{"report_id":"9f7d354a-5510-47c3-a149-8aced8ad529d","version":0,"status":"done","tags":[],"date":"2026-08-26T11:05:43Z","url":{"schema":"http","addr":"helm.legion.build/","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"helm.legion.build/","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"title":"Helm - Legion Helm","dom":{"size":6689,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2435)","md5":"cdb0f6c4c9c01ec3eb53f0a2b22bd8e1","sha1":"32acf782813d4de3f40066dc37ffbe372e93284b","sha256":"9d4260c738fe9c58f4be9de5e52970d71e91c3e5ee9b21bb465916d8ea1969b3","sha512":"a83b8edb6af28cbe2837861d074749738ee3b64362db4acc9e0b8442a0773bfaab7e6bbe50e3617da01364da765e8284d788337bce7afc06d269ca52771630e9","ssdeep":"96:BPSTZbWrSNaZlrW9efmfAFqvONrniWpuk4L+Lg7hQlJwPBChjypHvlhH:BPSTZbWrSNEl8eOoFql3fj","tlshash":"bfd17435a4b1045a112f7782e5e37f0897e7d30746c9ebe476ad04846fc2ec42a63e65","dom_hash":"domhash3d2ee9b7573f71713a27fd24ca13f378","first_seen":"2026-08-26T11:05:48.679532Z","last_seen":"2026-08-26T11:05:48.679532Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"helm.legion.build/","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-30T11:05:43Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"helm.legion.build","ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":20,"request_count":10,"received_data":1079889,"sent_data":11338,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Inertia.js","description":"Inertia.js is a protocol for creating monolithic single-page applications.","website":"https://inertiajs.com","common_platform_enumeration":"","icon":"Inertia.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"fonts.bunny.net","ip":{"addr":"195.181.166.158","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"domain_registered":"1999-11-22","domain_rank":56787,"first_seen":"2022-03-21T07:38:02Z","last_seen":"2026-08-24T09:12:38.906Z","alert_count":0,"request_count":1,"received_data":4052,"sent_data":515,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"reverb.helm.legion.build","ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"domain_registered":"2022-02-25","domain_rank":0,"first_seen":"2026-08-26T11:05:44.388997Z","last_seen":"2026-08-26T11:05:44.388997Z","alert_count":0,"request_count":1,"received_data":211,"sent_data":641,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.201.234","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-23T22:23:59.870946Z","alert_count":0,"request_count":1,"received_data":4072,"sent_data":534,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-23T22:20:52.902616Z","alert_count":0,"request_count":2,"received_data":65842,"sent_data":1122,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"helm.legion.build/","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"86eb7d1035357be0aa44523f299b98f3","sha1":"c1b29fe200daeafc1d1d1339b036abaef1b8ff9a","sha256":"26356e4e60562c77e63cd310c17f9985927252e5b3054a071e4241aa573bc5d2","sha512":"693591fe79c329dcc9244e177059c378e7a3d4cd168fb23651a8bd057eaffd1b5ef6225fa61374248696b4699eed941a1abe0d37abe970686daa576f0d41bc3e","ssdeep":"","tlshash":"01e0177812e4280750333578228b0ad83839642366359905beac866c9fd697a86a1ac9","size":375,"data":"","first_seen":"2026-06-07T20:05:07.683818Z","last_seen":"2026-08-26T11:09:10.433828Z","times_seen":109,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/Welcome-CYLr4DuY.js","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0a438430d241922c11a9684434507ce5","sha1":"7ee0b4830b1eb8e21c6bb0d727b0d81d99af93f8","sha256":"74914e72a58bb0dc5dab9fad20899c9f3ffab6ef11e80aa252314273af0da477","sha512":"6ee29590364939dbd6793a4f0d897c53de86d6ad247e8fecaccb9d22a07241bda0843c43a9fba943b793c7be70d9a297