a4aab1da2a6d6dc360df4bdb226d8a418215a61f6cda2b43564f404738f1f57e4","ssdeep":"96:GHWnYkQs6pMVyxuZLPIPeGF/to0qLQqVzgKccn:G2YRsKMUkD17eKccn","tlshash":"ede151ba60f14a845013c376693fbd563833a5af6c0a0e11b2ed27c09f41eeeed57158","size":7231,"data":"","first_seen":"2025-04-01T11:27:30.111177Z","last_seen":"2026-04-12T05:40:05.133775Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/portfolio/bg.png","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.193Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/portfolio/bg.png HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/png\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\ncontent-length: 262698\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=60ihT0f6OTD03rY%2BFL07LfWTrcl4Lydf4BRhk2IBT9TRJjp7qDpzBl44eVrm1BSIrisjfXL%2B25e4au2Di6jtVeD%2FRgIEsON5cdj%2FSZA%3D\"}]}\r\ncf-ray: 9c0d8371af9b0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":262698,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 624 x 447, 8-bit/color RGBA, non-interlaced","md5":"645605f411179fec6b363b3fdd1e34c6","sha1":"9124d4662078ac4f4842af1ed5a314b7709f7735","sha256":"7b1f2b65768d1e3feb41f4529e993674aab5ce49ff622b04640a7083339c52c4","sha512":"74a14c6a72a9db07787cc13678b83819df2fa730a87b9650a0cc1f3b129b1fe41afae4831798d030358c5f21568136ada100eeb42d4f140a499a724cbe5a71df","ssdeep":"6144:okebzH276tfbB2uT+VekROR49DBkoNJZ7VTa95ASx:qbWmVKRRplT7Z1k3","tlshash":"4e44238e983022e1da0be9524b9de3984cd6c279f55d58d4d7e628ee317c0a4df63f04","first_seen":"2025-04-01T11:27:30.084559Z","last_seen":"2026-05-17T06:36:06.074018Z","times_seen":41,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/js/toastr.js","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/js/toastr.js HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=60%2Bm8VzaW%2BkOJGyystg2f59NLoV4%2FPFWTBOAlCfmsRo6G9H7g6a7Hk6P%2FEDJA9iHZ4iidyNfhO7c7f%2B7LmQz8CTXJfWDQaHLVkkhvKk%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8371af9e0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24855,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (327), with CRLF line terminators","md5":"a02ccbbcf3073559037a62af82bfdd24","sha1":"4d5f7b3f3f280698aa26b10e1d7c6dd5708d64aa","sha256":"27f959b17ddfe77ca20a31b9950ebc3fbe8030c3ac376eec7355b2d7925e364c","sha512":"35acaadcc160935be74fb1492b1b0ca205aed6b61d8bd8edf4e26254c7772da02941ec53de59e3d66ce1695cc12de4ed9cf32b750e04659c7c0e2521b4697f22","ssdeep":"192:JJZWM9gzM3t3QrpJvxl6Xs8cZ9tID6CqQwPjOoOg6yS21tl3jWq5T14:JY45Kk7cZDItqLNO6S21tNA","tlshash":"deb20a08695263654cb7737c8aab800cfb769323458a96067dbc92d82f70714d6f6fec","first_seen":"2023-07-07T00:40:59Z","last_seen":"2026-06-07T23:46:49.515699Z","times_seen":915,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/platform/line.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.322Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/platform/line.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/landings/6/style/platform.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nvC%2FXLJqxRMelJpGNirT0DMf4SZeNC9Bk47Ew37HngMUrdroZ1lFoWaHYCjiAcOQexI0Y4nEQwNUDZ6eHQbrMqy4juYU2pWRvmVUkqk%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83728fd00afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":802,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a25f453dfb5ed3cf38937180ac318561","sha1":"9bd85d5ee9ff6dcb7f1a0cfff904330c0f7f2bdb","sha256":"0db06699408b8f618b30a81e80d12408120d5df647a5f48d688f93e9459bafc4","sha512":"0a34a277176f58dc83286ec2ba6914c7e99053e0c62d355468e26f41295a5b1fd8d33e8061835bfc53fcfa7683a0d92a045989ad79b0f454c95208fe981e8bce","ssdeep":"","tlshash":"c401892fcb8d8c7bd2a9c13ce814987511aa8382aac1c3a0c074bb2f5a191930c2b3d4","first_seen":"2025-06-23T06:51:13.836192Z","last_seen":"2026-05-17T06:36:06.050265Z","times_seen":42,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/home/bg-line.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.315Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/home/bg-line.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/landings/6/style/home.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8mVfDvTIujK3aFcIBNMHwygyZY6sV3dLj9%2F0Zx2k8nBli9XWVC1bNJ3GVBXgYqoL4YyNEJ8o9ya1MEVivHd1TZB2b5XoVXTIm7wLDBE%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83727fcb0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":962,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5ce305d4bfa3a901933db28adde4f853","sha1":"9530ea02f1cb905afce28553f795b7b0a6fcdf4a","sha256":"a7e9d7ce777f97c1cd5f14f2281c9d0e22b1181ed34f51c61163083b303b306e","sha512":"aac0d45eaa4953654d7c7722fad00789193a1ca4010890e23f92d19348df0173de4240ac8ac04cd0f74ab6e5dda6f479019623ff3d68642ac971a218b6eb00f4","ssdeep":"","tlshash":"3b1151777a9de873e98364a7f530aa91415f20f7c1c9625689050ce905e9fc7303b0f9","first_seen":"2025-06-23T06:51:13.818174Z","last_seen":"2026-04-12T05:40:05.11514Z","times_seen":29,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/way/blue-bg.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.320Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/way/blue-bg.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/landings/6/style/way.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zBPv0C8qPkjSt8T7mNPJCPR%2B74O4qKhVGZpQlQv1SgGXS%2FYU6x1UIRs3vAGiWJ%2F4w4DjhFXzYz8PsH%2FrLJEr0J4CAFXVGYG5v7%2FDeqg%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83727fce0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1036,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8f47beecb986ab037800cd92f18c5314","sha1":"2a963a074508f9ea3021aeb9ee8093b7ddb2874a","sha256":"1de393b273f05c25b94bf68f6436a95203fbd562407eece5e86e1587b9a166c7","sha512":"528ab67c49ac86f591869cb49575924c0901a24c96c46dff56028252b190c654df064c7c698b2c6888b0c004f7df0d5689fc27432395c72ffef68b814361a27c","ssdeep":"","tlshash":"6c11effca5959d0d56a2a130f6a9ace1572de1b2f001011eec3e3263d063d81e96b218","first_seen":"2025-06-23T06:51:13.819392Z","last_seen":"2026-05-17T06:36:06.032297Z","times_seen":40,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.363Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:06 GMT","end":"Tue, 03 Mar 2026 17:10:05 GMT"},"fingerprint":{"sha1":"87:0F:C1:25:08:22:50:0D:D6:14:D4:EF:A9:CF:49:70:C2:8E:5D:36","sha256":"65:A3:E5:AA:4F:13:A5:53:EC:B5:39:DF:03:7F:DE:7D:6F:2B:23:33:85:34:59:13:C3:FC:C2:AC:22:E9:97:D9"}}},"request":{"raw":"GET /s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://steamrefund.