{"report_id":"59ee6709-e202-4d02-88ad-bbf590ae782f","version":0,"status":"done","tags":[],"date":"2026-09-11T12:35:48Z","url":{"schema":"http","addr":"helmtrading.live/","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"helmtrading.live/","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"title":"Helm | Built for Global Traders Who Actually Trade","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-11T14:24:35.064475Z","times_seen":18404274,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"helmtrading.live/","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-16T12:35:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"helmtrading.live","ip":{"addr":"172.67.179.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-11T12:27:18.747141Z","last_seen":"2026-09-11T12:27:18.747142Z","alert_count":0,"request_count":6,"received_data":6818855,"sent_data":2790,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"helmtrading.live/fancybox-3.5.7.min.js","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"db290a1935292cc819dcf6f111b9ce78","sha1":"d09835b2cf0d11f8287de3d20139c2f2d714ad8c","sha256":"c900dc386ca43fceea4c5405d740da248fbee7a1991b7b25648af0b8885d9f10","sha512":"c0b47b138cb01bcae709345984f85a7efe5b4d93e2f6c174a1bddfc9b24fbb77f8778b0ea5161f0491134600a9103d1c7b26b06227ffed619deb8651641044f8","ssdeep":"24576:1av32zvdvgzvp1fdaV3CMCeCbC6CLpNb4j9CWCgChCMCCqqbDDX36loUT9FusNFF:y8vd1c3bWar8CXz5gJ5t8rQLFebdr+js","tlshash":"c2f58603a1e1386604d35eb63d2741caec2d8faf508ca6b8b54df838b9e5165e5ec770","size":3364735,"data":"","first_seen":"2026-09-11T12:35:52.194129Z","last_seen":"2026-09-11T12:35:52.194129Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helmtrading.live/","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-09-11T14:17:22.383403Z","times_seen":94287,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"helmtrading.live/","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-11T12:35:01.180Z","timestamp":1789130101180,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helmtrading.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 03 Sep 2026 07:08:40 GMT","end":"Wed, 02 Dec 2026 08:07:20 GMT"},"fingerprint":{"sha1":"25:29:B6:F2:48:E3:73:31:FE:D2:37:57:8C:48:52:BF:68:4A:64:C2","sha256":"1B:2E:EA:1C:C1:37:31:E7:81:BD:60:A3:99:B3:6C:02:16:37:E5:A9:73:D7:E2:75:99:16:A0:86:05:6A:44:EC"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: helmtrading.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 12:35:01 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Thu, 18 Jun 2026 19:03:08 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QFfkHfK55kc5UCEwI21RS9FowL%2BJXV7viahGhYC9WHKhguMJDjcmr%2FtbNXi8mjE1IzzX45kTrsvkwHVYdAfJkE7sWCCN4ctSTkVRvbZWd4H%2FmOp8r0T%2Bg%2B6SuEaF8Q%2F4qRn%2B\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\npriority: u=0,i\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a396b5bcabf22af8-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":182691,"size_decoded":29340,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (64737)","md5":"cf02b68f0d71e889f00c655d667116d6","sha1":"56468b1f3187f0c1e74005c8fda9fd4b5cde3c63","sha256":"6fa58300149e60a7b9be9d746c8abea7f497469d2ad1955296dd0fb6f3bc55a6","sha512":"ed2a11917aaaa4db8d23502292cce506e05a69a2c70fa4bf753c33157c13d1be9a88451f241baaa9f9d7d910a52ffbfd6b59405f4fd20476740e03965c03b489","ssdeep":"3072:Yaz/OK1qO0CmckjaI55m2lngYpOOl/E5hEq8Ni:wK1qOkN/8ug","tlshash":"5204f91412f0093e2c5381e9a291bf7d565dd283cd7b47a973bd12612fc3dab8e63298","first_seen":"2026-06-28T15:20:06.589001Z","last_seen":"2026-09-11T12:35:52.190922Z","times_seen":3,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":8,"connect":28,"send":0,"wait":154,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helmtrading.live/fancybox-3.5.7.min.js","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helmtrading.live/","date":"2026-09-11T12:35:01.551Z","timestamp":1789130101551,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helmtrading.