e4da431f7f1861f0c2e89ca1ca912e4e","ssdeep":"192:dZSYf05US7SI8HwqW2J4FFtC7nFIWj9UGlY7pKYFV70Qxak1XtZ:jJYUS7gJWlK7FIWj9LY7pKY2k1b","tlshash":"9df10969625051bc5b33e68a02d1640052340edb7c03ede0b26e74176fe68e783db7e9","size":7492,"data":"","first_seen":"2026-08-26T11:05:48.710295Z","last_seen":"2026-08-26T11:09:10.429415Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/app-DSZUuOly.js","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1e2a9b19a6d6dcc7288aa825367b37ec","sha1":"2b2fe6ccc598862a54b2718daa443d6ee73c74a8","sha256":"c57c82b55801c1ea68f2221f1817dbe376d75d5a36c7ba11580e4a2fe81dae3c","sha512":"9587c4a92d5c8487519cce467b178f1628d0d66497eb81d3927907766ea498328450274ae3d736958162640b99931afe9415fa819ac3b6ce5c24cac99bd46c6e","ssdeep":"6144:FZAe9Q1fbLUkhfZd30RXbtkQE87yGPTmJQ7k+tTy/yh:PHQ1crtkQp7yiTEQ71wc","tlshash":"be8439d47292b07203ea14e1507b4506f2382a24780dc0acf76dedee7db694a917bf79","size":395461,"data":"","first_seen":"2026-08-26T11:05:48.707695Z","last_seen":"2026-08-26T11:09:10.43322Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/index-Dt6PVEVn.js","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0af6836b956dcce2efd98443b3039f3d","sha1":"bfe15c178e29edeac32a29de3623152688e465e3","sha256":"c3417b4fff9c774e9f368b8581f4745a6a100aaf017cf7454d1cc712fafc020a","sha512":"bd8d10705796ba704a3bf1004d5f9f6a5a75e1a104656a103b22aac6870289728a4356dcd72f99a37464cb168d82b5cec5cb932c0158cada42a2fda416a70d9f","ssdeep":"96:+KC/6ysxGgoeaZGuOwIM/XsR1t815cpjsTgqqYS2n7NzmEQX1:+Zi4go1GuOwIM/XsR1tZpj0gqqYS2n5Q","tlshash":"cc9167502ea3fd5f6a2bd64ee93f01bdb6ac8341f00b8cc4bd66631b65b66172512f04","size":4365,"data":"","first_seen":"2026-08-26T11:05:48.684646Z","last_seen":"2026-08-26T11:09:10.43044Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/three-Bo_fBMpX.js","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2644edb0d2319fce1c5430f6ca646377","sha1":"203775b937fcc5deae7be6d856a9b3e191cd8543","sha256":"c9c93f0cb8bb597dbae657e5ff2ca42987a6e2a3d9878ae9ff9574ec02d66bcb","sha512":"d692b588b0de9a1949cff0cbbe07b6d801e4e33474d7cb29098ce2bbde392d13a7bdf7a784fbf96ce45a8422b296b659d662abcc0741f049e88f1d094208ba38","ssdeep":"12288:Dmz/T8Fw7NkfO5XAmhOsp/RWLbolWO7pScIfixLiilT6:DUKw7NkfO5XAmhOsp/RWLbolWO7bIfoS","tlshash":"09b46de0b27460164d5390eb54790406a23db4d77809c9ec791caceb78a1859b2ffffa","size":521025,"data":"","first_seen":"2026-08-26T11:05:48.713349Z","last_seen":"2026-08-26T11:09:10.426579Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"helm.legion.build/build/assets/index-Dt6PVEVn.js","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.392Z","timestamp":1787742314392,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET /build/assets/index-Dt6PVEVn.js HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nCookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 26 Aug 2026 11:05:14 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 11 Aug 2026 15:56:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7b4620-110d\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4365,"size_decoded":1434,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4364)","md5":"0af6836b956dcce2efd98443b3039f3d","sha1":"bfe15c178e29edeac32a29de3623152688e465e3","sha256":"c3417b4fff9c774e9f368b8581f4745a6a100aaf017cf7454d1cc712fafc020a","sha512":"bd8d10705796ba704a3bf1004d5f9f6a5a75e1a104656a103b22aac6870289728a4356dcd72f99a37464cb168d82b5cec5cb932c0158cada42a2fda416a70d9f","ssdeep":"96:+KC/6ysxGgoeaZGuOwIM/XsR1t815cpjsTgqqYS2n7NzmEQX1:+Zi4go1GuOwIM/XsR1tZpj0gqqYS2n5Q","tlshash":"cc9167502ea3fd5f6a2bd64ee93f01bdb6ac8341f00b8cc4bd66631b65b66172512f04","first_seen":"2026-08-26T11:05:48.684646Z","last_seen":"2026-08-26T11:09:10.43044Z","times_seen":2,"resource_available":true,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.bunny.net/css?family=instrument-sans:400,500,600","fqdn":"fonts.bunny.net","domain":"bunny.net","tld":"net"},"ip":{"addr":"195.181.166.158","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.586Z","timestamp":1787742314586,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fonts.bunny.