Report - netcdn.xyz/app/1330123889/pubg-uc-buy-paytm-game-hack

Report Overview

URL

netcdn.xyz/app/1330123889/pubg-uc-buy-paytm-game-hack
IP

91.223.82.61

ASN

#199968 Iws Networks LLC
Submitted

2022-12-13T00:00:39Z

Access
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

0
Threat Detection Systems

50

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
push.services.mozilla.com (1)	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606	127	52.42.74.230
r3.o.lencr.org (12)	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	4056	10637	23.36.76.226
netcdn.xyz (1)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	482	550	91.223.82.61
translate.google.com (1)	1156	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	408	807	216.58.211.14
content-signature-2.cdn.mozilla.net (1)	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413	5843	34.160.144.191
downloadlocked.com (1)	127304	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	365	7189	23.22.126.183
ajax.googleapis.com (2)	12905	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	788	83636	142.250.74.74
fonts.googleapis.com (1)	8877	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	402	5794	142.250.74.74
track.enigmacdn.com (2)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1140	20892	91.223.82.61
s4.histats.com (1)	12782	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	629	183	149.56.240.27
firefox.settings.services.mozilla.com (2)	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782	2374	35.241.9.150
contile.services.mozilla.com (1)	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333	391	34.117.237.239
ocsp.pki.goog (9)	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3087	6300	142.250.74.131
is3-ssl.mzstatic.com (1)	1658	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	540	13302	23.38.200.24
i0.wp.com (1)	3021	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	392	1176	192.0.77.2
fonts.gstatic.com (1)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	503	45804	216.58.207.227
translate.googleapis.com (1)	1005	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	415	4565	142.250.74.106
www.gstatic.com (2)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	843	4303	142.250.74.35
gaminghelper.co (34)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	17280	260479	91.223.82.61
ocsp.digicert.com (4)	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1364	2646	93.184.220.29
img-getpocket.cdn.mozilla.net (6)	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3245	48034	34.120.237.76
maxcdn.bootstrapcdn.com (1)	724	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	416	894	104.18.10.207

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-12-12	medium	netcdn.xyz/app/1330123889/pubg-uc-buy-paytm-game-hack	Tencent
2022-12-12	medium	gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack	Tencent

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-12-13	medium	netcdn.xyz/app/1330123889/pubg-uc-buy-paytm-game-hack	Phishing
2022-12-13	medium	gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack	Phishing
2022-12-13	medium	gaminghelper.co/js/jquery.countTo.js	Phishing
2022-12-13	medium	gaminghelper.co/js/validator.min.js	Phishing
2022-12-13	medium	gaminghelper.co/js/com.js	Phishing
2022-12-13	medium	gaminghelper.co/js/sweetalert2.min.js	Phishing
2022-12-13	medium	gaminghelper.co/js/form-scripts.js	Phishing
2022-12-13	medium	gaminghelper.co/js/jquery.magnific-popup.min.js	Phishing
2022-12-13	medium	gaminghelper.co/js/sticky.js	Phishing
2022-12-13	medium	gaminghelper.co/js/main.js	Phishing
2022-12-13	medium	gaminghelper.co/fonts/bebasneue_bold-webfont.html	Phishing
2022-12-13	medium	gaminghelper.co/fonts/bebasneue_regular-webfont.html	Phishing
2022-12-13	medium	gaminghelper.co/fonts/et-line.woff	Phishing
2022-12-13	medium	gaminghelper.co/js/fancySelect.js	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed
2022-12-13	medium	gaminghelper.co	Sinkholed

HTTP Transactions (86)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

b642ec5702fb818c5d1c67168cc68fdb

015146489a8e7fcb4ba0ba74cfe757a072705f93

4846d047a23903856bd113d02639ce7e08a1e40030151d302295b2d12df98ffc

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4846D047A23903856BD113D02639CE7E08A1E40030151D302295B2D12DF98FFC"
Last-Modified: Mon, 12 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9806
Expires: Tue, 13 Dec 2022 02:43:54 GMT
Date: Tue, 13 Dec 2022 00:00:28 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