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:20:02 GMT\r\nexpires: Sun, 17 Jan 2027 18:20:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 227008\r\nlast-modified: Tue, 18 Nov 2025 19:00:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40128, version 1.0","md5":"9a01b69183a9604ab3a439e388b30501","sha1":"8ed1d59003d0dbe6360481017b44665153665fbe","sha256":"20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2","sha512":"0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca","ssdeep":"768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO","tlshash":"3703023a5e3ccf1a84157a703950f6d9a8481e548e9d143b4f1ac7bf085dde2209b6d4","first_seen":"2025-01-08T22:59:02.845106Z","last_seen":"2026-06-08T21:16:12.332851Z","times_seen":873942,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":69,"dns":1,"connect":23,"send":0,"wait":25,"receive":16,"ssl":44},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/media/logos/favicon.ico","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/media/logos/favicon.ico HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/x-icon\r\npriority: u=6,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X5e13w7r0fhhj4yZP1ePEnHHTNqL5eHDCwjS2VM%2Fs9tbODxsCzATKnEcLjJ936GuHeVnVKUzv1BzHXgmLUk2Hm3i04TlYQL%2BWUOC0NU%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83743ff50afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9662,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel","md5":"50ec41fb68191b157dc92d60c9123806","sha1":"fc7ab9994b4610844133e807a83b28dff23361cf","sha256":"51ed290c09a566a3b11c7a11ecb0fc195cd6ff701b41b3e2b832abce21961bcf","sha512":"c6892c2e8dc36c087f4611c8941d85fbc241cff7dec0cb4c7acf287c5ef2b0c72e3725a6a03faa1fed2d006447d1b44ece34b76b85cc1e4273a2232d862fa01b","ssdeep":"192:iuvI2ePZxx1OHjUwNZJIFX7bzfXZnSg+NtLUH3bTxRb6hFzZSX+:RQ2ePZxODtnJeLbzfXhl+NtLMxAhFzgO","tlshash":"d61220825dff051dfde40a3156a9091ebd6adc24a0f6bc18179ffe80ab36ad0b593490","first_seen":"2023-10-15T06:02:08Z","last_seen":"2026-06-01T08:48:29.121077Z","times_seen":165,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/home.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/home.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8AiEyzHCPAQX5%2FvzoRGQGyJ%2FbjbmTmHXDFq1sigx99suzCvwKlSFcFt5aE7Ulk7gxIXL5xMlt8d94Ru5%2FdmuonM%2BBrVhNJcOlI%2FeOd8%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf140afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3251,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"30098ae36becd0c2e0c9e1e2ce865788","sha1":"df3427c4667202eec589577d1416181c686d973d","sha256":"6e0789e3e7e141731246373c041de4c9cdf8bb96256eb65232ba1091f881549d","sha512":"add3b17ddd6389193e9abe8312d22dd3beaef6d50c1fa113d272815c90a9e0682fd4d0af190f5af477e1f4b131da26af13513790e23318a36755afe3037b0b8d","ssdeep":"","tlshash":"ca61d015cb01600e713fe2b9bbb2024ce5594057870645b87bdc7b949ff415ca262fcd","first_seen":"2025-06-23T06:51:13.831827Z","last_seen":"2026-04-12T05:40:05.124505Z","times_seen":27,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/company.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.055Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/company.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NvaumQm2fMhv3G3tmJO6WKC%2FeZtHq5bozJzylSjJYb%2Bv5NkNmA2Ay0ggNyOWeWNyHfnypGsfItB%2FdghiMj31CxFV6FVVMRhNz1cYSL0%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf170afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1376,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"744f2e50289d09f539c4b5e59f195255","sha1":"a588afba957f93b125a5f1ae79ba90d95e0a145a","sha256":"c10baecdea74c4e988791d7eb5ea9e7e1c9619120b6df191f9e4822742d51401","sha512":"c9a24b33de6c740e0acb8d31b300f5aed3f30898cd07db1773ba80e9f7bccf026a140df1f2b462c0f5170d4f1f977daad87a9c1900bdd5a77de34a8a942a39a4","ssdeep":"","tlshash":"ad21e23548113009ba33b5a44be80a25d1f59027d60236ddb7ce708e4ffa9dc99e2ede","first_seen":"2025-06-23T06:51:13.842119Z","last_seen":"2026-05-17T06:36:06.083231Z","times_seen":42,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/platform.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/platform.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0R1mViNGwziFBZKViyaI3r8vbw1b3yGwmArQdgXPmcSrFrMu4Xvni59xH9TmXBIY86Klnsi9NmMqRiqRT11exD%2FBPhASNRSmDp%2FOlhg%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf190afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4035,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"fd0beb367f61475d4de63ae8fc9ee2cc","sha1":"714b21b63cb6b0e5ba6e9948f9eed08c838ca7b9","sha256":"0f3015600a9bec0d368289789e477caae196cc9b86e36af29066caa33193a217","sha512":"62f415f0711d24b341aa7bc5625d463adcc93c7e3a4a94f69c405de988c209d7d0a5ad16f0abd6cc52e627f9f29a929397039015733cd78e0a3f9017e08a94aa","ssdeep":"","tlshash":"e581ad1a8a3694459337f66d6be20204e76590238b07c3ec7edc71488ff5158d562fee","first_seen":"2025-06-23T06:51:13.838166Z","last_seen":"2026-05-17T06:36:06.072697Z","times_seen":42,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/footer.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/footer.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4ESB6R3chVxBDTV3n0SMEM2qWn0zon%2BZ08NRwLtmvo%2B34FhIWu3v9TsTf%2Fu%2B2O%2BbOAsgH2Xq9ObGMzz33W3yn%2BSBNe3OFAowErErnmo%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf1c0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2903,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"6d97311ecc0cf0cc3d6e7ae458eb05ad","sha1":"b8b04bed33ba2a8495668396505540da37115e4d","sha256":"7e57af63cb9f640c5c755833739912f5f995e8c56fd98a369f2279e3f14c3b2d","sha512":"b38be93b5bfb5ff778f1b8e2c9cec1fed14449e504e453796a3624988e619231a2751ccb421ba0e2b96d76a6975b1e7c189a3e6609706af3ea23928359ec909d","ssdeep":"","tlshash":"1d516b2df921600eb1776a78f7f30249e6688013530691b4fedc33448fb616a89a1fcd","first_seen":"2025-06-23T06:51:13.833789Z","last_seen":"2026-04-12T05:40:05.098806Z","times_seen":29,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/usdt.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/usdt.