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Aug 2026 08:02:20 GMT","end":"Tue, 03 Nov 2026 08:02:19 GMT"},"fingerprint":{"sha1":"43:25:AE:A6:63:C6:CE:82:04:B4:CE:F8:98:99:27:79:46:A4:08:F9","sha256":"2D:F0:7F:11:D9:00:6F:8B:43:B7:3A:CE:7B:F6:FA:B4:8F:AC:28:07:84:BC:0E:43:07:A9:4E:FD:C5:9C:8A:77"}}},"request":{"raw":"GET /css?family=instrument-sans:400,500,600 HTTP/1.1\r\nHost: fonts.bunny.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 26 Aug 2026 11:05:14 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nserver: BunnyCDN-SE1-725\r\ncdn-pullzone: 781720\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\ncache-control: public, max-age=2592000\r\ncdn-proxyver: 1.58\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 08/10/2026 10:49:48\r\ncdn-edgestorageid: 725\r\ncdn-requestid: f767f36c86894f71efc43c21acb0ee95\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":3216,"size_decoded":1306,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"ace136c0a6fe6427e9d963629a2ed365","sha1":"e56580c7550fd2e07b0c1431ee453964360a44bf","sha256":"da2a0027d4b0e93baf5df93e99d1f9632d6264d71242e7745447dde3985e1978","sha512":"d02fb8d5966cac35acda5b07443fa3df4e8d9f3bd49fbd4be8a690e80719a14bfc0b529b787c2ea49bf529b47b1ed1fcb003aa58223c012674015f76fa25fcc2","ssdeep":"","tlshash":"0361ddf1445b36049f83192222e7de231e1ed112f045a85a9e3638d48ea4d3d97f3b6e","first_seen":"2025-04-12T15:00:33.052844Z","last_seen":"2026-08-26T11:09:10.427224Z","times_seen":627,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":13,"connect":17,"send":0,"wait":9,"receive":-1,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"wss://reverb.helm.legion.build/app/7271f7e42c90e003805f6f2bbe59771d?protocol=7\u0026client=js\u0026version=8.5.0\u0026flash=false","fqdn":"reverb.helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.901Z","timestamp":1787742314901,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"reverb.helm.legion.build","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 03:07:14 GMT","end":"Mon, 19 Oct 2026 03:07:13 GMT"},"fingerprint":{"sha1":"D3:33:60:66:08:A1:42:CE:EA:C9:DE:55:14:4A:F9:35:95:A4:77:F2","sha256":"57:5E:5E:13:AA:96:C9:52:74:F8:B9:9D:FE:15:1F:4C:28:BC:C2:E0:99:DA:41:F6:E1:43:08:FD:2D:CC:59:E2"}}},"request":{"raw":"GET /app/7271f7e42c90e003805f6f2bbe59771d?protocol=7\u0026client=js\u0026version=8.5.0\u0026flash=false HTTP/1.1\r\nHost: reverb.helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://helm.legion.build\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: h9o2vXfXM2fxM2+LxY9Syg==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx\r\nDate: Wed, 26 Aug 2026 11:05:15 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: sYukxVngCqNyHuCEL/gnT1XBr1U=\r\nX-Powered-By: Laravel Reverb\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}],"data":{"size":0,"size_decoded":211,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-26T15:40:45.624659Z","times_seen":18115603,"resource_available":true,"data":null}},"time_used":988,"timings":{"blocked":0,"dns":374,"connect":402,"send":0,"wait":104,"receive":0,"ssl":108},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-26T11:05:13.639Z","timestamp":1787742313639,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-cache, private\r\ndate: Wed, 26 Aug 2026 11:05:14 