3c0c53379f331e934f61070074d41035

420f6e542cbf741838566f22e475a80e2f600d21

4b7213ec107cdf1c2cd61a124453fb682ec291af0004d071105c87e2fe7528f5

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4B7213EC107CDF1C2CD61A124453FB682EC291AF0004D071105C87E2FE7528F5"
Last-Modified: Mon, 12 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7657
Expires: Tue, 13 Dec 2022 02:08:05 GMT
Date: Tue, 13 Dec 2022 00:00:28 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

b44c4b5daa307a355e7bab1c83c1ca82

dbd14cd873f1dd4502f277b3f51cb7bc8da0c080

fd4604461cfa002c8a261bb14eb8dda56817db231b9012b2eb38d6dbc2674df5

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Length, Alert, Retry-After, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 12 Dec 2022 23:08:39 GMT
content-type: application/json
age: 3109
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

d29881eeb0456eff8cf415ad2ce64ba0

e3cfdd5f56ff88066257ec8f4726f53e3a733bd3

2cd90072f113163f976ddb8bc7017884efd3f764e7e8961b04e3ba5ec0a17d85

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2CD90072F113163F976DDB8BC7017884EFD3F764E7E8961B04E3BA5EC0A17D85"
Last-Modified: Mon, 12 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13387
Expires: Tue, 13 Dec 2022 03:43:35 GMT
Date: Tue, 13 Dec 2022 00:00:28 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

53341dea33f4f3d9b4966f80589f429a

20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d

651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: wiDytNPzbaqOPgrmVTsg3v5+CGxJ+A3PquofNWz8JtF46pRAcOcxsT1CQSWAyou2xM7XPVu8V3E=
x-amz-request-id: VRP5VBR8A21S7Z96
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 12 Dec 2022 23:49:48 GMT
age: 640
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

8f7315a47cce4fe41e773ad5564b3793

9ee2be31c8c56db5fbd71a42b2c887e9e237955b

c5f4fcf267bfaa1358c03f2378d3d311f6a8eac1385e025e19f593599c54ec98

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C5F4FCF267BFAA1358C03F2378D3D311F6A8EAC1385E025E19F593599C54EC98"
Last-Modified: Mon, 12 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21483
Expires: Tue, 13 Dec 2022 05:58:31 GMT
Date: Tue, 13 Dec 2022 00:00:28 GMT
Connection: keep-alive

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Tue, 13 Dec 2022 00:00:28 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

netcdn.xyz/app/1330123889/pubg-uc-buy-paytm-game-hack

91.223.82.61

301 Moved Permanently

274

URL HTTP/1.1

netcdn.xyz/app/1330123889/pubg-uc-buy-paytm-game-hack
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text

Size

274
Hash

3a6eedceaae6c5ef3e9d9b0de7ae5777

bd385f040e0b286747ba20e7ed63200458c8fdd5

99b539c0cd1a4eff2944072fbda0935a6c78c04f3b9482781b6b872c30a54028

Detections

Analyzer	Verdict	Alert
openphish	Tencent
fortinet	Phishing

HTTP Headers

                                        GET /app/1330123889/pubg-uc-buy-paytm-game-hack HTTP/1.1
Host: netcdn.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 274
Connection: keep-alive
Keep-Alive: timeout=60
Location: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

ff9ac7cd10bd7b389a619c7395253f41

22907f3ddfe323ff11ad19915c94d77a30ef05b8

ef8689b50166552aa82e3ddf13a713f2c96878c0c0694973fb26d0dab0be91dc

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF8689B50166552AA82E3DDF13A713F2C96878C0C0694973FB26D0DAB0BE91DC"
Last-Modified: Mon, 12 Dec 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21531
Expires: Tue, 13 Dec 2022 05:59:19 GMT
Date: Tue, 13 Dec 2022 00:00:28 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Backoff, Content-Length, Pragma, Alert, Expires, Last-Modified, Retry-After, ETag, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 12 Dec 2022 23:33:17 GMT
age: 1631
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack