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sXz1FbvD8C5IZETc8mmhMQe3aBehXj3391CUYNN2VFcX4b2ZoafPvcO2VX1epb0nJ9pYW0Tiz25TX8suofLGLkatIxCL6lm7FmcK9jQ%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370cf240afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":704,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"eac1f7bb15967c89034b440b095ad74c","sha1":"5da1c6617fab973a2501cf6c01e083bf45aa29fb","sha256":"e0636ccbdd55d437a62c09b1355f2f018614418dc9b28d223bb2820fcfd88765","sha512":"d1aa4e69ae573e30c08d4337a91e4602eadadc28f3ef2b08e0776c156329a0eb3dcc7abe9384c4718b5c12a9d0c32c6b3455178d724b36ece1b716f0cb3130c4","ssdeep":"","tlshash":"1d019c794145c95cf51085a9db99310425b871fad2f258b8f9da12127c41cf60834fb6","first_seen":"2023-06-29T23:08:25Z","last_seen":"2026-06-07T23:46:49.536696Z","times_seen":401,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/features/wallet.png","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/features/wallet.png HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/png\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\ncontent-length: 5248\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bCKTHjL6YB0eu6CKD50mHuOPJZgM1iQEIZkmzi9oCMMKLlQ6y0hk4C25F%2B%2BqJCTBjzdSEt9%2Fcmt2BYU9sH1PqV5Xigcxrrq0x1A48ic%3D\"}]}\r\ncf-ray: 9c0d83716f930afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5248,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 54 x 59, 8-bit/color RGBA, non-interlaced","md5":"6f514f828bb08e7e6343ac92b131bbeb","sha1":"8c9beac529a1a5ea2b4a1e8b494d6262fad241bb","sha256":"2d19f68fb79f4b4319717e9d17d410f385dd4fc8bbe945342ef3e1dea08705b4","sha512":"418609b061ee7a656db48ef0c36ab499cf931a83b4477920deae3fc954b926d5d3990d4c9eaa330c61cfac2b205aacb92a009fb5ce006fc3d94145a2de8aad1f","ssdeep":"96:BS1IiibvpyBNHS3EqyrBUarmp+Dtmuj5XBrg2rweB3/Sr79Kkp3rCyWU:BS1ribhp3HqBUarjpmCXxtrd3/Sr75rl","tlshash":"81b19e66c7c8a26af30e3d61048f0c6a11922ea5ea05930f72b7ef09c07d5422f85e30","first_seen":"2025-04-01T11:27:30.08867Z","last_seen":"2026-05-17T06:36:06.04886Z","times_seen":43,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/features/coins.png","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.179Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/features/coins.png HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/png\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\ncontent-length: 6152\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BTVBtDRsmXAff2agZlPeaHycvX9gky6BqatIaDmbAxlLVwQvtRG3v3QBT1yVs8T8cJyKQU1dKSF7gJcbGMtrP4f%2FxU6VSjTqkeQsQb8%3D\"}]}\r\ncf-ray: 9c0d83718f950afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6152,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 57 x 58, 8-bit/color RGBA, non-interlaced","md5":"54afa2b04ff8894ea378711dfbe393de","sha1":"200c02ae5071be480d24233b15685ef051d23213","sha256":"2f9d7458702befd2dfff0927c3caf52ceff3ba664267a820582cc20acb184dee","sha512":"78fa202921455cc1e3f5f6d6e415e63a881bb9f50e88ac7dd85a30f7ce4b246962e2525d0db30fc03160ad9918bc6d56535fd44e20aeac72d374978280397915","ssdeep":"192:eSco/9FvEMucbaO0FZtpF0vMFjQaxf6Fiv:Bco/HDuR/tp2MMCUq","tlshash":"ddc19e8c88cafc21cdd947ce0d9e6a307d6edf8970891848b53815b45e40ced296fb32","first_seen":"2025-04-01T11:27:30.092556Z","last_seen":"2026-05-17T06:36:06.089908Z","times_seen":43,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/features/line.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.318Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/features/line.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/landings/6/style/features.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F504UxXPbipnXOWpIE1qv%2FVnngza4Nk4J93oNH%2BUigvDM3dy5b5hx8ZAAF7lctRHDbQCWwk6N5myNi8tFoYTzatFM6Eak5xbvUJBFQA%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83727fcd0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":822,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9a0b510875e5a10c02962a5c2a34e6d3","sha1":"23d9a2ce7e5a7c26cde0d3b06b83d8b0ab59b38b","sha256":"7d970b7d363fe55b21dfa1423c3a060e3bf4a2293e10b13763426e052961d46c","sha512":"a602ca46a076dc469a6e9528492fc355b23d35a5739b935a9f2f6e34310e213066b2b2bb48dd2466ef496cdb213670af1672d4ab55499b2584f44f38b6028fdf","ssdeep":"","tlshash":"4e01662f9b4cdc3fd2b9c2bcd914d420116a8692ddc18240ca74fb1f5a0668b0c6f384","first_seen":"2025-06-23T06:51:13.828674Z","last_seen":"2026-05-17T06:36:06.055684Z","times_seen":42,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/normalize.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.045Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/normalize.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QN0ahiicav91f1MO7UR6YYbuV0zHT5cvCorEkpLMBMxzO%2Fpg1B0am9YF970Xi3HEUz6sXxpzQj9opYc4e8k5iBFw3Bu8UcC4vcutrc8%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370af110afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6599,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"8a1230675cc14f82e14af8c0d0bc3993","sha1":"9d355b9a68424b466b9fc5c03e6dfa85874de9bb","sha256":"9319b857e89db58b4b44a6ef7bf644d93429e74aa140cea93dfa5a26c0b43760","sha512":"a88e4dd3237ed3fd20a3d8fbc419cf9c63be731b0e32fc95e3da89c575a6c2ec8ec15045db1623e9de1ea1e1a4853ea3ee3a0e9680d5b806c076e6eb6ec5ca2e","ssdeep":"96:FCeGD84G0k7M0ZUn3PocEoSX4Z75PBm8xtnU6Z76azbz6Cz2ns:FiD8KnAcEoh7RBmgU6V6aaCis","tlshash":"80d10c921b423b22a2b20e34776b6689f36011778e4434dc7ce112b49f65be8d664fcf","first_seen":"2023-07-05T03:12:07Z","last_seen":"2026-06-07T23:46:49.514681Z","times_seen":166,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/media/logos/favicon.ico","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.069Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/media/logos/favicon.ico HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/x-icon\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pTSEIKMurHqV3p9DE1rSPdG9jZChJuqagLHgxKcaP5gIvA6K%2FrdXENH3jmSbayeoPRKZcFFpkCuFuy%2B3SZx1Ec1rI20cfq556sJhHUY%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf1d0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9662,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel","md5":"50ec41fb68191b157dc92d60c9123806","sha1":"fc7ab9994b4610844133e807a83b28dff23361cf","sha256":"51ed290c09a566a3b11c7a11ecb0fc195cd6ff701b41b3e2b832abce21961bcf","sha512":"c6892c2e8dc36c087f4611c8941d85fbc241cff7dec0cb4c7acf287c5ef2b0c72e3725a6a03faa1fed2d006447d1b44ece34b76b85cc1e4273a2232d862fa01b","ssdeep":"192:iuvI2ePZxx1OHjUwNZJIFX7bzfXZnSg+NtLUH3bTxRb6hFzZSX+:RQ2ePZxODtnJeLbzfXhl+NtLMxAhFzgO","tlshash":"d61220825dff051dfde40a3156a9091ebd6adc24a0f6bc18179ffe80ab36ad0b593490","first_seen":"2023-10-15T06:02:08Z","last_seen":"2026-06-01T08:48:29.121077Z","times_seen":165,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/platform/bg.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/platform/bg.