GMT\r\nlink: \u003chttps://helm.legion.build/build/assets/app-D9d88L1U.css\u003e; rel=\"preload\"; as=\"style\", \u003chttps://helm.legion.build/build/assets/Welcome-DaOTskNi.css\u003e; rel=\"preload\"; as=\"style\", \u003chttps://helm.legion.build/build/assets/app-DSZUuOly.js\u003e; rel=\"modulepreload\"; as=\"script\", \u003chttps://helm.legion.build/build/assets/Welcome-CYLr4DuY.js\u003e; rel=\"modulepreload\"; as=\"script\", \u003chttps://helm.legion.build/build/assets/three-Bo_fBMpX.js\u003e; rel=\"modulepreload\"; as=\"script\", \u003chttps://helm.legion.build/build/assets/index-Dt6PVEVn.js\u003e; rel=\"modulepreload\"; as=\"script\"\r\nvary: Accept-Encoding, X-Inertia\r\nset-cookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; expires=Wed, 26 Aug 2026 13:05:14 GMT; Max-Age=7200; path=/; secure; samesite=lax\nlegion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D; expires=Wed, 26 Aug 2026 13:05:14 GMT; Max-Age=7200; path=/; secure; httponly; samesite=lax\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"XSRF-TOKEN","value":"eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D","quoted":false,"path":"/","expires":"2026-08-26T13:05:14Z","raw_expires":"Wed, 26 Aug 2026 13:05:14 GMT","max_age":7200,"secure":true,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; expires=Wed, 26 Aug 2026 13:05:14 GMT; Max-Age=7200; path=/; secure; samesite=lax"},{"name":"legion-helm-session","value":"eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D","quoted":false,"path":"/","expires":"2026-08-26T13:05:14Z","raw_expires":"Wed, 26 Aug 2026 13:05:14 GMT","max_age":7200,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D; expires=Wed, 26 Aug 2026 13:05:14 GMT; Max-Age=7200; path=/; secure; httponly; samesite=lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Inertia.js","description":"Inertia.js is a protocol for creating monolithic single-page applications.","website":"https://inertiajs.com","common_platform_enumeration":"","icon":"Inertia.svg","categories":["JavaScript frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3584,"size_decoded":3005,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1226)","md5":"2fe9ad0072b1dab3f725852ba73afd90","sha1":"25873d7afadd4023016e001f367cae687d57956b","sha256":"efc309316d003ce081e61ece7a9ffd8ddfa08a33309b69c669aff5edf97b983f","sha512":"5f05b8f5090a072869fa4dec18cdb8858bc2ce2d4fee9d6de0d79f026319e9b909c76668bfec2884d0613f10578f7e5688df403338864cb9fa541987c8026470","ssdeep":"","tlshash":"c571123694f2889e617e3516c5a3ab08cbfbc31711d57bf4b1ae04906f41ed918b3936","first_seen":"2026-08-26T11:05:48.690324Z","last_seen":"2026-08-26T11:05:48.690324Z","times_seen":1,"resource_available":false,"data":null}},"time_used":542,"timings":{"blocked":-1,"dns":114,"connect":99,"send":0,"wait":116,"receive":0,"ssl":213},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Outfit:wght@300;400;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.201.234","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:17.391Z","timestamp":1787742317391,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:45 GMT","end":"Wed, 28 Oct 2026 20:43:44 GMT"},"fingerprint":{"sha1":"1E:50:A8:26:86:57:06:AF:03:D0:36:74:91:62:52:AE:87:D0:50:0C","sha256":"18:6F:33:F9:74:07:4C:C9:5D:94:38:03:B5:86:40:07:10:6F:E2:91:F9:CC:9C:DC:92:11:AA:41:F7:ED:5A:8E"}}},"request":{"raw":"GET /css2?family=Outfit:wght@300;400;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 26 Aug 2026 11:05:17 GMT\r\ndate: Wed, 26 Aug 2026 11:05:17 