91.223.82.61

200 OK

20224

URL HTTP/1.1

gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (14923)

Size

20224
Hash

522a22adb5a3da271f5349b3706c850c

7197afa445715299f2e645fe080c5e02b53cf643

d61f21e06c8a3e32e1e92451497b3381810032efc48598a0e8c5bcdd4aea5595

Detections

Analyzer	Verdict	Alert
openphish	Tencent
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

                                        GET /app/1330123889/pubg-uc-buy-paytm-game-hack HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
X-Powered-By: PHP/8.0.8RC1
Content-Encoding: gzip

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

ee19f96e42a0eca99d00c8d91f977c35

3bf8dbf8b8ce6ea7adadf7bb92cae2f9502fbee9

6d8adcb1494bfe2ca73cd6b77eb57b2d08e07b05eb892fea98a1fde0bfb2ea12

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5273
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:28 GMT
Etag: "6396ef2b-1d7"
Last-Modified: Mon, 12 Dec 2022 22:32:35 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471

gaminghelper.co/css/bootstrap.min.css

91.223.82.61

200 OK

19597

URL HTTP/1.1

gaminghelper.co/css/bootstrap.min.css
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text, with very long lines (65371)

Size

19597
Hash

3f142cfc2d7123b31a1e696e0591f27a

834192dbadf2713cd2ff89f50d7ec2f1d4782e54

3421e2383a7c02f24509d2f1294d3099b658d0773f97706b87b832b0b770c0b6

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /css/bootstrap.min.css HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: text/css
Last-Modified: Fri, 03 Sep 2021 06:30:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c104-1d9bb"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

gaminghelper.co/css/fancySelect.css

91.223.82.61

200 OK

1023

URL HTTP/1.1

gaminghelper.co/css/fancySelect.css
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text

Size

1023
Hash

458a1a06f282aa4c457a8b613d6a38e6

b524e1cb32722230e18bc85f414b9a10e43a7e2d

3f41176d4616a36f4325865bb3c0ea652f3616dec60b31bd923df91f600506b2

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /css/fancySelect.css HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: text/css
Last-Modified: Fri, 03 Sep 2021 06:30:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c105-109d"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

e89f8194617cdd764e607468473f0341

810ed618482a7e19323605930f20d84205cb6c9f

025866e838be169bcbf1d1be9d552c74af1486058bebf3e8777dbb7a79078b05

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4742
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Last-Modified: Mon, 12 Dec 2022 22:41:27 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 279

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

0f3dad0d025c4b6b8abd5d698f00cfbd

3a82ecac8709c7acd620316502a0e774ac3b1170

8d98454c05e1bfb1e534913e69fe76f4b0cb619c02626bcdc163f7be48b1621f

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

0f3dad0d025c4b6b8abd5d698f00cfbd

3a82ecac8709c7acd620316502a0e774ac3b1170

8d98454c05e1bfb1e534913e69fe76f4b0cb619c02626bcdc163f7be48b1621f

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

gaminghelper.co/css/animate.css

91.223.82.61

200 OK

4026

URL HTTP/1.1

gaminghelper.co/css/animate.css
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text

Size

4026
Hash

48bc9b81bca18c06ba937cbb880b4cb3

697313edfad185bcca5c7bde18da4a98f93e3adb

b30b4d8565f9af6c8d2cb3839aa09dbccd60ca1a766465d542debade38f45741

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /css/animate.css HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: text/css
Last-Modified: Fri, 03 Sep 2021 06:30:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c104-10cbc"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

gaminghelper.co/css/style.css

91.223.82.61

200 OK

8520

URL HTTP/1.1

gaminghelper.co/css/style.css
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text, with very long lines (1512)