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vyuZXHTXj2tHNU1O8o1SbIYhJJ%2FRkFSx%2FVo2MNGWI5D%2BUCOroSaEkHM0k1bN3AGwkobYKfCnmRTDN09WN88flBJ9IUZm%2BpMY9%2BQGxc4%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83718f970afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":995811,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cd4f7e969f8f1e337885796c10ad1591","sha1":"6546882b85a09b93752fa14f9c26f3bda3ddb462","sha256":"7617ee2b6f07dce337c546890c7cf60a88262ed73fc0f19fae8176c63bb74503","sha512":"131c81f5a966f4390995688ce7d523b5157be35102209e4b1099e803cdedfcf29618c2e05933949c6b3ee4755ec52d85f9e80dab510df28e8a4ad79ba1179012","ssdeep":"1536:08lASvFoyCPTPzmOW0ByA5t1Zu1jJ2T7Oq6s34R4nmsi4yhqT4OPMrtPyznEcXaQ:rVtamZEc/XhQ1hpJijEm4pCSCvU00","tlshash":"0825a2cd3fb05dc48ac8cbd77f1154bd395390b79c958a05c11caf4a24ca96dae8ae83","first_seen":"2025-04-01T11:27:30.076262Z","last_seen":"2026-05-17T06:36:06.019031Z","times_seen":41,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/js/header.js","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/js/header.js HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BOGm4tO8YK4pLcJHx05zZgeRtKojAq%2F7JBGlrv%2BwPRVcyn%2BV75PzNi9ZPuLZW8MfRt9lxxwVIMK6PBakmrQ8DqMLwJsihFf%2By4Lk4b4%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8371af9f0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":764,"size_decoded":0,"mime_type":"text/javascript","magic":"ASCII text, with CRLF line terminators","md5":"6346713cce7e17259e64d496ba485768","sha1":"245f3809552985258772d5749a57198898707caa","sha256":"078e59fd4c57b2ecddabd2a0fb0a1157a3bfd7475957f0f67d3adb0dfd163020","sha512":"1ffc08826328cb2ae820caa60f29b684558cf851ee5f70d9c0f0e501cd714498ad7b5c352284d3e913ae0d0ca253fd3001bea86dc3f20965258a0b61233e224d","ssdeep":"","tlshash":"1901d22667047d7d40bb0bafe7e20e94fb2590d79461403730ad898f0fe25d1a6a6af0","first_seen":"2023-07-19T01:27:01Z","last_seen":"2026-05-17T06:36:06.091007Z","times_seen":138,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/way/pink-bg.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/way/pink-bg.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/landings/6/style/way.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Vvj8o5lFRfd%2BLtqCFLClfQvEniYzqmlZgM0pOSaLlb%2B2oPzaJi9CeJ%2BN84%2BMGOlZncaducUZqwrFem2RLYsJaOcdb6RoA1gRmTllTqk%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83727fcf0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1092,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0e790e5010ecc4fdab751117c00c997b","sha1":"834bfc7d02928e6c77e467a87b2bd71f91c33961","sha256":"6f7d2daa9e498c9f901a39545d427b09551f74297e6d44c920e4914676033a6d","sha512":"dff0d03f04e8331761a8f5140dcbd38e795af71ae1c9ff1f60ae38f573179e807f2b931298f7745986c013d16dd1d5daaf054a90ce88ec89140f7245931ba035","ssdeep":"","tlshash":"4b11d0f964e59d4d45956330f6a85ce2073da1b2f002110aec3f3273d057d95eb5b618","first_seen":"2025-06-23T06:51:13.829628Z","last_seen":"2026-05-17T06:36:06.08018Z","times_seen":40,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.361Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:06 GMT","end":"Tue, 03 Mar 2026 17:10:05 GMT"},"fingerprint":{"sha1":"87:0F:C1:25:08:22:50:0D:D6:14:D4:EF:A9:CF:49:70:C2:8E:5D:36","sha256":"65:A3:E5:AA:4F:13:A5:53:EC:B5:39:DF:03:7F:DE:7D:6F:2B:23:33:85:34:59:13:C3:FC:C2:AC:22:E9:97:D9"}}},"request":{"raw":"GET /s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://steamrefund.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:20:02 GMT\r\nexpires: Sun, 17 Jan 2027 18:20:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 227008\r\nlast-modified: Tue, 18 Nov 2025 19:00:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40128, version 1.0","md5":"9a01b69183a9604ab3a439e388b30501","sha1":"8ed1d59003d0dbe6360481017b44665153665fbe","sha256":"20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2","sha512":"0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca","ssdeep":"768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO","tlshash":"3703023a5e3ccf1a84157a703950f6d9a8481e548e9d143b4f1ac7bf085dde2209b6d4","first_seen":"2025-01-08T22:59:02.845106Z","last_seen":"2026-06-08T21:16:12.332851Z","times_seen":873942,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":68,"dns":2,"connect":10,"send":0,"wait":11,"receive":11,"ssl":54},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.042Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:14 GMT","end":"Tue, 03 Mar 2026 17:10:13 GMT"},"fingerprint":{"sha1":"EC:AE:DB:3F:30:AD:2E:C9:C6:A5:F6:31:5D:CB:EF:06:6D:B3:2B:E0","sha256":"37:8C:B2:95:4D:4C:79:2C:79:EA:6C:AD:61:E9:E6:30:41:EA:A4:C6:D4:10:5F:FE:3B:CA:18:F3:AA:FE:CF:F0"}}},"request":{"raw":"GET /css2?family=Roboto:wght@300;400;500;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 20 Jan 2026 09:23:30 GMT\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22340,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"2056f58463ef1ae5de1eb25701dea875","sha1":"2ca916563e184d51c8b7c246778d141a1ca9def5","sha256":"d72044187146182f03039474a4fa2c2d98c5ba399880afdcc97cb69cfdbe7877","sha512":"a0d0fa36cee3bad27b59f1baf241663570e726ef3650f118d304af5200d999a6da56d1c517e4915b5f4a0f7cc7acc5d36830cfa5b671ce41f77788ded4b570d2","ssdeep":"384:pKf5KgKPKrKyUK/qY4+K4KYKpKfMK1KWK6KyhK/qY4XKNKtKiKfDKOKdKBKyaK/2:pCJmwBUiRDfMTcfFBhiEymDcTYeBai7e","tlshash":"caa200a1041750009b834ce223cebf35fe1f52517142d0b5abfdab6b9dcbc66526939d","first_seen":"2025-11-19T00:43:54.727724Z","last_seen":"2026-02-19T21:27:07.841031Z","times_seen":4212,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":137,"dns":1,"connect":15,"send":0,"wait":32,"receive":0,"ssl":137},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/eth.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/eth.