{"report_id":"782997ef-e825-46ad-959d-ab20762cb189","version":0,"status":"done","tags":[],"date":"2026-06-08T13:32:56Z","url":{"schema":"http","addr":"sqs.non-steam.com","fqdn":"sqs.non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":0,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"non-steam.com/","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"title":"Non-steam client panel","dom":{"size":4639,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"ea6ae94bed7dbe36566e0ccf17bd6728","sha1":"95000a4f00b3abb08f9580a3430df7dfef125fb6","sha256":"98a755939b31a0a19aec3d8f549058103c8668e5562f9620ab3451a986de6725","sha512":"18a06a2b2648c75a1ee896bb97fdb25401a334b9c3a17c1094ff18b196092b7c448afc7792c9e026701f726dea73f02ac6c98246b2540b05aae73cb1579c6f17","ssdeep":"48:OdQv19ZY6u2IjTwALLF9DLlsY9kh6WfneBOITwu6HiXv6UJtEMYEKF0QpQ:OI19ZDu2y0ALLPDLlsPXfnegMAVuuQ","tlshash":"21a120514cf56467024280ca717aae0aadd1da17fa5b594433fd57cd0fe7d42c80ba1d","dom_hash":"domhashf07407e9398fc49daaa969be5aaa751c","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"sqs.non-steam.com","fqdn":"sqs.non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":0,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-13T13:32:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":8}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"sqs.non-steam.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2019-08-23","domain_rank":0,"first_seen":"2026-06-08T13:29:15.914939Z","last_seen":"2026-06-08T13:29:15.914939Z","alert_count":8,"request_count":2,"received_data":619,"sent_data":888,"comment":"","tags":null,"fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}]},{"fqdn":"non-steam.com","ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2019-08-23","domain_rank":1608609,"first_seen":"2026-04-29T03:47:10.059749Z","last_seen":"2026-06-08T13:32:08.060181Z","alert_count":40,"request_count":10,"received_data":853353,"sent_data":6143,"comment":"","tags":null,"fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"non-steam.com/","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"d4df696a97910cafed45a22fe1e19525","sha1":"5dddb14a528bce3ebae48717c0ac45cd6ba91ee1","sha256":"57fa0cb15d477f81e15ce2d924fe1d1da6c454caba9f1e85d025d67b33ede649","sha512":"119790921eea8a0f176b4b57c318f902e16ddfa589b84f8f41e559a8adce7705ffc6046688105b1ce482465886e327095db3469292746a7495ed654ec2fd0fae","ssdeep":"","tlshash":"91f082fa8c3b4051c651c5e3432f146524107d2b3821c5c87bb9cb559e92f80e4567ef","size":486,"data":"","first_seen":"2026-06-08T13:32:59.315908Z","last_seen":"2026-06-18T04:27:09.741046Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"81160826b25398c9e86e047b3bc281ee","sha1":"214009818ee478ec953caab11ff1ef207a19340c","sha256":"5426cb7a58c3081cb19b5e7eb26f3bc8c0fa535bb5623815cedc6860786d2bf1","sha512":"30e00bf317f04c6beae749544f58d64fe788cf36626be7432de951025524de343a6d215f58b5177298670c22c2aad8b840819a9d44cd8080e253bf2389dc69c3","ssdeep":"","tlshash":"7fb0125788735f09d256340f8d1d4b417120556fc404682c3d5e95175fc5d84d2d933c","size":124,"data":"","first_seen":"2026-06-08T13:32:59.316909Z","last_seen":"2026-06-08T13:32:59.316909Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/runtime.c2980329.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"60aeb948706b140fe7e3d5ef5a876260","sha1":"620a1c5147f26db32f0d4c19a95d216a6371ea43","sha256":"5fca017eb9c96e7b8382dfcf5f8edf9a20500f32a948d9fc1f48efc37d297ec0","sha512":"930af573c8fa3e2baaee149d0eda5ce2effafb35991c31c93a65a9469bb761c33704b4664bc8a43ed9e31efbb2afa2ac43311cced4ad4f5d844d6fa6400b2996","ssdeep":"","tlshash":"e121549531e4f8e427e6d8c5091f8047e612d973517ee8f1e32bcca13828a920177eb7","size":1428,"data":"","first_seen":"2025-08-03T17:04:22.993277Z","last_seen":"2026-06-18T04:27:09.738568Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/755.43aadddf.