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3388,"size_decoded":1120,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"156531602f19bb575e3a101be8678cbd","sha1":"9fbaf18bfe689c32bcd6a97b249cca3e6669d8ed","sha256":"b33da2ce9fba79d201d0a84f5ea5ce2e630afbe3f9db016ac027f943daaa8c05","sha512":"d853cd1040aa3a430454a3dd7f6e8d9580471f5633cc6d2a07f6ab81e0b9a4023e048c47067d63e0b4fe842449a422b4ad8a14ef416d03aad9f2f1aeee935f20","ssdeep":"","tlshash":"6061dca1042ba144df970cc222ce7e33ef5f62516444d934affe1899ac6bd5a835770d","first_seen":"2025-11-11T14:27:20.977987Z","last_seen":"2026-08-26T11:09:10.432646Z","times_seen":94,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":8,"send":0,"wait":19,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/outfit/v15/QGYvz_MVcBeNP4NJtEtqUYTkntBJ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:17.514Z","timestamp":1787742317514,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/outfit/v15/QGYvz_MVcBeNP4NJtEtqUYTkntBJ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://helm.legion.build\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 32108\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 20 Aug 2026 06:30:38 GMT\r\nexpires: Fri, 20 Aug 2027 06:30:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 534879\r\nlast-modified: Thu, 04 Sep 2025 17:18:28 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":32108,"size_decoded":32921,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32108, version 1.0","md5":"e414fe5664f376c8f145acd792939183","sha1":"5b69d46adc3a06af762193adb2dddbc359b2e786","sha256":"fa31c7981483e52cbb8b8bc1eb0dc6326f160b8699cc0899349f977f0517a9df","sha512":"51c251910e5cce616b3c336bcb63853f83c306e16e9b79e0a18f924a738ba06b3e2cb8132ff9bc6e720527234eb80e90be2625b860e1728b66d4fe86ac9bafe5","ssdeep":"768:gUX6jLkDeuAkZHs27nAflEFIapAgCauwIFPo3zjERcgmcjz:3X6tkpNAf6FIapAgCaMFozInjz","tlshash":"6ee2e14f8beb009ef3828a7812c46b3195b305d569cbfa901eef85d76b5c247c1474a8","first_seen":"2025-09-05T02:25:45.343777Z","last_seen":"2026-08-26T15:28:11.071023Z","times_seen":30139,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":35,"send":0,"wait":17,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/outfit/v15/QGYvz_MVcBeNP4NJtEtqUYTkntBJ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:17.517Z","timestamp":1787742317517,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/outfit/v15/QGYvz_MVcBeNP4NJtEtqUYTkntBJ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://helm.legion.build\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 32108\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 20 Aug 2026 06:30:38 GMT\r\nexpires: Fri, 20 Aug 2027 06:30:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 534879\r\nlast-modified: Thu, 04 Sep 2025 17:18:28 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":32108,"size_decoded":32921,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32108, version 1.0","md5":"e414fe5664f376c8f145acd792939183","sha1":"5b69d46adc3a06af762193adb2dddbc359b2e786","sha256":"fa31c7981483e52cbb8b8bc1eb0dc6326f160b8699cc0899349f977f0517a9df","sha512":"51c251910e5cce616b3c336bcb63853f83c306e16e9b79e0a18f924a738ba06b3e2cb8132ff9bc6e720527234eb80e90be2625b860e1728b66d4fe86ac9bafe5","ssdeep":"768:gUX6jLkDeuAkZHs27nAflEFIapAgCauwIFPo3zjERcgmcjz:3X6tkpNAf6FIapAgCaMFozInjz","tlshash":"6ee2e14f8beb009ef3828a7812c46b3195b305d569cbfa901eef85d76b5c247c1474a8","first_seen":"2025-09-05T02:25:45.343777Z","last_seen":"2026-08-26T15:28:11.071023Z","times_seen":30139,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":33,"dns":0,"connect":0,"send":0,"wait":21,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/Welcome-DaOTskNi.css","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.387Z","timestamp":1787742314387,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET /build/assets/Welcome-DaOTskNi.css HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nCookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 26 Aug 2026 11:05:14 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 11 Aug 2026 15:56:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7b4620-10cd\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4301,"size_decoded":1613,"mime_type":"text/css","magic":"ASCII text, with very long lines (4300)","md5":"47c049561446febe48f543be034d4e64","sha1":"c6cb2fa58a3ee277178af3add2514190b035c638","sha256":"a164fe5aaf3cddf53721eada26f078c389624f819a753db093c8c419479580ef","sha512":"ffc0055069086136d483c03c40f2a46314fecfc22088d76fbb2dbc95a14ec5162eef0a61a72122ceb96eb0120a321d2aff37e2a67a8ffd92e58204e13c4591b0","ssdeep":"96:IUdFhjO/4kwex751Z+sG3cxcR5mh49TtKHejxTM5VpVoqmvFJN+M+qyBh0gz3X9r:dkhXxcKsBApCqd","tlshash":"229130616d082018e237d65334e35aec1307ba17d9973bcc574b3d5cbc47a822b2f698","first_seen":"2026-08-26T11:05:48.696535Z","last_seen":"2026-08-26T11:09:10.425728Z","times_seen":2,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/Welcome-DaOTskNi.css","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.859Z","timestamp":1787742314859,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET /build/assets/Welcome-DaOTskNi.css HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nCookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 26 Aug 2026 11:05:14 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 11 Aug 2026 15:56:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7b4620-10cd\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4301,"size_decoded":1613,"mime_type":"text/css","magic":"ASCII text, with very long lines (4300)","md5":"47c049561446febe48f543be034d4e64","sha1":"c6cb2fa58a3ee277178af3add2514190b035c638","sha256":"a164fe5aaf3cddf53721eada26f078c389624f819a753db093c8c419479580ef","sha512":"ffc0055069086136d483c03c40f2a46314fecfc22088d76fbb2dbc95a14ec5162eef0a61a72122ceb96eb0120a321d2aff37e2a67a8ffd92e58204e13c4591b0","ssdeep":"96:IUdFhjO/4kwex751Z+sG3cxcR5mh49TtKHejxTM5VpVoqmvFJN+M+qyBh0gz3X9r:dkhXxcKsBApCqd","tlshash":"229130616d082018e237d65334e35aec1307ba17d9973bcc574b3d5cbc47a822b2f698","first_seen":"2026-08-26T11:05:48.696535Z","last_seen":"2026-08-26T11:09:10.425728Z","times_seen":2,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/favicon.svg","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.968Z","timestamp":1787742314968,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nCookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 26 Aug 2026 11:05:15 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 11 Aug 2026 15:55:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7b45ed-258\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":600,"size_decoded":686,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6be3a44f109db231db7fd3211bd77df1","sha1":"da0178a1825e1bdf462ac0a940a1ed394a43e95c","sha256":"51677f8f17bb3d101ea4fa7284ad6d7e24d2ca19c9dae265c20ca0e24a19f4c7","sha512":"ba04ff6202c1b7235359e35ef355ef1df81bd16fb08a4db0c5126c42250f679e6ca7d896de0800d10798b72af2da6a26ac7a5b759f39c53b114297303d5e2d07","ssdeep":"","tlshash":"8ef0283252854bc9da5cd53da61c384974d1986645a0c34dfbbf2e05f92d0f5b0946e2","first_seen":"2026-08-26T11:05:48.699068Z","last_seen":"2026-08-26T11:09:10.431993Z","times_seen":2,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/app-D9d88L1U.css","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.386Z","timestamp":1787742314386,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET /build/assets/app-D9d88L1U.css HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nCookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 26 Aug 2026 11:05:14 