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ta%2BEVigi%2BbYtE%2B9ZeKvG7h%2BCzwErF7mnr%2FX1Xr174R%2BHPy8WqZouWjnw%2BcWcCMsF9ojoOu5gH5ye9482%2FOCLi0P2M5rJ8rsxigyytg8%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370cf200afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1025,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b4140b368702c1a2a0c62215f61aefee","sha1":"c14afee9821f4091f0754d0a186c2454d3ac9a4c","sha256":"0e2d8f6f3c63c07ea6381033872e9ba6e2175efb951149e99ce68e51ba530a4e","sha512":"0b0a88d61f0e1aea18121b610eabb0ed6e2464bb4a03646eb4e6be406b3c39f0b67f7c27a7e3968ffe8d6a755d31c8f6e648a51679f2602ff4475e0dfb03c07d","ssdeep":"","tlshash":"09117fcd3908e8414694c339a78c21b5d6f385e7de4c8194c5447a3b35651d17d9fbd8","first_seen":"2023-11-19T01:14:24Z","last_seen":"2026-06-07T23:46:49.517912Z","times_seen":230,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/js/jquery-3.4.1.min.js","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.199Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/js/jquery-3.4.1.min.js HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d8uRzKLDYJfAXaqyVdTZXsGFhQOzd%2BGEsCHE4qkPEVyYdci%2B4Ixfsnm4EgTR%2Be4zGGri5akzNwkEeZ%2BMJoBLuku7R7kmBeu%2F%2B1yZ%2BgI%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8371af9c0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":88147,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65450), with CRLF line terminators","md5":"a6b6350ee94a3ea74595c065cbf58af0","sha1":"b15f7cfa79519756dff1ad22553fd0ed09024343","sha256":"412b8ff9c5ab32b9019fcd84bcd4a54c0e265a14528474f4ee45b27a20abeaeb","sha512":"f5a9c6aee347c155e4dd796c51716b7447bc22ae44741fceb6bcfee02f955ad4063d38613f241108a3e1f3e1f540fcaed8d9848b9a0fb823c00955cf9a19efad","ssdeep":"1536:jTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPmt:jgZm0H5HO5+gCKWZyPmHQ47GKR","tlshash":"a08319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","first_seen":"2023-03-07T01:10:32Z","last_seen":"2026-06-08T21:19:14.652524Z","times_seen":5125,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/home/line.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.317Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/home/line.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/landings/6/style/home.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=46HaMjy6xtI%2BZQTXsYu4dPDEheiVAB%2BsB043FhdW8n6q0HIqsU69T%2BvnXhLSq4i4u5Pz48rJtv9sOZ1K7ZAlsecTCu4P3b%2BaBNVaAm0%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83727fcc0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":891,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a5b729ba882b9af165be11594e534235","sha1":"492bc258ab856a5ef2ba624932f70322ebfe06d8","sha256":"b7e006acde6eff0fe516383894e1e964d268c3fa6e0a89ee55fa7c189687b4d9","sha512":"daf592ed1ef87426709693ff1d3ef4dad4634832f4bf7226d4d8661ea5aed6bc564c743b2b8b7c0228a05755fb5cb1694a0d1d4fc47394c092941497e9288e57","ssdeep":"","tlshash":"e0110c2fb758dc3ba298c28cd814c4b8551e925396c8c2b0c0a5ff2f150959b3c1b7e4","first_seen":"2025-06-23T06:51:13.827893Z","last_seen":"2026-04-12T05:40:05.130596Z","times_seen":29,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/global.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/global.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2GUDQPmncw%2FhsNryyOC80gR7X5OfoMTRie%2Fubj3Zi0AVs2gbFJvSeTe19mkGW0bG%2B8f0Fzn5cqUldcdNO%2BesaheM6kQGD%2BWMFyML%2Fb4%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370af120afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1287,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"a064de2bb1fd847c1d1d7fb1c20858a7","sha1":"a682e33969cbf78e48d741f139b30cc8d7750181","sha256":"2b20db488ba155ed0d5370748f910302c5e198c7224247c78bd177172c3dd3f6","sha512":"4963a992f31506e373b5de3e0e7a2e5ac3d6fdbc4098007c6629a11c296c2447ea851e7d7641f2bfca3c6dd12d99343712f8ea1b447ef7755a5d69f4faf0a8a8","ssdeep":"","tlshash":"d421c1adc9431185637b4e1907e5870afb5504631a0006feb7daaba0cfb2e7a41f0e5c","first_seen":"2025-06-23T06:51:13.82508Z","last_seen":"2026-04-12T05:40:05.106497Z","times_seen":29,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/features.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/features.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hGWXT0zOb%2BOHUx6LlcNM6aCpjetL073l3yg1LvFu8FMNDCZWbkq69nwytWv6s9JYTxjzojaY%2FT8eY4cj4TjOEJi2SpDR2HCmaT8Iu4E%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf160afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4665,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"0241b0f61d3df8cabdc079c14b546b90","sha1":"0b667c915d1055f3df57eda3668dbc468e5c2e6f","sha256":"24a76dab70d19c18e1b3113461c09950076f969aa803097e3faaa1916b048f2c","sha512":"ba378131280530a82cc6732ebd79bbf0ea61ae855ec2f94e1366efe9ab2d122995dadfb4772c0cfd1ebf31ac932839207fde4462a399d479ab7e1e8504e0c231","ssdeep":"48:rn4wPaVbfym5pAKZqanz73CPWAqXFygzunhTYaVGdoXF8qr/gJgpuMV+i/tE2sY/:r4PVF/Gh+pumCTr/gkgi/t6s","tlshash":"73a1cc3dd9292006a137f6bd5fa20708ea684053d30652a97bdce3488ff509d857afce","first_seen":"2025-06-23T06:51:13.82111Z","last_seen":"2026-05-17T06:36:06.049524Z","times_seen":42,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/start.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/start.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IlU5XXFrbEOD%2FoL%2BvSEyvpAZABERot8WR5DNWgQA22ACVX%2BXakp%2B10C04bzkreZ%2FnJHhP5yeI701eTZbY9cvGcAqKSl4sn3KiV0BQxU%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf1b0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2721,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"7d80e0186736ab87d41f7d002f7df9e8","sha1":"5ca699368f71e2b87a18f3db66a628a1f901a50c","sha256":"3405e1b9e04f50e4789b228c5cc2c083abdf2682c1f38c52c4e8b2972be8c12d","sha512":"bc40b4af5766b0c3786b7c451473768b72d4a7c72b78b1b918452c7de487a02cb3216c2470b6b1df7fa5f117fb9e7bea3b09b5112bdb200e49ea6d92e5097c18","ssdeep":"","tlshash":"84519c29d9148086b536e6f4bb734745d3480037c60652a8bffd76488fb559c8660fdd","first_seen":"2025-06-23T06:51:13.837199Z","last_seen":"2026-05-17T06:36:06.03128Z","times_seen":42,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/home/bg.png","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.071Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/home/bg.png HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/png\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\ncontent-length: 376762\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SoHQRfqwD2%2BbOrrjY2VlaCnVI8nBJSFPmSRYmWytHfi8enwWE%2FhkQzoeRIKxKnZ88ek2UNMqrEK3XyILUfEcYL8UM3uSRdpMQnb%2FS%2FE%3D\"}]}\r\ncf-ray: 9c0d8370bf1e0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":376762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 461 x 664, 8-bit/color RGBA, non-interlaced","md5":"4859cc800e70e263495d067307a37ce6","sha1":"cab0f0b91b190f52de78c710c2a7c9244754144c","sha256":"537b78f5806b2a3e6c641ca6435a3d0086d216a6751f83e4035b36614c55ba9e","sha512":"4374facd0aba8c538793189de5eff9f9efa2f9f8083d3045b02b1e4c2486e28bd9b67f599e685f592eb79031bd1509d44bbb19174e5dadf33f27292a45a30f8f","ssdeep":"6144:h0z54xB0tIiz7JWIp/4tqEL3jRfbN9X7pXKeEAlamuQTsdEcRt66OvKqZ6O1/JgQ:h0z54xBV+/4t7zRTX74eEIaDEcQn/wC","tlshash":"1f84233cf1aeefed6447fde2d2042ce498426b94aa77c81377667bc8ec441a10b16128","first_seen":"2025-04-01T11:27:30.102212Z","last_seen":"2026-05-17T06:36:06.087796Z","times_seen":41,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/btc.