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"08e7640bcab8fd1ece626495ee61d7ae","sha1":"d519a7e330a932d9cd50a240c36328041b63858a","sha256":"46b47041f30a3156db035a62b017876285afbeebd59d735e033b58291e9be0c9","sha512":"871fb6fc2b35078fd1880accbacd90ea05a3a9e797c87527682e3a4644708ee8c92ec5e8694e58014d36f1db9eeca3cba32e6469563a74b009ebbdae12536272","ssdeep":"1536:lfRLi9gxGUs+4Ezy4bx60BW1kkWyAuxPb8vJ5pDVGf9oOcENMnEBt0AIH6ia/YIX:lfStPAvJ5TlllAYlYgP+","tlshash":"70930addb2cab06347a770ba40bf550bf2361999684d4400f125e4e9bc78b4a927bf3d","size":90006,"data":"","first_seen":"2023-03-11T22:22:29Z","last_seen":"2026-06-18T04:27:09.713496Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/809.dd650ea1.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b188f053f6825bbae4903ab45c6dbf3","sha1":"bfc0b0fe939628aac186f9a689999d9a852fee01","sha256":"e522a006bfeb6aec5452806c317393a1e0677587d756c9758370e7de0b8e741f","sha512":"9a0fa946ad66a575c589e187470ad6a9c33d726896fdeb4b9ad7c0004ac1ab9d3bc4c9cff901977bb16afa9abec535fdc96d617db344e9769d88996fa5ebfd3e","ssdeep":"3072:YhgN1QneuB1DGusRwxKTHDAtz1MPaH+8uQS04EJOu5LCT0Ef5IrGt+6ad7Nw/Sov:ckOdyP1eOeuwI5IrGtNaQS0R","tlshash":"da94054db2417532429ba1a6107b1a0fb2376a2da106809cb57ccdde5ebcd48327bf7d","size":414540,"data":"","first_seen":"2025-08-03T17:04:22.997062Z","last_seen":"2026-06-18T04:27:09.71509Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/js/app.e801413a.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"70b9106d07f3776e0c496cce68f87a87","sha1":"9662b57e1df9b6ff9a879bcd93ba394d8b58edef","sha256":"1b4cd7047eb43893972b9a58067d4ea4eeb5824706adb7e6486b7ab836da1cfe","sha512":"3ba0093c800ddc561c5972a3da75720b5dc9156eb163008c241258b7bfb83b0a29586e6ae2f2162228e59cf1a3f46548eb1f91748fc40410f9f6175efa45bcd0","ssdeep":"192:bHvlG5WePiUcaB/SIcWvV2WMfQBUXS68z4zx4WdckDBWlHOgm/VW:Lo5WePi4B/SC92WMIyXS68z4t4WdxWVT","tlshash":"9d32f8d87515306066af2096a02f25177826f57e981f5420a15a58f93decfcea133f3f","size":11818,"data":"","first_seen":"2025-08-03T17:04:22.999933Z","last_seen":"2026-06-18T04:27:09.717733Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sqs.non-steam.com/","fqdn":"sqs.non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T13:32:29.797Z","timestamp":1780925549797,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: sqs.non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-20T18:29:40.417331Z","times_seen":16586757,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sqs.non-steam.com/","fqdn":"sqs.non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":80,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T13:32:33.024Z","timestamp":1780925553024,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: sqs.non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: ddos-guard\r\nConnection: keep-alive\r\nKeep-Alive: timeout=60\r\nSet-Cookie: __ddg8_=E5Q0YwcnFupcJqF3; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:33 GMT\n__ddg10_=1780925553; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:33 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:33 GMT\n__ddg1_=uNlsIRM8F7K9v4eO5M6U; Domain=.non-steam.com; HttpOnly; Path=/; Expires=Tue, 08-Jun-2027 13:32:33 GMT\r\nDate: Mon, 08 Jun 2026 13:32:33 GMT\r\nContent-Type: text/html\r\nContent-Length: 185\r\nLocation: https://non-steam.com/\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-20T18:29:40.417331Z","times_seen":16586757,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":5,"connect":21,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"sqs.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T13:32:33.128Z","timestamp":1780925553128,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=E5Q0YwcnFupcJqF3; __ddg10_=1780925553; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=41ZXdznv6BcdcPmr; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:33 GMT\n__ddg10_=1780925553; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:33 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:33 GMT\nPHPSESSID=m6gk77ie8755p81fm8s2jcgeng; path=/; secure; HttpOnly; SameSite=lax\nRememberMe=deleted; expires=Sun, 08-Jun-2025 13:32:32 GMT; Max-Age=0; path=/; httponly\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: no-cache, private, max-age=0, must-revalidate, private\r\ndate: Mon, 08 Jun 2026 13:32:33 GMT, Mon, 08 Jun 2026 13:32:33 GMT\r\nexpires: Mon, 08 Jun 2026 13:32:33 GMT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":4678,"size_decoded":2586,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"5bbc9599a157aa6c7f7c7f4d9b6e1a61","sha1":"5faf7f25e7156db5c0149b9948007a7130851821","sha256":"2fd5a903ae72b817f9912b3d198efeb1cc406f2b25dfbeb3d862428d46f8c361","sha512":"b75d948fa51bea4a77f9c4f4ce0191a4eca30cb9754e6b381ea6ddc3a5c3cd97510af265938e0295ec470b851e41fcbdfac276002475af10daa44c4d179bd623","ssdeep":"48:YaQv1vZY6u2IjTwALLF9DLlsY9kh6OufneBOITwu6HiXv6UJtEMYEKF0Qpu:YX1vZDu2y0ALLPDLlsPFufnegMAVuuu","tlshash":"bea120614cf56467024280ca727aae0aadd1ca17fa5b598433fd57cd0fe7e42c80ba2d","first_seen":"2026-06-08T13:32:59.303658Z","last_seen":"2026-06-08T13:32:59.303658Z","times_seen":1,"resource_available":true,"data":null}},"time_used":646,"timings":{"blocked":-1,"dns":4,"connect":21,"send":0,"wait":594,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/runtime.c2980329.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://non-steam.com/","date":"2026-06-08T13:32:34.039Z","timestamp":1780925554039,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/runtime.c2980329.js HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=41ZXdznv6BcdcPmr; __ddg10_=1780925553; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U; PHPSESSID=m6gk77ie8755p81fm8s2jcgeng\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=5x0VCkeevmMj9ECg; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg10_=1780925554; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\r\ndate: Mon, 08 Jun 2026 13:32:34 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 1428\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-594\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1428,"size_decoded":1961,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1428), with no line terminators","md5":"60aeb948706b140fe7e3d5ef5a876260","sha1":"620a1c5147f26db32f0d4c19a95d216a6371ea43","sha256":"5fca017eb9c96e7b8382dfcf5f8edf9a20500f32a948d9fc1f48efc37d297ec0","sha512":"930af573c8fa3e2baaee149d0eda5ce2effafb35991c31c93a65a9469bb761c33704b4664bc8a43ed9e31efbb2afa2ac43311cced4ad4f5d844d6fa6400b2996","ssdeep":"","tlshash":"e121549531e4f8e427e6d8c5091f8047e612d973517ee8f1e32bcca13828a920177eb7","first_seen":"2025-08-03T17:04:22.993277Z","last_seen":"2026-06-18T04:27:09.738568Z","times_seen":20,"resource_available":true,"data":null}},"time_used":744,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":713,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/img/favicon.ico","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://non-steam.com/","date":"2026-06-08T13:32:35.745Z","timestamp":1780925555745,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /img/favicon.ico HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=5x0VCkeevmMj9ECg; __ddg10_=1780925554; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U; PHPSESSID=m6gk77ie8755p81fm8s2jcgeng\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=5WkBAwP0vbFRA4HP; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:35 GMT\n__ddg10_=1780925555; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:35 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:35 GMT\r\ndate: Mon, 08 Jun 2026 13:32:35 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 38554\r\nlast-modified: Tue, 14 Jan 2020 12:41:13 GMT\r\netag: \"5e1db6e9-969a\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":38554,"size_decoded":39079,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel","md5":"231913fdebabcbe65f4b0052372bde56","sha1":"553909d080e4f210b64dc73292f3a111d5a0781f","sha256":"9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad","sha512":"7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919","ssdeep":"768:PcaDYrV5KBau+3erpKn9jpe7z9mWAFjQcR4D9DQ0LKfjLh:PcsiV5Y+erc9T/H4f0jLh","tlshash":"70038de82e4917aee9e2cf324adb6716237b4f88c0bc169742b07f193175a51c6d78c1","first_seen":"2023-04-05T07:02:49Z","last_seen":"2026-06-20T18:33:05.547362Z","times_seen":6549,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":125,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/sound/newFriend.mp3","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://non-steam.com/","date":"2026-06-08T13:32:35.756Z","timestamp":1780925555756,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /sound/newFriend.mp3 HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=5x0VCkeevmMj9ECg; __ddg10_=1780925554; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U; PHPSESSID=m6gk77ie8755p81fm8s2jcgeng\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=26PUUnt5xD5EixYQ; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:35 GMT\n__ddg10_=1780925555; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:35 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:35 GMT\r\ndate: Mon, 08 Jun 2026 13:32:35 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 32934\r\nlast-modified: Tue, 14 Jan 2020 12:41:13 GMT\r\netag: \"5e1db6e9-80a6\"\r\ncontent-range: bytes 0-32933/32934\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":32934,"size_decoded":33471,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo","md5":"fe059ea5a5153c603f577c0f077286c0","sha1":"89e9f66e4cf91579219cf9dab792eb75042e457f","sha256":"733d4729fdcd28a227b6b254e08186c7c42bb0e609ae01d36521b6ee66071647","sha512":"023002124e9c3c6e680e68e060d697db54167fb1c1439426bf2806482c813179a3e4f2995a4cca4bcdf6b7793ea06ed8ac2848ec772933107e904f15ccb004d0","ssdeep":"384:XBIgZLEEX9nNxSDPV9o4SOlXkNS5MOEGOP3dI3tNwPr/6FeTptt9NJo820:XB3ZjB7S/oUVkM/sPtmwPLLTZ9Hoj0","tlshash":"b3e2c0496be55164f98f2e7e204ff035e9c5acac1c05cfc8ac045f601a7f592be39a26","first_seen":"2025-08-03T17:04:22.986003Z","last_seen":"2026-06-18T04:27:09.729932Z","times_seen":20,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":128,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/235.c3078fc7.css","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://non-steam.com/","date":"2026-06-08T13:32:34.036Z","timestamp":1780925554036,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/235.c3078fc7.css HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=41ZXdznv6BcdcPmr; __ddg10_=1780925553; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U; PHPSESSID=m6gk77ie8755p81fm8s2jcgeng\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=jmrMbAtAEOrZ8NFH; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg10_=1780925554; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\r\ndate: Mon, 08 Jun 2026 13:32:34 GMT\r\ncontent-type: text/css\r\ncontent-length: 34722\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-87a2\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":34722,"size_decoded":35243,"mime_type":"text/css","magic":"ASCII text, with very long lines (15427)","md5":"9eec6156d933d2944499cd6fc68311e1","sha1":"36a00bb3651e80da426551a5185121943515d48a","sha256":"5c2e87b849647f3ad0b9d73e8ba458ccd32c75cd877e2de0f364c05ba61734b3","sha512":"98b5d8be8938f1e95b7d514fcb1acfd893ebef5b8dbeb999f4c32025f5af533841a31638b4ced533bef1e7320950bfd33b0ffbaf0a3b88402b0f7c3eaa68ae2d","ssdeep":"384:pCwiEt7Cksa5cvR3u1e73CwiEtgUJwamiHWu4G6IzvgSc7nfZBhVLV:slEt+NJslEtgUJHmnu4G6IzvgBhL","tlshash":"38f27530a583242efe33c13460e15ef4522bc146eda64fbca05af65a53e68e8d47b971","first_seen":"2025-08-03T17:04:22.990353Z","last_seen":"2026-06-18T04:27:09.734852Z","times_seen":20,"resource_available":false,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":441,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/css/app.69de329a.css","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://non-steam.com/","date":"2026-06-08T13:32:34.037Z","timestamp":1780925554037,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/css/app.69de329a.css HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=41ZXdznv6BcdcPmr; __ddg10_=1780925553; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U; PHPSESSID=m6gk77ie8755p81fm8s2jcgeng\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=xnuMk7QpRMoNTmGr; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg10_=1780925554; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\r\ndate: Mon, 08 Jun 2026 13:32:34 GMT\r\ncontent-type: text/css\r\ncontent-length: 210337\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-335a1\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":210337,"size_decoded":210860,"mime_type":"text/css","magic":"ASCII text, with very long lines (65308)","md5":"7205b806bc43a3ccc45aba3575a57b93","sha1":"3bacb05ba254bb3eb63005ec71879f8c38bcfc54","sha256":"2908bc8966d29be2e198fa69863259762eafb08a49be590533a20fe81ed71ead","sha512":"8892bf55ebb61d3dfe2339d99ffbbb2c898b021f2068ea7df693fff1e5d236be4f71a72f73313b824f6dd63c88dc912a03b8e39a06bacf7101642ef607cbced0","ssdeep":"3072:ND7aUmq3SYiLENM6HN26E5+pCkiBwQiy5:ND7Bmq3SYiLENM6HN263CkiBcy5","tlshash":"a824a5a9f58420f8e37bc91f95e0b6b9153fe655d2110f9af01bab188bc52c605a3f0d","first_seen":"2025-08-03T17:04:22.979656Z","last_seen":"2026-06-18T04:27:09.712035Z","times_seen":20,"resource_available":false,"data":null}},"time_used":1244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":715,"receive":529,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/755.43aadddf.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://non-steam.com/","date":"2026-06-08T13:32:34.040Z","timestamp":1780925554040,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/755.43aadddf.js HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=41ZXdznv6BcdcPmr; __ddg10_=1780925553; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U; PHPSESSID=m6gk77ie8755p81fm8s2jcgeng\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=KBvOKCPlT1jEMFAG; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg10_=1780925554; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\r\ndate: Mon, 08 Jun 2026 13:32:34 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 90006\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-15f96\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":90006,"size_decoded":90542,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65464)","md5":"08e7640bcab8fd1ece626495ee61d7ae","sha1":"d519a7e330a932d9cd50a240c36328041b63858a","sha256":"46b47041f30a3156db035a62b017876285afbeebd59d735e033b58291e9be0c9","sha512":"871fb6fc2b35078fd1880accbacd90ea05a3a9e797c87527682e3a4644708ee8c92ec5e8694e58014d36f1db9eeca3cba32e6469563a74b009ebbdae12536272","ssdeep":"1536:lfRLi9gxGUs+4Ezy4bx60BW1kkWyAuxPb8vJ5pDVGf9oOcENMnEBt0AIH6ia/YIX:lfStPAvJ5TlllAYlYgP+","tlshash":"70930addb2cab06347a770ba40bf550bf2361999684d4400f125e4e9bc78b4a927bf3d","first_seen":"2023-03-11T22:22:29Z","last_seen":"2026-06-18T04:27:09.713496Z","times_seen":40,"resource_available":true,"data":null}},"time_used":890,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":712,"receive":178,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/809.dd650ea1.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://non-steam.com/","date":"2026-06-08T13:32:34.042Z","timestamp":1780925554042,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/809.dd650ea1.js HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=41ZXdznv6BcdcPmr; __ddg10_=1780925553; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U; PHPSESSID=m6gk77ie8755p81fm8s2jcgeng\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=kolmyql3Om1z2uie; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg10_=1780925554; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\r\ndate: Mon, 08 Jun 2026 13:32:34 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 