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 11 Aug 2026 15:56:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7b4620-204be\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":132286,"size_decoded":21799,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"b2df8e93647b0673f61f394786408150","sha1":"c348f076df2e14625998158ad63cec665581d69a","sha256":"54f23edaa7590224ebb14606cc691b2f36f8178c6a28eff2f49c1a1cd67ff472","sha512":"73b31c4707aa75f7ddacd2ebb4fc4b806b7819cd633df0ed3b3ce672e29c451a73c6a65beecaf39b6f6e5dd2bcbb4bb8f2c9911092f4793ebdba3fa3e63d667b","ssdeep":"3072:9P2wmeFIA+lhQ1AZWV4TNrYy7xoupW6iXpOoZIhn7DJVZUevWMq+WDhKAyI9Qpev:h2wmeFIA+lhQ1AZWV4TNrYyeupW6Xn70","tlshash":"5bd381a4f138e53f7c2368bea3dce84c511a74c19d2657fdfa22a12116c7bf669a3500","first_seen":"2026-08-26T11:05:48.701592Z","last_seen":"2026-08-26T11:09:10.424693Z","times_seen":2,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/apple-touch-icon.png","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.967Z","timestamp":1787742314967,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nCookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 26 Aug 2026 11:05:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 1662\r\nlast-modified: Tue, 11 Aug 2026 15:55:25 GMT\r\netag: \"6a7b45ed-67e\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1662,"size_decoded":1981,"mime_type":"image/png","magic":"PNG image data, 166 x 166, 8-bit colormap, non-interlaced","md5":"4ec34bfee5050d402638888ce2e9a968","sha1":"cdedf5b84942a5511948d1851ecd2c7930b5b1b9","sha256":"4001aa032ff113e1a268a9bbf1ab0fd9949439f9f54a85895956eb323aba977d","sha512":"a1bed2b4603432bb82f5164bdfed801d773ef2c81892bf921186e01f6f2a263e6c2bf411a3b29ce76743e290f6a1d3d63e341a0fbfc376a257348fe5916e2cbd","ssdeep":"","tlshash":"cc31d6d7c5490a1afea98030c6bdbd5cb52c2c88a3595fe70b844aef29903802737c62","first_seen":"2025-07-01T03:18:17.602652Z","last_seen":"2026-08-26T11:09:10.431404Z","times_seen":173,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/app-DSZUuOly.js","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.388Z","timestamp":1787742314388,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET /build/assets/app-DSZUuOly.js HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nCookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 26 Aug 2026 11:05:14 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 11 Aug 2026 15:56:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7b4620-608c5\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":395461,"size_decoded":136590,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (57069)","md5":"1e2a9b19a6d6dcc7288aa825367b37ec","sha1":"2b2fe6ccc598862a54b2718daa443d6ee73c74a8","sha256":"c57c82b55801c1ea68f2221f1817dbe376d75d5a36c7ba11580e4a2fe81dae3c","sha512":"9587c4a92d5c8487519cce467b178f1628d0d66497eb81d3927907766ea498328450274ae3d736958162640b99931afe9415fa819ac3b6ce5c24cac99bd46c6e","ssdeep":"6144:FZAe9Q1fbLUkhfZd30RXbtkQE87yGPTmJQ7k+tTy/yh:PHQ1crtkQp7yiTEQ71wc","tlshash":"be8439d47292b07203ea14e1507b4506f2382a24780dc0acf76dedee7db694a917bf79","first_seen":"2026-08-26T11:05:48.707695Z","last_seen":"2026-08-26T11:09:10.43322Z","times_seen":2,"resource_available":true,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/Welcome-CYLr4DuY.js","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.390Z","timestamp":1787742314390,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET /build/assets/Welcome-CYLr4DuY.js HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nCookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 26 Aug 2026 11:05:14 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 11 Aug 2026 