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 03 Sep 2026 07:08:40 GMT","end":"Wed, 02 Dec 2026 08:07:20 GMT"},"fingerprint":{"sha1":"25:29:B6:F2:48:E3:73:31:FE:D2:37:57:8C:48:52:BF:68:4A:64:C2","sha256":"1B:2E:EA:1C:C1:37:31:E7:81:BD:60:A3:99:B3:6C:02:16:37:E5:A9:73:D7:E2:75:99:16:A0:86:05:6A:44:EC"}}},"request":{"raw":"GET /fancybox-3.5.7.min.js HTTP/1.1\r\nHost: helmtrading.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helmtrading.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 12:35:01 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Thu, 21 May 2026 13:38:44 GMT\r\netag: W/\"6a0f0ae4-33577f\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zFqo%2F4RX5kEVJaxiO5H9HhmF3utSBdPpgDpOJqDik2QKzTht7u%2FCbFZpTIYUSBco2fFTYSgAWx0RGQttTrN5Tj6yPLo2G%2FlXIeFRrmh9TSKNmO2TiTeohyQn5hhFED1inL3m\"}]}\r\npriority: u=3,i=?0\r\nvary: accept-encoding\r\ncf-ray: a396b5bebc4c2af8-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3364735,"size_decoded":1061282,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4fa4c430be0896f45d0eeaaf541d82f9","sha1":"21bc61bd867a6af62ed4a7b41800e27bb7fe6ec3","sha256":"4575057f1d8f5704621b13a6f6ce5291af5b41388e4b7c32560103861aa42f39","sha512":"5f53d3a74d5660b1bf37971a9583ec5648802eae6b5762d6201621017fd71b6c32a9784cc6bb53211ae9d8e0b25f000ed5a4a9a041d24e75774038891090efa2","ssdeep":"24576:1av32zvdvgzvp1fdaV3CMCeCbC6CLpNb4j9CWCgChCMCCqqbDDX36loUT9FusNFa:y8vd1c3bWar8C2","tlshash":"cc25b503a1d0386604d35fb67a2750daec2d8bef618c6ab9b54df834b8e4154e6ec770","first_seen":"2026-06-28T15:20:06.591624Z","last_seen":"2026-09-11T12:35:52.191512Z","times_seen":7,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":95,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helmtrading.live/modern-net-v3.1.min.js","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helmtrading.live/","date":"2026-09-11T12:35:01.553Z","timestamp":1789130101553,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helmtrading.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 03 Sep 2026 07:08:40 GMT","end":"Wed, 02 Dec 2026 08:07:20 GMT"},"fingerprint":{"sha1":"25:29:B6:F2:48:E3:73:31:FE:D2:37:57:8C:48:52:BF:68:4A:64:C2","sha256":"1B:2E:EA:1C:C1:37:31:E7:81:BD:60:A3:99:B3:6C:02:16:37:E5:A9:73:D7:E2:75:99:16:A0:86:05:6A:44:EC"}}},"request":{"raw":"GET /modern-net-v3.1.min.js HTTP/1.1\r\nHost: helmtrading.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helmtrading.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 12:35:01 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Thu, 21 May 2026 13:38:10 GMT\r\netag: W/\"6a0f0ac2-2ff1ea\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jNc0ScmyYA6uaPXgKdXM04A5oAuMKDQq5jVkenmegQdSqUZeGv96znxRZXb6YgflNZw3RWXF274F7YL%2B%2B%2FuLrQv%2BqjuleV5iWYyiD4jLvudZ7BHzJ%2Ba50299RyN2F2s%2FPAyG\"}]}\r\npriority: u=2,i=?0\r\nvary: accept-encoding\r\ncf-ray: a396b5bebc4d2af8-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3142122,"size_decoded":884953,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"813c157a64d4593ebbec0b3f917d2529","sha1":"1d22cfdf864d87db6aef65252a955bc066c73dd5","sha256":"cc1285781126a93d8070a009c10e617a328b186cd14b3ba5b5f52052230d718f","sha512":"00bf2134d419cd9eac7182a00c1725a863e2f2034738de2cd20c23fc6bcb38c7cee26b94f74cda71f45733e332f9436df1b6932883839f19a0b24e53e0f3399f","ssdeep":"24576:/8NTMDz9zLTHH7jf/HZ5zUyp7dEXCOfQsocw0YkkTpfp9L5zoJiERHQzX6B1BBz7:/MaPLRYMlnKYtvvtzO","tlshash":"6b259413a2d038d241d75eb1b62750daec2d4bafb48c9afa998cf834fce1054e5d8674","first_seen":"2026-06-28T15:20:06.594765Z","last_seen":"2026-09-11T12:35:52.192141Z","times_seen":7,"resource_available":false,"data":null}},"time_used":115,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":89,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helmtrading.live/angular-router.js","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helmtrading.live/","date":"2026-09-11T12:35:01.554Z","timestamp":1789130101554,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helmtrading.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 03 Sep 2026 07:08:40 GMT","end":"Wed, 02 Dec 2026 08:07:20 GMT"},"fingerprint":{"sha1":"25:29:B6:F2:48:E3:73:31:FE:D2:37:57:8C:48:52:BF:68:4A:64:C2","sha256":"1B:2E:EA:1C:C1:37:31:E7:81:BD:60:A3:99:B3:6C:02:16:37:E5:A9:73:D7:E2:75:99:16:A0:86:05:6A:44:EC"}}},"request":{"raw":"GET /angular-router.js HTTP/1.1\r\nHost: helmtrading.