Size

8520
Hash

4d36bdeba8bb00f4ee280771fddfa689

8dfbed7251f5bb010d5fe8f64e0d60abc3e9fd54

08bb84420272831b8755bc5bd2858bf8a486006a9367b670d826ee516262a2c8

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /css/style.css HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: text/css
Last-Modified: Fri, 03 Sep 2021 06:30:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c106-bd7b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

gaminghelper.co/css/sweetalert2.min.css

91.223.82.61

200 OK

2737

URL HTTP/1.1

gaminghelper.co/css/sweetalert2.min.css
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text, with very long lines (13987), with no line terminators

Size

2737
Hash

1cfac88a4a8e1bc20b811757fb028b40

10427c064f703342d031411a3310e2a5ef2083bc

53976df2ad3ce0c0f2632bb620bbb02d930a5eb943298170e97189f029a0d70d

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /css/sweetalert2.min.css HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: text/css
Last-Modified: Fri, 03 Sep 2021 06:30:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c106-36a3"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

0f3dad0d025c4b6b8abd5d698f00cfbd

3a82ecac8709c7acd620316502a0e774ac3b1170

8d98454c05e1bfb1e534913e69fe76f4b0cb619c02626bcdc163f7be48b1621f

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

gaminghelper.co/js/jquery.countTo.js

91.223.82.61

200 OK

1125

URL HTTP/1.1

gaminghelper.co/js/jquery.countTo.js
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text

Size

1125
Hash

547f5246e091d19af521dee35588e468

4772f3c1e62865ccbbab04abd39e69510c8f5843

67880d8532d95db3e74b7da985ca2fe7c9d9660e3dd125202cebcda96a2007e2

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

                                        GET /js/jquery.countTo.js HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: application/javascript
Last-Modified: Fri, 03 Sep 2021 06:33:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c1b3-eb1"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

a41c1c2a6aad29835a33369555bbe359

4e104748d3d8c3237d58e03b6f7493fcc9182142

a0495e2ab6ed55134a4bf56eb85252977c6978eb965b14724d47e3c979f25ab4

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

e89f8194617cdd764e607468473f0341

810ed618482a7e19323605930f20d84205cb6c9f

025866e838be169bcbf1d1be9d552c74af1486058bebf3e8777dbb7a79078b05

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4742
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Last-Modified: Mon, 12 Dec 2022 22:41:27 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 279

gaminghelper.co/css/magnific-popup.css

91.223.82.61

200 OK

1994

URL HTTP/1.1

gaminghelper.co/css/magnific-popup.css
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text

Size

1994
Hash

c0275239cb960b014d780d8105b44d72

8db83ac790988232549a3740ecf04fc199da1ce8

211b79363793093a7a2f1d342768844e938e88156b62293093185a6500ead1cf

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /css/magnific-popup.css HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: text/css
Last-Modified: Fri, 03 Sep 2021 06:30:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c105-1f0a"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

142.250.74.74

200 OK

29725

URL HTTP/2

ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js
IP

142.250.74.74:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (32025)

Size

29725
Hash

83b3b5729cdff3976db52c51831e96b8

d23dc823e37f58e5366340be755730f3fa9a850d

675fa88b39008a09994460a93b310a7d4593735009a9b24b6f176c347ad12421

HTTP Headers

                                        GET /ajax/libs/jquery/2.1.4/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 29725
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 08 Dec 2022 08:31:51 GMT
expires: Fri, 08 Dec 2023 08:31:51 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 401318
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ajax.googleapis.com/ajax/libs/jqueryui/1.8.13/jquery-ui.min.js

142.250.74.74

200 OK

51711

URL HTTP/2

ajax.googleapis.com/ajax/libs/jqueryui/1.8.13/jquery-ui.min.js
IP

142.250.74.74:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (563)