15:56:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7b4620-1d44\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7492,"size_decoded":3639,"mime_type":"application/javascript; charset=utf-8","magic":"C source, ASCII text, with very long lines (4485)","md5":"0a438430d241922c11a9684434507ce5","sha1":"7ee0b4830b1eb8e21c6bb0d727b0d81d99af93f8","sha256":"74914e72a58bb0dc5dab9fad20899c9f3ffab6ef11e80aa252314273af0da477","sha512":"6ee29590364939dbd6793a4f0d897c53de86d6ad247e8fecaccb9d22a07241bda0843c43a9fba943b793c7be70d9a297e4da431f7f1861f0c2e89ca1ca912e4e","ssdeep":"192:dZSYf05US7SI8HwqW2J4FFtC7nFIWj9UGlY7pKYFV70Qxak1XtZ:jJYUS7gJWlK7FIWj9LY7pKY2k1b","tlshash":"9df10969625051bc5b33e68a02d1640052340edb7c03ede0b26e74176fe68e783db7e9","first_seen":"2026-08-26T11:05:48.710295Z","last_seen":"2026-08-26T11:09:10.429415Z","times_seen":2,"resource_available":true,"data":null}},"time_used":392,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":392,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helm.legion.build/build/assets/three-Bo_fBMpX.js","fqdn":"helm.legion.build","domain":"legion.build","tld":"build"},"ip":{"addr":"159.223.163.100","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helm.legion.build/","date":"2026-08-26T11:05:14.391Z","timestamp":1787742314391,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helm.legion.build","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 16:08:21 GMT","end":"Sun, 22 Nov 2026 16:08:20 GMT"},"fingerprint":{"sha1":"A9:17:94:52:B6:BA:87:17:0F:B8:C7:AA:63:F5:C7:5D:D0:5C:C3:A8","sha256":"0F:0D:8B:1E:F8:E7:5B:D3:48:66:54:42:40:AF:2A:02:65:05:84:F2:D3:14:E9:7C:81:9B:E6:38:DF:75:30:BB"}}},"request":{"raw":"GET /build/assets/three-Bo_fBMpX.js HTTP/1.1\r\nHost: helm.legion.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helm.legion.build/\r\nCookie: XSRF-TOKEN=eyJpdiI6ImdrM1FFbkdmMGFWMFdWRWc2RVIzTlE9PSIsInZhbHVlIjoiNkN6NHpEVGN3ZXR5clVRejdFOFNTak56M0daT0lLNXhTVk1jZkQ1WUNCVm81bDlmR3FVeTZRZWhhTVdPbkJTRTh5NlVVV0xBeWgrTFRrWUVWL1UvSkc0QktsQy9yR2xqUWhQTjRydFhSWHBYU0FkR3VOUmxPU3BBcFIzeUU1NGYiLCJtYWMiOiI1NzM5NTBiNmI0YzUyNDQxMGFlMmM3NjRmNmYzMTVkNzBmYWQyZjMyZWRlMWNlNjMxNmViODU1YTg4ZWRiZjFhIiwidGFnIjoiIn0%3D; legion-helm-session=eyJpdiI6ImRQT21WclBrbFhzbGJyTjBkVWhhQlE9PSIsInZhbHVlIjoiTTlYdXlHOE1KOHNmZlR1YTl4KzNtM0lLWGNmUXlHVDE1SDB0YUxEcXZLZ0swRmRJRDVPdkZOcm9iMHdlMWNOL3NlbEcxbDB3WHpScTRnVW5vcWZiTU5kODlOeEFNcFZBUE1yQTB4WHpnL29EZkhqYThEcEdBTm52MHhpVzRkakoiLCJtYWMiOiI4NzA5MTRkOTkzNzYzMzE5YjAxZTRjMDZlYzY2ZDRlMDZiOGMwODZjZTRkOGNhNjVmZWVhYzA3ZDljN2E0ZjA3IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 26 Aug 2026 11:05:14 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 11 Aug 2026 15:56:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7b4620-7f341\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":521025,"size_decoded":134281,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"2644edb0d2319fce1c5430f6ca646377","sha1":"203775b937fcc5deae7be6d856a9b3e191cd8543","sha256":"c9c93f0cb8bb597dbae657e5ff2ca42987a6e2a3d9878ae9ff9574ec02d66bcb","sha512":"d692b588b0de9a1949cff0cbbe07b6d801e4e33474d7cb29098ce2bbde392d13a7bdf7a784fbf96ce45a8422b296b659d662abcc0741f049e88f1d094208ba38","ssdeep":"12288:Dmz/T8Fw7NkfO5XAmhOsp/RWLbolWO7pScIfixLiilT6:DUKw7NkfO5XAmhOsp/RWLbolWO7bIfoS","tlshash":"09b46de0b27460164d5390eb54790406a23db4d77809c9ec791caceb78a1859b2ffffa","first_seen":"2026-08-26T11:05:48.713349Z","last_seen":"2026-08-26T11:09:10.426579Z","times_seen":2,"resource_available":true,"data":null}},"time_used":391,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":391,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"helm.legion.build","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}