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/btc.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sDTaocyzbDQYSUU%2BwAr42JFkz4BrQruyvmHBUd1MLycAwQf9dRvguqKhY32wOQqQsnQBpnUY1QZgC5ha28ox0TB6iBN4yPsAchC7sJc%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf1f0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3705,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1e959a957e7815d3c97ffcfa927a6ac3","sha1":"be033b9cbd925aaab0b6244f715c5d3f34d1cd5e","sha256":"af4022bb60633db1a667a52e1746eeefe6384b81825b13155a93b47f88cdc3ed","sha512":"244d59641af74b45d0b9079ccf7a3f9c241e8888a6fb15373140a730cb21f7fddcb356ccac93eb91e1c854e848f7be1ae92987176e5924ac8bd90d456014b658","ssdeep":"","tlshash":"7671b799e3fd84d6e31c8564ede1250a875c609342040d08bead5ca4efa25d2f77bb98","first_seen":"2023-10-25T05:58:22Z","last_seen":"2026-06-07T23:46:49.481527Z","times_seen":369,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/ltc.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.076Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/ltc.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JLaCxALNEyRE2LFPA%2Bbz7tCtrf6kT%2F78tNKFGy7J6mnRJaoLVt5g1cysrOABnyBxrUZsAc2U8qqktm%2FS2VlJtQKB%2F3d%2BmsRPEs6AqKY%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370cf210afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":753,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1357667ba2495b5b9b624e477f83c544","sha1":"841592b39e45a36429a8d5a054c08e5c7c934a6c","sha256":"19a2412000c4b36f27b784a6f0ae5d074945770bcb9d3433aa8e9cf26a4cb39c","sha512":"67f23837d53730f260685d63066c729ba7cc5433133643d58f5d6af5420fdf8622a5a6d77d2e57e429914848a8ec3d906c5dbd35ca78e327afb134e9f920d8f4","ssdeep":"","tlshash":"fc01d05d4780dc7d6591866443b461d16376b047c78149f4dceb267bf6058d05254bac","first_seen":"2023-11-19T01:14:24Z","last_seen":"2026-06-07T23:46:49.519434Z","times_seen":344,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/usdc.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/usdc.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4Y6Xy8RD6rMkcA0N%2BhArvbOI%2FhYJ4iQAIa%2FptcR%2FeT9CaQhTAgJrUIIsRm2HGToZFuaQTnlOZP1AlOrBiuveCd1vN4IMQoerA1K7yE0%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83710f470afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1626,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"94ec50bf272c2ca70d2741d9794652b9","sha1":"984e715c5968afbe271b777a11cbbf1434933215","sha256":"a59ffcad23c4de45b0389620bf9bf14811e606e22bbf2f674b00baaabeed6500","sha512":"c922eef8d1002995de7e76e08adbd7245c23bf2eb411ae7df1776423503b442a9838cd471eeb00753ad79b80742eaf65d7fd8f3232682f2956a58c6846ee3b79","ssdeep":"","tlshash":"483110068204dabdfed6062cb27038c476f1a99ff271d0e8aa6f1057d08cde0759c6e9","first_seen":"2023-11-19T01:14:23Z","last_seen":"2026-06-07T23:46:49.57307Z","times_seen":319,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/js/app.min.js","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/js/app.min.js HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nkUts6aQ07StqaqiiaCFI4y2LcN49OHTYHy3EvQgUgjTXEgScJnnyC4pAo%2BKgZCIS%2B%2FKL3GH7knrR2qQ3tFZmEaYOtqBgpaWnkSK%2F2E%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8371af9d0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3615,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (3615), with no line terminators","md5":"d07fddad2dbb2e1b33663063df276af3","sha1":"ff05ef5d12cab598273743b8ecba860d5fe3eb19","sha256":"84c100eb29667fada78eac7c2ef3831d2dfa9d01827c00f9a8c07a8da28231ee","sha512":"497e5b7368287addb7d29b29b80a3f89ee35f8b1fb5156b0b02bf27fbc6b238fbe78d4554ec7f879b982da6ff9b1e4750f1daf058c5f921c5032eec06afd48c6","ssdeep":"","tlshash":"c57122791314b93c02a30ad7e6e6aad07a343886d5411070a8b9ccaf1fd98d39371ff6","first_seen":"2023-07-07T00:40:59Z","last_seen":"2026-06-07T23:46:49.554582Z","times_seen":435,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/header.css?v=3","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.049Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/header.css?v=3 HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7jOQuWF9jV3laL36hnEtxvmInlnjaWHsowdh4wwb0vw8Z%2FFfa1lP1XilBplbFGFXvZSF2kglS4uWN2f%2FYj8rJzhSf5lcyny1yBjuBDo%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370af130afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4388,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"f22cab87ee1f1e90a434d8d9abde6d27","sha1":"43e3bf736fb7b83a426db38e861bfe58ddd473b3","sha256":"c6c501cd90158136126012a9b65c6bfa0eb8312cb6ae2a981a55b1f17638f12c","sha512":"79523d383fec372ff860baecd6ab623c9108e2b7b3aa7ea0fdee7e6143b98d5252794d1a4d8ffe848ff4acd05ff6c865ab0acdb51bab0c79df3d1b744d0698f2","ssdeep":"96:uZXcUp/EnDDI3K9iwhnpmAskATGITtOrazbmGyv/0:wXcUeDDI3K9iwhnpmAskATftOrazSGd","tlshash":"7d91de099b06301a5537a7beebe20e08f66530136b0251b977ce514f8ff6119c7a6edc","first_seen":"2025-06-23T06:51:13.839012Z","last_seen":"2026-05-17T06:36:06.064284Z","times_seen":42,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/bnb.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/bnb.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bRf18CmSLGnzu%2BBvY%2FNu6Pzvv36y5eHHsRTisCjWRNvP1MoGMhjwSXMSkhnA9xxp47Ox7zJ2kpZ74mQ0rPhEpE%2B0c%2FLvyyxWUCciaqM%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370cf230afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1871,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"faad1f8773e47415f372e48416f460e9","sha1":"9e1e10f8554a43fe3e9e870b7409636370af597b","sha256":"1e3f4850b5e106283bab874805118c2bc246923e52ac418009c0af133f5af545","sha512":"55966d0ca64f991e97ed14bcaced6a7ee4b7667e4cb33f308c7c92794e5116ab2a86be72528f880a111e593e6c01cc56b00e40cf786768de954a1184b7647154","ssdeep":"","tlshash":"863101ac41b6cc3de23583f409b052d816e6ac77f100347cb4e59b52bd24ad72a85ede","first_seen":"2023-11-19T01:14:24Z","last_seen":"2026-06-07T23:46:49.565325Z","times_seen":343,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.400Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:06 GMT","end":"Tue, 03 Mar 2026 17:10:05 GMT"},"fingerprint":{"sha1":"87:0F:C1:25:08:22:50:0D:D6:14:D4:EF:A9:CF:49:70:C2:8E:5D:36","sha256":"65:A3:E5:AA:4F:13:A5:53:EC:B5:39:DF:03:7F:DE:7D:6F:2B:23:33:85:34:59:13:C3:FC:C2:AC:22:E9:97:D9"}}},"request":{"raw":"GET /s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://steamrefund.