414540\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-6534c\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":414540,"size_decoded":415077,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65466)","md5":"2b188f053f6825bbae4903ab45c6dbf3","sha1":"bfc0b0fe939628aac186f9a689999d9a852fee01","sha256":"e522a006bfeb6aec5452806c317393a1e0677587d756c9758370e7de0b8e741f","sha512":"9a0fa946ad66a575c589e187470ad6a9c33d726896fdeb4b9ad7c0004ac1ab9d3bc4c9cff901977bb16afa9abec535fdc96d617db344e9769d88996fa5ebfd3e","ssdeep":"3072:YhgN1QneuB1DGusRwxKTHDAtz1MPaH+8uQS04EJOu5LCT0Ef5IrGt+6ad7Nw/Sov:ckOdyP1eOeuwI5IrGtNaQS0R","tlshash":"da94054db2417532429ba1a6107b1a0fb2376a2da106809cb57ccdde5ebcd48327bf7d","first_seen":"2025-08-03T17:04:22.997062Z","last_seen":"2026-06-18T04:27:09.71509Z","times_seen":20,"resource_available":true,"data":null}},"time_used":1565,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":711,"receive":854,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/js/app.e801413a.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://non-steam.com/","date":"2026-06-08T13:32:34.043Z","timestamp":1780925554043,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/js/app.e801413a.js HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=41ZXdznv6BcdcPmr; __ddg10_=1780925553; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U; PHPSESSID=m6gk77ie8755p81fm8s2jcgeng\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=rcYgM5AHgEVQaCSE; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg10_=1780925554; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:34 GMT\r\ndate: Mon, 08 Jun 2026 13:32:34 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 11852\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-2e4c\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":11852,"size_decoded":12387,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11334), with no line terminators","md5":"70b9106d07f3776e0c496cce68f87a87","sha1":"9662b57e1df9b6ff9a879bcd93ba394d8b58edef","sha256":"1b4cd7047eb43893972b9a58067d4ea4eeb5824706adb7e6486b7ab836da1cfe","sha512":"3ba0093c800ddc561c5972a3da75720b5dc9156eb163008c241258b7bfb83b0a29586e6ae2f2162228e59cf1a3f46548eb1f91748fc40410f9f6175efa45bcd0","ssdeep":"192:bHvlG5WePiUcaB/SIcWvV2WMfQBUXS68z4zx4WdckDBWlHOgm/VW:Lo5WePi4B/SC92WMIyXS68z4t4WdxWVT","tlshash":"9d32f8d87515306066af2096a02f25177826f57e981f5420a15a58f93decfcea133f3f","first_seen":"2025-08-03T17:04:22.999933Z","last_seen":"2026-06-18T04:27:09.717733Z","times_seen":20,"resource_available":true,"data":null}},"time_used":740,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":709,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/sound/icq.mp3","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://non-steam.com/","date":"2026-06-08T13:32:35.753Z","timestamp":1780925555753,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /sound/icq.mp3 HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=5x0VCkeevmMj9ECg; __ddg10_=1780925554; __ddg9_=195.64.118.152; __ddg1_=uNlsIRM8F7K9v4eO5M6U; PHPSESSID=m6gk77ie8755p81fm8s2jcgeng\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=lF9rlBwHdHGJVy9D; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:35 GMT\n__ddg10_=1780925555; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:35 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:52:35 GMT\r\ndate: Mon, 08 Jun 2026 13:32:35 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 8768\r\nlast-modified: Tue, 14 Jan 2020 12:41:13 GMT\r\netag: \"5e1db6e9-2240\"\r\ncontent-range: bytes 0-8767/8768\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":8768,"size_decoded":9302,"mime_type":"audio/mpeg","magic":"data","md5":"fd7eb21974e89390513d726a137ff482","sha1":"5fd62766c4be5de1665e7743954eaa43489b59bb","sha256":"a938983c2ec2f74f85eff6a3a03d5144d90cd52bb1fa7a11d0c8a565de5b4aea","sha512":"f50d0e58acb876efba3c3fefc6f041730f00aa354dcb03bc8230cb4a0af5c1384d03137e369a82cadf701d6466138631ea6323d67ed50b4ae068c2f25da559a1","ssdeep":"192:N0c2ePiiMuk2/hZKDhMtJGL0sco/egePC42EdT0ld5frtnij:NBiiMnQ4uAL0sCkEdMHN2","tlshash":"a2029ef64cc14067d2e70f7798127424eda4bad2e57520e03e6e45ed63d7700c8d5072","first_seen":"2025-08-03T17:04:22.982826Z","last_seen":"2026-06-18T04:27:09.727695Z","times_seen":20,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}