Size

51711
Hash

d3908721b39ebbeffaf1c917bbda06e8

0f9b6c6bdad9cfc057f3e85f52cc417370959fb9

4ae100977cea8b9965e5d231f3ae655783b4f163c56ee703953aff937525ed37

HTTP Headers

                                        GET /ajax/libs/jqueryui/1.8.13/jquery-ui.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 51711
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 06 Dec 2022 15:53:32 GMT
expires: Wed, 06 Dec 2023 15:53:32 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 547617
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

354d1c71c6eb7ea571e1c63b44ed38d2

e72580fcbd87651c2591aa7802047598446d62dc

e7d77d4facda5f5683708ba8211bcf1a2253543f6fac8f3d9a82aa2f93fe1d56

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E7D77D4FACDA5F5683708BA8211BCF1A2253543F6FAC8F3D9A82AA2F93FE1D56"
Last-Modified: Mon, 12 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6981
Expires: Tue, 13 Dec 2022 01:56:50 GMT
Date: Tue, 13 Dec 2022 00:00:29 GMT
Connection: keep-alive

gaminghelper.co/js/validator.min.js

91.223.82.61

200 OK

2094

URL HTTP/1.1

gaminghelper.co/js/validator.min.js
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text, with very long lines (5862)

Size

2094
Hash

1ab13fa2eeca5d16de99a1cad839416c

0d0a95bd88d04b02d89e1162dd3ebb20b5543dd8

56b8d7fb44f86809b49d416022455ac170fb0b79d1ab4b6e5192a046e660f667

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

                                        GET /js/validator.min.js HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: application/javascript
Last-Modified: Fri, 03 Sep 2021 06:33:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c1b9-17a7"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

gaminghelper.co/js/com.js

91.223.82.61

200 OK

3265

URL HTTP/1.1

gaminghelper.co/js/com.js
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

C source, Unicode text, UTF-8 text, with very long lines (2456)

Size

3265
Hash

ecf323c878106fa274f5e9f3b3a82437

86b15826e8a83c81da7ef264dd8e3ff59ef5c1bf

28babf5e232e3dc0985bab21a28eea25b17bc078bafc92a6ba049eefb1e45720

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

                                        GET /js/com.js HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: application/javascript
Last-Modified: Fri, 03 Sep 2021 06:33:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c1b2-461a"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

gaminghelper.co/js/sweetalert2.min.js

91.223.82.61

200 OK

6538

URL HTTP/1.1

gaminghelper.co/js/sweetalert2.min.js
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text, with very long lines (20305), with no line terminators

Size

6538
Hash

b238ef007e57c4c8f9447cba68fdb3a2

2d4ca455aca3fcd8ee7ac2e2883cfa89c87bd532

aeafa1e7bb6a973eac2b4f5462844b1c2d64d53eb2e09e75f265e646320f7080

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

                                        GET /js/sweetalert2.min.js HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: application/javascript
Last-Modified: Fri, 03 Sep 2021 06:33:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c1b9-4f51"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

gaminghelper.co/js/form-scripts.js

91.223.82.61

200 OK

609

URL HTTP/1.1

gaminghelper.co/js/form-scripts.js
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text

Size

609
Hash

4fb85eb3b2f0dd8b8f5953c58236da3e

1c9f6c7a15a3248147e056672ffbf4fdbaed6718

3dd0f5e5567c73519dc3eeb98ba6fef9d2b2982af24544ba3d7bbc684d6bae6c

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

                                        GET /js/form-scripts.js HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: application/javascript
Last-Modified: Fri, 03 Sep 2021 06:33:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c1b2-5bd"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

push.services.mozilla.com/

52.42.74.230

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

52.42.74.230:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: mC+XiPxN3bpTW4SUeirGEg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: GxXYrgxdDonmRihoax8S5sOE/cE=

gaminghelper.co/js/jquery.magnific-popup.min.js

91.223.82.61

200 OK

7685

URL HTTP/1.1

gaminghelper.co/js/jquery.magnific-popup.min.js
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text, with very long lines (21014)