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:20:02 GMT\r\nexpires: Sun, 17 Jan 2027 18:20:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 227008\r\nlast-modified: Tue, 18 Nov 2025 19:00:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40128, version 1.0","md5":"9a01b69183a9604ab3a439e388b30501","sha1":"8ed1d59003d0dbe6360481017b44665153665fbe","sha256":"20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2","sha512":"0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca","ssdeep":"768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO","tlshash":"3703023a5e3ccf1a84157a703950f6d9a8481e548e9d143b4f1ac7bf085dde2209b6d4","first_seen":"2025-01-08T22:59:02.845106Z","last_seen":"2026-06-08T21:16:12.332851Z","times_seen":873942,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":31,"dns":0,"connect":0,"send":0,"wait":22,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-20T09:23:29.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 20 Jan 2026 09:23:29 GMT\r\ncontent-type: text/html;charset=UTF-8\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-language: en-US\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FWAKiC3x9rNxYmr5jipwNBQMz6SYZgzz2jvX1HmVEd1Yn1i%2FOXFlZRtnjdZVc7tM22Ba6BnnpQi9hZFcoqp9AF5qTvEUmbkREKqEiRo%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c0d836ecbab5694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery:3.4.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":130999,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (3947), with CRLF line terminators","md5":"b21558c2ec15b9482564783c912288aa","sha1":"c3a15e6d946b1fd9de196d4a1380d372b26245f3","sha256":"0656dded5590f660c6eb580bc7ab27dc2d89cb6f34131208d1f5a0e50f9c7143","sha512":"6a97e9333e228b1dcead36520cf31fdcbafacf353c10b03a30f6b190348d8f1b884e2249645560bbf53610b6487df71857ad0be343d2ed73157ec5e2c0728c3e","ssdeep":"1536:+cPXVXcGbRYjB0nRvCmvCAvCbCvC7vCIJvC67vCivCniz9no:pc9W","tlshash":"dfd3e7e8a3d0a1a4e067d3e4d6225665fe6650a76b03c668b3fc1f829f72c1ccc57c46","first_seen":"2026-01-20T09:23:53.45377Z","last_seen":"2026-01-20T09:23:53.45377Z","times_seen":1,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":21,"dns":1,"connect":1,"send":0,"wait":133,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/gateway.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/gateway.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=96ZKNvaEeSI8CXXYsDBIzvF8rhNxoGUWUQ2fy3Wzqzs2CvAjC0NiWn%2B03D58YHp64LF%2BRAR44sQrWBn8XWO9HvaVzaXIjcrdWmkQc5Q%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf150afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4143,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"4c0d33299007dffe9aef6052c92babb8","sha1":"108ebe865e190aea1dd58591cdba7c0b9cff18ea","sha256":"a7db497b861a3ea47b89ad2fdcb8f8eb69bf952ce47f0b8f8441428cf754e7a1","sha512":"c4af406fd0c1e7b8bb1c75a7a1fd789731ad6981c4e9f38f258f6c7745125d7558435626253cdd2c81f48be359c53c8304fdee5120b7ff30873f7658274e3829","ssdeep":"48:q+vfmjfcw5B6clmicStpyHFnhi56Rrqqnk5WcNqh6cmcBvHpipr2pipAs/O2Mp2f:Hv6F5UMSk6xqp4/0803/zs6XpVKWv","tlshash":"ba81f24dd702a28171fbba2deb630146e609e2578f05d1627fd861448fb4d2fe12af8d","first_seen":"2025-06-23T06:51:13.832917Z","last_seen":"2026-05-17T06:36:06.01462Z","times_seen":42,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/way.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.057Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/way.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C5N1riZGmYjDmPxyZ0Lyxi7oD2FcH%2FTZuW72XT8eWYVtnT6Y11NcoQF0dfBBc%2FUx3KEc%2BA%2BDdzrAjXa4ppGrZk%2BZroB7PF81Pbvg68M%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf180afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3271,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"479a6a7862d353badd8fda368828b6de","sha1":"b6b2799e4e51eedb0937c1113830b45b36f9a15a","sha256":"9694f6c2e3b237d1f2430eac8d2281945a47d8633eac67afea664cae5bb0e6d1","sha512":"11a28ca627a24f2f819cb2b11ef9abc480ab9e0e70bacaf11cfe5eedce420508a114ff927d1f9ca96b167fc4daba2295fb69476759821afc21a4d733f79886d8","ssdeep":"","tlshash":"bb61bb19da419146a577e66c2bb31385f296a0138306c3b87fdc71489ff84a8e52afcd","first_seen":"2025-06-23T06:51:13.814815Z","last_seen":"2026-05-17T06:36:06.024789Z","times_seen":42,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/bch.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/bch.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z9sqiosuI0b9q0dlnTL6TWgsqv%2B97gryZwvwDi9uQojM4uV5kVcvHoM7qhjTwZmPRC2YsFKWezUvkOuFysa1eGyCEGYX53%2BoEWNKTho%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83716f900afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1216,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"08ba28bf3baad9e9d8b052b67491a857","sha1":"c9d7a01dd78d35dab7c9ef244df783459db22487","sha256":"0d3126a3953282479600ad2e7dfbf1ecace0456416bc25428894c5c7b7d1dc3b","sha512":"f0f78e36085c35ebcb92608ccf15397ed0531aada7d284ac09e992a29a6f61fc81b35245c1b320edd02496f774918dd2977eb18e7ad07bdeb1aebc45cda56a0f","ssdeep":"","tlshash":"8321cdac62c8cea84928c7f56d25d0b0d59c92df6458f30ed444d236759a0fd65e0f06","first_seen":"2023-11-19T01:14:23Z","last_seen":"2026-06-07T23:46:49.580674Z","times_seen":199,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/xrp.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/xrp.