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helmtrading.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 12:35:01 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Thu, 18 Jun 2026 19:03:08 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1ZnT5nl5q94UrC5kt3gcoW7ojgbNc94uPUoy3QQ56cTcA5Fb0UJO%2FWYfL8rCaVu1VplWjzKgfjn25hNWJBXtvEb31OPhVM7k%2FzL3QgOwYoufXJxVJlX44fdp%2BTNAGeM5mVSN\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=2,i=?0\r\nage: 1400\r\nvary: accept-encoding\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a396b5becc502af8-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-11T14:24:35.064475Z","times_seen":18404274,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helmtrading.live/ultrajs-5.3.8.min.js","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helmtrading.live/","date":"2026-09-11T12:35:01.555Z","timestamp":1789130101555,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helmtrading.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 03 Sep 2026 07:08:40 GMT","end":"Wed, 02 Dec 2026 08:07:20 GMT"},"fingerprint":{"sha1":"25:29:B6:F2:48:E3:73:31:FE:D2:37:57:8C:48:52:BF:68:4A:64:C2","sha256":"1B:2E:EA:1C:C1:37:31:E7:81:BD:60:A3:99:B3:6C:02:16:37:E5:A9:73:D7:E2:75:99:16:A0:86:05:6A:44:EC"}}},"request":{"raw":"GET /ultrajs-5.3.8.min.js HTTP/1.1\r\nHost: helmtrading.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helmtrading.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 12:35:01 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Thu, 21 May 2026 13:40:16 GMT\r\netag: W/\"6a0f0b40-1e0dd\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 1400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U9eXZj8brBIkJJ4mcb%2BZtg6TasNSZJ22y3nunlcMYnG3jYHTvh285gwwmk8tcdY1cwtQwVfH%2Buh7b4P0OOYSgIC9Q%2B%2BxA%2FD4BjttiyEsNFlhIqYCzLl2CmjATn8I9jY5Fru6\"}]}\r\npriority: u=2,i=?0\r\nvary: accept-encoding\r\ncf-ray: a396b5becc542af8-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":123101,"size_decoded":37743,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"afb6c898cfd4d205b52c2665d657d22d","sha1":"0ad455c791af0979ac39b5fac696fc72247d7471","sha256":"f4cb549869ad1779eea40ba9f14c478dd7d45ad293cfc5955473b19af142ce0c","sha512":"3e2ba2df57057d93d0e855708cb809d97366a4054207d1e7a7ca946cc4a843d20bc15e42167b0c5ad3ef5798a8abe07bee6782ee3bd7345e0d00db37c0669f73","ssdeep":"1536:P7zDNl7zDNnvMfCI7zEZeMEiJe5Y5pMiVLVzOs7oQFd9L2a+XwEQFQ:TH2fCSzaePIMiVLVym5QAEQa","tlshash":"b4c361d6590ad4ea8e5111cdd477ec08e0684aa3cdacf193fa2cddc2b41ef66844727b","first_seen":"2026-06-28T15:20:06.584664Z","last_seen":"2026-09-11T12:35:52.193219Z","times_seen":5,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helmtrading.live/secureproxy?s=%2Fipfs%2FKEfmyVywAtw5VA7LjB_d3w1b3739e0fdddd0eb45afc5ed2d5bb0ea%3Ft%3D1789130101547","fqdn":"helmtrading.live","domain":"helmtrading.live","tld":"live"},"ip":{"addr":"172.67.179.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helmtrading.live/","date":"2026-09-11T12:35:01.562Z","timestamp":1789130101562,"http_version":"HTTP/3","security_state":"","security_info":null,"request":{"raw":"GET /secureproxy?s=%2Fipfs%2FKEfmyVywAtw5VA7LjB_d3w1b3739e0fdddd0eb45afc5ed2d5bb0ea%3Ft%3D1789130101547 HTTP/1.1\r\nHost: helmtrading.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helmtrading.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 11 Sep 2026 12:35:02 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"9d9e1-JXgf1aMsuI2R5pSsJzDTF4tCc58\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=QOA9LAh1TT7dbRh7xVoPTQ.js\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/11/2026 12:35:01\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: 99cc00df8e21149135376a0b81f69264\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5EBiCTLGABqTtxTHDYnkU%2BK4EEIQBVZv%2FpINJqXrtsvSAxUztIYP5URnYu5peV4gbEbTLVzhMDjF7VkgxsHMkNs1HBkuoAFk2NZzKmlO9tAw7DF8eddgJmwr7bqQx3emrLA4\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: a396b5bedc582af8-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-11T14:24:35.064475Z","times_seen":18404274,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}