Size

7685
Hash

12a9a563724e70a895de0fbd5f7b4ee5

a14c616f532deb9ca2d5fa0de6124d47ea60ab57

f2e1cd5f2953925591288bd1cc3f167bbd392497476119083458e33e9ab87079

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

                                        GET /js/jquery.magnific-popup.min.js HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: application/javascript
Last-Modified: Fri, 03 Sep 2021 06:33:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c1b6-5297"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

0f3dad0d025c4b6b8abd5d698f00cfbd

3a82ecac8709c7acd620316502a0e774ac3b1170

8d98454c05e1bfb1e534913e69fe76f4b0cb619c02626bcdc163f7be48b1621f

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

0f3dad0d025c4b6b8abd5d698f00cfbd

3a82ecac8709c7acd620316502a0e774ac3b1170

8d98454c05e1bfb1e534913e69fe76f4b0cb619c02626bcdc163f7be48b1621f

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

gaminghelper.co/js/sticky.js

91.223.82.61

200 OK

URL HTTP/1.1

gaminghelper.co/js/sticky.js
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

                                        GET /js/sticky.js HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: application/javascript
Content-Length: 0
Last-Modified: Fri, 03 Sep 2021 06:33:28 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "6131c1b8-0"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

gaminghelper.co/js/main.js

91.223.82.61

200 OK

15195

URL HTTP/1.1

gaminghelper.co/js/main.js
IP

91.223.82.61:0
ASN

#199968 Iws Networks LLC

Magic

ASCII text, with very long lines (16162)

Size

15195
Hash

562dc83f2f14b713905fe69a0994e11d

43cd616f9ea8c8c1eb0edccd54a29e2490fcf90a

745ecf708bc71ba73f7071b8a35c3f639ec7f3e05ceb826458a1b6a8fb4fe782

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

                                        GET /js/main.js HTTP/1.1
Host: gaminghelper.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gaminghelper.co/app/1330123889/pubg-uc-buy-paytm-game-hack
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Dec 2022 00:00:27 GMT
Content-Type: application/javascript
Last-Modified: Fri, 03 Sep 2021 06:33:27 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6131c1b7-a08b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

8bc1b4db769ee14aba872f3f93af10b1

f24c742805ff56d77d50924d60dabd2b6750c46e

35e6181045327df4b97bddff70ea1f9510e03d6896213b5f8473d8da771b15f1

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

ab9571c6eaea8d1bb7a07b8eda56c5cc

578ee30e7d0a98fac97a54d55805fa2da618a626

5cc695dc6bca3b4a7aeb8640910a560a2276a2ebacedbc5683b2d3948c647826

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3794
Cache-Control: max-age=150375
Content-Type: application/ocsp-response
Date: Tue, 13 Dec 2022 00:00:29 GMT
Etag: "63975a32-1d7"
Expires: Wed, 14 Dec 2022 17:46:44 GMT
Last-Modified: Mon, 12 Dec 2022 16:43:30 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (20)

#1 JS:Script (size: 0)

#2 JS:Script (size: 6778)

#3 JS:Script (size: 21143)

#4 JS:Script (size: 424)

#5 JS:Script (size: 62256)

#6 JS:Script (size: 51)

#7 JS:Script (size: 84380)

#8 JS:Script (size: 41099)

#9 JS:Script (size: 3761)

#10 JS:Script (size: 134)

#11 JS:Script (size: 22419)

#12 JS:Script (size: 11440)

#13 JS:Script (size: 76759)

#14 JS:Script (size: 17946)

#15 JS:Script (size: 20305)

#16 JS:Script (size: 211667)

#17 JS:Script (size: 6055)

#18 JS:Script (size: 1469)

#19 JS:Script (size: 536)

#20 JS:Script (size: 2799)

HTTP Transactions (86)

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1