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x8%2FIlfGYoQITd6t1I7SSwx9eq2%2Fig0FD0U2RZcWJXW9zcsQRrOrD89Xm1HwxLWiF9XM0Uglt2zGxEQXUx%2BcBxLTXVQH%2Bri46ne83Too%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83716f910afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":405,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3cebae7f3009bf71217052c176fc1886","sha1":"8173d69bb4987aa4dd29f743f91c4cd9ad7fd325","sha256":"0d3e57faf9b3e86ccb3c2093393ec4f4ba9c685b3e0b3f62f4bf541a512450ac","sha512":"173383818b33606aaf1cf9f22157100af2c8f9078d21e5c45da57b01ecf15c20df7d7f675cc14a2c72a86fee71f15ef350b1cd29e1d0a6d57f52003e8156e670","ssdeep":"","tlshash":"c8e02bf9407d08a9ec8b823847a804f1142d784870f4123851b4b955a8588dd7562eef","first_seen":"2025-06-09T16:14:25.011598Z","last_seen":"2026-05-18T19:43:40.52997Z","times_seen":55,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/images/features/shield.png","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/images/features/shield.png HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/png\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\ncontent-length: 4053\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N%2B7%2FZWVYMtYLPWWNMdurUQjcLVrnYVq47nlxjU6Gr%2B9YyzEXgHeMh4RH3hKd5Y7%2B7zIBQ6SRTJEoemGmpkunbS6phD4sl8apx02yzTE%3D\"}]}\r\ncf-ray: 9c0d83718f960afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4053,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 52 x 54, 8-bit/color RGBA, non-interlaced","md5":"ee3349d68386509ac05f1b210917ca47","sha1":"cef25dba78d3322759168abb80266a6f1dbe304a","sha256":"84e60fc9e1aff922948a83c73c515d83a29cda3b72412f37a12383db83580fab","sha512":"1e3fca9f5ca2c4f842b6d89d586c4aa5f63427976bb1aaafe4b29600e9d7b623f47af34b2d797cac0d803ecbe0f9d70e3738cf6fef1590e450eaefc1fddb006d","ssdeep":"","tlshash":"08819f472fc1ad54a4f8d6d6fe916c10345e4146c1f6dd882f0ef754a84d2bcb0f6650","first_seen":"2025-04-01T11:27:30.082048Z","last_seen":"2026-05-17T06:36:06.052562Z","times_seen":43,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:06 GMT","end":"Tue, 03 Mar 2026 17:10:05 GMT"},"fingerprint":{"sha1":"87:0F:C1:25:08:22:50:0D:D6:14:D4:EF:A9:CF:49:70:C2:8E:5D:36","sha256":"65:A3:E5:AA:4F:13:A5:53:EC:B5:39:DF:03:7F:DE:7D:6F:2B:23:33:85:34:59:13:C3:FC:C2:AC:22:E9:97:D9"}}},"request":{"raw":"GET /s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://steamrefund.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:20:02 GMT\r\nexpires: Sun, 17 Jan 2027 18:20:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 227008\r\nlast-modified: Tue, 18 Nov 2025 19:00:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40128, version 1.0","md5":"9a01b69183a9604ab3a439e388b30501","sha1":"8ed1d59003d0dbe6360481017b44665153665fbe","sha256":"20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2","sha512":"0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca","ssdeep":"768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO","tlshash":"3703023a5e3ccf1a84157a703950f6d9a8481e548e9d143b4f1ac7bf085dde2209b6d4","first_seen":"2025-01-08T22:59:02.845106Z","last_seen":"2026-06-08T21:16:12.332851Z","times_seen":873942,"resource_available":false,"data":null}},"time_used":279,"timings":{"blocked":134,"dns":1,"connect":10,"send":0,"wait":8,"receive":3,"ssl":120},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/landings/6/style/portfolio.css","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /landings/6/style/portfolio.css HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aPJa1sWUnz%2BTxTEbuMk38wt0a4L2tZtTAc24ZvNQla1izWf%2BDJxVdJ3BqfwamcJXx2iO8V7gvqcsHhZDoSN5DKScS70zZJJJ7vyo8mg%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370bf1a0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1965,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"f9521e13ea18206199b617996d0ae293","sha1":"d0353457dec03cce3ea8ca39efe81d850a4c95db","sha256":"1c7b3cb72394966aeb92f6b3a41e4ba65f76dfa2f39c4f0beb428c563d504a18","sha512":"a356a198af0960f98bbb3d710d65742902bb88860e4c03df93bc4464a239603e0ac03c33d80a15903264eeeb93debbb2d86c3476bf7e35ec6146b2819f629527","ssdeep":"","tlshash":"0441ce2e8d211c45927baaac2bb12148eb0970d3930624957fcc73089ff995ce961fcc","first_seen":"2025-06-23T06:51:13.842919Z","last_seen":"2026-05-17T06:36:06.09742Z","times_seen":42,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/trx.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/trx.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BevFzYvhRPtJbKFJ2RTmakFPMXOEaNjSE4kZ5CKO0dilZU%2FE9CeCnmGkalYgLAshA%2Fu174BwtuJjc%2FV0DniUEyERGZL8nV02FTv6FAE%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d8370cf220afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1451,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"76f81a124b273e6a86325e711ebaa6d2","sha1":"cafe93010ab183240a167866a0c882ea625496b8","sha256":"83c9e68359f6cc95b6b5f366ab2212baa55c9cf14e2bb1f5fa9e25e8e96a566c","sha512":"4751802877c27a83bf68ff75cf0b1ddbae0239c60018697621850d7681e908f25774783e1adb1ed01e65cbfbab91ccaf91c510c8b923a90829b61db5f8ab2c0a","ssdeep":"","tlshash":"3d3165c62f68ded9c7a893f2a6602465a825f2aa755c4d5dc04c3f1739c94783c03dca","first_seen":"2023-11-19T01:14:23Z","last_seen":"2026-06-07T23:46:49.572115Z","times_seen":226,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamrefund.top/assets/img/cryptoicons/busd.svg","fqdn":"steamrefund.top","domain":"steamrefund.top","tld":"top"},"ip":{"addr":"104.21.0.250","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamrefund.top/","date":"2026-01-20T09:23:30.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamrefund.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 26 Nov 2025 19:10:36 GMT","end":"Tue, 24 Feb 2026 20:09:17 GMT"},"fingerprint":{"sha1":"0E:41:43:41:D3:1F:9F:EC:58:5E:4B:A0:15:E5:5F:55:71:2C:F2:7B","sha256":"C9:6A:BC:94:AA:65:4F:21:85:6E:3E:B3:2E:3D:8A:7F:5F:1E:4C:3A:E3:A4:69:51:A9:17:1F:97:3B:81:8D:D4"}}},"request":{"raw":"GET /assets/img/cryptoicons/busd.svg HTTP/1.1\r\nHost: steamrefund.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://steamrefund.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: Origin, accept-encoding\r\nlast-modified: Wed, 16 Oct 2024 18:58:00 GMT\r\ncache-control: max-age=14400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\ndate: Tue, 20 Jan 2026 09:23:30 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JWzmxV7Qye4EV94KuMpWZUSR233lStTyZQPDEBuvy8h3dDQzhgcMjVssjqZG%2FSacvX%2FWAf4P1DQJUQ8SR%2Bc2Vml9NDW%2BkqLJ3iclHp8%3D\"}]}\r\nserver: cloudflare\r\nage: 238\r\ncf-cache-status: HIT\r\ncontent-encoding: br\r\ncf-ray: 9c0d83710f4f0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":942,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e18c9a55ae92ba734105e2ebdea06679","sha1":"0c5927bbf67033788a0829b817e8ba735da3b026","sha256":"23a5afc32f0a882ae287456596c37ef02183563af26c57619e91c66a90cfef21","sha512":"0aa09904c5489dd182148d429ba9497aacccb895b6c7e7f07b77e3dfcbc2af8bb3a02f7f5a3ddbaaa7eeff9b5659193fe3724b0003c20e78ab0e7b7b00529d16","ssdeep":"","tlshash":"6d119e24d204aceff50dcf4483f0aad12e626ca382544c7cdef81a79d755c570c5529d","first_seen":"2023-11-15T03:06:45Z","last_seen":"2026-06-07T23:46:49.524306Z","times_seen":348,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"steamrefund.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}